From 81982125c352f2db1012c2cd37487e6c0c3b7da8 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sun, 23 May 2021 21:12:11 -0700
Subject: [PATCH 0001/1043] RDMA/srp: Make struct scsi_cmnd and struct
 srp_request adjacent

[ Upstream commit ad215aaea4f9d637f441566cdbbc610e9849e1fa ]

Define .init_cmd_priv and .exit_cmd_priv callback functions in struct
scsi_host_template. Set .cmd_size such that the SCSI core allocates
per-command private data. Use scsi_cmd_priv() to access that private
data. Remove the req_ring pointer from struct srp_rdma_ch since it is no
longer necessary. Convert srp_alloc_req_data() and srp_free_req_data()
into functions that initialize one instance of the SRP-private command
data. This is a micro-optimization since this patch removes several
pointer dereferences from the hot path.

Note: due to commit e73a5e8e8003 ("scsi: core: Only return started
requests from scsi_host_find_tag()"), it is no longer necessary to protect
the completion path against duplicate responses.

Link: https://lore.kernel.org/r/20210524041211.9480-6-bvanassche@acm.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Stable-dep-of: e193b7955dfa ("RDMA/srp: Do not call scsi_done() from srp_abort()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/srp/ib_srp.c | 153 ++++++++++++----------------
 drivers/infiniband/ulp/srp/ib_srp.h |   2 -
 2 files changed, 63 insertions(+), 92 deletions(-)

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 9b9b9557ae74..f47d104e6c9d 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -965,67 +965,52 @@ static void srp_disconnect_target(struct srp_target_port *target)
 	}
 }
 
-static void srp_free_req_data(struct srp_target_port *target,
-			      struct srp_rdma_ch *ch)
+static int srp_exit_cmd_priv(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
 {
+	struct srp_target_port *target = host_to_target(shost);
 	struct srp_device *dev = target->srp_host->srp_dev;
 	struct ib_device *ibdev = dev->dev;
-	struct srp_request *req;
-	int i;
+	struct srp_request *req = scsi_cmd_priv(cmd);
 
-	if (!ch->req_ring)
-		return;
-
-	for (i = 0; i < target->req_ring_size; ++i) {
-		req = &ch->req_ring[i];
-		if (dev->use_fast_reg)
-			kfree(req->fr_list);
-		if (req->indirect_dma_addr) {
-			ib_dma_unmap_single(ibdev, req->indirect_dma_addr,
-					    target->indirect_size,
-					    DMA_TO_DEVICE);
-		}
-		kfree(req->indirect_desc);
+	kfree(req->fr_list);
+	if (req->indirect_dma_addr) {
+		ib_dma_unmap_single(ibdev, req->indirect_dma_addr,
+				    target->indirect_size,
+				    DMA_TO_DEVICE);
 	}
+	kfree(req->indirect_desc);
 
-	kfree(ch->req_ring);
-	ch->req_ring = NULL;
+	return 0;
 }
 
-static int srp_alloc_req_data(struct srp_rdma_ch *ch)
+static int srp_init_cmd_priv(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
 {
-	struct srp_target_port *target = ch->target;
+	struct srp_target_port *target = host_to_target(shost);
 	struct srp_device *srp_dev = target->srp_host->srp_dev;
 	struct ib_device *ibdev = srp_dev->dev;
-	struct srp_request *req;
+	struct srp_request *req = scsi_cmd_priv(cmd);
 	dma_addr_t dma_addr;
-	int i, ret = -ENOMEM;
+	int ret = -ENOMEM;
 
-	ch->req_ring = kcalloc(target->req_ring_size, sizeof(*ch->req_ring),
-			       GFP_KERNEL);
-	if (!ch->req_ring)
+	if (srp_dev->use_fast_reg) {
+		req->fr_list = kmalloc_array(target->mr_per_cmd, sizeof(void *),
+					GFP_KERNEL);
+		if (!req->fr_list)
+			goto out;
+	}
+	req->indirect_desc = kmalloc(target->indirect_size, GFP_KERNEL);
+	if (!req->indirect_desc)
 		goto out;
 
-	for (i = 0; i < target->req_ring_size; ++i) {
-		req = &ch->req_ring[i];
-		if (srp_dev->use_fast_reg) {
-			req->fr_list = kmalloc_array(target->mr_per_cmd,
-						sizeof(void *), GFP_KERNEL);
-			if (!req->fr_list)
-				goto out;
-		}
-		req->indirect_desc = kmalloc(target->indirect_size, GFP_KERNEL);
-		if (!req->indirect_desc)
-			goto out;
-
-		dma_addr = ib_dma_map_single(ibdev, req->indirect_desc,
-					     target->indirect_size,
-					     DMA_TO_DEVICE);
-		if (ib_dma_mapping_error(ibdev, dma_addr))
-			goto out;
-
-		req->indirect_dma_addr = dma_addr;
+	dma_addr = ib_dma_map_single(ibdev, req->indirect_desc,
+				     target->indirect_size,
+				     DMA_TO_DEVICE);
+	if (ib_dma_mapping_error(ibdev, dma_addr)) {
+		srp_exit_cmd_priv(shost, cmd);
+		goto out;
 	}
+
+	req->indirect_dma_addr = dma_addr;
 	ret = 0;
 
 out:
@@ -1067,10 +1052,6 @@ static void srp_remove_target(struct srp_target_port *target)
 	}
 	cancel_work_sync(&target->tl_err_work);
 	srp_rport_put(target->rport);
-	for (i = 0; i < target->ch_count; i++) {
-		ch = &target->ch[i];
-		srp_free_req_data(target, ch);
-	}
 	kfree(target->ch);
 	target->ch = NULL;
 
@@ -1289,22 +1270,32 @@ static void srp_finish_req(struct srp_rdma_ch *ch, struct srp_request *req,
 	}
 }
 
+struct srp_terminate_context {
+	struct srp_target_port *srp_target;
+	int scsi_result;
+};
+
+static bool srp_terminate_cmd(struct scsi_cmnd *scmnd, void *context_ptr,
+			      bool reserved)
+{
+	struct srp_terminate_context *context = context_ptr;
+	struct srp_target_port *target = context->srp_target;
+	u32 tag = blk_mq_unique_tag(scmnd->request);
+	struct srp_rdma_ch *ch = &target->ch[blk_mq_unique_tag_to_hwq(tag)];
+	struct srp_request *req = scsi_cmd_priv(scmnd);
+
+	srp_finish_req(ch, req, NULL, context->scsi_result);
+
+	return true;
+}
+
 static void srp_terminate_io(struct srp_rport *rport)
 {
 	struct srp_target_port *target = rport->lld_data;
-	struct srp_rdma_ch *ch;
-	int i, j;
+	struct srp_terminate_context context = { .srp_target = target,
+		.scsi_result = DID_TRANSPORT_FAILFAST << 16 };
 
-	for (i = 0; i < target->ch_count; i++) {
-		ch = &target->ch[i];
-
-		for (j = 0; j < target->req_ring_size; ++j) {
-			struct srp_request *req = &ch->req_ring[j];
-
-			srp_finish_req(ch, req, NULL,
-				       DID_TRANSPORT_FAILFAST << 16);
-		}
-	}
+	scsi_host_busy_iter(target->scsi_host, srp_terminate_cmd, &context);
 }
 
 /* Calculate maximum initiator to target information unit length. */
@@ -1360,13 +1351,12 @@ static int srp_rport_reconnect(struct srp_rport *rport)
 		ch = &target->ch[i];
 		ret += srp_new_cm_id(ch);
 	}
-	for (i = 0; i < target->ch_count; i++) {
-		ch = &target->ch[i];
-		for (j = 0; j < target->req_ring_size; ++j) {
-			struct srp_request *req = &ch->req_ring[j];
+	{
+		struct srp_terminate_context context = {
+			.srp_target = target, .scsi_result = DID_RESET << 16};
 
-			srp_finish_req(ch, req, NULL, DID_RESET << 16);
-		}
+		scsi_host_busy_iter(target->scsi_host, srp_terminate_cmd,
+				    &context);
 	}
 	for (i = 0; i < target->ch_count; i++) {
 		ch = &target->ch[i];
@@ -1962,13 +1952,10 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp)
 		spin_unlock_irqrestore(&ch->lock, flags);
 	} else {
 		scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag);
-		if (scmnd && scmnd->host_scribble) {
-			req = (void *)scmnd->host_scribble;
+		if (scmnd) {
+			req = scsi_cmd_priv(scmnd);
 			scmnd = srp_claim_req(ch, req, NULL, scmnd);
 		} else {
-			scmnd = NULL;
-		}
-		if (!scmnd) {
 			shost_printk(KERN_ERR, target->scsi_host,
 				     "Null scmnd for RSP w/tag %#016llx received on ch %td / QP %#x\n",
 				     rsp->tag, ch - target->ch, ch->qp->qp_num);
@@ -1996,7 +1983,6 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp)
 		srp_free_req(ch, req, scmnd,
 			     be32_to_cpu(rsp->req_lim_delta));
 
-		scmnd->host_scribble = NULL;
 		scmnd->scsi_done(scmnd);
 	}
 }
@@ -2164,13 +2150,12 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
 {
 	struct srp_target_port *target = host_to_target(shost);
 	struct srp_rdma_ch *ch;
-	struct srp_request *req;
+	struct srp_request *req = scsi_cmd_priv(scmnd);
 	struct srp_iu *iu;
 	struct srp_cmd *cmd;
 	struct ib_device *dev;
 	unsigned long flags;
 	u32 tag;
-	u16 idx;
 	int len, ret;
 
 	scmnd->result = srp_chkready(target->rport);
@@ -2180,10 +2165,6 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
 	WARN_ON_ONCE(scmnd->request->tag < 0);
 	tag = blk_mq_unique_tag(scmnd->request);
 	ch = &target->ch[blk_mq_unique_tag_to_hwq(tag)];
-	idx = blk_mq_unique_tag_to_tag(tag);
-	WARN_ONCE(idx >= target->req_ring_size, "%s: tag %#x: idx %d >= %d\n",
-		  dev_name(&shost->shost_gendev), tag, idx,
-		  target->req_ring_size);
 
 	spin_lock_irqsave(&ch->lock, flags);
 	iu = __srp_get_tx_iu(ch, SRP_IU_CMD);
@@ -2192,13 +2173,10 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
 	if (!iu)
 		goto err;
 
-	req = &ch->req_ring[idx];
 	dev = target->srp_host->srp_dev->dev;
 	ib_dma_sync_single_for_cpu(dev, iu->dma, ch->max_it_iu_len,
 				   DMA_TO_DEVICE);
 
-	scmnd->host_scribble = (void *) req;
-
 	cmd = iu->buf;
 	memset(cmd, 0, sizeof *cmd);
 
@@ -3075,6 +3053,8 @@ static struct scsi_host_template srp_template = {
 	.target_alloc			= srp_target_alloc,
 	.slave_configure		= srp_slave_configure,
 	.info				= srp_target_info,
+	.init_cmd_priv			= srp_init_cmd_priv,
+	.exit_cmd_priv			= srp_exit_cmd_priv,
 	.queuecommand			= srp_queuecommand,
 	.change_queue_depth             = srp_change_queue_depth,
 	.eh_timed_out			= srp_timed_out,
@@ -3088,6 +3068,7 @@ static struct scsi_host_template srp_template = {
 	.cmd_per_lun			= SRP_DEFAULT_CMD_SQ_SIZE,
 	.shost_attrs			= srp_host_attrs,
 	.track_queue_depth		= 1,
+	.cmd_size			= sizeof(struct srp_request),
 };
 
 static int srp_sdev_count(struct Scsi_Host *host)
@@ -3735,8 +3716,6 @@ static ssize_t srp_create_target(struct device *dev,
 	if (ret)
 		goto out;
 
-	target->req_ring_size = target->queue_size - SRP_TSK_MGMT_SQ_SIZE;
-
 	if (!srp_conn_unique(target->srp_host, target)) {
 		if (target->using_rdma_cm) {
 			shost_printk(KERN_INFO, target->scsi_host,
@@ -3839,10 +3818,6 @@ static ssize_t srp_create_target(struct device *dev,
 		if (ret)
 			goto err_disconnect;
 
-		ret = srp_alloc_req_data(ch);
-		if (ret)
-			goto err_disconnect;
-
 		ret = srp_connect_ch(ch, max_iu_len, multich);
 		if (ret) {
 			char dst[64];
@@ -3861,7 +3836,6 @@ static ssize_t srp_create_target(struct device *dev,
 				goto free_ch;
 			} else {
 				srp_free_ch_ib(target, ch);
-				srp_free_req_data(target, ch);
 				target->ch_count = ch - target->ch;
 				goto connected;
 			}
@@ -3922,7 +3896,6 @@ static ssize_t srp_create_target(struct device *dev,
 	for (i = 0; i < target->ch_count; i++) {
 		ch = &target->ch[i];
 		srp_free_ch_ib(target, ch);
-		srp_free_req_data(target, ch);
 	}
 
 	kfree(target->ch);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
index 85bac20d9007..152242e8f733 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.h
+++ b/drivers/infiniband/ulp/srp/ib_srp.h
@@ -176,7 +176,6 @@ struct srp_rdma_ch {
 
 	struct srp_iu	      **tx_ring;
 	struct srp_iu	      **rx_ring;
-	struct srp_request     *req_ring;
 	int			comp_vector;
 
 	u64			tsk_mgmt_tag;
@@ -222,7 +221,6 @@ struct srp_target_port {
 	int			mr_pool_size;
 	int			mr_per_cmd;
 	int			queue_size;
-	int			req_ring_size;
 	int			comp_vector;
 	int			tl_retry_count;
 

From 26788a5b48d9d5cd3283d777d238631c8cd7495a Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Wed, 23 Aug 2023 13:57:27 -0700
Subject: [PATCH 0002/1043] RDMA/srp: Do not call scsi_done() from srp_abort()

[ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ]

After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler
callback, it performs one of the following actions:
* Call scsi_queue_insert().
* Call scsi_finish_command().
* Call scsi_eh_scmd_add().
Hence, SCSI abort handlers must not call scsi_done(). Otherwise all
the above actions would trigger a use-after-free. Hence remove the
scsi_done() call from srp_abort(). Keep the srp_free_req() call
before returning SUCCESS because we may not see the command again if
SUCCESS is returned.

Cc: Bob Pearson <rpearsonhpe@gmail.com>
Cc: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index f47d104e6c9d..12bc24ee2d13 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -2781,7 +2781,6 @@ static int srp_abort(struct scsi_cmnd *scmnd)
 	u32 tag;
 	u16 ch_idx;
 	struct srp_rdma_ch *ch;
-	int ret;
 
 	shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
 
@@ -2797,19 +2796,14 @@ static int srp_abort(struct scsi_cmnd *scmnd)
 	shost_printk(KERN_ERR, target->scsi_host,
 		     "Sending SRP abort for tag %#x\n", tag);
 	if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun,
-			      SRP_TSK_ABORT_TASK, NULL) == 0)
-		ret = SUCCESS;
-	else if (target->rport->state == SRP_RPORT_LOST)
-		ret = FAST_IO_FAIL;
-	else
-		ret = FAILED;
-	if (ret == SUCCESS) {
+			      SRP_TSK_ABORT_TASK, NULL) == 0) {
 		srp_free_req(ch, req, scmnd, 0);
-		scmnd->result = DID_ABORT << 16;
-		scmnd->scsi_done(scmnd);
+		return SUCCESS;
 	}
+	if (target->rport->state == SRP_RPORT_LOST)
+		return FAST_IO_FAIL;
 
-	return ret;
+	return FAILED;
 }
 
 static int srp_reset_device(struct scsi_cmnd *scmnd)

From 0ed2ad00f33392185cb54ea5cedf8fe0edaf3c0d Mon Sep 17 00:00:00 2001
From: Artem Chernyshev <artem.chernyshev@red-soft.ru>
Date: Tue, 5 Sep 2023 15:40:48 +0300
Subject: [PATCH 0003/1043] RDMA/cxgb4: Check skb value for failure to allocate

[ Upstream commit 8fb8a82086f5bda6893ea6557c5a458e4549c6d7 ]

get_skb() can fail to allocate skb, so check it.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 5be78ee924ae ("RDMA/cxgb4: Fix LE hash collision bug for active open connection")
Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
Link: https://lore.kernel.org/r/20230905124048.284165-1-artem.chernyshev@red-soft.ru
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/cxgb4/cm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index e42c812e74c3..8c54b1be0442 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1965,6 +1965,9 @@ static int send_fw_act_open_req(struct c4iw_ep *ep, unsigned int atid)
 	int win;
 
 	skb = get_skb(NULL, sizeof(*req), GFP_KERNEL);
+	if (!skb)
+		return -ENOMEM;
+
 	req = __skb_put_zero(skb, sizeof(*req));
 	req->op_compl = htonl(WR_OP_V(FW_OFLD_CONNECTION_WR));
 	req->len16_pkd = htonl(FW_WR_LEN16_V(DIV_ROUND_UP(sizeof(*req), 16)));

From 06068e7f3ff8c0beddd30b978743d271479ecbb5 Mon Sep 17 00:00:00 2001
From: Jing Zhang <renyu.zj@linux.alibaba.com>
Date: Mon, 25 Sep 2023 11:22:32 +0800
Subject: [PATCH 0004/1043] perf/arm-cmn: Fix the unhandled overflow status of
 counter 4 to 7

[ Upstream commit 7f949f6f54ff593123ab95b6247bfa4542a65580 ]

The register por_dt_pmovsr Bits[7:0] indicates overflow from counters 7
to 0. But in arm_cmn_handle_irq(), only handled the overflow status of
Bits[3:0] which results in unhandled overflow status of counters 4 to 7.

So let the overflow status of DTC counters 4 to 7 to be handled.

Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver")
Signed-off-by: Jing Zhang <renyu.zj@linux.alibaba.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/1695612152-123633-1-git-send-email-renyu.zj@linux.alibaba.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/perf/arm-cmn.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
index 36061aaf026c..ac4428e8fae9 100644
--- a/drivers/perf/arm-cmn.c
+++ b/drivers/perf/arm-cmn.c
@@ -1177,7 +1177,7 @@ static irqreturn_t arm_cmn_handle_irq(int irq, void *dev_id)
 		u64 delta;
 		int i;
 
-		for (i = 0; i < CMN_DTM_NUM_COUNTERS; i++) {
+		for (i = 0; i < CMN_DT_NUM_COUNTERS; i++) {
 			if (status & (1U << i)) {
 				ret = IRQ_HANDLED;
 				if (WARN_ON(!dtc->counters[i]))

From cb4a8146e3a9bff52d987941135f7703fda9d0e9 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 12 Oct 2023 10:17:39 +0200
Subject: [PATCH 0005/1043] lib/test_meminit: fix off-by-one error in
 test_pages()

commit efb78fa86e95 ("lib/test_meminit: allocate pages up to order
MAX_ORDER") works great in kernels 6.4 and newer thanks to commit
23baf831a32c ("mm, treewide: redefine MAX_ORDER sanely"), but for older
kernels, the loop is off by one, which causes crashes when the test
runs.

Fix this up by changing "<= MAX_ORDER" "< MAX_ORDER" to allow the test
to work properly for older kernel branches.

Fixes: 2a1cf9fe09d9 ("lib/test_meminit: allocate pages up to order MAX_ORDER")
Cc: Andrew Donnellan <ajd@linux.ibm.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Xiaoke Wang <xkernel.wang@foxmail.com>
Cc: <stable@vger.kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/test_meminit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/test_meminit.c b/lib/test_meminit.c
index 75638404ed57..0f1a3bd09b7b 100644
--- a/lib/test_meminit.c
+++ b/lib/test_meminit.c
@@ -86,7 +86,7 @@ static int __init test_pages(int *total_failures)
 	int failures = 0, num_tests = 0;
 	int i;
 
-	for (i = 0; i <= MAX_ORDER; i++)
+	for (i = 0; i < MAX_ORDER; i++)
 		num_tests += do_alloc_pages_order(i, &failures);
 
 	REPORT_FAILURES_IN_FN();

From 093af62c023537f097d2ebdfaa0bc7c1a6e874e1 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Thu, 5 Oct 2023 20:26:38 +0200
Subject: [PATCH 0006/1043] HID: logitech-hidpp: Fix kernel crash on receiver
 USB disconnect

commit dac501397b9d81e4782232c39f94f4307b137452 upstream.

hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU)
races when it races with itself.

hidpp_connect_event() primarily runs from a workqueue but it also runs
on probe() and if a "device-connected" packet is received by the hw
when the thread running hidpp_connect_event() from probe() is waiting on
the hw, then a second thread running hidpp_connect_event() will be
started from the workqueue.

This opens the following races (note the below code is simplified):

1. Retrieving + printing the protocol (harmless race):

	if (!hidpp->protocol_major) {
		hidpp_root_get_protocol_version()
		hidpp->protocol_major = response.rap.params[0];
	}

We can actually see this race hit in the dmesg in the abrt output
attached to rhbz#2227968:

[ 3064.624215] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected.
[ 3064.658184] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected.

Testing with extra logging added has shown that after this the 2 threads
take turn grabbing the hw access mutex (send_mutex) so they ping-pong
through all the other TOCTOU cases managing to hit all of them:

2. Updating the name to the HIDPP name (harmless race):

	if (hidpp->name == hdev->name) {
		...
		hidpp->name = new_name;
	}

3. Initializing the power_supply class for the battery (problematic!):

hidpp_initialize_battery()
{
        if (hidpp->battery.ps)
                return 0;

	probe_battery(); /* Blocks, threads take turns executing this */

	hidpp->battery.desc.properties =
		devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);

	hidpp->battery.ps =
		devm_power_supply_register(&hidpp->hid_dev->dev,
					   &hidpp->battery.desc, cfg);
}

4. Creating delayed input_device (potentially problematic):

	if (hidpp->delayed_input)
		return;

	hidpp->delayed_input = hidpp_allocate_input(hdev);

The really big problem here is 3. Hitting the race leads to the following
sequence:

	hidpp->battery.desc.properties =
		devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);

	hidpp->battery.ps =
		devm_power_supply_register(&hidpp->hid_dev->dev,
					   &hidpp->battery.desc, cfg);

	...

	hidpp->battery.desc.properties =
		devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);

	hidpp->battery.ps =
		devm_power_supply_register(&hidpp->hid_dev->dev,
					   &hidpp->battery.desc, cfg);

So now we have registered 2 power supplies for the same battery,
which looks a bit weird from userspace's pov but this is not even
the really big problem.

Notice how:

1. This is all devm-maganaged
2. The hidpp->battery.desc struct is shared between the 2 power supplies
3. hidpp->battery.desc.properties points to the result from the second
   devm_kmemdup()

This causes a use after free scenario on USB disconnect of the receiver:
1. The last registered power supply class device gets unregistered
2. The memory from the last devm_kmemdup() call gets freed,
   hidpp->battery.desc.properties now points to freed memory
3. The first registered power supply class device gets unregistered,
   this involves sending a remove uevent to userspace which invokes
   power_supply_uevent() to fill the uevent data
4. power_supply_uevent() uses hidpp->battery.desc.properties which
   now points to freed memory leading to backtraces like this one:

Sep 22 20:01:35 eric kernel: BUG: unable to handle page fault for address: ffffb2140e017f08
...
Sep 22 20:01:35 eric kernel: Workqueue: usb_hub_wq hub_event
Sep 22 20:01:35 eric kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0
...
Sep 22 20:01:35 eric kernel:  ? asm_exc_page_fault+0x26/0x30
Sep 22 20:01:35 eric kernel:  ? power_supply_uevent+0xee/0x1d0
Sep 22 20:01:35 eric kernel:  ? power_supply_uevent+0x10d/0x1d0
Sep 22 20:01:35 eric kernel:  dev_uevent+0x10f/0x2d0
Sep 22 20:01:35 eric kernel:  kobject_uevent_env+0x291/0x680
Sep 22 20:01:35 eric kernel:  power_supply_unregister+0x8e/0xa0
Sep 22 20:01:35 eric kernel:  release_nodes+0x3d/0xb0
Sep 22 20:01:35 eric kernel:  devres_release_group+0xfc/0x130
Sep 22 20:01:35 eric kernel:  hid_device_remove+0x56/0xa0
Sep 22 20:01:35 eric kernel:  device_release_driver_internal+0x19f/0x200
Sep 22 20:01:35 eric kernel:  bus_remove_device+0xc6/0x130
Sep 22 20:01:35 eric kernel:  device_del+0x15c/0x3f0
Sep 22 20:01:35 eric kernel:  ? __queue_work+0x1df/0x440
Sep 22 20:01:35 eric kernel:  hid_destroy_device+0x4b/0x60
Sep 22 20:01:35 eric kernel:  logi_dj_remove+0x9a/0x100 [hid_logitech_dj 5c91534a0ead2b65e04dd799a0437e3b99b21bc4]
Sep 22 20:01:35 eric kernel:  hid_device_remove+0x44/0xa0
Sep 22 20:01:35 eric kernel:  device_release_driver_internal+0x19f/0x200
Sep 22 20:01:35 eric kernel:  bus_remove_device+0xc6/0x130
Sep 22 20:01:35 eric kernel:  device_del+0x15c/0x3f0
Sep 22 20:01:35 eric kernel:  ? __queue_work+0x1df/0x440
Sep 22 20:01:35 eric kernel:  hid_destroy_device+0x4b/0x60
Sep 22 20:01:35 eric kernel:  usbhid_disconnect+0x47/0x60 [usbhid 727dcc1c0b94e6b4418727a468398ac3bca492f3]
Sep 22 20:01:35 eric kernel:  usb_unbind_interface+0x90/0x270
Sep 22 20:01:35 eric kernel:  device_release_driver_internal+0x19f/0x200
Sep 22 20:01:35 eric kernel:  bus_remove_device+0xc6/0x130
Sep 22 20:01:35 eric kernel:  device_del+0x15c/0x3f0
Sep 22 20:01:35 eric kernel:  ? kobject_put+0xa0/0x1d0
Sep 22 20:01:35 eric kernel:  usb_disable_device+0xcd/0x1e0
Sep 22 20:01:35 eric kernel:  usb_disconnect+0xde/0x2c0
Sep 22 20:01:35 eric kernel:  usb_disconnect+0xc3/0x2c0
Sep 22 20:01:35 eric kernel:  hub_event+0xe80/0x1c10

There have been quite a few bug reports (see Link tags) about this crash.

Fix all the TOCTOU issues, including the really bad power-supply related
system crash on USB disconnect, by making probe() use the workqueue for
running hidpp_connect_event() too, so that it can never run more then once.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227221
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2242189
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217412#c58
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231005182638.3776-1-hdegoede@redhat.com
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-logitech-hidpp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 6ac0c2d9a147..651fa0966939 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3936,7 +3936,8 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 			goto hid_hw_init_fail;
 	}
 
-	hidpp_connect_event(hidpp);
+	schedule_work(&hidpp->work);
+	flush_work(&hidpp->work);
 
 	if (will_restart) {
 		/* Reset the HID node state */

From 22c06bf1f99ec3ec16b1a81342becba4c59a1f16 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 4 Oct 2023 15:32:01 +0200
Subject: [PATCH 0007/1043] quota: Fix slow quotaoff

commit 869b6ea1609f655a43251bf41757aa44e5350a8f upstream.

Eric has reported that commit dabc8b207566 ("quota: fix dqput() to
follow the guarantees dquot_srcu should provide") heavily increases
runtime of generic/270 xfstest for ext4 in nojournal mode. The reason
for this is that ext4 in nojournal mode leaves dquots dirty until the last
dqput() and thus the cleanup done in quota_release_workfn() has to write
them all. Due to the way quota_release_workfn() is written this results
in synchronize_srcu() call for each dirty dquot which makes the dquot
cleanup when turning quotas off extremely slow.

To be able to avoid synchronize_srcu() for each dirty dquot we need to
rework how we track dquots to be cleaned up. Instead of keeping the last
dquot reference while it is on releasing_dquots list, we drop it right
away and mark the dquot with new DQ_RELEASING_B bit instead. This way we
can we can remove dquot from releasing_dquots list when new reference to
it is acquired and thus there's no need to call synchronize_srcu() each
time we drop dq_list_lock.

References: https://lore.kernel.org/all/ZRytn6CxFK2oECUt@debian-BULLSEYE-live-builder-AMD64
Reported-by: Eric Whitney <enwlinux@gmail.com>
Fixes: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/quota/dquot.c         | 66 ++++++++++++++++++++++++----------------
 include/linux/quota.h    |  4 ++-
 include/linux/quotaops.h |  2 +-
 3 files changed, 43 insertions(+), 29 deletions(-)

diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 13a9a17d6a13..fd2ca079448d 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -233,19 +233,18 @@ static void put_quota_format(struct quota_format_type *fmt)
  * All dquots are placed to the end of inuse_list when first created, and this
  * list is used for invalidate operation, which must look at every dquot.
  *
- * When the last reference of a dquot will be dropped, the dquot will be
- * added to releasing_dquots. We'd then queue work item which would call
+ * When the last reference of a dquot is dropped, the dquot is added to
+ * releasing_dquots. We'll then queue work item which will call
  * synchronize_srcu() and after that perform the final cleanup of all the
- * dquots on the list. Both releasing_dquots and free_dquots use the
- * dq_free list_head in the dquot struct. When a dquot is removed from
- * releasing_dquots, a reference count is always subtracted, and if
- * dq_count == 0 at that point, the dquot will be added to the free_dquots.
+ * dquots on the list. Each cleaned up dquot is moved to free_dquots list.
+ * Both releasing_dquots and free_dquots use the dq_free list_head in the dquot
+ * struct.
  *
- * Unused dquots (dq_count == 0) are added to the free_dquots list when freed,
- * and this list is searched whenever we need an available dquot.  Dquots are
- * removed from the list as soon as they are used again, and
- * dqstats.free_dquots gives the number of dquots on the list. When
- * dquot is invalidated it's completely released from memory.
+ * Unused and cleaned up dquots are in the free_dquots list and this list is
+ * searched whenever we need an available dquot. Dquots are removed from the
+ * list as soon as they are used again and dqstats.free_dquots gives the number
+ * of dquots on the list. When dquot is invalidated it's completely released
+ * from memory.
  *
  * Dirty dquots are added to the dqi_dirty_list of quota_info when mark
  * dirtied, and this list is searched when writing dirty dquots back to
@@ -323,6 +322,7 @@ static inline void put_dquot_last(struct dquot *dquot)
 static inline void put_releasing_dquots(struct dquot *dquot)
 {
 	list_add_tail(&dquot->dq_free, &releasing_dquots);
+	set_bit(DQ_RELEASING_B, &dquot->dq_flags);
 }
 
 static inline void remove_free_dquot(struct dquot *dquot)
@@ -330,8 +330,10 @@ static inline void remove_free_dquot(struct dquot *dquot)
 	if (list_empty(&dquot->dq_free))
 		return;
 	list_del_init(&dquot->dq_free);
-	if (!atomic_read(&dquot->dq_count))
+	if (!test_bit(DQ_RELEASING_B, &dquot->dq_flags))
 		dqstats_dec(DQST_FREE_DQUOTS);
+	else
+		clear_bit(DQ_RELEASING_B, &dquot->dq_flags);
 }
 
 static inline void put_inuse(struct dquot *dquot)
@@ -583,12 +585,6 @@ static void invalidate_dquots(struct super_block *sb, int type)
 			continue;
 		/* Wait for dquot users */
 		if (atomic_read(&dquot->dq_count)) {
-			/* dquot in releasing_dquots, flush and retry */
-			if (!list_empty(&dquot->dq_free)) {
-				spin_unlock(&dq_list_lock);
-				goto restart;
-			}
-
 			atomic_inc(&dquot->dq_count);
 			spin_unlock(&dq_list_lock);
 			/*
@@ -607,6 +603,15 @@ static void invalidate_dquots(struct super_block *sb, int type)
 			 * restart. */
 			goto restart;
 		}
+		/*
+		 * The last user already dropped its reference but dquot didn't
+		 * get fully cleaned up yet. Restart the scan which flushes the
+		 * work cleaning up released dquots.
+		 */
+		if (test_bit(DQ_RELEASING_B, &dquot->dq_flags)) {
+			spin_unlock(&dq_list_lock);
+			goto restart;
+		}
 		/*
 		 * Quota now has no users and it has been written on last
 		 * dqput()
@@ -698,6 +703,13 @@ int dquot_writeback_dquots(struct super_block *sb, int type)
 						 dq_dirty);
 
 			WARN_ON(!dquot_active(dquot));
+			/* If the dquot is releasing we should not touch it */
+			if (test_bit(DQ_RELEASING_B, &dquot->dq_flags)) {
+				spin_unlock(&dq_list_lock);
+				flush_delayed_work(&quota_release_work);
+				spin_lock(&dq_list_lock);
+				continue;
+			}
 
 			/* Now we have active dquot from which someone is
  			 * holding reference so we can safely just increase
@@ -811,18 +823,18 @@ static void quota_release_workfn(struct work_struct *work)
 	/* Exchange the list head to avoid livelock. */
 	list_replace_init(&releasing_dquots, &rls_head);
 	spin_unlock(&dq_list_lock);
+	synchronize_srcu(&dquot_srcu);
 
 restart:
-	synchronize_srcu(&dquot_srcu);
 	spin_lock(&dq_list_lock);
 	while (!list_empty(&rls_head)) {
 		dquot = list_first_entry(&rls_head, struct dquot, dq_free);
-		/* Dquot got used again? */
-		if (atomic_read(&dquot->dq_count) > 1) {
-			remove_free_dquot(dquot);
-			atomic_dec(&dquot->dq_count);
-			continue;
-		}
+		WARN_ON_ONCE(atomic_read(&dquot->dq_count));
+		/*
+		 * Note that DQ_RELEASING_B protects us from racing with
+		 * invalidate_dquots() calls so we are safe to work with the
+		 * dquot even after we drop dq_list_lock.
+		 */
 		if (dquot_dirty(dquot)) {
 			spin_unlock(&dq_list_lock);
 			/* Commit dquot before releasing */
@@ -836,7 +848,6 @@ static void quota_release_workfn(struct work_struct *work)
 		}
 		/* Dquot is inactive and clean, now move it to free list */
 		remove_free_dquot(dquot);
-		atomic_dec(&dquot->dq_count);
 		put_dquot_last(dquot);
 	}
 	spin_unlock(&dq_list_lock);
@@ -877,6 +888,7 @@ void dqput(struct dquot *dquot)
 	BUG_ON(!list_empty(&dquot->dq_free));
 #endif
 	put_releasing_dquots(dquot);
+	atomic_dec(&dquot->dq_count);
 	spin_unlock(&dq_list_lock);
 	queue_delayed_work(system_unbound_wq, &quota_release_work, 1);
 }
@@ -965,7 +977,7 @@ struct dquot *dqget(struct super_block *sb, struct kqid qid)
 		dqstats_inc(DQST_LOOKUPS);
 	}
 	/* Wait for dq_lock - after this we know that either dquot_release() is
-	 * already finished or it will be canceled due to dq_count > 1 test */
+	 * already finished or it will be canceled due to dq_count > 0 test */
 	wait_on_dquot(dquot);
 	/* Read the dquot / allocate space in quota file */
 	if (!dquot_active(dquot)) {
diff --git a/include/linux/quota.h b/include/linux/quota.h
index 27aab84fcbaa..b93cb93d1956 100644
--- a/include/linux/quota.h
+++ b/include/linux/quota.h
@@ -285,7 +285,9 @@ static inline void dqstats_dec(unsigned int type)
 #define DQ_FAKE_B	3	/* no limits only usage */
 #define DQ_READ_B	4	/* dquot was read into memory */
 #define DQ_ACTIVE_B	5	/* dquot is active (dquot_release not called) */
-#define DQ_LASTSET_B	6	/* Following 6 bits (see QIF_) are reserved\
+#define DQ_RELEASING_B	6	/* dquot is in releasing_dquots list waiting
+				 * to be cleaned up */
+#define DQ_LASTSET_B	7	/* Following 6 bits (see QIF_) are reserved\
 				 * for the mask of entries set via SETQUOTA\
 				 * quotactl. They are set under dq_data_lock\
 				 * and the quota format handling dquot can\
diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index a0f6668924d3..4bc8ff2a6614 100644
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -56,7 +56,7 @@ static inline bool dquot_is_busy(struct dquot *dquot)
 {
 	if (test_bit(DQ_MOD_B, &dquot->dq_flags))
 		return true;
-	if (atomic_read(&dquot->dq_count) > 1)
+	if (atomic_read(&dquot->dq_count) > 0)
 		return true;
 	return false;
 }

From 31e7e77b24f1d4f1ae2c045bfec412af5858d8d6 Mon Sep 17 00:00:00 2001
From: Jordan Rife <jrife@google.com>
Date: Thu, 21 Sep 2023 18:46:42 -0500
Subject: [PATCH 0008/1043] net: prevent address rewrite in kernel_bind()

commit c889a99a21bf124c3db08d09df919f0eccc5ea4c upstream.

Similar to the change in commit 0bdf399342c5("net: Avoid address
overwrite in kernel_connect"), BPF hooks run on bind may rewrite the
address passed to kernel_bind(). This change

1) Makes a copy of the bind address in kernel_bind() to insulate
   callers.
2) Replaces direct calls to sock->ops->bind() in net with kernel_bind()

Link: https://lore.kernel.org/netdev/20230912013332.2048422-1-jrife@google.com/
Fixes: 4fbac77d2d09 ("bpf: Hooks for sys_bind")
Cc: stable@vger.kernel.org
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Jordan Rife <jrife@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/ipvs/ip_vs_sync.c | 4 ++--
 net/rds/tcp_connect.c           | 2 +-
 net/rds/tcp_listen.c            | 2 +-
 net/socket.c                    | 6 +++++-
 4 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index e45ffa762bbe..87b1cf69b9c2 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1441,7 +1441,7 @@ static int bind_mcastif_addr(struct socket *sock, struct net_device *dev)
 	sin.sin_addr.s_addr  = addr;
 	sin.sin_port         = 0;
 
-	return sock->ops->bind(sock, (struct sockaddr*)&sin, sizeof(sin));
+	return kernel_bind(sock, (struct sockaddr *)&sin, sizeof(sin));
 }
 
 static void get_mcast_sockaddr(union ipvs_sockaddr *sa, int *salen,
@@ -1548,7 +1548,7 @@ static int make_receive_sock(struct netns_ipvs *ipvs, int id,
 
 	get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id);
 	sock->sk->sk_bound_dev_if = dev->ifindex;
-	result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen);
+	result = kernel_bind(sock, (struct sockaddr *)&mcast_addr, salen);
 	if (result < 0) {
 		pr_err("Error binding to the multicast addr\n");
 		goto error;
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index 2f38dac0160e..09967bab2c36 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -141,7 +141,7 @@ int rds_tcp_conn_path_connect(struct rds_conn_path *cp)
 		addrlen = sizeof(sin);
 	}
 
-	ret = sock->ops->bind(sock, addr, addrlen);
+	ret = kernel_bind(sock, addr, addrlen);
 	if (ret) {
 		rdsdebug("bind failed with %d at address %pI6c\n",
 			 ret, &conn->c_laddr);
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 09cadd556d1e..3994eeef95a3 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -301,7 +301,7 @@ struct socket *rds_tcp_listen_init(struct net *net, bool isv6)
 		addr_len = sizeof(*sin);
 	}
 
-	ret = sock->ops->bind(sock, (struct sockaddr *)&ss, addr_len);
+	ret = kernel_bind(sock, (struct sockaddr *)&ss, addr_len);
 	if (ret < 0) {
 		rdsdebug("could not bind %s listener socket: %d\n",
 			 isv6 ? "IPv6" : "IPv4", ret);
diff --git a/net/socket.c b/net/socket.c
index de89ab55d475..36e38ee434ea 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -3414,7 +3414,11 @@ static long compat_sock_ioctl(struct file *file, unsigned int cmd,
 
 int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
 {
-	return sock->ops->bind(sock, addr, addrlen);
+	struct sockaddr_storage address;
+
+	memcpy(&address, addr, addrlen);
+
+	return sock->ops->bind(sock, (struct sockaddr *)&address, addrlen);
 }
 EXPORT_SYMBOL(kernel_bind);
 

From dbbbeaef778686db4546f07699049be9060e1bfa Mon Sep 17 00:00:00 2001
From: Kuogee Hsieh <quic_khsieh@quicinc.com>
Date: Tue, 8 Aug 2023 15:19:50 -0700
Subject: [PATCH 0009/1043] drm/msm/dp: do not reinitialize phy unless retry
 during link training

[ Upstream commit 0c1a2e69bcb506f48ebf94bd199bab0b93f66da2 ]

DP PHY re-initialization done using dp_ctrl_reinitialize_mainlink() will
cause PLL unlocked initially and then PLL gets locked at the end of
initialization. PLL_UNLOCKED interrupt will fire during this time if the
interrupt mask is enabled.

However currently DP driver link training implementation incorrectly
re-initializes PHY unconditionally during link training as the PHY was
already configured in dp_ctrl_enable_mainlink_clocks().

Fix this by re-initializing the PHY only if the previous link training
failed.

[drm:dp_aux_isr] *ERROR* Unexpected DP AUX IRQ 0x01000000 when not busy

Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support")
Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/30
Signed-off-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
Tested-by: Abhinav Kumar <quic_abhinavk@quicinc.com> # sc7280
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/551847/
Link: https://lore.kernel.org/r/1691533190-19335-1-git-send-email-quic_khsieh@quicinc.com
[quic_abhinavk@quicinc.com: added line break in commit text]
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dp/dp_ctrl.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 9fac55c24214..07becbf3c64f 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -1665,13 +1665,6 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
 		return rc;
 
 	while (--link_train_max_retries) {
-		rc = dp_ctrl_reinitialize_mainlink(ctrl);
-		if (rc) {
-			DRM_ERROR("Failed to reinitialize mainlink. rc=%d\n",
-					rc);
-			break;
-		}
-
 		training_step = DP_TRAINING_NONE;
 		rc = dp_ctrl_setup_main_link(ctrl, &cr, &training_step);
 		if (rc == 0) {
@@ -1712,6 +1705,12 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
 				break; /* lane == 1 already */
 			}
 		}
+
+		rc = dp_ctrl_reinitialize_mainlink(ctrl);
+		if (rc) {
+			DRM_ERROR("Failed to reinitialize mainlink. rc=%d\n", rc);
+			break;
+		}
 	}
 
 	if (ctrl->link->sink_request & DP_TEST_LINK_PHY_TEST_PATTERN)

From 6004ca7ad2d0301a492a691d1be1b71e104d4ec3 Mon Sep 17 00:00:00 2001
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
Date: Fri, 15 Sep 2023 13:44:25 -0700
Subject: [PATCH 0010/1043] drm/msm/dsi: skip the wait for video mode done if
 not applicable

[ Upstream commit ab483e3adcc178254eb1ce0fbdfbea65f86f1006 ]

dsi_wait4video_done() API waits for the DSI video mode engine to
become idle so that we can transmit the DCS commands in the
beginning of BLLP. However, with the current sequence, the MDP
timing engine is turned on after the panel's pre_enable() callback
which can send out the DCS commands needed to power up the panel.

During those cases, this API will always timeout and print out the
error spam leading to long bootup times and log flooding.

Fix this by checking if the DSI video engine was actually busy before
waiting for it to become idle otherwise this is a redundant wait.

changes in v2:
	- move the reg read below the video mode check
	- minor fixes in commit text

Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/34
Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support")
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/557853/
Link: https://lore.kernel.org/r/20230915204426.19011-1-quic_abhinavk@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dsi/dsi_host.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 5a76aa138917..fb7792ca39e2 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -1075,9 +1075,21 @@ static void dsi_wait4video_done(struct msm_dsi_host *msm_host)
 
 static void dsi_wait4video_eng_busy(struct msm_dsi_host *msm_host)
 {
+	u32 data;
+
 	if (!(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO))
 		return;
 
+	data = dsi_read(msm_host, REG_DSI_STATUS0);
+
+	/* if video mode engine is not busy, its because
+	 * either timing engine was not turned on or the
+	 * DSI controller has finished transmitting the video
+	 * data already, so no need to wait in those cases
+	 */
+	if (!(data & DSI_STATUS0_VIDEO_MODE_ENGINE_BUSY))
+		return;
+
 	if (msm_host->power_on && msm_host->enabled) {
 		dsi_wait4video_done(msm_host);
 		/* delay 4 ms to skip BLLP */

From 1673841da013fd90f367140b4a0b9f1ff3badc87 Mon Sep 17 00:00:00 2001
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
Date: Thu, 7 Sep 2023 18:26:16 -0700
Subject: [PATCH 0011/1043] drm/msm/dpu: change _dpu_plane_calc_bw() to use u64
 to avoid overflow

[ Upstream commit 95e681ca3b65e4ce3d2537b47672d787b7d30375 ]

_dpu_plane_calc_bw() uses integer variables to calculate the bandwidth
used during plane bandwidth calculations. However for high resolution
displays this overflows easily and leads to below errors

[dpu error]crtc83 failed performance check -7

Promote the intermediate variables to u64 to avoid overflow.

changes in v2:
	- change to u64 where actually needed in the math

Fixes: c33b7c0389e1 ("drm/msm/dpu: add support for clk and bw scaling for display")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reported-by: Nia Espera <nespera@igalia.com>
Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/32
Tested-by: Nia Espera <nespera@igalia.com>
Patchwork: https://patchwork.freedesktop.org/patch/556288/
Link: https://lore.kernel.org/r/20230908012616.20654-1-quic_abhinavk@quicinc.com
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
index 7ea90d25a3b6..8aa9f2335f57 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
@@ -147,6 +147,7 @@ static void _dpu_plane_calc_bw(struct drm_plane *plane,
 	const struct dpu_format *fmt = NULL;
 	struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
 	int src_width, src_height, dst_height, fps;
+	u64 plane_pixel_rate, plane_bit_rate;
 	u64 plane_prefill_bw;
 	u64 plane_bw;
 	u32 hw_latency_lines;
@@ -168,13 +169,12 @@ static void _dpu_plane_calc_bw(struct drm_plane *plane,
 	scale_factor = src_height > dst_height ?
 		mult_frac(src_height, 1, dst_height) : 1;
 
-	plane_bw =
-		src_width * mode->vtotal * fps * fmt->bpp *
-		scale_factor;
+	plane_pixel_rate = src_width * mode->vtotal * fps;
+	plane_bit_rate = plane_pixel_rate * fmt->bpp;
 
-	plane_prefill_bw =
-		src_width * hw_latency_lines * fps * fmt->bpp *
-		scale_factor * mode->vtotal;
+	plane_bw = plane_bit_rate * scale_factor;
+
+	plane_prefill_bw = plane_bw * hw_latency_lines;
 
 	do_div(plane_prefill_bw, (vbp+vpw));
 

From ef7a0d51bfdb987982001e5f72c9c3481c42d2d0 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Thu, 5 Oct 2023 10:12:00 +0900
Subject: [PATCH 0012/1043] ravb: Fix up dma_free_coherent() call in
 ravb_remove()

[ Upstream commit e6864af61493113558c502b5cd0d754c19b93277 ]

In ravb_remove(), dma_free_coherent() should be call after
unregister_netdev(). Otherwise, this controller is possible to use
the freed buffer.

Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/20231005011201.14368-2-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/renesas/ravb_main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 410ccd28f653..a59da6a11976 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -2249,14 +2249,14 @@ static int ravb_remove(struct platform_device *pdev)
 	if (priv->chip_id != RCAR_GEN2)
 		ravb_ptp_stop(ndev);
 
-	dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
-			  priv->desc_bat_dma);
 	/* Set reset mode */
 	ravb_write(ndev, CCC_OPC_RESET, CCC);
 	unregister_netdev(ndev);
 	netif_napi_del(&priv->napi[RAVB_NC]);
 	netif_napi_del(&priv->napi[RAVB_BE]);
 	ravb_mdio_release(priv);
+	dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
+			  priv->desc_bat_dma);
 	pm_runtime_put_sync(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 	free_netdev(ndev);

From 55e06850c7894f00d41b767c5f5665459f83f58f Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Sat, 7 Oct 2023 11:30:49 +0800
Subject: [PATCH 0013/1043] ieee802154: ca8210: Fix a potential UAF in
 ca8210_probe

[ Upstream commit f990874b1c98fe8e57ee9385669f501822979258 ]

If of_clk_add_provider() fails in ca8210_register_ext_clock(),
it calls clk_unregister() to release priv->clk and returns an
error. However, the caller ca8210_probe() then calls ca8210_remove(),
where priv->clk is freed again in ca8210_unregister_ext_clock(). In
this case, a use-after-free may happen in the second time we call
clk_unregister().

Fix this by removing the first clk_unregister(). Also, priv->clk could
be an error code on failure of clk_register_fixed_rate(). Use
IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock().

Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Message-ID: <20231007033049.22353-1-dinghao.liu@zju.edu.cn>
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ieee802154/ca8210.c | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index 1c5d70c60354..0ce426c0c0bf 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -2783,7 +2783,6 @@ static int ca8210_register_ext_clock(struct spi_device *spi)
 	struct device_node *np = spi->dev.of_node;
 	struct ca8210_priv *priv = spi_get_drvdata(spi);
 	struct ca8210_platform_data *pdata = spi->dev.platform_data;
-	int ret = 0;
 
 	if (!np)
 		return -EFAULT;
@@ -2800,18 +2799,8 @@ static int ca8210_register_ext_clock(struct spi_device *spi)
 		dev_crit(&spi->dev, "Failed to register external clk\n");
 		return PTR_ERR(priv->clk);
 	}
-	ret = of_clk_add_provider(np, of_clk_src_simple_get, priv->clk);
-	if (ret) {
-		clk_unregister(priv->clk);
-		dev_crit(
-			&spi->dev,
-			"Failed to register external clock as clock provider\n"
-		);
-	} else {
-		dev_info(&spi->dev, "External clock set as clock provider\n");
-	}
 
-	return ret;
+	return of_clk_add_provider(np, of_clk_src_simple_get, priv->clk);
 }
 
 /**
@@ -2823,8 +2812,8 @@ static void ca8210_unregister_ext_clock(struct spi_device *spi)
 {
 	struct ca8210_priv *priv = spi_get_drvdata(spi);
 
-	if (!priv->clk)
-		return
+	if (IS_ERR_OR_NULL(priv->clk))
+		return;
 
 	of_clk_del_provider(spi->dev.of_node);
 	clk_unregister(priv->clk);

From 33548a6b3c7ce09adf53a9fe0556ceb1006c5c1e Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Thu, 5 Oct 2023 17:00:12 +0300
Subject: [PATCH 0014/1043] mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set()
 return type

[ Upstream commit 1e0b72a2a6432c0ef67ee5ce8d9172a7c20bba25 ]

The mlxsw_sp2_nve_vxlan_learning_set() function is supposed to return
zero on success or negative error codes.  So it needs to be type int
instead of bool.

Fixes: 4ee70efab68d ("mlxsw: spectrum_nve: Add support for VXLAN on Spectrum-2")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c
index 05517c7feaa5..a20ba23f0ed7 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c
@@ -294,8 +294,8 @@ const struct mlxsw_sp_nve_ops mlxsw_sp1_nve_vxlan_ops = {
 	.fdb_clear_offload = mlxsw_sp_nve_vxlan_clear_offload,
 };
 
-static bool mlxsw_sp2_nve_vxlan_learning_set(struct mlxsw_sp *mlxsw_sp,
-					     bool learning_en)
+static int mlxsw_sp2_nve_vxlan_learning_set(struct mlxsw_sp *mlxsw_sp,
+					    bool learning_en)
 {
 	char tnpc_pl[MLXSW_REG_TNPC_LEN];
 

From 1bf4da1818c2e0c57d3171bb35260f4224368ff5 Mon Sep 17 00:00:00 2001
From: Roger Pau Monne <roger.pau@citrix.com>
Date: Thu, 5 Oct 2023 16:08:31 +0200
Subject: [PATCH 0015/1043] xen-netback: use default TX queue size for vifs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 66cf7435a26917c0c4d6245ad9137e7606e84fdf ]

Do not set netback interfaces (vifs) default TX queue size to the ring size.
The TX queue size is not related to the ring size, and using the ring size (32)
as the queue size can lead to packet drops.  Note the TX side of the vif
interface in the netback domain is the one receiving packets to be injected
to the guest.

Do not explicitly set the TX queue length to any value when creating the
interface, and instead use the system default.  Note that the queue length can
also be adjusted at runtime.

Fixes: f942dc2552b8 ('xen network backend driver')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Acked-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/xen-netback/interface.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 97cf5bc48902..09fc4bc0622e 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -41,7 +41,6 @@
 #include <asm/xen/hypercall.h>
 #include <xen/balloon.h>
 
-#define XENVIF_QUEUE_LENGTH 32
 #define XENVIF_NAPI_WEIGHT  64
 
 /* Number of bytes allowed on the internal guest Rx queue. */
@@ -528,8 +527,6 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
 	dev->features = dev->hw_features | NETIF_F_RXCSUM;
 	dev->ethtool_ops = &xenvif_ethtool_ops;
 
-	dev->tx_queue_len = XENVIF_QUEUE_LENGTH;
-
 	dev->min_mtu = ETH_MIN_MTU;
 	dev->max_mtu = ETH_MAX_MTU - VLAN_ETH_HLEN;
 

From 2a8ef2234b3a0c129890556b2c4900870cb8411c Mon Sep 17 00:00:00 2001
From: Pu Lehui <pulehui@huawei.com>
Date: Wed, 15 Feb 2023 21:52:03 +0800
Subject: [PATCH 0016/1043] riscv, bpf: Factor out emit_call for kernel and bpf
 context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 0fd1fd0104954380477353aea29c347e85dff16d ]

The current emit_call function is not suitable for kernel function call as
it store return value to bpf R0 register. We can separate it out for common
use. Meanwhile, simplify judgment logic, that is, fixed function address
can use jal or auipc+jalr, while the unfixed can use only auipc+jalr.

Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Björn Töpel <bjorn@rivosinc.com>
Acked-by: Björn Töpel <bjorn@rivosinc.com>
Link: https://lore.kernel.org/bpf/20230215135205.1411105-3-pulehui@huaweicloud.com
Stable-dep-of: 2f1b0d3d7331 ("riscv, bpf: Sign-extend return values")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/net/bpf_jit_comp64.c | 30 +++++++++++++-----------------
 1 file changed, 13 insertions(+), 17 deletions(-)

diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index 053dc83e323b..53d1f520c589 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -394,12 +394,12 @@ static void emit_sext_32_rd(u8 *rd, struct rv_jit_context *ctx)
 	*rd = RV_REG_T2;
 }
 
-static int emit_jump_and_link(u8 rd, s64 rvoff, bool force_jalr,
+static int emit_jump_and_link(u8 rd, s64 rvoff, bool fixed_addr,
 			      struct rv_jit_context *ctx)
 {
 	s64 upper, lower;
 
-	if (rvoff && is_21b_int(rvoff) && !force_jalr) {
+	if (rvoff && fixed_addr && is_21b_int(rvoff)) {
 		emit(rv_jal(rd, rvoff >> 1), ctx);
 		return 0;
 	} else if (in_auipc_jalr_range(rvoff)) {
@@ -420,24 +420,17 @@ static bool is_signed_bpf_cond(u8 cond)
 		cond == BPF_JSGE || cond == BPF_JSLE;
 }
 
-static int emit_call(bool fixed, u64 addr, struct rv_jit_context *ctx)
+static int emit_call(u64 addr, bool fixed_addr, struct rv_jit_context *ctx)
 {
 	s64 off = 0;
 	u64 ip;
-	u8 rd;
-	int ret;
 
 	if (addr && ctx->insns) {
 		ip = (u64)(long)(ctx->insns + ctx->ninsns);
 		off = addr - ip;
 	}
 
-	ret = emit_jump_and_link(RV_REG_RA, off, !fixed, ctx);
-	if (ret)
-		return ret;
-	rd = bpf_to_rv_reg(BPF_REG_0, ctx);
-	emit_mv(rd, RV_REG_A0, ctx);
-	return 0;
+	return emit_jump_and_link(RV_REG_RA, off, fixed_addr, ctx);
 }
 
 int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
@@ -731,7 +724,7 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 	/* JUMP off */
 	case BPF_JMP | BPF_JA:
 		rvoff = rv_offset(i, off, ctx);
-		ret = emit_jump_and_link(RV_REG_ZERO, rvoff, false, ctx);
+		ret = emit_jump_and_link(RV_REG_ZERO, rvoff, true, ctx);
 		if (ret)
 			return ret;
 		break;
@@ -850,17 +843,20 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 	/* function call */
 	case BPF_JMP | BPF_CALL:
 	{
-		bool fixed;
+		bool fixed_addr;
 		u64 addr;
 
 		mark_call(ctx);
-		ret = bpf_jit_get_func_addr(ctx->prog, insn, extra_pass, &addr,
-					    &fixed);
+		ret = bpf_jit_get_func_addr(ctx->prog, insn, extra_pass,
+					    &addr, &fixed_addr);
 		if (ret < 0)
 			return ret;
-		ret = emit_call(fixed, addr, ctx);
+
+		ret = emit_call(addr, fixed_addr, ctx);
 		if (ret)
 			return ret;
+
+		emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
 		break;
 	}
 	/* tail call */
@@ -875,7 +871,7 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 			break;
 
 		rvoff = epilogue_offset(ctx);
-		ret = emit_jump_and_link(RV_REG_ZERO, rvoff, false, ctx);
+		ret = emit_jump_and_link(RV_REG_ZERO, rvoff, true, ctx);
 		if (ret)
 			return ret;
 		break;

From d4ba78e5522ec975f875003b678d5833b6cc753d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= <bjorn@rivosinc.com>
Date: Wed, 4 Oct 2023 14:07:05 +0200
Subject: [PATCH 0017/1043] riscv, bpf: Sign-extend return values
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 2f1b0d3d733169eb11680bfa97c266ae5e757148 ]

The RISC-V architecture does not expose sub-registers, and hold all
32-bit values in a sign-extended format [1] [2]:

  | The compiler and calling convention maintain an invariant that all
  | 32-bit values are held in a sign-extended format in 64-bit
  | registers. Even 32-bit unsigned integers extend bit 31 into bits
  | 63 through 32. Consequently, conversion between unsigned and
  | signed 32-bit integers is a no-op, as is conversion from a signed
  | 32-bit integer to a signed 64-bit integer.

While BPF, on the other hand, exposes sub-registers, and use
zero-extension (similar to arm64/x86).

This has led to some subtle bugs, where a BPF JITted program has not
sign-extended the a0 register (return value in RISC-V land), passed
the return value up the kernel, e.g.:

  | int from_bpf(void);
  |
  | long foo(void)
  | {
  |    return from_bpf();
  | }

Here, a0 would be 0xffff_ffff, instead of the expected
0xffff_ffff_ffff_ffff.

Internally, the RISC-V JIT uses a5 as a dedicated register for BPF
return values.

Keep a5 zero-extended, but explicitly sign-extend a0 (which is used
outside BPF land). Now that a0 (RISC-V ABI) and a5 (BPF ABI) differs,
a0 is only moved to a5 for non-BPF native calls (BPF_PSEUDO_CALL).

Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G")
Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://github.com/riscv/riscv-isa-manual/releases/download/riscv-isa-release-056b6ff-2023-10-02/unpriv-isa-asciidoc.pdf # [2]
Link: https://github.com/riscv-non-isa/riscv-elf-psabi-doc/releases/download/draft-20230929-e5c800e661a53efe3c2678d71a306323b60eb13b/riscv-abi.pdf # [2]
Link: https://lore.kernel.org/bpf/20231004120706.52848-2-bjorn@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/net/bpf_jit_comp64.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index 53d1f520c589..0cc3dd9d32e6 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -201,7 +201,7 @@ static void __build_epilogue(bool is_tail_call, struct rv_jit_context *ctx)
 	emit_addi(RV_REG_SP, RV_REG_SP, stack_adjust, ctx);
 	/* Set return value. */
 	if (!is_tail_call)
-		emit_mv(RV_REG_A0, RV_REG_A5, ctx);
+		emit_addiw(RV_REG_A0, RV_REG_A5, 0, ctx);
 	emit_jalr(RV_REG_ZERO, is_tail_call ? RV_REG_T3 : RV_REG_RA,
 		  is_tail_call ? 4 : 0, /* skip TCC init */
 		  ctx);
@@ -856,7 +856,8 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
 		if (ret)
 			return ret;
 
-		emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
+		if (insn->src_reg != BPF_PSEUDO_CALL)
+			emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
 		break;
 	}
 	/* tail call */

From a629f0575c9cbbd8dc98e2426391f8de27546a6a Mon Sep 17 00:00:00 2001
From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Date: Tue, 5 Sep 2023 18:02:03 +0800
Subject: [PATCH 0018/1043] drm/vmwgfx: fix typo of sizeof argument

[ Upstream commit 39465cac283702a7d4a507a558db81898029c6d3 ]

Since size of 'header' pointer and '*header' structure is equal on 64-bit
machines issue probably didn't cause any wrong behavior. But anyway,
fixing typo is required.

Fixes: 7a73ba7469cb ("drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.")
Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Reviewed-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Zack Rusin <zackr@vmware.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230905100203.1716731-1-konstantin.meskhidze@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 4c6c2e5abf95..00082c679170 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -1627,7 +1627,7 @@ static int vmw_cmd_tex_state(struct vmw_private *dev_priv,
 {
 	VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSetTextureState);
 	SVGA3dTextureState *last_state = (SVGA3dTextureState *)
-	  ((unsigned long) header + header->size + sizeof(header));
+	  ((unsigned long) header + header->size + sizeof(*header));
 	SVGA3dTextureState *cur_state = (SVGA3dTextureState *)
 		((unsigned long) header + sizeof(*cmd));
 	struct vmw_resource *ctx;

From a848ae8b5ad71e8ace04fbcc9faddb4cefc2b269 Mon Sep 17 00:00:00 2001
From: "Radu Pirea (NXP OSS)" <radu-nicolae.pirea@oss.nxp.com>
Date: Thu, 5 Oct 2023 21:06:33 +0300
Subject: [PATCH 0019/1043] net: macsec: indicate next pn update when
 offloading

[ Upstream commit 0412cc846a1ef38697c3f321f9b174da91ecd3b5 ]

Indicate next PN update using update_pn flag in macsec_context.
Offloaded MACsec implementations does not know whether or not the
MACSEC_SA_ATTR_PN attribute was passed for an SA update and assume
that next PN should always updated, but this is not always true.

The PN can be reset to its initial value using the following command:
$ ip macsec set macsec0 tx sa 0 off #octeontx2-pf case

Or, the update PN command will succeed even if the driver does not support
PN updates.
$ ip macsec set macsec0 tx sa 0 pn 1 on #mscc phy driver case

Comparing the initial PN with the new PN value is not a solution. When
the user updates the PN using its initial value the command will
succeed, even if the driver does not support it. Like this:
$ ip macsec add macsec0 tx sa 0 pn 1 on key 00 \
ead3664f508eb06c40ac7104cdae4ce5
$ ip macsec set macsec0 tx sa 0 pn 1 on #mlx5 case

Signed-off-by: Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: e0a8c918daa5 ("net: phy: mscc: macsec: reject PN update requests")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/macsec.c | 2 ++
 include/net/macsec.h | 1 +
 2 files changed, 3 insertions(+)

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 4fb58fc5ec95..0ffcef2fa10a 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -2414,6 +2414,7 @@ static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info)
 
 		ctx.sa.assoc_num = assoc_num;
 		ctx.sa.tx_sa = tx_sa;
+		ctx.sa.update_pn = !!prev_pn.full64;
 		ctx.secy = secy;
 
 		ret = macsec_offload(ops->mdo_upd_txsa, &ctx);
@@ -2507,6 +2508,7 @@ static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info)
 
 		ctx.sa.assoc_num = assoc_num;
 		ctx.sa.rx_sa = rx_sa;
+		ctx.sa.update_pn = !!prev_pn.full64;
 		ctx.secy = secy;
 
 		ret = macsec_offload(ops->mdo_upd_rxsa, &ctx);
diff --git a/include/net/macsec.h b/include/net/macsec.h
index d6fa6b97f6ef..0dc430332939 100644
--- a/include/net/macsec.h
+++ b/include/net/macsec.h
@@ -240,6 +240,7 @@ struct macsec_context {
 	struct macsec_secy *secy;
 	struct macsec_rx_sc *rx_sc;
 	struct {
+		bool update_pn;
 		unsigned char assoc_num;
 		u8 key[MACSEC_MAX_KEY_LEN];
 		union {

From b24bd127750182529ce8cbe6b61dbe6e7e1c085d Mon Sep 17 00:00:00 2001
From: "Radu Pirea (NXP OSS)" <radu-nicolae.pirea@oss.nxp.com>
Date: Thu, 5 Oct 2023 21:06:35 +0300
Subject: [PATCH 0020/1043] net: phy: mscc: macsec: reject PN update requests

[ Upstream commit e0a8c918daa58700609ebd45e3fcd49965be8bbc ]

Updating the PN is not supported.
Return -EINVAL if update_pn is true.

The following command succeeded, but it should fail because the driver
does not update the PN:
ip macsec set macsec0 tx sa 0 pn 232 on

Fixes: 28c5107aa904 ("net: phy: mscc: macsec support")
Signed-off-by: Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/mscc/mscc_macsec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/phy/mscc/mscc_macsec.c b/drivers/net/phy/mscc/mscc_macsec.c
index c00eef457b85..bec270785c59 100644
--- a/drivers/net/phy/mscc/mscc_macsec.c
+++ b/drivers/net/phy/mscc/mscc_macsec.c
@@ -880,6 +880,9 @@ static int vsc8584_macsec_upd_rxsa(struct macsec_context *ctx)
 {
 	struct macsec_flow *flow;
 
+	if (ctx->sa.update_pn)
+		return -EINVAL;
+
 	flow = vsc8584_macsec_find_flow(ctx, MACSEC_INGR);
 	if (IS_ERR(flow))
 		return PTR_ERR(flow);
@@ -929,6 +932,9 @@ static int vsc8584_macsec_upd_txsa(struct macsec_context *ctx)
 {
 	struct macsec_flow *flow;
 
+	if (ctx->sa.update_pn)
+		return -EINVAL;
+
 	flow = vsc8584_macsec_find_flow(ctx, MACSEC_EGR);
 	if (IS_ERR(flow))
 		return PTR_ERR(flow);

From 31ea13e3ff52e585ed792d984d2619560cd411ee Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Fri, 6 Oct 2023 15:53:09 +0300
Subject: [PATCH 0021/1043] ixgbe: fix crash with empty VF macvlan list

[ Upstream commit 7b5add9af567c44e12196107f0fe106e194034fd ]

The adapter->vf_mvs.l list needs to be initialized even if the list is
empty.  Otherwise it will lead to crashes.

Fixes: a1cbb15c1397 ("ixgbe: Add macvlan support for VF")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Link: https://lore.kernel.org/r/ZSADNdIw8zFx1xw2@kadam
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index 0078ae592616..5eba086690ef 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -28,6 +28,9 @@ static inline void ixgbe_alloc_vf_macvlans(struct ixgbe_adapter *adapter,
 	struct vf_macvlans *mv_list;
 	int num_vf_macvlans, i;
 
+	/* Initialize list of VF macvlans */
+	INIT_LIST_HEAD(&adapter->vf_mvs.l);
+
 	num_vf_macvlans = hw->mac.num_rar_entries -
 			  (IXGBE_MAX_PF_MACVLANS + 1 + num_vfs);
 	if (!num_vf_macvlans)
@@ -36,8 +39,6 @@ static inline void ixgbe_alloc_vf_macvlans(struct ixgbe_adapter *adapter,
 	mv_list = kcalloc(num_vf_macvlans, sizeof(struct vf_macvlans),
 			  GFP_KERNEL);
 	if (mv_list) {
-		/* Initialize list of VF macvlans */
-		INIT_LIST_HEAD(&adapter->vf_mvs.l);
 		for (i = 0; i < num_vf_macvlans; i++) {
 			mv_list[i].vf = -1;
 			mv_list[i].free = true;

From 6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 9 Oct 2023 12:31:10 +0000
Subject: [PATCH 0022/1043] net: nfc: fix races in nfc_llcp_sock_get() and
 nfc_llcp_sock_get_sn()

[ Upstream commit 31c07dffafce914c1d1543c135382a11ff058d93 ]

Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.

Getting a reference on the socket found in a lookup while
holding a lock should happen before releasing the lock.

nfc_llcp_sock_get_sn() has a similar problem.

Finally nfc_llcp_recv_snl() needs to make sure the socket
found by nfc_llcp_sock_from_sn() does not disappear.

Fixes: 8f50020ed9b8 ("NFC: LLCP late binding")
Reported-by: Sili Luo <rootlab@huawei.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willy Tarreau <w@1wt.eu>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/nfc/llcp_core.c | 30 ++++++++++++------------------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index b1107570eaee..92f70686bee0 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -205,17 +205,13 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
 
 		if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) {
 			llcp_sock = tmp_sock;
+			sock_hold(&llcp_sock->sk);
 			break;
 		}
 	}
 
 	read_unlock(&local->sockets.lock);
 
-	if (llcp_sock == NULL)
-		return NULL;
-
-	sock_hold(&llcp_sock->sk);
-
 	return llcp_sock;
 }
 
@@ -348,7 +344,8 @@ static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len)
 
 static
 struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
-					    const u8 *sn, size_t sn_len)
+					    const u8 *sn, size_t sn_len,
+					    bool needref)
 {
 	struct sock *sk;
 	struct nfc_llcp_sock *llcp_sock, *tmp_sock;
@@ -384,6 +381,8 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
 
 		if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) {
 			llcp_sock = tmp_sock;
+			if (needref)
+				sock_hold(&llcp_sock->sk);
 			break;
 		}
 	}
@@ -425,7 +424,8 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
 		 * to this service name.
 		 */
 		if (nfc_llcp_sock_from_sn(local, sock->service_name,
-					  sock->service_name_len) != NULL) {
+					  sock->service_name_len,
+					  false) != NULL) {
 			mutex_unlock(&local->sdp_lock);
 
 			return LLCP_SAP_MAX;
@@ -833,16 +833,7 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local
 static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local,
 						  const u8 *sn, size_t sn_len)
 {
-	struct nfc_llcp_sock *llcp_sock;
-
-	llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len);
-
-	if (llcp_sock == NULL)
-		return NULL;
-
-	sock_hold(&llcp_sock->sk);
-
-	return llcp_sock;
+	return nfc_llcp_sock_from_sn(local, sn, sn_len, true);
 }
 
 static const u8 *nfc_llcp_connect_sn(const struct sk_buff *skb, size_t *sn_len)
@@ -1307,7 +1298,8 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
 			}
 
 			llcp_sock = nfc_llcp_sock_from_sn(local, service_name,
-							  service_name_len);
+							  service_name_len,
+							  true);
 			if (!llcp_sock) {
 				sap = 0;
 				goto add_snl;
@@ -1327,6 +1319,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
 
 				if (sap == LLCP_SAP_MAX) {
 					sap = 0;
+					nfc_llcp_sock_put(llcp_sock);
 					goto add_snl;
 				}
 
@@ -1344,6 +1337,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
 
 			pr_debug("%p %d\n", llcp_sock, sap);
 
+			nfc_llcp_sock_put(llcp_sock);
 add_snl:
 			sdp = nfc_llcp_build_sdres_tlv(tid, sap);
 			if (sdp == NULL)

From b5b03da30bd5bf260dcad83c5dece5fad70895f4 Mon Sep 17 00:00:00 2001
From: Ralph Siemsen <ralph.siemsen@linaro.org>
Date: Wed, 4 Oct 2023 16:00:08 -0400
Subject: [PATCH 0023/1043] pinctrl: renesas: rzn1: Enable missing PINMUX

[ Upstream commit f055ff23c331f28aa4ace4b72dc56f63b9a726c8 ]

Enable pin muxing (eg. programmable function), so that the RZ/N1 GPIO
pins will be configured as specified by the pinmux in the DTS.

This used to be enabled implicitly via CONFIG_GENERIC_PINMUX_FUNCTIONS,
however that was removed, since the RZ/N1 driver does not call any of
the generic pinmux functions.

Fixes: 1308fb4e4eae14e6 ("pinctrl: rzn1: Do not select GENERIC_PIN{CTRL_GROUPS,MUX_FUNCTIONS}")
Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20231004200008.1306798-1-ralph.siemsen@linaro.org
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/renesas/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/renesas/Kconfig b/drivers/pinctrl/renesas/Kconfig
index e941b8440dbc..39559ce9d1ed 100644
--- a/drivers/pinctrl/renesas/Kconfig
+++ b/drivers/pinctrl/renesas/Kconfig
@@ -212,6 +212,7 @@ config PINCTRL_RZN1
 	depends on OF
 	depends on ARCH_RZN1 || COMPILE_TEST
 	select GENERIC_PINCONF
+	select PINMUX
 	help
 	  This selects pinctrl driver for Renesas RZ/N1 devices.
 

From a424807d860ba816aaafc3064b46b456361c0802 Mon Sep 17 00:00:00 2001
From: Jeremy Cline <jeremy@jcline.org>
Date: Mon, 9 Oct 2023 16:00:54 -0400
Subject: [PATCH 0024/1043] nfc: nci: assert requested protocol is valid

[ Upstream commit 354a6e707e29cb0c007176ee5b8db8be7bd2dee0 ]

The protocol is used in a bit mask to determine if the protocol is
supported. Assert the provided protocol is less than the maximum
defined so it doesn't potentially perform a shift-out-of-bounds and
provide a clearer error for undefined protocols vs unsupported ones.

Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
Reported-and-tested-by: syzbot+0839b78e119aae1fec78@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0839b78e119aae1fec78
Signed-off-by: Jeremy Cline <jeremy@jcline.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20231009200054.82557-1-jeremy@jcline.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/nfc/nci/core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index ed9019d807c7..4c931bd1c174 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -894,6 +894,11 @@ static int nci_activate_target(struct nfc_dev *nfc_dev,
 		return -EINVAL;
 	}
 
+	if (protocol >= NFC_PROTO_MAX) {
+		pr_err("the requested nfc protocol is invalid\n");
+		return -EINVAL;
+	}
+
 	if (!(nci_target->supported_protocols & (1 << protocol))) {
 		pr_err("target does not support the requested protocol 0x%x\n",
 		       protocol);

From ce03f0234f9da772272c4507c9c7bd39a5c87398 Mon Sep 17 00:00:00 2001
From: Waiman Long <longman@redhat.com>
Date: Tue, 10 Oct 2023 22:48:42 -0400
Subject: [PATCH 0025/1043] workqueue: Override implicit ordered attribute in
 workqueue_apply_unbound_cpumask()

[ Upstream commit ca10d851b9ad0338c19e8e3089e24d565ebfffd7 ]

Commit 5c0338c68706 ("workqueue: restore WQ_UNBOUND/max_active==1
to be ordered") enabled implicit ordered attribute to be added to
WQ_UNBOUND workqueues with max_active of 1. This prevented the changing
of attributes to these workqueues leading to fix commit 0a94efb5acbb
("workqueue: implicit ordered attribute should be overridable").

However, workqueue_apply_unbound_cpumask() was not updated at that time.
So sysfs changes to wq_unbound_cpumask has no effect on WQ_UNBOUND
workqueues with implicit ordered attribute. Since not all WQ_UNBOUND
workqueues are visible on sysfs, we are not able to make all the
necessary cpumask changes even if we iterates all the workqueue cpumasks
in sysfs and changing them one by one.

Fix this problem by applying the corresponding change made
to apply_workqueue_attrs_locked() in the fix commit to
workqueue_apply_unbound_cpumask().

Fixes: 5c0338c68706 ("workqueue: restore WQ_UNBOUND/max_active==1 to be ordered")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/workqueue.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index fa0a0e59b385..37d01e44d483 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5300,9 +5300,13 @@ static int workqueue_apply_unbound_cpumask(void)
 	list_for_each_entry(wq, &workqueues, list) {
 		if (!(wq->flags & WQ_UNBOUND))
 			continue;
+
 		/* creating multiple pwqs breaks ordering guarantee */
-		if (wq->flags & __WQ_ORDERED)
-			continue;
+		if (!list_empty(&wq->pwqs)) {
+			if (wq->flags & __WQ_ORDERED_EXPLICIT)
+				continue;
+			wq->flags &= ~__WQ_ORDERED;
+		}
 
 		ctx = apply_wqattrs_prepare(wq, wq->unbound_attrs);
 		if (!ctx) {

From 649237ccf440c1921a770435a708374faaa73ba5 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sat, 14 Oct 2023 12:40:26 -0400
Subject: [PATCH 0026/1043] Revert "spi: zynqmp-gqspi: fix clock imbalance on
 probe failure"

This reverts commit 19f3d5d13b756b913be582a9e0d0afdeca9c397e.

Reported issues with backport, revert for now.

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-zynqmp-gqspi.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
index 12d9c5d6b9e2..ed68e237314f 100644
--- a/drivers/spi/spi-zynqmp-gqspi.c
+++ b/drivers/spi/spi-zynqmp-gqspi.c
@@ -1197,9 +1197,9 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
 	return 0;
 
 clk_dis_all:
-	pm_runtime_disable(&pdev->dev);
-	pm_runtime_put_noidle(&pdev->dev);
+	pm_runtime_put_sync(&pdev->dev);
 	pm_runtime_set_suspended(&pdev->dev);
+	pm_runtime_disable(&pdev->dev);
 	clk_disable_unprepare(xqspi->refclk);
 clk_dis_pclk:
 	clk_disable_unprepare(xqspi->pclk);
@@ -1223,15 +1223,11 @@ static int zynqmp_qspi_remove(struct platform_device *pdev)
 {
 	struct zynqmp_qspi *xqspi = platform_get_drvdata(pdev);
 
-	pm_runtime_get_sync(&pdev->dev);
-
 	zynqmp_gqspi_write(xqspi, GQSPI_EN_OFST, 0x0);
-
-	pm_runtime_disable(&pdev->dev);
-	pm_runtime_put_noidle(&pdev->dev);
-	pm_runtime_set_suspended(&pdev->dev);
 	clk_disable_unprepare(xqspi->refclk);
 	clk_disable_unprepare(xqspi->pclk);
+	pm_runtime_set_suspended(&pdev->dev);
+	pm_runtime_disable(&pdev->dev);
 
 	return 0;
 }

From 1ceaf0d3a883bd5fa4433583ed8dfc2f2e8b9417 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sat, 14 Oct 2023 12:40:41 -0400
Subject: [PATCH 0027/1043] Revert "spi: spi-zynqmp-gqspi: Fix runtime PM
 imbalance in zynqmp_qspi_probe"

This reverts commit 2cdec9c13f81313dd9f41f09c7cdecbfa4bea91d.

Reported issues with the backport, revert for now.

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-zynqmp-gqspi.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
index ed68e237314f..3d3ac48243eb 100644
--- a/drivers/spi/spi-zynqmp-gqspi.c
+++ b/drivers/spi/spi-zynqmp-gqspi.c
@@ -1147,16 +1147,11 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
 	pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
 	pm_runtime_set_active(&pdev->dev);
 	pm_runtime_enable(&pdev->dev);
-
-	ret = pm_runtime_get_sync(&pdev->dev);
-	if (ret < 0) {
-		dev_err(&pdev->dev, "Failed to pm_runtime_get_sync: %d\n", ret);
-		goto clk_dis_all;
-	}
-
 	/* QSPI controller initializations */
 	zynqmp_qspi_init_hw(xqspi);
 
+	pm_runtime_mark_last_busy(&pdev->dev);
+	pm_runtime_put_autosuspend(&pdev->dev);
 	xqspi->irq = platform_get_irq(pdev, 0);
 	if (xqspi->irq <= 0) {
 		ret = -ENXIO;
@@ -1183,7 +1178,6 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
 	ctlr->mode_bits = SPI_CPOL | SPI_CPHA | SPI_RX_DUAL | SPI_RX_QUAD |
 			    SPI_TX_DUAL | SPI_TX_QUAD;
 	ctlr->dev.of_node = np;
-	ctlr->auto_runtime_pm = true;
 
 	ret = devm_spi_register_controller(&pdev->dev, ctlr);
 	if (ret) {
@@ -1191,13 +1185,9 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
 		goto clk_dis_all;
 	}
 
-	pm_runtime_mark_last_busy(&pdev->dev);
-	pm_runtime_put_autosuspend(&pdev->dev);
-
 	return 0;
 
 clk_dis_all:
-	pm_runtime_put_sync(&pdev->dev);
 	pm_runtime_set_suspended(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 	clk_disable_unprepare(xqspi->refclk);

From 354a96770d94ce2cf2c9d4671b19401641877e9f Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 13 Oct 2023 14:44:12 -0700
Subject: [PATCH 0028/1043] net: add sysctl accept_ra_min_rtr_lft
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 1671bcfd76fdc0b9e65153cf759153083755fe4c upstream.

This change adds a new sysctl accept_ra_min_rtr_lft to specify the
minimum acceptable router lifetime in an RA. If the received RA router
lifetime is less than the configured value (and not 0), the RA is
ignored.
This is useful for mobile devices, whose battery life can be impacted
by networks that configure RAs with a short lifetime. On such networks,
the device should never gain IPv6 provisioning and should attempt to
drop RAs via hardware offload, if available.

Signed-off-by: Patrick Rohr <prohr@google.com>
Cc: Maciej Żenczykowski <maze@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/networking/ip-sysctl.rst |  8 ++++++++
 include/linux/ipv6.h                   |  1 +
 include/uapi/linux/ipv6.h              |  7 +++++++
 net/ipv6/addrconf.c                    | 10 ++++++++++
 net/ipv6/ndisc.c                       | 18 ++++++++++++++++--
 5 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index 252212998378..f7db7652341d 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1916,6 +1916,14 @@ accept_ra_min_hop_limit - INTEGER
 
 	Default: 1
 
+accept_ra_min_rtr_lft - INTEGER
+	Minimum acceptable router lifetime in Router Advertisement.
+
+	RAs with a router lifetime less than this value shall be
+	ignored. RAs with a router lifetime of 0 are unaffected.
+
+	Default: 0
+
 accept_ra_pinfo - BOOLEAN
 	Learn Prefix Information in Router Advertisement.
 
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 510f87656479..b91925a70296 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -32,6 +32,7 @@ struct ipv6_devconf {
 	__s32		max_addresses;
 	__s32		accept_ra_defrtr;
 	__s32		accept_ra_min_hop_limit;
+	__s32		accept_ra_min_rtr_lft;
 	__s32		accept_ra_pinfo;
 	__s32		ignore_routes_with_linkdown;
 #ifdef CONFIG_IPV6_ROUTER_PREF
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index d44d0483fd73..2038eff9b63f 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -192,6 +192,13 @@ enum {
 	DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN,
 	DEVCONF_NDISC_TCLASS,
 	DEVCONF_RPL_SEG_ENABLED,
+	DEVCONF_RA_DEFRTR_METRIC,
+	DEVCONF_IOAM6_ENABLED,
+	DEVCONF_IOAM6_ID,
+	DEVCONF_IOAM6_ID_WIDE,
+	DEVCONF_NDISC_EVICT_NOCARRIER,
+	DEVCONF_ACCEPT_UNTRACKED_NA,
+	DEVCONF_ACCEPT_RA_MIN_RTR_LFT,
 	DEVCONF_MAX
 };
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 0eafe26c05f7..7f122f27137f 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -207,6 +207,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
+	.accept_ra_min_rtr_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -262,6 +263,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
+	.accept_ra_min_rtr_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -5559,6 +5561,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 	array[DEVCONF_DISABLE_POLICY] = cnf->disable_policy;
 	array[DEVCONF_NDISC_TCLASS] = cnf->ndisc_tclass;
 	array[DEVCONF_RPL_SEG_ENABLED] = cnf->rpl_seg_enabled;
+	array[DEVCONF_ACCEPT_RA_MIN_RTR_LFT] = cnf->accept_ra_min_rtr_lft;
 }
 
 static inline size_t inet6_ifla6_size(void)
@@ -6716,6 +6719,13 @@ static const struct ctl_table addrconf_sysctl[] = {
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
 	},
+	{
+		.procname	= "accept_ra_min_rtr_lft",
+		.data		= &ipv6_devconf.accept_ra_min_rtr_lft,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec,
+	},
 	{
 		.procname	= "accept_ra_pinfo",
 		.data		= &ipv6_devconf.accept_ra_pinfo,
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index ac1e51087b1d..215ea5dbc5f0 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1222,6 +1222,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		return;
 	}
 
+	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
+
 	if (!ipv6_accept_ra(in6_dev)) {
 		ND_PRINTK(2, info,
 			  "RA: %s, did not accept ra for dev: %s\n",
@@ -1229,6 +1231,13 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_linkparms;
 	}
 
+	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
+		ND_PRINTK(2, info,
+			  "RA: router lifetime (%ds) is too short: %s\n",
+			  lifetime, skb->dev->name);
+		goto skip_linkparms;
+	}
+
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
 	/* skip link-specific parameters from interior routers */
 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
@@ -1281,8 +1290,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_defrtr;
 	}
 
-	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
-
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	pref = ra_msg->icmph.icmp6_router_pref;
 	/* 10b is handled as if it were 00b (medium) */
@@ -1429,6 +1436,13 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto out;
 	}
 
+	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
+		ND_PRINTK(2, info,
+			  "RA: router lifetime (%ds) is too short: %s\n",
+			  lifetime, skb->dev->name);
+		goto out;
+	}
+
 #ifdef CONFIG_IPV6_ROUTE_INFO
 	if (!in6_dev->cnf.accept_ra_from_local &&
 	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,

From d491ac7aa12a09a1a48f9f6cbf628b29080ca9f4 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 13 Oct 2023 14:44:13 -0700
Subject: [PATCH 0029/1043] net: change accept_ra_min_rtr_lft to affect all RA
 lifetimes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 5027d54a9c30bc7ec808360378e2b4753f053f25 upstream.

accept_ra_min_rtr_lft only considered the lifetime of the default route
and discarded entire RAs accordingly.

This change renames accept_ra_min_rtr_lft to accept_ra_min_lft, and
applies the value to individual RA sections; in particular, router
lifetime, PIO preferred lifetime, and RIO lifetime. If any of those
lifetimes are lower than the configured value, the specific RA section
is ignored.

In order for the sysctl to be useful to Android, it should really apply
to all lifetimes in the RA, since that is what determines the minimum
frequency at which RAs must be processed by the kernel. Android uses
hardware offloads to drop RAs for a fraction of the minimum of all
lifetimes present in the RA (some networks have very frequent RAs (5s)
with high lifetimes (2h)). Despite this, we have encountered networks
that set the router lifetime to 30s which results in very frequent CPU
wakeups. Instead of disabling IPv6 (and dropping IPv6 ethertype in the
WiFi firmware) entirely on such networks, it seems better to ignore the
misconfigured routers while still processing RAs from other IPv6 routers
on the same network (i.e. to support IoT applications).

The previous implementation dropped the entire RA based on router
lifetime. This turned out to be hard to expand to the other lifetimes
present in the RA in a consistent manner; dropping the entire RA based
on RIO/PIO lifetimes would essentially require parsing the whole thing
twice.

Fixes: 1671bcfd76fd ("net: add sysctl accept_ra_min_rtr_lft")
Cc: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Patrick Rohr <prohr@google.com>
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20230726230701.919212-1-prohr@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/networking/ip-sysctl.rst |  8 ++++----
 include/linux/ipv6.h                   |  2 +-
 include/uapi/linux/ipv6.h              |  2 +-
 net/ipv6/addrconf.c                    | 13 ++++++++-----
 net/ipv6/ndisc.c                       | 27 +++++++++++---------------
 5 files changed, 25 insertions(+), 27 deletions(-)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index f7db7652341d..e912a47765f3 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1916,11 +1916,11 @@ accept_ra_min_hop_limit - INTEGER
 
 	Default: 1
 
-accept_ra_min_rtr_lft - INTEGER
-	Minimum acceptable router lifetime in Router Advertisement.
+accept_ra_min_lft - INTEGER
+	Minimum acceptable lifetime value in Router Advertisement.
 
-	RAs with a router lifetime less than this value shall be
-	ignored. RAs with a router lifetime of 0 are unaffected.
+	RA sections with a lifetime less than this value shall be
+	ignored. Zero lifetimes stay unaffected.
 
 	Default: 0
 
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index b91925a70296..d758c131ed5e 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -32,7 +32,7 @@ struct ipv6_devconf {
 	__s32		max_addresses;
 	__s32		accept_ra_defrtr;
 	__s32		accept_ra_min_hop_limit;
-	__s32		accept_ra_min_rtr_lft;
+	__s32		accept_ra_min_lft;
 	__s32		accept_ra_pinfo;
 	__s32		ignore_routes_with_linkdown;
 #ifdef CONFIG_IPV6_ROUTER_PREF
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index 2038eff9b63f..4fa8511b1e35 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -198,7 +198,7 @@ enum {
 	DEVCONF_IOAM6_ID_WIDE,
 	DEVCONF_NDISC_EVICT_NOCARRIER,
 	DEVCONF_ACCEPT_UNTRACKED_NA,
-	DEVCONF_ACCEPT_RA_MIN_RTR_LFT,
+	DEVCONF_ACCEPT_RA_MIN_LFT,
 	DEVCONF_MAX
 };
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 7f122f27137f..2a389895d0a2 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -207,7 +207,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
-	.accept_ra_min_rtr_lft	= 0,
+	.accept_ra_min_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -263,7 +263,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
-	.accept_ra_min_rtr_lft	= 0,
+	.accept_ra_min_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -2726,6 +2726,9 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
 		return;
 	}
 
+	if (valid_lft != 0 && valid_lft < in6_dev->cnf.accept_ra_min_lft)
+		return;
+
 	/*
 	 *	Two things going on here:
 	 *	1) Add routes for on-link prefixes
@@ -5561,7 +5564,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 	array[DEVCONF_DISABLE_POLICY] = cnf->disable_policy;
 	array[DEVCONF_NDISC_TCLASS] = cnf->ndisc_tclass;
 	array[DEVCONF_RPL_SEG_ENABLED] = cnf->rpl_seg_enabled;
-	array[DEVCONF_ACCEPT_RA_MIN_RTR_LFT] = cnf->accept_ra_min_rtr_lft;
+	array[DEVCONF_ACCEPT_RA_MIN_LFT] = cnf->accept_ra_min_lft;
 }
 
 static inline size_t inet6_ifla6_size(void)
@@ -6720,8 +6723,8 @@ static const struct ctl_table addrconf_sysctl[] = {
 		.proc_handler	= proc_dointvec,
 	},
 	{
-		.procname	= "accept_ra_min_rtr_lft",
-		.data		= &ipv6_devconf.accept_ra_min_rtr_lft,
+		.procname	= "accept_ra_min_lft",
+		.data		= &ipv6_devconf.accept_ra_min_lft,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 215ea5dbc5f0..14251347c4a5 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1222,8 +1222,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		return;
 	}
 
-	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
-
 	if (!ipv6_accept_ra(in6_dev)) {
 		ND_PRINTK(2, info,
 			  "RA: %s, did not accept ra for dev: %s\n",
@@ -1231,13 +1229,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_linkparms;
 	}
 
-	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
-		ND_PRINTK(2, info,
-			  "RA: router lifetime (%ds) is too short: %s\n",
-			  lifetime, skb->dev->name);
-		goto skip_linkparms;
-	}
-
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
 	/* skip link-specific parameters from interior routers */
 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
@@ -1278,6 +1269,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_defrtr;
 	}
 
+	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
+	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_lft) {
+		ND_PRINTK(2, info,
+			  "RA: router lifetime (%ds) is too short: %s\n",
+			  lifetime, skb->dev->name);
+		goto skip_defrtr;
+	}
+
 	/* Do not accept RA with source-addr found on local machine unless
 	 * accept_ra_from_local is set to true.
 	 */
@@ -1436,13 +1435,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto out;
 	}
 
-	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
-		ND_PRINTK(2, info,
-			  "RA: router lifetime (%ds) is too short: %s\n",
-			  lifetime, skb->dev->name);
-		goto out;
-	}
-
 #ifdef CONFIG_IPV6_ROUTE_INFO
 	if (!in6_dev->cnf.accept_ra_from_local &&
 	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
@@ -1467,6 +1459,9 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 			if (ri->prefix_len == 0 &&
 			    !in6_dev->cnf.accept_ra_defrtr)
 				continue;
+			if (ri->lifetime != 0 &&
+			    ntohl(ri->lifetime) < in6_dev->cnf.accept_ra_min_lft)
+				continue;
 			if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
 				continue;
 			if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)

From 014cab5329d18524749dacc25923938aab14ff57 Mon Sep 17 00:00:00 2001
From: Patrick Rohr <prohr@google.com>
Date: Fri, 13 Oct 2023 14:44:14 -0700
Subject: [PATCH 0030/1043] net: release reference to inet6_dev pointer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 5cb249686e67dbef3ffe53887fa725eefc5a7144 upstream.

addrconf_prefix_rcv returned early without releasing the inet6_dev
pointer when the PIO lifetime is less than accept_ra_min_lft.

Fixes: 5027d54a9c30 ("net: change accept_ra_min_rtr_lft to affect all RA lifetimes")
Cc: Maciej Żenczykowski <maze@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: David Ahern <dsahern@kernel.org>
Cc: Simon Horman <horms@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: Patrick Rohr <prohr@google.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/addrconf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2a389895d0a2..193e5f275733 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2727,7 +2727,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
 	}
 
 	if (valid_lft != 0 && valid_lft < in6_dev->cnf.accept_ra_min_lft)
-		return;
+		goto put;
 
 	/*
 	 *	Two things going on here:

From d346a2ef6b1ebb77d740890cfaf8478c5b286380 Mon Sep 17 00:00:00 2001
From: Zheng Wang <zyytlz.wz@163.com>
Date: Fri, 7 Jul 2023 17:24:14 +0800
Subject: [PATCH 0031/1043] media: mtk-jpeg: Fix use after free bug due to
 uncanceled work

commit c677d7ae83141d390d1253abebafa49c962afb52 upstream.

In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with
mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run
and mtk_jpeg_enc_device_run may be called to start the
work.
If we remove the module which will call mtk_jpeg_remove
to make cleanup, there may be a unfinished work. The
possible sequence is as follows, which will cause a
typical UAF bug.

Fix it by canceling the work before cleanup in the mtk_jpeg_remove

CPU0                  CPU1

                    |mtk_jpeg_job_timeout_work
mtk_jpeg_remove     |
  v4l2_m2m_release  |
    kfree(m2m_dev); |
                    |
                    | v4l2_m2m_get_curr_priv
                    |   m2m_dev->curr_ctx //use
Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
index 88a23bce569d..36109c324cb6 100644
--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
@@ -1455,6 +1455,7 @@ static int mtk_jpeg_remove(struct platform_device *pdev)
 {
 	struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev);
 
+	cancel_delayed_work_sync(&jpeg->job_timeout_work);
 	pm_runtime_disable(&pdev->dev);
 	video_unregister_device(jpeg->vdev);
 	video_device_release(jpeg->vdev);

From 2d30692c6c9442b1a8cd5405486d218836a385a6 Mon Sep 17 00:00:00 2001
From: Amelie Delaunay <amelie.delaunay@foss.st.com>
Date: Wed, 4 Oct 2023 18:35:28 +0200
Subject: [PATCH 0032/1043] dmaengine: stm32-mdma: abort resume if no ongoing
 transfer

commit 81337b9a72dc58a5fa0ae8a042e8cb59f9bdec4a upstream.

chan->desc can be null, if transfer is terminated when resume is called,
leading to a NULL pointer when retrieving the hwdesc.
To avoid this case, check that chan->desc is not null and channel is
disabled (transfer previously paused or terminated).

Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver")
Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231004163531.2864160-1-amelie.delaunay@foss.st.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/dma/stm32-mdma.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
index 9d54746c422c..3e57176ca0ca 100644
--- a/drivers/dma/stm32-mdma.c
+++ b/drivers/dma/stm32-mdma.c
@@ -1206,6 +1206,10 @@ static int stm32_mdma_resume(struct dma_chan *c)
 	unsigned long flags;
 	u32 status, reg;
 
+	/* Transfer can be terminated */
+	if (!chan->desc || (stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)) & STM32_MDMA_CCR_EN))
+		return -EPERM;
+
 	hwdesc = chan->desc->node[chan->curr_hwdesc].hwdesc;
 
 	spin_lock_irqsave(&chan->vchan.lock, flags);

From 4bf69ee6bb416302a28427899fb13da70bd49eda Mon Sep 17 00:00:00 2001
From: Wesley Cheng <quic_wcheng@quicinc.com>
Date: Fri, 15 Sep 2023 17:31:05 +0300
Subject: [PATCH 0033/1043] usb: xhci: xhci-ring: Use sysdev for mapping bounce
 buffer

commit 41a43013d2366db5b88b42bbcd8e8f040b6ccf21 upstream.

As mentioned in:
  commit 474ed23a6257 ("xhci: align the last trb before link if it is
easily splittable.")

A bounce buffer is utilized for ensuring that transfers that span across
ring segments are aligned to the EP's max packet size.  However, the device
that is used to map the DMA buffer to is currently using the XHCI HCD,
which does not carry any DMA operations in certain configrations.
Migration to using the sysdev entry was introduced for DWC3 based
implementations where the IOMMU operations are present.

Replace the reference to the controller device to sysdev instead.  This
allows the bounce buffer to be properly mapped to any implementations that
have an IOMMU involved.

cc: stable@vger.kernel.org
Fixes: 4c39d4b949d3 ("usb: xhci: use bus->sysdev for DMA configuration")
Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230915143108.1532163-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-ring.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index b69b8c7e7966..248bfa3020de 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -742,7 +742,7 @@ static void xhci_giveback_urb_in_irq(struct xhci_hcd *xhci,
 static void xhci_unmap_td_bounce_buffer(struct xhci_hcd *xhci,
 		struct xhci_ring *ring, struct xhci_td *td)
 {
-	struct device *dev = xhci_to_hcd(xhci)->self.controller;
+	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
 	struct xhci_segment *seg = td->bounce_seg;
 	struct urb *urb = td->urb;
 	size_t len;
@@ -3325,7 +3325,7 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred,
 static int xhci_align_td(struct xhci_hcd *xhci, struct urb *urb, u32 enqd_len,
 			 u32 *trb_buff_len, struct xhci_segment *seg)
 {
-	struct device *dev = xhci_to_hcd(xhci)->self.controller;
+	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
 	unsigned int unalign;
 	unsigned int max_pkt;
 	u32 new_buff_len;

From d71d0009f9e768dc87853626c6e89401ad6e1a41 Mon Sep 17 00:00:00 2001
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Date: Tue, 10 Oct 2023 00:26:14 +0200
Subject: [PATCH 0034/1043] net: usb: dm9601: fix uninitialized variable use in
 dm9601_mdio_read

commit 8f8abb863fa5a4cc18955c6a0e17af0ded3e4a76 upstream.

syzbot has found an uninit-value bug triggered by the dm9601 driver [1].

This error happens because the variable res is not updated if the call
to dm_read_shared_word returns an error. In this particular case -EPROTO
was returned and res stayed uninitialized.

This can be avoided by checking the return value of dm_read_shared_word
and propagating the error if the read operation failed.

[1] https://syzkaller.appspot.com/bug?extid=1f53a30781af65d2c955

Cc: stable@vger.kernel.org
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Reported-and-tested-by: syzbot+1f53a30781af65d2c955@syzkaller.appspotmail.com
Acked-by: Peter Korsgaard <peter@korsgaard.com>
Fixes: d0374f4f9c35cdfbee0 ("USB: Davicom DM9601 usbnet driver")
Link: https://lore.kernel.org/r/20231009-topic-dm9601_uninit_mdio_read-v2-1-f2fe39739b6c@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/dm9601.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 915ac75b55fc..5aad26600b03 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -221,13 +221,18 @@ static int dm9601_mdio_read(struct net_device *netdev, int phy_id, int loc)
 	struct usbnet *dev = netdev_priv(netdev);
 
 	__le16 res;
+	int err;
 
 	if (phy_id) {
 		netdev_dbg(dev->net, "Only internal phy supported\n");
 		return 0;
 	}
 
-	dm_read_shared_word(dev, 1, loc, &res);
+	err = dm_read_shared_word(dev, 1, loc, &res);
+	if (err < 0) {
+		netdev_err(dev->net, "MDIO read error: %d\n", err);
+		return err;
+	}
 
 	netdev_dbg(dev->net,
 		   "dm9601_mdio_read() phy_id=0x%02x, loc=0x%02x, returns=0x%04x\n",

From 459eb7c6885f9553848b7f8fc13a24da5435e812 Mon Sep 17 00:00:00 2001
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Date: Wed, 13 Sep 2023 00:52:15 +0000
Subject: [PATCH 0035/1043] usb: dwc3: Soft reset phy on probe for host

commit 8bea147dfdf823eaa8d3baeccc7aeb041b41944b upstream.

When there's phy initialization, we need to initiate a soft-reset
sequence. That's done through USBCMD.HCRST in the xHCI driver and its
initialization, However, the dwc3 driver may modify core configs before
the soft-reset. This may result in some connection instability. So,
ensure the phy is ready before the controller updates the GCTL.PRTCAPDIR
or other settings by issuing phy soft-reset.

Note that some host-mode configurations may not expose device registers
to initiate the controller soft-reset (via DCTL.CoreSftRst). So we reset
through GUSB3PIPECTL and GUSB2PHYCFG instead.

Cc: stable@vger.kernel.org
Fixes: e835c0a4e23c ("usb: dwc3: don't reset device side if dwc3 was configured as host-only")
Reported-by: Kenta Sato <tosainu.maple@gmail.com>
Closes: https://lore.kernel.org/linux-usb/ZPUciRLUcjDywMVS@debian.me/
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Tested-by: Kenta Sato <tosainu.maple@gmail.com>
Link: https://lore.kernel.org/r/70aea513215d273669152696cc02b20ddcdb6f1a.1694564261.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/core.c | 39 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index b02b10acb884..5bc245b4be44 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -277,9 +277,46 @@ int dwc3_core_soft_reset(struct dwc3 *dwc)
 	 * XHCI driver will reset the host block. If dwc3 was configured for
 	 * host-only mode or current role is host, then we can return early.
 	 */
-	if (dwc->dr_mode == USB_DR_MODE_HOST || dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
+	if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
 		return 0;
 
+	/*
+	 * If the dr_mode is host and the dwc->current_dr_role is not the
+	 * corresponding DWC3_GCTL_PRTCAP_HOST, then the dwc3_core_init_mode
+	 * isn't executed yet. Ensure the phy is ready before the controller
+	 * updates the GCTL.PRTCAPDIR or other settings by soft-resetting
+	 * the phy.
+	 *
+	 * Note: GUSB3PIPECTL[n] and GUSB2PHYCFG[n] are port settings where n
+	 * is port index. If this is a multiport host, then we need to reset
+	 * all active ports.
+	 */
+	if (dwc->dr_mode == USB_DR_MODE_HOST) {
+		u32 usb3_port;
+		u32 usb2_port;
+
+		usb3_port = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0));
+		usb3_port |= DWC3_GUSB3PIPECTL_PHYSOFTRST;
+		dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(0), usb3_port);
+
+		usb2_port = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+		usb2_port |= DWC3_GUSB2PHYCFG_PHYSOFTRST;
+		dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), usb2_port);
+
+		/* Small delay for phy reset assertion */
+		usleep_range(1000, 2000);
+
+		usb3_port &= ~DWC3_GUSB3PIPECTL_PHYSOFTRST;
+		dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(0), usb3_port);
+
+		usb2_port &= ~DWC3_GUSB2PHYCFG_PHYSOFTRST;
+		dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), usb2_port);
+
+		/* Wait for clock synchronization */
+		msleep(50);
+		return 0;
+	}
+
 	reg = dwc3_readl(dwc->regs, DWC3_DCTL);
 	reg |= DWC3_DCTL_CSFTRST;
 	reg &= ~DWC3_DCTL_RUN_STOP;

From bc929a0052c43a626112e1724e72691e4e54be56 Mon Sep 17 00:00:00 2001
From: Xingxing Luo <xingxing.luo@unisoc.com>
Date: Tue, 19 Sep 2023 11:30:55 +0800
Subject: [PATCH 0036/1043] usb: musb: Get the musb_qh poniter after
 musb_giveback

commit 33d7e37232155aadebe4145dcc592f00dabd7a2b upstream.

When multiple threads are performing USB transmission, musb->lock will be
unlocked when musb_giveback is executed. At this time, qh may be released
in the dequeue process in other threads, resulting in a wild pointer, so
it needs to be here get qh again, and judge whether qh is NULL, and when
dequeue, you need to set qh to NULL.

Fixes: dbac5d07d13e ("usb: musb: host: don't start next rx urb if current one failed")
Cc: stable@vger.kernel.org
Signed-off-by: Xingxing Luo <xingxing.luo@unisoc.com>
Link: https://lore.kernel.org/r/20230919033055.14085-1-xingxing.luo@unisoc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/musb/musb_host.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 30c5e7de0761..1880b0f20df0 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -321,10 +321,16 @@ static void musb_advance_schedule(struct musb *musb, struct urb *urb,
 	musb_giveback(musb, urb, status);
 	qh->is_ready = ready;
 
+	/*
+	 * musb->lock had been unlocked in musb_giveback, so qh may
+	 * be freed, need to get it again
+	 */
+	qh = musb_ep_get_qh(hw_ep, is_in);
+
 	/* reclaim resources (and bandwidth) ASAP; deschedule it, and
 	 * invalidate qh as soon as list_empty(&hep->urb_list)
 	 */
-	if (list_empty(&qh->hep->urb_list)) {
+	if (qh && list_empty(&qh->hep->urb_list)) {
 		struct list_head	*head;
 		struct dma_controller	*dma = musb->dma_controller;
 
@@ -2404,6 +2410,7 @@ static int musb_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 		 * and its URB list has emptied, recycle this qh.
 		 */
 		if (ready && list_empty(&qh->hep->urb_list)) {
+			musb_ep_set_qh(qh->hw_ep, is_in, NULL);
 			qh->hep->hcpriv = NULL;
 			list_del(&qh->ring);
 			kfree(qh);

From aadbf612f8b14984c7f7eacbdf05dab812b36f89 Mon Sep 17 00:00:00 2001
From: Xingxing Luo <xingxing.luo@unisoc.com>
Date: Fri, 22 Sep 2023 15:59:29 +0800
Subject: [PATCH 0037/1043] usb: musb: Modify the "HWVers" register address

commit 6658a62e1ddf726483cb2d8bf45ea3f9bd533074 upstream.

musb HWVers rgister address is not 0x69, if we operate the
wrong address 0x69, it will cause a kernel crash, because
there is no register corresponding to this address in the
additional control register of musb. In fact, HWVers has
been defined in musb_register.h, and the name is
"MUSB_HWVERS", so We need to use this macro instead of 0x69.

Fixes: c2365ce5d5a0 ("usb: musb: replace hard coded registers with defines")
Cc: stable@vger.kernel.org
Signed-off-by: Xingxing Luo <xingxing.luo@unisoc.com>
Link: https://lore.kernel.org/r/20230922075929.31074-1-xingxing.luo@unisoc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/musb/musb_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c
index 30a89aa8a3e7..5401ae66894e 100644
--- a/drivers/usb/musb/musb_debugfs.c
+++ b/drivers/usb/musb/musb_debugfs.c
@@ -39,7 +39,7 @@ static const struct musb_register_map musb_regmap[] = {
 	{ "IntrUsbE",	MUSB_INTRUSBE,	8 },
 	{ "DevCtl",	MUSB_DEVCTL,	8 },
 	{ "VControl",	0x68,		32 },
-	{ "HWVers",	0x69,		16 },
+	{ "HWVers",	MUSB_HWVERS,	16 },
 	{ "LinkInfo",	MUSB_LINKINFO,	8 },
 	{ "VPLen",	MUSB_VPLEN,	8 },
 	{ "HS_EOF1",	MUSB_HS_EOF1,	8 },

From 2abd2cffa1b8a80f32bef2539fc129b21fd6e846 Mon Sep 17 00:00:00 2001
From: Phil Elwell <phil@raspberrypi.com>
Date: Fri, 11 Aug 2023 16:58:29 +0100
Subject: [PATCH 0038/1043] iio: pressure: bmp280: Fix NULL pointer exception

commit 85dfb43bf69281adb1f345dfd9a39faf2e5a718d upstream.

The bmp085 EOC IRQ support is optional, but the driver's common probe
function queries the IRQ properties whether or not it exists, which
can trigger a NULL pointer exception. Avoid any exception by making
the query conditional on the possession of a valid IRQ.

Fixes: aae953949651 ("iio: pressure: bmp280: add support for BMP085 EOC interrupt")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20230811155829.51208-1-phil@raspberrypi.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/pressure/bmp280-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index 6b7da40f99c8..919a338d9181 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -1112,7 +1112,7 @@ int bmp280_common_probe(struct device *dev,
 	 * however as it happens, the BMP085 shares the chip ID of BMP180
 	 * so we look for an IRQ if we have that.
 	 */
-	if (irq > 0 || (chip_id  == BMP180_CHIP_ID)) {
+	if (irq > 0 && (chip_id  == BMP180_CHIP_ID)) {
 		ret = bmp085_fetch_eoc_irq(dev, name, irq, data);
 		if (ret)
 			return ret;

From 02388eaf3a15ec4e8dc01bd59842c2b104d31bed Mon Sep 17 00:00:00 2001
From: Lakshmi Yadlapati <lakshmiy@us.ibm.com>
Date: Tue, 29 Aug 2023 13:02:22 -0500
Subject: [PATCH 0039/1043] iio: pressure: dps310: Adjust Timeout Settings

commit 901a293fd96fb9bab843ba4cc7be3094a5aa7c94 upstream.

The DPS310 sensor chip has been encountering intermittent errors while
reading the sensor device across various system designs. This issue causes
the chip to become "stuck," preventing the indication of "ready" status
for pressure and temperature measurements in the MEAS_CFG register.

To address this issue, this commit fixes the timeout settings to improve
sensor stability:
- After sending a reset command to the chip, the timeout has been extended
  from 2.5 ms to 15 ms, aligning with the DPS310 specification.
- The read timeout value of the MEAS_CFG register has been adjusted from
  20ms to 30ms to match the specification.

Signed-off-by: Lakshmi Yadlapati <lakshmiy@us.ibm.com>
Fixes: 7b4ab4abcea4 ("iio: pressure: dps310: Reset chip after timeout")
Link: https://lore.kernel.org/r/20230829180222.3431926-2-lakshmiy@us.ibm.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/pressure/dps310.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/pressure/dps310.c b/drivers/iio/pressure/dps310.c
index cf8b92fae1b3..1b6b9530f166 100644
--- a/drivers/iio/pressure/dps310.c
+++ b/drivers/iio/pressure/dps310.c
@@ -57,8 +57,8 @@
 #define  DPS310_RESET_MAGIC	0x09
 #define DPS310_COEF_BASE	0x10
 
-/* Make sure sleep time is <= 20ms for usleep_range */
-#define DPS310_POLL_SLEEP_US(t)		min(20000, (t) / 8)
+/* Make sure sleep time is <= 30ms for usleep_range */
+#define DPS310_POLL_SLEEP_US(t)		min(30000, (t) / 8)
 /* Silently handle error in rate value here */
 #define DPS310_POLL_TIMEOUT_US(rc)	((rc) <= 0 ? 1000000 : 1000000 / (rc))
 
@@ -402,8 +402,8 @@ static int dps310_reset_wait(struct dps310_data *data)
 	if (rc)
 		return rc;
 
-	/* Wait for device chip access: 2.5ms in specification */
-	usleep_range(2500, 12000);
+	/* Wait for device chip access: 15ms in specification */
+	usleep_range(15000, 55000);
 	return 0;
 }
 

From b608f4aedc0eb4e4eb78ebb6978f3f7d0c368797 Mon Sep 17 00:00:00 2001
From: Alexander Zangerl <az@breathe-safe.com>
Date: Wed, 20 Sep 2023 10:01:10 +1000
Subject: [PATCH 0040/1043] iio: pressure: ms5611: ms5611_prom_is_valid false
 negative bug

commit fd39d9668f2ce9f4b05ad55e8c8d80c098073e0b upstream.

The ms5611 driver falsely rejects lots of MS5607-02BA03-50 chips
with "PROM integrity check failed" because it doesn't accept a prom crc
value of zero as legitimate.

According to the datasheet for this chip (and the manufacturer's
application note about the PROM CRC), none of the possible values for the
CRC are excluded - but the current code in ms5611_prom_is_valid() ends with

return crc_orig != 0x0000 && crc == crc_orig

Discussed with the driver author (Tomasz Duszynski) and he indicated that
at that time (2015) he was dealing with some faulty chip samples which
returned blank data under some circumstances and/or followed example code
which indicated CRC zero being bad.

As far as I can tell this exception should not be applied anymore; We've
got a few hundred custom boards here with this chip where large numbers
of the prom have a legitimate CRC value 0, and do work fine, but which the
current driver code wrongly rejects.

Signed-off-by: Alexander Zangerl <az@breathe-safe.com>
Fixes: c0644160a8b5 ("iio: pressure: add support for MS5611 pressure and temperature sensor")
Link: https://lore.kernel.org/r/2535-1695168070.831792@Ze3y.dhYT.s3fx
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/pressure/ms5611_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/pressure/ms5611_core.c b/drivers/iio/pressure/ms5611_core.c
index 874a73b3ea9d..f88d8f2ce610 100644
--- a/drivers/iio/pressure/ms5611_core.c
+++ b/drivers/iio/pressure/ms5611_core.c
@@ -76,7 +76,7 @@ static bool ms5611_prom_is_valid(u16 *prom, size_t len)
 
 	crc = (crc >> 12) & 0x000F;
 
-	return crc_orig != 0x0000 && crc == crc_orig;
+	return crc == crc_orig;
 }
 
 static int ms5611_read_prom(struct iio_dev *indio_dev)

From ec93456c0289850235cee83a91c6c5567d607a55 Mon Sep 17 00:00:00 2001
From: "Borislav Petkov (AMD)" <bp@alien8.de>
Date: Sat, 7 Oct 2023 12:57:02 +0200
Subject: [PATCH 0041/1043] x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit f454b18e07f518bcd0c05af17a2239138bff52de upstream.

Fix erratum #1485 on Zen4 parts where running with STIBP disabled can
cause an #UD exception. The performance impact of the fix is negligible.

Reported-by: René Rebe <rene@exactcode.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: René Rebe <rene@exactcode.de>
Cc: <stable@kernel.org>
Link: https://lore.kernel.org/r/D99589F4-BC5D-430B-87B2-72C20370CF57@exactcode.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/msr-index.h | 9 +++++++--
 arch/x86/kernel/cpu/amd.c        | 8 ++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 202a52e42a36..8465fc8ffd99 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -541,12 +541,17 @@
 
 #define MSR_AMD64_VIRT_SPEC_CTRL	0xc001011f
 
-/* Fam 17h MSRs */
-#define MSR_F17H_IRPERF			0xc00000e9
+/* Zen4 */
+#define MSR_ZEN4_BP_CFG			0xc001102e
+#define MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT 5
 
+/* Zen 2 */
 #define MSR_ZEN2_SPECTRAL_CHICKEN	0xc00110e3
 #define MSR_ZEN2_SPECTRAL_CHICKEN_BIT	BIT_ULL(1)
 
+/* Fam 17h MSRs */
+#define MSR_F17H_IRPERF			0xc00000e9
+
 /* Fam 16h MSRs */
 #define MSR_F16H_L2I_PERF_CTL		0xc0010230
 #define MSR_F16H_L2I_PERF_CTR		0xc0010231
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 2bc1c78a7cc5..d254e02aa179 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -81,6 +81,10 @@ static const int amd_div0[] =
 	AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0x00, 0x0, 0x2f, 0xf),
 			   AMD_MODEL_RANGE(0x17, 0x50, 0x0, 0x5f, 0xf));
 
+static const int amd_erratum_1485[] =
+	AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x19, 0x10, 0x0, 0x1f, 0xf),
+			   AMD_MODEL_RANGE(0x19, 0x60, 0x0, 0xaf, 0xf));
+
 static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
 {
 	int osvw_id = *erratum++;
@@ -1178,6 +1182,10 @@ static void init_amd(struct cpuinfo_x86 *c)
 		pr_notice_once("AMD Zen1 DIV0 bug detected. Disable SMT for full protection.\n");
 		setup_force_cpu_bug(X86_BUG_DIV0);
 	}
+
+	if (!cpu_has(c, X86_FEATURE_HYPERVISOR) &&
+	     cpu_has_amd_erratum(c, amd_erratum_1485))
+		msr_set_bit(MSR_ZEN4_BP_CFG, MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT);
 }
 
 #ifdef CONFIG_X86_32

From 008ba1a5ada58f0e4cdfaeff3eed88a443296ab0 Mon Sep 17 00:00:00 2001
From: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
Date: Wed, 6 Sep 2023 11:49:26 +0000
Subject: [PATCH 0042/1043] mcb: remove is_added flag from mcb_device struct

commit 0f28ada1fbf0054557cddcdb93ad17f767105208 upstream.

When calling mcb_bus_add_devices(), both mcb devices and the mcb
bus will attempt to attach a device to a driver because they share
the same bus_type. This causes an issue when trying to cast the
container of the device to mcb_device struct using to_mcb_device(),
leading to a wrong cast when the mcb_bus is added. A crash occurs
when freing the ida resources as the bus numbering of mcb_bus gets
confused with the is_added flag on the mcb_device struct.

The only reason for this cast was to keep an is_added flag on the
mcb_device struct that does not seem necessary. The function
device_attach() handles already bound devices and the mcb subsystem
does nothing special with this is_added flag so remove it completely.

Fixes: 18d288198099 ("mcb: Correctly initialize the bus's device")
Cc: stable <stable@kernel.org>
Signed-off-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
Co-developed-by: Jose Javier Rodriguez Barbarin <JoseJavier.Rodriguez@duagon.com>
Signed-off-by: Jose Javier Rodriguez Barbarin <JoseJavier.Rodriguez@duagon.com>
Link: https://lore.kernel.org/r/20230906114901.63174-2-JoseJavier.Rodriguez@duagon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mcb/mcb-core.c  | 10 +++-------
 drivers/mcb/mcb-parse.c |  2 --
 include/linux/mcb.h     |  1 -
 3 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
index 8b8cd751fe9a..806a3d9da12f 100644
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -389,17 +389,13 @@ EXPORT_SYMBOL_NS_GPL(mcb_free_dev, MCB);
 
 static int __mcb_bus_add_devices(struct device *dev, void *data)
 {
-	struct mcb_device *mdev = to_mcb_device(dev);
 	int retval;
 
-	if (mdev->is_added)
-		return 0;
-
 	retval = device_attach(dev);
-	if (retval < 0)
+	if (retval < 0) {
 		dev_err(dev, "Error adding device (%d)\n", retval);
-
-	mdev->is_added = true;
+		return retval;
+	}
 
 	return 0;
 }
diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
index aa6938da0db8..c41cbacc75a2 100644
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -99,8 +99,6 @@ static int chameleon_parse_gdd(struct mcb_bus *bus,
 	mdev->mem.end = mdev->mem.start + size - 1;
 	mdev->mem.flags = IORESOURCE_MEM;
 
-	mdev->is_added = false;
-
 	ret = mcb_device_register(bus, mdev);
 	if (ret < 0)
 		goto err;
diff --git a/include/linux/mcb.h b/include/linux/mcb.h
index 71dd10a3d928..01fd26170e6b 100644
--- a/include/linux/mcb.h
+++ b/include/linux/mcb.h
@@ -63,7 +63,6 @@ static inline struct mcb_bus *to_mcb_bus(struct device *dev)
 struct mcb_device {
 	struct device dev;
 	struct mcb_bus *bus;
-	bool is_added;
 	struct mcb_driver *driver;
 	u16 id;
 	int inst;

From 5850eb4df42294022a950e5e17e62b5911997c31 Mon Sep 17 00:00:00 2001
From: Mika Westerberg <mika.westerberg@linux.intel.com>
Date: Tue, 22 Aug 2023 16:36:18 +0300
Subject: [PATCH 0043/1043] thunderbolt: Check that lane 1 is in CL0 before
 enabling lane bonding
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit a9fdf5f933a6f2b358fad0194b1287b67f6704b1 upstream.

Marek reported that when BlackMagic UltraStudio device is connected the
kernel repeatedly tries to enable lane bonding without success making
the device non-functional. It looks like the device does not have lane 1
connected at all so even though it is enabled we should not try to bond
the lanes. For this reason check that lane 1 is in fact CL0 (connected,
active) before attempting to bond the lanes.

Reported-by: Marek Šanta <teslan223@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217737
Cc: stable@vger.kernel.org
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/thunderbolt/switch.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index e881b72833dc..22e5c4de345b 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -2303,6 +2303,13 @@ int tb_switch_lane_bonding_enable(struct tb_switch *sw)
 	    !tb_port_is_width_supported(down, 2))
 		return 0;
 
+	/*
+	 * Both lanes need to be in CL0. Here we assume lane 0 already be in
+	 * CL0 and check just for lane 1.
+	 */
+	if (tb_wait_for_port(down->dual_link_port, false) <= 0)
+		return -ENOTCONN;
+
 	ret = tb_port_lane_bonding_enable(up);
 	if (ret) {
 		tb_port_warn(up, "failed to enable lane bonding\n");

From 62f6d24f2e7d6dee31eca8027543f264a4352a31 Mon Sep 17 00:00:00 2001
From: Jordan Rife <jrife@google.com>
Date: Wed, 4 Oct 2023 18:38:27 -0500
Subject: [PATCH 0044/1043] libceph: use kernel_connect()

commit 7563cf17dce0a875ba3d872acdc63a78ea344019 upstream.

Direct calls to ops->connect() can overwrite the address parameter when
used in conjunction with BPF SOCK_ADDR hooks. Recent changes to
kernel_connect() ensure that callers are insulated from such side
effects. This patch wraps the direct call to ops->connect() with
kernel_connect() to prevent unexpected changes to the address passed to
ceph_tcp_connect().

This change was originally part of a larger patch targeting the net tree
addressing all instances of unprotected calls to ops->connect()
throughout the kernel, but this change was split up into several patches
targeting various trees.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/netdev/20230821100007.559638-1-jrife@google.com/
Link: https://lore.kernel.org/netdev/9944248dba1bce861375fcce9de663934d933ba9.camel@redhat.com/
Fixes: d74bad4e74ee ("bpf: Hooks for sys_connect")
Signed-off-by: Jordan Rife <jrife@google.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ceph/messenger.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index af0f1fa24937..192a43f8efa2 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -477,8 +477,8 @@ static int ceph_tcp_connect(struct ceph_connection *con)
 	dout("connect %s\n", ceph_pr_addr(&con->peer_addr));
 
 	con_sock_state_connecting(con);
-	ret = sock->ops->connect(sock, (struct sockaddr *)&ss, sizeof(ss),
-				 O_NONBLOCK);
+	ret = kernel_connect(sock, (struct sockaddr *)&ss, sizeof(ss),
+			     O_NONBLOCK);
 	if (ret == -EINPROGRESS) {
 		dout("connect %s EINPROGRESS sk_state = %u\n",
 		     ceph_pr_addr(&con->peer_addr),

From 2b2bf63671ccbb68b5ebc94e808a44cced79cb27 Mon Sep 17 00:00:00 2001
From: Xiubo Li <xiubli@redhat.com>
Date: Wed, 6 Sep 2023 14:22:07 +0800
Subject: [PATCH 0045/1043] ceph: fix incorrect revoked caps assert in
 ceph_fill_file_size()

commit 15c0a870dc44ed14e01efbdd319d232234ee639f upstream.

When truncating the inode the MDS will acquire the xlock for the
ifile Locker, which will revoke the 'Frwsxl' caps from the clients.
But when the client just releases and flushes the 'Fw' caps to MDS,
for exmaple, and once the MDS receives the caps flushing msg it
just thought the revocation has finished. Then the MDS will continue
truncating the inode and then issued the truncate notification to
all the clients. While just before the clients receives the cap
flushing ack they receive the truncation notification, the clients
will detecte that the 'issued | dirty' is still holding the 'Fw'
caps.

Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/56693
Fixes: b0d7c2231015 ("ceph: introduce i_truncate_mutex")
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Milind Changire <mchangir@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/inode.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 76be50f6f041..36e3342d3633 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -635,9 +635,7 @@ int ceph_fill_file_size(struct inode *inode, int issued,
 			ci->i_truncate_seq = truncate_seq;
 
 			/* the MDS should have revoked these caps */
-			WARN_ON_ONCE(issued & (CEPH_CAP_FILE_EXCL |
-					       CEPH_CAP_FILE_RD |
-					       CEPH_CAP_FILE_WR |
+			WARN_ON_ONCE(issued & (CEPH_CAP_FILE_RD |
 					       CEPH_CAP_FILE_LAZYIO));
 			/*
 			 * If we hold relevant caps, or in the case where we're

From 27b6c809d3937275576c297a72290f618db3f45b Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Sat, 7 Oct 2023 11:52:39 +0300
Subject: [PATCH 0046/1043] ceph: fix type promotion bug on 32bit systems

commit 07bb00ef00ace88dd6f695fadbba76565756e55c upstream.

In this code "ret" is type long and "src_objlen" is unsigned int.  The
problem is that on 32bit systems, when we do the comparison signed longs
are type promoted to unsigned int.  So negative error codes from
do_splice_direct() are treated as success instead of failure.

Cc: stable@vger.kernel.org
Fixes: 1b0c3b9f91f0 ("ceph: re-org copy_file_range and fix some error paths")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 943655e36a79..d4974c652e8e 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -2428,7 +2428,7 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off,
 		ret = do_splice_direct(src_file, &src_off, dst_file,
 				       &dst_off, src_objlen, flags);
 		/* Abort on short copies or on error */
-		if (ret < src_objlen) {
+		if (ret < (long)src_objlen) {
 			dout("Failed partial copy (%zd)\n", ret);
 			goto out;
 		}

From cd2fbfd8b922b7fdd50732e47d797754ab59cb06 Mon Sep 17 00:00:00 2001
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Date: Fri, 13 Oct 2023 20:11:33 -0700
Subject: [PATCH 0047/1043] Input: powermate - fix use-after-free in
 powermate_config_complete

commit 5c15c60e7be615f05a45cd905093a54b11f461bc upstream.

syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct.  When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e

Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Reported-by: syzbot+0434ac83f907a1dbdd1e@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20230916-topic-powermate_use_after_free-v3-1-64412b81a7a2@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/misc/powermate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c
index c4e0e1886061..6b1b95d58e6b 100644
--- a/drivers/input/misc/powermate.c
+++ b/drivers/input/misc/powermate.c
@@ -425,6 +425,7 @@ static void powermate_disconnect(struct usb_interface *intf)
 		pm->requires_update = 0;
 		usb_kill_urb(pm->irq);
 		input_unregister_device(pm->input);
+		usb_kill_urb(pm->config);
 		usb_free_urb(pm->irq);
 		usb_free_urb(pm->config);
 		powermate_free_buffers(interface_to_usbdev(intf), pm);

From e8ea649fc35fba0b7b0b3243e6ed3203a0a27bad Mon Sep 17 00:00:00 2001
From: Jeffery Miller <jefferymiller@google.com>
Date: Fri, 13 Oct 2023 15:23:49 -0700
Subject: [PATCH 0048/1043] Input: psmouse - fix fast_reconnect function for
 PS/2 mode

commit e2cb5cc822b6c9ee72c56ce1d81671b22c05406a upstream.

When the SMBus connection is attempted psmouse_smbus_init() sets
the fast_reconnect pointer to psmouse_smbus_reconnecti(). If SMBus
initialization fails, elantech_setup_ps2() and synaptics_init_ps2() will
fallback to PS/2 mode, replacing the psmouse private data. This can cause
issues on resume, since psmouse_smbus_reconnect() expects to find an
instance of struct psmouse_smbus_dev in psmouse->private.

The issue was uncovered when in 92e24e0e57f7 ("Input: psmouse - add
delay when deactivating for SMBus mode") psmouse_smbus_reconnect()
started attempting to use more of the data structure. The commit was
since reverted, not because it was at fault, but because there was found
a better way of doing what it was attempting to do.

Fix the problem by resetting the fast_reconnect pointer in psmouse
structure in elantech_setup_ps2() and synaptics_init_ps2() when the PS/2
mode is used.

Reported-by: Thorsten Leemhuis <linux@leemhuis.info>
Tested-by: Thorsten Leemhuis <linux@leemhuis.info>
Signed-off-by: Jeffery Miller <jefferymiller@google.com>
Fixes: bf232e460a35 ("Input: psmouse-smbus - allow to control psmouse_deactivate")
Link: https://lore.kernel.org/r/20231005002249.554877-1-jefferymiller@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/mouse/elantech.c  | 1 +
 drivers/input/mouse/synaptics.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 598fcb99f6c9..400281feb4e8 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -2112,6 +2112,7 @@ static int elantech_setup_ps2(struct psmouse *psmouse,
 	psmouse->protocol_handler = elantech_process_byte;
 	psmouse->disconnect = elantech_disconnect;
 	psmouse->reconnect = elantech_reconnect;
+	psmouse->fast_reconnect = NULL;
 	psmouse->pktsize = info->hw_version > 1 ? 6 : 4;
 
 	return 0;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 82577095e175..afa5d2623c41 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1619,6 +1619,7 @@ static int synaptics_init_ps2(struct psmouse *psmouse,
 	psmouse->set_rate = synaptics_set_rate;
 	psmouse->disconnect = synaptics_disconnect;
 	psmouse->reconnect = synaptics_reconnect;
+	psmouse->fast_reconnect = NULL;
 	psmouse->cleanup = synaptics_reset;
 	/* Synaptics can usually stay in sync without extra help */
 	psmouse->resync_time = 0;

From 8d862a3dff7e0dd0f1500131725e49ce8b58718b Mon Sep 17 00:00:00 2001
From: Matthias Berndt <matthias_berndt@gmx.de>
Date: Fri, 13 Oct 2023 15:04:36 -0700
Subject: [PATCH 0049/1043] Input: xpad - add PXN V900 support

commit a65cd7ef5a864bdbbe037267c327786b7759d4c6 upstream.

Add VID and PID to the xpad_device table to allow driver to use the PXN
V900 steering wheel, which is XTYPE_XBOX360 compatible in xinput mode.

Signed-off-by: Matthias Berndt <matthias_berndt@gmx.de>
Link: https://lore.kernel.org/r/4932699.31r3eYUQgx@fedora
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/joystick/xpad.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index b99318fb58dc..762c50239146 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -252,6 +252,7 @@ static const struct xpad_device {
 	{ 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
 	{ 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
 	{ 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
+	{ 0x11ff, 0x0511, "PXN V900", 0, XTYPE_XBOX360 },
 	{ 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 },
 	{ 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
 	{ 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
@@ -446,6 +447,7 @@ static const struct usb_device_id xpad_table[] = {
 	XPAD_XBOXONE_VENDOR(0x0f0d),		/* Hori Controllers */
 	XPAD_XBOX360_VENDOR(0x1038),		/* SteelSeries Controllers */
 	XPAD_XBOX360_VENDOR(0x11c9),		/* Nacon GC100XF */
+	XPAD_XBOX360_VENDOR(0x11ff),		/* PXN V900 */
 	XPAD_XBOX360_VENDOR(0x1209),		/* Ardwiino Controllers */
 	XPAD_XBOX360_VENDOR(0x12ab),		/* X-Box 360 dance pads */
 	XPAD_XBOX360_VENDOR(0x1430),		/* RedOctane X-Box 360 controllers */

From 39fb79407e595710c1c2ea6504df3e32f75e33ee Mon Sep 17 00:00:00 2001
From: Szilard Fabian <szfabian@bluemarch.art>
Date: Wed, 4 Oct 2023 05:47:01 -0700
Subject: [PATCH 0050/1043] Input: i8042 - add Fujitsu Lifebook E5411 to i8042
 quirk table

commit 80f39e1c27ba9e5a1ea7e68e21c569c9d8e46062 upstream.

In the initial boot stage the integrated keyboard of Fujitsu Lifebook E5411
refuses to work and it's not possible to type for example a dm-crypt
passphrase without the help of an external keyboard.

i8042.nomux kernel parameter resolves this issue but using that a PS/2
mouse is detected. This input device is unused even when the i2c-hid-acpi
kernel module is blacklisted making the integrated ELAN touchpad
(04F3:308A) not working at all.

Since the integrated touchpad is managed by the i2c_designware input
driver in the Linux kernel and you can't find a PS/2 mouse port on the
computer I think it's safe to not use the PS/2 mouse port at all.

Signed-off-by: Szilard Fabian <szfabian@bluemarch.art>
Link: https://lore.kernel.org/r/20231004011749.101789-1-szfabian@bluemarch.art
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h
index 1bd5898abb97..09528c0a8a34 100644
--- a/drivers/input/serio/i8042-acpipnpio.h
+++ b/drivers/input/serio/i8042-acpipnpio.h
@@ -609,6 +609,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = {
 		},
 		.driver_data = (void *)(SERIO_QUIRK_NOMUX)
 	},
+	{
+		/* Fujitsu Lifebook E5411 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU CLIENT COMPUTING LIMITED"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E5411"),
+		},
+		.driver_data = (void *)(SERIO_QUIRK_NOAUX)
+	},
 	{
 		/* Gigabyte M912 */
 		.matches = {

From 0ea0231dd1b22e0038a64811475f7f28eee24999 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Wed, 4 Oct 2023 07:18:31 -0700
Subject: [PATCH 0051/1043] Input: goodix - ensure int GPIO is in input for
 gpio_count == 1 && gpio_int_idx == 0 case

commit 423622a90abb243944d1517b9f57db53729e45c4 upstream.

Add a special case for gpio_count == 1 && gpio_int_idx == 0 to
goodix_add_acpi_gpio_mappings().

It seems that on newer x86/ACPI devices the reset and irq GPIOs are no
longer listed as GPIO resources instead there is only 1 GpioInt resource
and _PS0 does the whole reset sequence for us.

This means that we must call acpi_device_fix_up_power() on these devices
to ensure that the chip is reset before we try to use it.

This part was already fixed in commit 3de93e6ed2df ("Input: goodix - call
acpi_device_fix_up_power() in some cases") by adding a call to
acpi_device_fix_up_power() to the generic "Unexpected ACPI resources"
catch all.

But it turns out that this case on some hw needs some more special
handling. Specifically the firmware may bootup with the IRQ pin in
output mode. The reset sequence from ACPI _PS0 (executed by
acpi_device_fix_up_power()) should put the pin in input mode,
but the GPIO subsystem has cached the direction at bootup, causing
request_irq() to fail due to gpiochip_lock_as_irq() failure:

[    9.119864] Goodix-TS i2c-GDIX1002:00: Unexpected ACPI resources: gpio_count 1, gpio_int_idx 0
[    9.317443] Goodix-TS i2c-GDIX1002:00: ID 911, version: 1060
[    9.321902] input: Goodix Capacitive TouchScreen as /devices/pci0000:00/0000:00:17.0/i2c_designware.4/i2c-5/i2c-GDIX1002:00/input/input8
[    9.327840] gpio gpiochip0: (INT3453:00): gpiochip_lock_as_irq: tried to flag a GPIO set as output for IRQ
[    9.327856] gpio gpiochip0: (INT3453:00): unable to lock HW IRQ 26 for IRQ
[    9.327861] genirq: Failed to request resources for GDIX1002:00 (irq 131) on irqchip intel-gpio
[    9.327912] Goodix-TS i2c-GDIX1002:00: request IRQ failed: -5

Fix this by adding a special case for gpio_count == 1 && gpio_int_idx == 0
which adds an ACPI GPIO lookup table for the int GPIO even though we cannot
use it for reset purposes (as there is no reset GPIO).

Adding the lookup will make the gpiod_int = gpiod_get(..., GPIOD_IN) call
succeed, which will explicitly set the direction to input fixing the issue.

Note this re-uses the acpi_goodix_int_first_gpios[] lookup table, since
there is only 1 GPIO in the ACPI resources the reset entry in that
lookup table will amount to a no-op.

Reported-and-tested-by: Michael Smith <1973.mjsmith@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231003215144.69527-1-hdegoede@redhat.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/touchscreen/goodix.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
index 098115eb8084..53792a1b6ac3 100644
--- a/drivers/input/touchscreen/goodix.c
+++ b/drivers/input/touchscreen/goodix.c
@@ -820,6 +820,25 @@ static int goodix_add_acpi_gpio_mappings(struct goodix_ts_data *ts)
 		dev_info(dev, "No ACPI GpioInt resource, assuming that the GPIO order is reset, int\n");
 		ts->irq_pin_access_method = IRQ_PIN_ACCESS_ACPI_GPIO;
 		gpio_mapping = acpi_goodix_int_last_gpios;
+	} else if (ts->gpio_count == 1 && ts->gpio_int_idx == 0) {
+		/*
+		 * On newer devices there is only 1 GpioInt resource and _PS0
+		 * does the whole reset sequence for us.
+		 */
+		acpi_device_fix_up_power(ACPI_COMPANION(dev));
+
+		/*
+		 * Before the _PS0 call the int GPIO may have been in output
+		 * mode and the call should have put the int GPIO in input mode,
+		 * but the GPIO subsys cached state may still think it is
+		 * in output mode, causing gpiochip_lock_as_irq() failure.
+		 *
+		 * Add a mapping for the int GPIO to make the
+		 * gpiod_int = gpiod_get(..., GPIOD_IN) call succeed,
+		 * which will explicitly set the direction to input.
+		 */
+		ts->irq_pin_access_method = IRQ_PIN_ACCESS_NONE;
+		gpio_mapping = acpi_goodix_int_first_gpios;
 	} else {
 		dev_warn(dev, "Unexpected ACPI resources: gpio_count %d, gpio_int_idx %d\n",
 			 ts->gpio_count, ts->gpio_int_idx);

From da7ce52a2f6c468946195b116615297d3d113a27 Mon Sep 17 00:00:00 2001
From: Rijo Thomas <Rijo-john.Thomas@amd.com>
Date: Fri, 29 Sep 2023 12:30:24 +0530
Subject: [PATCH 0052/1043] tee: amdtee: fix use-after-free vulnerability in
 amdtee_close_session

commit f4384b3e54ea813868bb81a861bf5b2406e15d8f upstream.

There is a potential race condition in amdtee_close_session that may
cause use-after-free in amdtee_open_session. For instance, if a session
has refcount == 1, and one thread tries to free this session via:

    kref_put(&sess->refcount, destroy_session);

the reference count will get decremented, and the next step would be to
call destroy_session(). However, if in another thread,
amdtee_open_session() is called before destroy_session() has completed
execution, alloc_session() may return 'sess' that will be freed up
later in destroy_session() leading to use-after-free in
amdtee_open_session.

To fix this issue, treat decrement of sess->refcount and removal of
'sess' from session list in destroy_session() as a critical section, so
that it is executed atomically.

Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver")
Cc: stable@vger.kernel.org
Signed-off-by: Rijo Thomas <Rijo-john.Thomas@amd.com>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tee/amdtee/core.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c
index 372d64756ed6..3c15f6a9e91c 100644
--- a/drivers/tee/amdtee/core.c
+++ b/drivers/tee/amdtee/core.c
@@ -217,12 +217,12 @@ static int copy_ta_binary(struct tee_context *ctx, void *ptr, void **ta,
 	return rc;
 }
 
+/* mutex must be held by caller */
 static void destroy_session(struct kref *ref)
 {
 	struct amdtee_session *sess = container_of(ref, struct amdtee_session,
 						   refcount);
 
-	mutex_lock(&session_list_mutex);
 	list_del(&sess->list_node);
 	mutex_unlock(&session_list_mutex);
 	kfree(sess);
@@ -272,7 +272,8 @@ int amdtee_open_session(struct tee_context *ctx,
 	if (arg->ret != TEEC_SUCCESS) {
 		pr_err("open_session failed %d\n", arg->ret);
 		handle_unload_ta(ta_handle);
-		kref_put(&sess->refcount, destroy_session);
+		kref_put_mutex(&sess->refcount, destroy_session,
+			       &session_list_mutex);
 		goto out;
 	}
 
@@ -290,7 +291,8 @@ int amdtee_open_session(struct tee_context *ctx,
 		pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS);
 		handle_close_session(ta_handle, session_info);
 		handle_unload_ta(ta_handle);
-		kref_put(&sess->refcount, destroy_session);
+		kref_put_mutex(&sess->refcount, destroy_session,
+			       &session_list_mutex);
 		rc = -ENOMEM;
 		goto out;
 	}
@@ -331,7 +333,7 @@ int amdtee_close_session(struct tee_context *ctx, u32 session)
 	handle_close_session(ta_handle, session_info);
 	handle_unload_ta(ta_handle);
 
-	kref_put(&sess->refcount, destroy_session);
+	kref_put_mutex(&sess->refcount, destroy_session, &session_list_mutex);
 
 	return 0;
 }

From 2a4a8280402453489ca0dc67ced4db9feb87b4a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20Koutn=C3=BD?= <mkoutny@suse.com>
Date: Mon, 9 Oct 2023 15:58:11 +0200
Subject: [PATCH 0053/1043] cgroup: Remove duplicates in cgroup v1 tasks file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 1ca0b605150501b7dc59f3016271da4eb3e96fce upstream.

One PID may appear multiple times in a preloaded pidlist.
(Possibly due to PID recycling but we have reports of the same
task_struct appearing with different PIDs, thus possibly involving
transfer of PID via de_thread().)

Because v1 seq_file iterator uses PIDs as position, it leads to
a message:
> seq_file: buggy .next function kernfs_seq_next did not update position index

Conservative and quick fix consists of removing duplicates from `tasks`
file (as opposed to removing pidlists altogether). It doesn't affect
correctness (it's sufficient to show a PID once), performance impact
would be hidden by unconditional sorting of the pidlist already in place
(asymptotically).

Link: https://lore.kernel.org/r/20230823174804.23632-1-mkoutny@suse.com/
Suggested-by: Firo Yang <firo.yang@suse.com>
Signed-off-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/cgroup/cgroup-v1.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index 433b9e840b38..b044ce3026eb 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -361,10 +361,9 @@ static int pidlist_array_load(struct cgroup *cgrp, enum cgroup_filetype type,
 	}
 	css_task_iter_end(&it);
 	length = n;
-	/* now sort & (if procs) strip out duplicates */
+	/* now sort & strip out duplicates (tgids or recycled thread PIDs) */
 	sort(array, length, sizeof(pid_t), cmppid, NULL);
-	if (type == CGROUP_FILE_PROCS)
-		length = pidlist_uniq(array, length);
+	length = pidlist_uniq(array, length);
 
 	l = cgroup_pidlist_find_create(cgrp, type);
 	if (!l) {

From a177771bff638a17010f5fb7c0628ed39fbb15c0 Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Wed, 20 Sep 2023 11:09:10 -0700
Subject: [PATCH 0054/1043] pinctrl: avoid unsafe code pattern in
 find_pinctrl()

commit c153a4edff6ab01370fcac8e46f9c89cca1060c2 upstream.

The code in find_pinctrl() takes a mutex and traverses a list of pinctrl
structures. Later the caller bumps up reference count on the found
structure. Such pattern is not safe as pinctrl that was found may get
deleted before the caller gets around to increasing the reference count.

Fix this by taking the reference count in find_pinctrl(), while it still
holds the mutex.

Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://lore.kernel.org/r/ZQs1RgTKg6VJqmPs@google.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/core.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 840000870d5a..6acb2a56910e 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1007,17 +1007,20 @@ static int add_setting(struct pinctrl *p, struct pinctrl_dev *pctldev,
 
 static struct pinctrl *find_pinctrl(struct device *dev)
 {
-	struct pinctrl *p;
+	struct pinctrl *entry, *p = NULL;
 
 	mutex_lock(&pinctrl_list_mutex);
-	list_for_each_entry(p, &pinctrl_list, node)
-		if (p->dev == dev) {
-			mutex_unlock(&pinctrl_list_mutex);
-			return p;
+
+	list_for_each_entry(entry, &pinctrl_list, node) {
+		if (entry->dev == dev) {
+			p = entry;
+			kref_get(&p->users);
+			break;
 		}
+	}
 
 	mutex_unlock(&pinctrl_list_mutex);
-	return NULL;
+	return p;
 }
 
 static void pinctrl_free(struct pinctrl *p, bool inlist);
@@ -1126,7 +1129,6 @@ struct pinctrl *pinctrl_get(struct device *dev)
 	p = find_pinctrl(dev);
 	if (p) {
 		dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n");
-		kref_get(&p->users);
 		return p;
 	}
 

From 7decb6515138f74840b31715111d8de025edeb93 Mon Sep 17 00:00:00 2001
From: Dharma Balasubiramani <dharma.b@microchip.com>
Date: Tue, 5 Sep 2023 15:38:35 +0530
Subject: [PATCH 0055/1043] counter: microchip-tcb-capture: Fix the use of
 internal GCLK logic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit df8fdd01c98b99d04915c04f3a5ce73f55456b7c upstream.

As per the datasheet, the clock selection Bits 2:0 – TCCLKS[2:0] should
be set to 0 while using the internal GCLK (TIMER_CLOCK1).

Fixes: 106b104137fd ("counter: Add microchip TCB capture counter")
Signed-off-by: Dharma Balasubiramani <dharma.b@microchip.com>
Link: https://lore.kernel.org/r/20230905100835.315024-1-dharma.b@microchip.com
Signed-off-by: William Breathitt Gray <william.gray@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/counter/microchip-tcb-capture.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/counter/microchip-tcb-capture.c b/drivers/counter/microchip-tcb-capture.c
index 85fbbac06d31..6f17644b6e0b 100644
--- a/drivers/counter/microchip-tcb-capture.c
+++ b/drivers/counter/microchip-tcb-capture.c
@@ -111,7 +111,7 @@ static int mchp_tc_count_function_set(struct counter_device *counter,
 		priv->qdec_mode = 0;
 		/* Set highest rate based on whether soc has gclk or not */
 		bmr &= ~(ATMEL_TC_QDEN | ATMEL_TC_POSEN);
-		if (priv->tc_cfg->has_gclk)
+		if (!priv->tc_cfg->has_gclk)
 			cmr |= ATMEL_TC_TIMER_CLOCK2;
 		else
 			cmr |= ATMEL_TC_TIMER_CLOCK1;

From a906f2eb675c8a1101ea1a901dc7c9f4d26459a8 Mon Sep 17 00:00:00 2001
From: Piyush Mehta <piyush.mehta@amd.com>
Date: Fri, 29 Sep 2023 17:45:14 +0530
Subject: [PATCH 0056/1043] usb: gadget: udc-xilinx: replace memcpy with
 memcpy_toio

commit 3061b6491f491197a35e14e49f805d661b02acd4 upstream.

For ARM processor, unaligned access to device memory is not allowed.
Method memcpy does not take care of alignment.

USB detection failure with the unalingned address of memory, with
below kernel crash. To fix the unalingned address kernel panic,
replace memcpy with memcpy_toio method.

Kernel crash:
Unable to handle kernel paging request at virtual address ffff80000c05008a
Mem abort info:
  ESR = 0x96000061
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x21: alignment fault
Data abort info:
  ISV = 0, ISS = 0x00000061
  CM = 0, WnR = 1
swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000000143b000
[ffff80000c05008a] pgd=100000087ffff003, p4d=100000087ffff003,
pud=100000087fffe003, pmd=1000000800bcc003, pte=00680000a0010713
Internal error: Oops: 96000061 [#1] SMP
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.19-xilinx-v2022.1 #1
Hardware name: ZynqMP ZCU102 Rev1.0 (DT)
pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __memcpy+0x30/0x260
lr : __xudc_ep0_queue+0xf0/0x110
sp : ffff800008003d00
x29: ffff800008003d00 x28: ffff800009474e80 x27: 00000000000000a0
x26: 0000000000000100 x25: 0000000000000012 x24: ffff000800bc8080
x23: 0000000000000001 x22: 0000000000000012 x21: ffff000800bc8080
x20: 0000000000000012 x19: ffff000800bc8080 x18: 0000000000000000
x17: ffff800876482000 x16: ffff800008004000 x15: 0000000000004000
x14: 00001f09785d0400 x13: 0103020101005567 x12: 0781400000000200
x11: 00000000c5672a10 x10: 00000000000008d0 x9 : ffff800009463cf0
x8 : ffff8000094757b0 x7 : 0201010055670781 x6 : 4000000002000112
x5 : ffff80000c05009a x4 : ffff000800a15012 x3 : ffff00080362ad80
x2 : 0000000000000012 x1 : ffff000800a15000 x0 : ffff80000c050088
Call trace:
 __memcpy+0x30/0x260
 xudc_ep0_queue+0x3c/0x60
 usb_ep_queue+0x38/0x44
 composite_ep0_queue.constprop.0+0x2c/0xc0
 composite_setup+0x8d0/0x185c
 configfs_composite_setup+0x74/0xb0
 xudc_irq+0x570/0xa40
 __handle_irq_event_percpu+0x58/0x170
 handle_irq_event+0x60/0x120
 handle_fasteoi_irq+0xc0/0x220
 handle_domain_irq+0x60/0x90
 gic_handle_irq+0x74/0xa0
 call_on_irq_stack+0x2c/0x60
 do_interrupt_handler+0x54/0x60
 el1_interrupt+0x30/0x50
 el1h_64_irq_handler+0x18/0x24
 el1h_64_irq+0x78/0x7c
 arch_cpu_idle+0x18/0x2c
 do_idle+0xdc/0x15c
 cpu_startup_entry+0x28/0x60
 rest_init+0xc8/0xe0
 arch_call_rest_init+0x10/0x1c
 start_kernel+0x694/0x6d4
 __primary_switched+0xa4/0xac

Fixes: 1f7c51660034 ("usb: gadget: Add xilinx usb2 device support")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/all/202209020044.CX2PfZzM-lkp@intel.com/
Cc: stable@vger.kernel.org
Signed-off-by: Piyush Mehta <piyush.mehta@amd.com>
Link: https://lore.kernel.org/r/20230929121514.13475-1-piyush.mehta@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/udc-xilinx.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c
index 096f56a09e6a..47486f0f21e5 100644
--- a/drivers/usb/gadget/udc/udc-xilinx.c
+++ b/drivers/usb/gadget/udc/udc-xilinx.c
@@ -496,11 +496,13 @@ static int xudc_eptxrx(struct xusb_ep *ep, struct xusb_req *req,
 		/* Get the Buffer address and copy the transmit data.*/
 		eprambase = (u32 __force *)(udc->addr + ep->rambase);
 		if (ep->is_in) {
-			memcpy(eprambase, bufferptr, bytestosend);
+			memcpy_toio((void __iomem *)eprambase, bufferptr,
+				    bytestosend);
 			udc->write_fn(udc->addr, ep->offset +
 				      XUSB_EP_BUF0COUNT_OFFSET, bufferlen);
 		} else {
-			memcpy(bufferptr, eprambase, bytestosend);
+			memcpy_toio((void __iomem *)bufferptr, eprambase,
+				    bytestosend);
 		}
 		/*
 		 * Enable the buffer for transmission.
@@ -514,11 +516,13 @@ static int xudc_eptxrx(struct xusb_ep *ep, struct xusb_req *req,
 		eprambase = (u32 __force *)(udc->addr + ep->rambase +
 			     ep->ep_usb.maxpacket);
 		if (ep->is_in) {
-			memcpy(eprambase, bufferptr, bytestosend);
+			memcpy_toio((void __iomem *)eprambase, bufferptr,
+				    bytestosend);
 			udc->write_fn(udc->addr, ep->offset +
 				      XUSB_EP_BUF1COUNT_OFFSET, bufferlen);
 		} else {
-			memcpy(bufferptr, eprambase, bytestosend);
+			memcpy_toio((void __iomem *)bufferptr, eprambase,
+				    bytestosend);
 		}
 		/*
 		 * Enable the buffer for transmission.
@@ -1020,7 +1024,7 @@ static int __xudc_ep0_queue(struct xusb_ep *ep0, struct xusb_req *req)
 			   udc->addr);
 		length = req->usb_req.actual = min_t(u32, length,
 						     EP0_MAX_PACKET);
-		memcpy(corebuf, req->usb_req.buf, length);
+		memcpy_toio((void __iomem *)corebuf, req->usb_req.buf, length);
 		udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, length);
 		udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1);
 	} else {
@@ -1746,7 +1750,7 @@ static void xudc_handle_setup(struct xusb_udc *udc)
 
 	/* Load up the chapter 9 command buffer.*/
 	ep0rambase = (u32 __force *) (udc->addr + XUSB_SETUP_PKT_ADDR_OFFSET);
-	memcpy(&setup, ep0rambase, 8);
+	memcpy_toio((void __iomem *)&setup, ep0rambase, 8);
 
 	udc->setup = setup;
 	udc->setup.wValue = cpu_to_le16(setup.wValue);
@@ -1833,7 +1837,7 @@ static void xudc_ep0_out(struct xusb_udc *udc)
 			     (ep0->rambase << 2));
 		buffer = req->usb_req.buf + req->usb_req.actual;
 		req->usb_req.actual = req->usb_req.actual + bytes_to_rx;
-		memcpy(buffer, ep0rambase, bytes_to_rx);
+		memcpy_toio((void __iomem *)buffer, ep0rambase, bytes_to_rx);
 
 		if (req->usb_req.length == req->usb_req.actual) {
 			/* Data transfer completed get ready for Status stage */
@@ -1909,7 +1913,7 @@ static void xudc_ep0_in(struct xusb_udc *udc)
 				     (ep0->rambase << 2));
 			buffer = req->usb_req.buf + req->usb_req.actual;
 			req->usb_req.actual = req->usb_req.actual + length;
-			memcpy(ep0rambase, buffer, length);
+			memcpy_toio((void __iomem *)ep0rambase, buffer, length);
 		}
 		udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, count);
 		udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1);

From 17c653d4913bbc50d284aa96cf12bfc63e41ee5c Mon Sep 17 00:00:00 2001
From: Krishna Kurapati <quic_kriskura@quicinc.com>
Date: Wed, 27 Sep 2023 16:28:58 +0530
Subject: [PATCH 0057/1043] usb: gadget: ncm: Handle decoding of multiple NTB's
 in unwrap call
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 427694cfaafa565a3db5c5ea71df6bc095dca92f upstream.

When NCM is used with hosts like Windows PC, it is observed that there are
multiple NTB's contained in one usb request giveback. Since the driver
unwraps the obtained request data assuming only one NTB is present, we
loose the subsequent NTB's present resulting in data loss.

Fix this by checking the parsed block length with the obtained data
length in usb request and continue parsing after the last byte of current
NTB.

Cc: stable@vger.kernel.org
Fixes: 9f6ce4240a2b ("usb: gadget: f_ncm.c added")
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Link: https://lore.kernel.org/r/20230927105858.12950-1-quic_kriskura@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_ncm.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index f56147489835..00aea45a04e9 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1180,7 +1180,8 @@ static int ncm_unwrap_ntb(struct gether *port,
 			  struct sk_buff_head *list)
 {
 	struct f_ncm	*ncm = func_to_ncm(&port->func);
-	__le16		*tmp = (void *) skb->data;
+	unsigned char	*ntb_ptr = skb->data;
+	__le16		*tmp;
 	unsigned	index, index2;
 	int		ndp_index;
 	unsigned	dg_len, dg_len2;
@@ -1193,6 +1194,10 @@ static int ncm_unwrap_ntb(struct gether *port,
 	const struct ndp_parser_opts *opts = ncm->parser_opts;
 	unsigned	crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
 	int		dgram_counter;
+	int		to_process = skb->len;
+
+parse_ntb:
+	tmp = (__le16 *)ntb_ptr;
 
 	/* dwSignature */
 	if (get_unaligned_le32(tmp) != opts->nth_sign) {
@@ -1239,7 +1244,7 @@ static int ncm_unwrap_ntb(struct gether *port,
 		 * walk through NDP
 		 * dwSignature
 		 */
-		tmp = (void *)(skb->data + ndp_index);
+		tmp = (__le16 *)(ntb_ptr + ndp_index);
 		if (get_unaligned_le32(tmp) != ncm->ndp_sign) {
 			INFO(port->func.config->cdev, "Wrong NDP SIGN\n");
 			goto err;
@@ -1296,11 +1301,11 @@ static int ncm_unwrap_ntb(struct gether *port,
 			if (ncm->is_crc) {
 				uint32_t crc, crc2;
 
-				crc = get_unaligned_le32(skb->data +
+				crc = get_unaligned_le32(ntb_ptr +
 							 index + dg_len -
 							 crc_len);
 				crc2 = ~crc32_le(~0,
-						 skb->data + index,
+						 ntb_ptr + index,
 						 dg_len - crc_len);
 				if (crc != crc2) {
 					INFO(port->func.config->cdev,
@@ -1327,7 +1332,7 @@ static int ncm_unwrap_ntb(struct gether *port,
 							 dg_len - crc_len);
 			if (skb2 == NULL)
 				goto err;
-			skb_put_data(skb2, skb->data + index,
+			skb_put_data(skb2, ntb_ptr + index,
 				     dg_len - crc_len);
 
 			skb_queue_tail(list, skb2);
@@ -1340,10 +1345,17 @@ static int ncm_unwrap_ntb(struct gether *port,
 		} while (ndp_len > 2 * (opts->dgram_item_len * 2));
 	} while (ndp_index);
 
-	dev_consume_skb_any(skb);
-
 	VDBG(port->func.config->cdev,
 	     "Parsed NTB with %d frames\n", dgram_counter);
+
+	to_process -= block_len;
+	if (to_process != 0) {
+		ntb_ptr = (unsigned char *)(ntb_ptr + block_len);
+		goto parse_ntb;
+	}
+
+	dev_consume_skb_any(skb);
+
 	return 0;
 err:
 	skb_queue_purge(list);

From 288a0593c7985ba9e0dab6c63e49ed00cff34d47 Mon Sep 17 00:00:00 2001
From: Duoming Zhou <duoming@zju.edu.cn>
Date: Sun, 6 Aug 2023 11:25:11 +0800
Subject: [PATCH 0058/1043] dmaengine: mediatek: Fix deadlock caused by
 synchronize_irq()

[ Upstream commit 01f1ae2733e2bb4de92fefcea5fda847d92aede1 ]

The synchronize_irq(c->irq) will not return until the IRQ handler
mtk_uart_apdma_irq_handler() is completed. If the synchronize_irq()
holds a spin_lock and waits the IRQ handler to complete, but the
IRQ handler also needs the same spin_lock. The deadlock will happen.
The process is shown below:

          cpu0                        cpu1
mtk_uart_apdma_device_pause() | mtk_uart_apdma_irq_handler()
  spin_lock_irqsave()         |
                              |   spin_lock_irqsave()
  //hold the lock to wait     |
  synchronize_irq()           |

This patch reorders the synchronize_irq(c->irq) outside the spin_lock
in order to mitigate the bug.

Fixes: 9135408c3ace ("dmaengine: mediatek: Add MediaTek UART APDMA support")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Eugen Hristev <eugen.hristev@collabora.com>
Link: https://lore.kernel.org/r/20230806032511.45263-1-duoming@zju.edu.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/mediatek/mtk-uart-apdma.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/dma/mediatek/mtk-uart-apdma.c b/drivers/dma/mediatek/mtk-uart-apdma.c
index a1517ef1f4a0..0acf6a92a4ad 100644
--- a/drivers/dma/mediatek/mtk-uart-apdma.c
+++ b/drivers/dma/mediatek/mtk-uart-apdma.c
@@ -451,9 +451,8 @@ static int mtk_uart_apdma_device_pause(struct dma_chan *chan)
 	mtk_uart_apdma_write(c, VFF_EN, VFF_EN_CLR_B);
 	mtk_uart_apdma_write(c, VFF_INT_EN, VFF_INT_EN_CLR_B);
 
-	synchronize_irq(c->irq);
-
 	spin_unlock_irqrestore(&c->vc.lock, flags);
+	synchronize_irq(c->irq);
 
 	return 0;
 }

From dadb86fba67f7f9a41d869bce5c25d1c156c2754 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@csgroup.eu>
Date: Mon, 25 Sep 2023 20:31:15 +0200
Subject: [PATCH 0059/1043] powerpc/8xx: Fix pte_access_permitted() for
 PAGE_NONE

[ Upstream commit 5d9cea8a552ee122e21fbd5a3c5d4eb85f648e06 ]

On 8xx, PAGE_NONE is handled by setting _PAGE_NA instead of clearing
_PAGE_USER.

But then pte_user() returns 1 also for PAGE_NONE.

As _PAGE_NA prevent reads, add a specific version of pte_read()
that returns 0 when _PAGE_NA is set instead of always returning 1.

Fixes: 351750331fc1 ("powerpc/mm: Introduce _PAGE_NA")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/57bcfbe578e43123f9ed73e040229b80f1ad56ec.1695659959.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/nohash/32/pte-8xx.h | 7 +++++++
 arch/powerpc/include/asm/nohash/pgtable.h    | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/arch/powerpc/include/asm/nohash/32/pte-8xx.h b/arch/powerpc/include/asm/nohash/32/pte-8xx.h
index 1581204467e1..2b06da0ffd2d 100644
--- a/arch/powerpc/include/asm/nohash/32/pte-8xx.h
+++ b/arch/powerpc/include/asm/nohash/32/pte-8xx.h
@@ -94,6 +94,13 @@ static inline pte_t pte_wrprotect(pte_t pte)
 
 #define pte_wrprotect pte_wrprotect
 
+static inline int pte_read(pte_t pte)
+{
+	return (pte_val(pte) & _PAGE_RO) != _PAGE_NA;
+}
+
+#define pte_read pte_read
+
 static inline int pte_write(pte_t pte)
 {
 	return !(pte_val(pte) & _PAGE_RO);
diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h
index ac75f4ab0dba..7ad1d1b042a6 100644
--- a/arch/powerpc/include/asm/nohash/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/pgtable.h
@@ -45,7 +45,9 @@ static inline int pte_write(pte_t pte)
 	return pte_val(pte) & _PAGE_RW;
 }
 #endif
+#ifndef pte_read
 static inline int pte_read(pte_t pte)		{ return 1; }
+#endif
 static inline int pte_dirty(pte_t pte)		{ return pte_val(pte) & _PAGE_DIRTY; }
 static inline int pte_special(pte_t pte)	{ return pte_val(pte) & _PAGE_SPECIAL; }
 static inline int pte_none(pte_t pte)		{ return (pte_val(pte) & ~_PTE_NONE_MASK) == 0; }

From ba4b377210968f4385ab41cc1a86db073fce9c22 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@csgroup.eu>
Date: Mon, 25 Sep 2023 20:31:16 +0200
Subject: [PATCH 0060/1043] powerpc/64e: Fix wrong test in
 __ptep_test_and_clear_young()

[ Upstream commit 5ea0bbaa32e8f54e9a57cfee4a3b8769b80be0d2 ]

Commit 45201c879469 ("powerpc/nohash: Remove hash related code from
nohash headers.") replaced:

  if ((pte_val(*ptep) & (_PAGE_ACCESSED | _PAGE_HASHPTE)) == 0)
	return 0;

By:

  if (pte_young(*ptep))
	return 0;

But it should be:

  if (!pte_young(*ptep))
	return 0;

Fix it.

Fixes: 45201c879469 ("powerpc/nohash: Remove hash related code from nohash headers.")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/8bb7f06494e21adada724ede47a4c3d97e879d40.1695659959.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/nohash/64/pgtable.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/include/asm/nohash/64/pgtable.h b/arch/powerpc/include/asm/nohash/64/pgtable.h
index a4d475c0fc2c..6075fac88286 100644
--- a/arch/powerpc/include/asm/nohash/64/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/64/pgtable.h
@@ -216,7 +216,7 @@ static inline int __ptep_test_and_clear_young(struct mm_struct *mm,
 {
 	unsigned long old;
 
-	if (pte_young(*ptep))
+	if (!pte_young(*ptep))
 		return 0;
 	old = pte_update(mm, addr, ptep, _PAGE_ACCESSED, 0, 0);
 	return (old & _PAGE_ACCESSED) != 0;

From 6788b10620ca6e98575d1e06e72a8974aad7657e Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Date: Thu, 12 Oct 2023 13:04:24 +0300
Subject: [PATCH 0061/1043] x86/alternatives: Disable KASAN in
 apply_alternatives()

commit d35652a5fc9944784f6f50a5c979518ff8dacf61 upstream.

Fei has reported that KASAN triggers during apply_alternatives() on
a 5-level paging machine:

	BUG: KASAN: out-of-bounds in rcu_is_watching()
	Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0
	...
	__asan_load4()
	rcu_is_watching()
	trace_hardirqs_on()
	text_poke_early()
	apply_alternatives()
	...

On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57)
gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on
__VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled().

KASAN gets confused when apply_alternatives() patches the
KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START
static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue.

Fix it for real by disabling KASAN while the kernel is patching alternatives.

[ mingo: updated the changelog ]

Fixes: 6657fca06e3f ("x86/mm: Allow to boot without LA57 if CONFIG_X86_5LEVEL=y")
Reported-by: Fei Yang <fei.yang@intel.com>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231012100424.1456-1-kirill.shutemov@linux.intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/alternative.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index e6e63a9d27cb..d58621f0fe51 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -424,6 +424,17 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,
 	u8 insn_buff[MAX_PATCH_LEN];
 
 	DPRINTK("alt table %px, -> %px", start, end);
+
+	/*
+	 * In the case CONFIG_X86_5LEVEL=y, KASAN_SHADOW_START is defined using
+	 * cpu_feature_enabled(X86_FEATURE_LA57) and is therefore patched here.
+	 * During the process, KASAN becomes confused seeing partial LA57
+	 * conversion and triggers a false-positive out-of-bound report.
+	 *
+	 * Disable KASAN until the patching is complete.
+	 */
+	kasan_disable_current();
+
 	/*
 	 * The scan order should be from start to end. A later scanned
 	 * alternative code can overwrite previously scanned alternative code.
@@ -491,6 +502,8 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,
 next:
 		optimize_nops(instr, a->instrlen);
 	}
+
+	kasan_enable_current();
 }
 
 #if defined(CONFIG_RETPOLINE) && defined(CONFIG_STACK_VALIDATION)

From 835cb1f78d746dc668997f723c804441c36e8540 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:31 +0000
Subject: [PATCH 0062/1043] arm64: report EL1 UNDEFs better

commit b502c87d2a26c349acbc231ff2acd6f17147926b upstream.

If an UNDEFINED exception is taken from EL1, and do_undefinstr() doesn't
find any suitable undef_hook, it will call:

	BUG_ON(!user_mode(regs))

... and the kernel will report a failure witin do_undefinstr() rather
than reporting the original context that the UNDEFINED exception was
taken from. The pt_regs and ESR value reported within the BUG() handler
will be from within do_undefinstr() and the code dump will be for the
BRK in BUG_ON(), which isn't sufficient to debug the cause of the
original exception.

This patch makes the reporting better by having do_undefinstr() call
die() directly in this case to report the original context from which
the UNDEFINED exception was taken.

Prior to this patch, an undefined instruction is reported as:

| kernel BUG at arch/arm64/kernel/traps.c:497!
| Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 0 PID: 0 Comm: swapper Not tainted 5.19.0-rc3-00127-geff044f1b04e-dirty #3
| Hardware name: linux,dummy-virt (DT)
| pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : do_undefinstr+0x28c/0x2ac
| lr : do_undefinstr+0x298/0x2ac
| sp : ffff800009f63bc0
| x29: ffff800009f63bc0 x28: ffff800009f73c00 x27: ffff800009644a70
| x26: ffff8000096778a8 x25: 0000000000000040 x24: 0000000000000000
| x23: 00000000800000c5 x22: ffff800009894060 x21: ffff800009f63d90
| x20: 0000000000000000 x19: ffff800009f63c40 x18: 0000000000000006
| x17: 0000000000403000 x16: 00000000bfbfd000 x15: ffff800009f63830
| x14: ffffffffffffffff x13: 0000000000000000 x12: 0000000000000019
| x11: 0101010101010101 x10: 0000000000161b98 x9 : 0000000000000000
| x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
| x5 : ffff800009f761d0 x4 : 0000000000000000 x3 : ffff80000a2b80f8
| x2 : 0000000000000000 x1 : ffff800009f73c00 x0 : 00000000800000c5
| Call trace:
|  do_undefinstr+0x28c/0x2ac
|  el1_undef+0x2c/0x4c
|  el1h_64_sync_handler+0x84/0xd0
|  el1h_64_sync+0x64/0x68
|  setup_arch+0x550/0x598
|  start_kernel+0x88/0x6ac
|  __primary_switched+0xb8/0xc0
| Code: 17ffff95 a9425bf5 17ffffb8 a9025bf5 (d4210000)

With this patch applied, an undefined instruction is reported as:

| Internal error: Oops - Undefined instruction: 0 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 0 PID: 0 Comm: swapper Not tainted 5.19.0-rc3-00128-gf27cfcc80e52-dirty #5
| Hardware name: linux,dummy-virt (DT)
| pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : setup_arch+0x550/0x598
| lr : setup_arch+0x50c/0x598
| sp : ffff800009f63d90
| x29: ffff800009f63d90 x28: 0000000081000200 x27: ffff800009644a70
| x26: ffff8000096778c8 x25: 0000000000000040 x24: 0000000000000000
| x23: 0000000000000100 x22: ffff800009f69a58 x21: ffff80000a2b80b8
| x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000006
| x17: 0000000000403000 x16: 00000000bfbfd000 x15: ffff800009f63830
| x14: ffffffffffffffff x13: 0000000000000000 x12: 0000000000000019
| x11: 0101010101010101 x10: 0000000000161b98 x9 : 0000000000000000
| x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
| x5 : 0000000000000008 x4 : 0000000000000010 x3 : 0000000000000000
| x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
| Call trace:
|  setup_arch+0x550/0x598
|  start_kernel+0x88/0x6ac
|  __primary_switched+0xb8/0xc0
| Code: b4000080 90ffed80 912ac000 97db745f (00000000)

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Amit Daniel Kachhap <amit.kachhap@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Link: https://lore.kernel.org/r/20220913101732.3925290-2-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/traps.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 2cdd53425509..fcc490699c22 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -404,7 +404,9 @@ void do_undefinstr(struct pt_regs *regs)
 	if (call_undef_hook(regs) == 0)
 		return;
 
-	BUG_ON(!user_mode(regs));
+	if (!user_mode(regs))
+		die("Oops - Undefined instruction", regs, 0);
+
 	force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
 }
 NOKPROBE_SYMBOL(do_undefinstr);

From 004bdab6edc70aa5bd0e61573bacaee7857c5790 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:32 +0000
Subject: [PATCH 0063/1043] arm64: die(): pass 'err' as long

commit 18906ff9af6517c20763ed63dab602a4150794f7 upstream.

Recently, we reworked a lot of code to consistentlt pass ESR_ELx as a
64-bit quantity. However, we missed that this can be passed into die()
and __die() as the 'err' parameter where it is truncated to a 32-bit
int.

As notify_die() already takes 'err' as a long, this patch changes die()
and __die() to also take 'err' as a long, ensuring that the full value
of ESR_ELx is retained.

At the same time, die() is updated to consistently log 'err' as a
zero-padded 64-bit quantity.

Subsequent patches will pass the ESR_ELx value to die() for a number of
exceptions.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Amit Daniel Kachhap <amit.kachhap@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20220913101732.3925290-3-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/system_misc.h | 2 +-
 arch/arm64/kernel/traps.c            | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/include/asm/system_misc.h b/arch/arm64/include/asm/system_misc.h
index 1ab63cfbbaf1..624a608933f1 100644
--- a/arch/arm64/include/asm/system_misc.h
+++ b/arch/arm64/include/asm/system_misc.h
@@ -18,7 +18,7 @@
 
 struct pt_regs;
 
-void die(const char *msg, struct pt_regs *regs, int err);
+void die(const char *msg, struct pt_regs *regs, long err);
 
 struct siginfo;
 void arm64_notify_die(const char *str, struct pt_regs *regs,
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index fcc490699c22..3a88bb1202ad 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -90,12 +90,12 @@ static void dump_kernel_instr(const char *lvl, struct pt_regs *regs)
 
 #define S_SMP " SMP"
 
-static int __die(const char *str, int err, struct pt_regs *regs)
+static int __die(const char *str, long err, struct pt_regs *regs)
 {
 	static int die_counter;
 	int ret;
 
-	pr_emerg("Internal error: %s: %x [#%d]" S_PREEMPT S_SMP "\n",
+	pr_emerg("Internal error: %s: %016lx [#%d]" S_PREEMPT S_SMP "\n",
 		 str, err, ++die_counter);
 
 	/* trap and error numbers are mostly meaningless on ARM */
@@ -116,7 +116,7 @@ static DEFINE_RAW_SPINLOCK(die_lock);
 /*
  * This function is protected against re-entrancy.
  */
-void die(const char *str, struct pt_regs *regs, int err)
+void die(const char *str, struct pt_regs *regs, long err)
 {
 	int ret;
 	unsigned long flags;

From a8d7c8484ff762bbdfde26e838d3bc451817454d Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:33 +0000
Subject: [PATCH 0064/1043] arm64: consistently pass ESR_ELx to die()

commit 0f2cb928a1547ae8f89e80a4b8df2c6c02ae5f96 upstream.

Currently, bug_handler() and kasan_handler() call die() with '0' as the
'err' value, whereas die_kernel_fault() passes the ESR_ELx value.

For consistency, this patch ensures we always pass the ESR_ELx value to
die(). As this is only called for exceptions taken from kernel mode,
there should be no user-visible change as a result of this patch.

For UNDEFINED exceptions, I've had to modify do_undefinstr() and its
callers to pass the ESR_ELx value. In all cases the ESR_ELx value had
already been read and was available.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Amit Daniel Kachhap <amit.kachhap@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20220913101732.3925290-4-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/exception.h |  2 +-
 arch/arm64/kernel/entry-common.c   | 14 +++++++-------
 arch/arm64/kernel/traps.c          | 14 +++++++-------
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h
index 59c3facb8a56..18f7a095b91e 100644
--- a/arch/arm64/include/asm/exception.h
+++ b/arch/arm64/include/asm/exception.h
@@ -33,7 +33,7 @@ asmlinkage void exit_to_user_mode(void);
 void arm64_enter_nmi(struct pt_regs *regs);
 void arm64_exit_nmi(struct pt_regs *regs);
 void do_mem_abort(unsigned long addr, unsigned int esr, struct pt_regs *regs);
-void do_undefinstr(struct pt_regs *regs);
+void do_undefinstr(struct pt_regs *regs, unsigned long esr);
 void do_bti(struct pt_regs *regs);
 asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr);
 void do_debug_exception(unsigned long addr_if_watchpoint, unsigned int esr,
diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c
index ec120ed18faf..c1d6720ae397 100644
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -132,11 +132,11 @@ static void noinstr el1_pc(struct pt_regs *regs, unsigned long esr)
 	exit_to_kernel_mode(regs);
 }
 
-static void noinstr el1_undef(struct pt_regs *regs)
+static void noinstr el1_undef(struct pt_regs *regs, unsigned long esr)
 {
 	enter_from_kernel_mode(regs);
 	local_daif_inherit(regs);
-	do_undefinstr(regs);
+	do_undefinstr(regs, esr);
 	local_daif_mask();
 	exit_to_kernel_mode(regs);
 }
@@ -210,7 +210,7 @@ asmlinkage void noinstr el1_sync_handler(struct pt_regs *regs)
 		break;
 	case ESR_ELx_EC_SYS64:
 	case ESR_ELx_EC_UNKNOWN:
-		el1_undef(regs);
+		el1_undef(regs, esr);
 		break;
 	case ESR_ELx_EC_BREAKPT_CUR:
 	case ESR_ELx_EC_SOFTSTP_CUR:
@@ -316,11 +316,11 @@ static void noinstr el0_sp(struct pt_regs *regs, unsigned long esr)
 	do_sp_pc_abort(regs->sp, esr, regs);
 }
 
-static void noinstr el0_undef(struct pt_regs *regs)
+static void noinstr el0_undef(struct pt_regs *regs, unsigned long esr)
 {
 	enter_from_user_mode();
 	local_daif_restore(DAIF_PROCCTX);
-	do_undefinstr(regs);
+	do_undefinstr(regs, esr);
 }
 
 static void noinstr el0_bti(struct pt_regs *regs)
@@ -394,7 +394,7 @@ asmlinkage void noinstr el0_sync_handler(struct pt_regs *regs)
 		el0_pc(regs, esr);
 		break;
 	case ESR_ELx_EC_UNKNOWN:
-		el0_undef(regs);
+		el0_undef(regs, esr);
 		break;
 	case ESR_ELx_EC_BTI:
 		el0_bti(regs);
@@ -454,7 +454,7 @@ asmlinkage void noinstr el0_sync_compat_handler(struct pt_regs *regs)
 	case ESR_ELx_EC_CP14_MR:
 	case ESR_ELx_EC_CP14_LS:
 	case ESR_ELx_EC_CP14_64:
-		el0_undef(regs);
+		el0_undef(regs, esr);
 		break;
 	case ESR_ELx_EC_CP15_32:
 	case ESR_ELx_EC_CP15_64:
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 3a88bb1202ad..2060ba0ee6b4 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -395,7 +395,7 @@ void arm64_notify_segfault(unsigned long addr)
 	force_signal_inject(SIGSEGV, code, addr, 0);
 }
 
-void do_undefinstr(struct pt_regs *regs)
+void do_undefinstr(struct pt_regs *regs, unsigned long esr)
 {
 	/* check for AArch32 breakpoint instructions */
 	if (!aarch32_break_handler(regs))
@@ -405,7 +405,7 @@ void do_undefinstr(struct pt_regs *regs)
 		return;
 
 	if (!user_mode(regs))
-		die("Oops - Undefined instruction", regs, 0);
+		die("Oops - Undefined instruction", regs, esr);
 
 	force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
 }
@@ -663,7 +663,7 @@ void do_cp15instr(unsigned int esr, struct pt_regs *regs)
 		hook_base = cp15_64_hooks;
 		break;
 	default:
-		do_undefinstr(regs);
+		do_undefinstr(regs, esr);
 		return;
 	}
 
@@ -678,7 +678,7 @@ void do_cp15instr(unsigned int esr, struct pt_regs *regs)
 	 * EL0. Fall back to our usual undefined instruction handler
 	 * so that we handle these consistently.
 	 */
-	do_undefinstr(regs);
+	do_undefinstr(regs, esr);
 }
 NOKPROBE_SYMBOL(do_cp15instr);
 #endif
@@ -698,7 +698,7 @@ void do_sysinstr(unsigned int esr, struct pt_regs *regs)
 	 * back to our usual undefined instruction handler so that we handle
 	 * these consistently.
 	 */
-	do_undefinstr(regs);
+	do_undefinstr(regs, esr);
 }
 NOKPROBE_SYMBOL(do_sysinstr);
 
@@ -901,7 +901,7 @@ static int bug_handler(struct pt_regs *regs, unsigned int esr)
 {
 	switch (report_bug(regs->pc, regs)) {
 	case BUG_TRAP_TYPE_BUG:
-		die("Oops - BUG", regs, 0);
+		die("Oops - BUG", regs, esr);
 		break;
 
 	case BUG_TRAP_TYPE_WARN:
@@ -969,7 +969,7 @@ static int kasan_handler(struct pt_regs *regs, unsigned int esr)
 	 * This is something that might be fixed at some point in the future.
 	 */
 	if (!recover)
-		die("Oops - KASAN", regs, 0);
+		die("Oops - KASAN", regs, esr);
 
 	/* If thread survives, skip over the brk instruction and continue: */
 	arm64_skip_faulting_instruction(regs, AARCH64_INSN_SIZE);

From 9113333d7c7cf87219c9b919ed2bc10f7042c5be Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:34 +0000
Subject: [PATCH 0065/1043] arm64: rework FPAC exception handling

commit a1fafa3b24a70461bbf3e5c0770893feb0a49292 upstream.

If an FPAC exception is taken from EL1, the entry code will call
do_ptrauth_fault(), where due to:

	BUG_ON(!user_mode(regs))

... the kernel will report a problem within do_ptrauth_fault() rather
than reporting the original context the FPAC exception was taken from.
The pt_regs and ESR value reported will be from within
do_ptrauth_fault() and the code dump will be for the BRK in BUG_ON(),
which isn't sufficient to debug the cause of the original exception.

This patch makes the reporting better by having separate EL0 and EL1
FPAC exception handlers, with the latter calling die() directly to
report the original context the FPAC exception was taken from.

Note that we only need to prevent kprobes of the EL1 FPAC handler, since
the EL0 FPAC handler cannot be called recursively.

For consistency with do_el0_svc*(), I've named the split functions
do_el{0,1}_fpac() rather than do_el{0,1}_ptrauth_fault(). I've also
clarified the comment to not imply there are casues other than FPAC
exceptions.

Prior to this patch FPAC exceptions are reported as:

| kernel BUG at arch/arm64/kernel/traps.c:517!
| Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc3-00130-g9c8a180a1cdf-dirty #12
| Hardware name: FVP Base RevC (DT)
| pstate: 00400009 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : do_ptrauth_fault+0x3c/0x40
| lr : el1_fpac+0x34/0x54
| sp : ffff80000a3bbc80
| x29: ffff80000a3bbc80 x28: ffff0008001d8000 x27: 0000000000000000
| x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
| x23: 0000000020400009 x22: ffff800008f70fa4 x21: ffff80000a3bbe00
| x20: 0000000072000000 x19: ffff80000a3bbcb0 x18: fffffbfffda37000
| x17: 3120676e696d7573 x16: 7361202c6e6f6974 x15: 0000000081a90000
| x14: 0040000000000041 x13: 0040000000000001 x12: ffff000001a90000
| x11: fffffbfffda37480 x10: 0068000000000703 x9 : 0001000080000000
| x8 : 0000000000090000 x7 : 0068000000000f03 x6 : 0060000000000783
| x5 : ffff80000a3bbcb0 x4 : ffff0008001d8000 x3 : 0000000072000000
| x2 : 0000000000000000 x1 : 0000000020400009 x0 : ffff80000a3bbcb0
| Call trace:
|  do_ptrauth_fault+0x3c/0x40
|  el1h_64_sync_handler+0xc4/0xd0
|  el1h_64_sync+0x64/0x68
|  test_pac+0x8/0x10
|  smp_init+0x7c/0x8c
|  kernel_init_freeable+0x128/0x28c
|  kernel_init+0x28/0x13c
|  ret_from_fork+0x10/0x20
| Code: 97fffe5e a8c17bfd d50323bf d65f03c0 (d4210000)

With this patch applied FPAC exceptions are reported as:

| Internal error: Oops - FPAC: 0000000072000000 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc3-00132-g78846e1c4757-dirty #11
| Hardware name: FVP Base RevC (DT)
| pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : test_pac+0x8/0x10
| lr : 0x0
| sp : ffff80000a3bbe00
| x29: ffff80000a3bbe00 x28: 0000000000000000 x27: 0000000000000000
| x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
| x23: ffff80000a2c8000 x22: 0000000000000000 x21: 0000000000000000
| x20: ffff8000099fa5b0 x19: ffff80000a007000 x18: fffffbfffda37000
| x17: 3120676e696d7573 x16: 7361202c6e6f6974 x15: 0000000081a90000
| x14: 0040000000000041 x13: 0040000000000001 x12: ffff000001a90000
| x11: fffffbfffda37480 x10: 0068000000000703 x9 : 0001000080000000
| x8 : 0000000000090000 x7 : 0068000000000f03 x6 : 0060000000000783
| x5 : ffff80000a2c6000 x4 : ffff0008001d8000 x3 : ffff800009f88378
| x2 : 0000000000000000 x1 : 0000000080210000 x0 : ffff000001a90000
| Call trace:
|  test_pac+0x8/0x10
|  smp_init+0x7c/0x8c
|  kernel_init_freeable+0x128/0x28c
|  kernel_init+0x28/0x13c
|  ret_from_fork+0x10/0x20
| Code: d50323bf d65f03c0 d503233f aa1f03fe (d50323bf)

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Amit Daniel Kachhap <amit.kachhap@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20220913101732.3925290-5-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/exception.h |  3 ++-
 arch/arm64/kernel/entry-common.c   |  4 ++--
 arch/arm64/kernel/traps.c          | 18 +++++++++++-------
 3 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h
index 18f7a095b91e..6c869d1f51cc 100644
--- a/arch/arm64/include/asm/exception.h
+++ b/arch/arm64/include/asm/exception.h
@@ -47,5 +47,6 @@ void bad_el0_sync(struct pt_regs *regs, int reason, unsigned int esr);
 void do_cp15instr(unsigned int esr, struct pt_regs *regs);
 void do_el0_svc(struct pt_regs *regs);
 void do_el0_svc_compat(struct pt_regs *regs);
-void do_ptrauth_fault(struct pt_regs *regs, unsigned int esr);
+void do_el0_fpac(struct pt_regs *regs, unsigned long esr);
+void do_el1_fpac(struct pt_regs *regs, unsigned long esr);
 #endif	/* __ASM_EXCEPTION_H */
diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c
index c1d6720ae397..b17f848a09c5 100644
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -187,7 +187,7 @@ static void noinstr el1_fpac(struct pt_regs *regs, unsigned long esr)
 {
 	enter_from_kernel_mode(regs);
 	local_daif_inherit(regs);
-	do_ptrauth_fault(regs, esr);
+	do_el1_fpac(regs, esr);
 	local_daif_mask();
 	exit_to_kernel_mode(regs);
 }
@@ -357,7 +357,7 @@ static void noinstr el0_fpac(struct pt_regs *regs, unsigned long esr)
 {
 	enter_from_user_mode();
 	local_daif_restore(DAIF_PROCCTX);
-	do_ptrauth_fault(regs, esr);
+	do_el0_fpac(regs, esr);
 }
 
 asmlinkage void noinstr el0_sync_handler(struct pt_regs *regs)
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 2060ba0ee6b4..5d29ba0d85c1 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -418,16 +418,20 @@ void do_bti(struct pt_regs *regs)
 }
 NOKPROBE_SYMBOL(do_bti);
 
-void do_ptrauth_fault(struct pt_regs *regs, unsigned int esr)
+void do_el0_fpac(struct pt_regs *regs, unsigned long esr)
 {
-	/*
-	 * Unexpected FPAC exception or pointer authentication failure in
-	 * the kernel: kill the task before it does any more harm.
-	 */
-	BUG_ON(!user_mode(regs));
 	force_signal_inject(SIGILL, ILL_ILLOPN, regs->pc, esr);
 }
-NOKPROBE_SYMBOL(do_ptrauth_fault);
+
+void do_el1_fpac(struct pt_regs *regs, unsigned long esr)
+{
+	/*
+	 * Unexpected FPAC exception in the kernel: kill the task before it
+	 * does any more harm.
+	 */
+	die("Oops - FPAC", regs, esr);
+}
+NOKPROBE_SYMBOL(do_el1_fpac);
 
 #define __user_cache_maint(insn, address, res)			\
 	if (address >= user_addr_max()) {			\

From 793ed958b62ad4831e03de51b3d23ad6eb23eea7 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:35 +0000
Subject: [PATCH 0066/1043] arm64: rework BTI exception handling

commit 830a2a4d853f2c4a1e4606aa03341b7f273b0e9b upstream.

If a BTI exception is taken from EL1, the entry code will treat this as
an unhandled exception and will panic() the kernel. This is inconsistent
with the way we handle FPAC exceptions, which have a dedicated handler
and only necessarily kill the thread from which the exception was taken
from, and we don't log all the information that could be relevant to
debug the issue.

The code in do_bti() has:

	BUG_ON(!user_mode(regs));

... and it seems like the intent was to call this for EL1 BTI
exceptions, as with FPAC, but this was omitted due to an oversight.

This patch adds separate EL0 and EL1 BTI exception handlers, with the
latter calling die() directly to report the original context the BTI
exception was taken from. This matches our handling of FPAC exceptions.

Prior to this patch, a BTI failure is reported as:

| Unhandled 64-bit el1h sync exception on CPU0, ESR 0x0000000034000002 -- BTI
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc3-00131-g7d937ff0221d-dirty #9
| Hardware name: linux,dummy-virt (DT)
| pstate: 20400809 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=-c)
| pc : test_bti_callee+0x4/0x10
| lr : test_bti_caller+0x1c/0x28
| sp : ffff80000800bdf0
| x29: ffff80000800bdf0 x28: 0000000000000000 x27: 0000000000000000
| x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
| x23: ffff80000a2b8000 x22: 0000000000000000 x21: 0000000000000000
| x20: ffff8000099fa5b0 x19: ffff800009ff7000 x18: fffffbfffda37000
| x17: 3120676e696d7573 x16: 7361202c6e6f6974 x15: 0000000041a90000
| x14: 0040000000000041 x13: 0040000000000001 x12: ffff000001a90000
| x11: fffffbfffda37480 x10: 0068000000000703 x9 : 0001000040000000
| x8 : 0000000000090000 x7 : 0068000000000f03 x6 : 0060000000000f83
| x5 : ffff80000a2b6000 x4 : ffff0000028d0000 x3 : ffff800009f78378
| x2 : 0000000000000000 x1 : 0000000040210000 x0 : ffff8000080257e4
| Kernel panic - not syncing: Unhandled exception
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc3-00131-g7d937ff0221d-dirty #9
| Hardware name: linux,dummy-virt (DT)
| Call trace:
|  dump_backtrace.part.0+0xcc/0xe0
|  show_stack+0x18/0x5c
|  dump_stack_lvl+0x64/0x80
|  dump_stack+0x18/0x34
|  panic+0x170/0x360
|  arm64_exit_nmi.isra.0+0x0/0x80
|  el1h_64_sync_handler+0x64/0xd0
|  el1h_64_sync+0x64/0x68
|  test_bti_callee+0x4/0x10
|  smp_cpus_done+0xb0/0xbc
|  smp_init+0x7c/0x8c
|  kernel_init_freeable+0x128/0x28c
|  kernel_init+0x28/0x13c
|  ret_from_fork+0x10/0x20

With this patch applied, a BTI failure is reported as:

| Internal error: Oops - BTI: 0000000034000002 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc3-00132-g0ad98265d582-dirty #8
| Hardware name: linux,dummy-virt (DT)
| pstate: 20400809 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=-c)
| pc : test_bti_callee+0x4/0x10
| lr : test_bti_caller+0x1c/0x28
| sp : ffff80000800bdf0
| x29: ffff80000800bdf0 x28: 0000000000000000 x27: 0000000000000000
| x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
| x23: ffff80000a2b8000 x22: 0000000000000000 x21: 0000000000000000
| x20: ffff8000099fa5b0 x19: ffff800009ff7000 x18: fffffbfffda37000
| x17: 3120676e696d7573 x16: 7361202c6e6f6974 x15: 0000000041a90000
| x14: 0040000000000041 x13: 0040000000000001 x12: ffff000001a90000
| x11: fffffbfffda37480 x10: 0068000000000703 x9 : 0001000040000000
| x8 : 0000000000090000 x7 : 0068000000000f03 x6 : 0060000000000f83
| x5 : ffff80000a2b6000 x4 : ffff0000028d0000 x3 : ffff800009f78378
| x2 : 0000000000000000 x1 : 0000000040210000 x0 : ffff800008025804
| Call trace:
|  test_bti_callee+0x4/0x10
|  smp_cpus_done+0xb0/0xbc
|  smp_init+0x7c/0x8c
|  kernel_init_freeable+0x128/0x28c
|  kernel_init+0x28/0x13c
|  ret_from_fork+0x10/0x20
| Code: d50323bf d53cd040 d65f03c0 d503233f (d50323bf)

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Amit Daniel Kachhap <amit.kachhap@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20220913101732.3925290-6-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/exception.h |  3 ++-
 arch/arm64/kernel/entry-common.c   | 14 +++++++++++++-
 arch/arm64/kernel/traps.c          | 10 +++++++---
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h
index 6c869d1f51cc..3ed01b913f81 100644
--- a/arch/arm64/include/asm/exception.h
+++ b/arch/arm64/include/asm/exception.h
@@ -34,7 +34,8 @@ void arm64_enter_nmi(struct pt_regs *regs);
 void arm64_exit_nmi(struct pt_regs *regs);
 void do_mem_abort(unsigned long addr, unsigned int esr, struct pt_regs *regs);
 void do_undefinstr(struct pt_regs *regs, unsigned long esr);
-void do_bti(struct pt_regs *regs);
+void do_el0_bti(struct pt_regs *regs);
+void do_el1_bti(struct pt_regs *regs, unsigned long esr);
 asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr);
 void do_debug_exception(unsigned long addr_if_watchpoint, unsigned int esr,
 			struct pt_regs *regs);
diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c
index b17f848a09c5..53e596aae4e8 100644
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -141,6 +141,15 @@ static void noinstr el1_undef(struct pt_regs *regs, unsigned long esr)
 	exit_to_kernel_mode(regs);
 }
 
+static void noinstr el1_bti(struct pt_regs *regs, unsigned long esr)
+{
+	enter_from_kernel_mode(regs);
+	local_daif_inherit(regs);
+	do_el1_bti(regs, esr);
+	local_daif_mask();
+	exit_to_kernel_mode(regs);
+}
+
 static void noinstr el1_inv(struct pt_regs *regs, unsigned long esr)
 {
 	enter_from_kernel_mode(regs);
@@ -212,6 +221,9 @@ asmlinkage void noinstr el1_sync_handler(struct pt_regs *regs)
 	case ESR_ELx_EC_UNKNOWN:
 		el1_undef(regs, esr);
 		break;
+	case ESR_ELx_EC_BTI:
+		el1_bti(regs, esr);
+		break;
 	case ESR_ELx_EC_BREAKPT_CUR:
 	case ESR_ELx_EC_SOFTSTP_CUR:
 	case ESR_ELx_EC_WATCHPT_CUR:
@@ -327,7 +339,7 @@ static void noinstr el0_bti(struct pt_regs *regs)
 {
 	enter_from_user_mode();
 	local_daif_restore(DAIF_PROCCTX);
-	do_bti(regs);
+	do_el0_bti(regs);
 }
 
 static void noinstr el0_inv(struct pt_regs *regs, unsigned long esr)
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 5d29ba0d85c1..da13cfeee706 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -411,12 +411,16 @@ void do_undefinstr(struct pt_regs *regs, unsigned long esr)
 }
 NOKPROBE_SYMBOL(do_undefinstr);
 
-void do_bti(struct pt_regs *regs)
+void do_el0_bti(struct pt_regs *regs)
 {
-	BUG_ON(!user_mode(regs));
 	force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
 }
-NOKPROBE_SYMBOL(do_bti);
+
+void do_el1_bti(struct pt_regs *regs, unsigned long esr)
+{
+	die("Oops - BTI", regs, esr);
+}
+NOKPROBE_SYMBOL(do_el1_bti);
 
 void do_el0_fpac(struct pt_regs *regs, unsigned long esr)
 {

From 8a8d4cc303ef53b456af2660e0f5753cb3622d31 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:36 +0000
Subject: [PATCH 0067/1043] arm64: allow kprobes on EL0 handlers

commit b3a0c010e900a9f89dcd99f10bd8f7538d21b0a9 upstream.

Currently do_sysinstr() and do_cp15instr() are marked with
NOKPROBE_SYMBOL(). However, these are only called for exceptions taken
from EL0, and there is no risk of recursion in kprobes, so this is not
necessary.

Remove the NOKPROBE_SYMBOL() annotation, and rename the two functions to
more clearly indicate that these are solely for exceptions taken from
EL0, better matching the names used by the lower level entry points in
entry-common.c.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-2-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/exception.h | 4 ++--
 arch/arm64/kernel/entry-common.c   | 4 ++--
 arch/arm64/kernel/traps.c          | 6 ++----
 3 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h
index 3ed01b913f81..a31584c63a6c 100644
--- a/arch/arm64/include/asm/exception.h
+++ b/arch/arm64/include/asm/exception.h
@@ -42,10 +42,10 @@ void do_debug_exception(unsigned long addr_if_watchpoint, unsigned int esr,
 void do_fpsimd_acc(unsigned int esr, struct pt_regs *regs);
 void do_sve_acc(unsigned int esr, struct pt_regs *regs);
 void do_fpsimd_exc(unsigned int esr, struct pt_regs *regs);
-void do_sysinstr(unsigned int esr, struct pt_regs *regs);
+void do_el0_sys(unsigned long esr, struct pt_regs *regs);
 void do_sp_pc_abort(unsigned long addr, unsigned int esr, struct pt_regs *regs);
 void bad_el0_sync(struct pt_regs *regs, int reason, unsigned int esr);
-void do_cp15instr(unsigned int esr, struct pt_regs *regs);
+void do_el0_cp15(unsigned long esr, struct pt_regs *regs);
 void do_el0_svc(struct pt_regs *regs);
 void do_el0_svc_compat(struct pt_regs *regs);
 void do_el0_fpac(struct pt_regs *regs, unsigned long esr);
diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c
index 53e596aae4e8..397c55468ed8 100644
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -306,7 +306,7 @@ static void noinstr el0_sys(struct pt_regs *regs, unsigned long esr)
 {
 	enter_from_user_mode();
 	local_daif_restore(DAIF_PROCCTX);
-	do_sysinstr(esr, regs);
+	do_el0_sys(esr, regs);
 }
 
 static void noinstr el0_pc(struct pt_regs *regs, unsigned long esr)
@@ -430,7 +430,7 @@ static void noinstr el0_cp15(struct pt_regs *regs, unsigned long esr)
 {
 	enter_from_user_mode();
 	local_daif_restore(DAIF_PROCCTX);
-	do_cp15instr(esr, regs);
+	do_el0_cp15(esr, regs);
 }
 
 static void noinstr el0_svc_compat(struct pt_regs *regs)
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index da13cfeee706..cc57ffe0503a 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -650,7 +650,7 @@ static const struct sys64_hook cp15_64_hooks[] = {
 	{},
 };
 
-void do_cp15instr(unsigned int esr, struct pt_regs *regs)
+void do_el0_cp15(unsigned long esr, struct pt_regs *regs)
 {
 	const struct sys64_hook *hook, *hook_base;
 
@@ -688,10 +688,9 @@ void do_cp15instr(unsigned int esr, struct pt_regs *regs)
 	 */
 	do_undefinstr(regs, esr);
 }
-NOKPROBE_SYMBOL(do_cp15instr);
 #endif
 
-void do_sysinstr(unsigned int esr, struct pt_regs *regs)
+void do_el0_sys(unsigned long esr, struct pt_regs *regs)
 {
 	const struct sys64_hook *hook;
 
@@ -708,7 +707,6 @@ void do_sysinstr(unsigned int esr, struct pt_regs *regs)
 	 */
 	do_undefinstr(regs, esr);
 }
-NOKPROBE_SYMBOL(do_sysinstr);
 
 static const char *esr_class_str[] = {
 	[0 ... ESR_ELx_EC_MAX]		= "UNRECOGNIZED EC",

From 7a76df1ae1b3a6d1cc806066d48c6b95dc4335fa Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:37 +0000
Subject: [PATCH 0068/1043] arm64: split EL0/EL1 UNDEF handlers

commit 61d64a376ea80f9097e7ea599bcd68671b836dc6 upstream.

In general, exceptions taken from EL1 need to be handled separately from
exceptions taken from EL0, as the logic to handle the two cases can be
significantly divergent, and exceptions taken from EL1 typically have
more stringent requirements on locking and instrumentation.

Subsequent patches will rework the way EL1 UNDEFs are handled in order
to address longstanding soundness issues with instrumentation and RCU.
In preparation for that rework, this patch splits the existing
do_undefinstr() handler into separate do_el0_undef() and do_el1_undef()
handlers.

Prior to this patch, do_undefinstr() was marked with NOKPROBE_SYMBOL(),
preventing instrumentation via kprobes. However, do_undefinstr() invokes
other code which can be instrumented, and:

* For UNDEFINED exceptions taken from EL0, there is no risk of recursion
  within kprobes. Therefore it is safe for do_el0_undef to be
  instrumented with kprobes, and it does not need to be marked with
  NOKPROBE_SYMBOL().

* For UNDEFINED exceptions taken from EL1, either:

  (a) The exception is has been taken when manipulating SSBS; these cases
      are limited and do not occur within code that can be invoked
      recursively via kprobes. Hence, in these cases instrumentation
      with kprobes is benign.

  (b) The exception has been taken for an unknown reason, as other than
      manipulating SSBS we do not expect to take UNDEFINED exceptions
      from EL1. Any handling of these exception is best-effort.

  ... and in either case, marking do_el1_undef() with NOKPROBE_SYMBOL()
  isn't sufficient to prevent recursion via kprobes as functions it
  calls (including die()) are instrumentable via kprobes.

  Hence, it's not worthwhile to mark do_el1_undef() with
  NOKPROBE_SYMBOL(). The same applies to do_el1_bti() and do_el1_fpac(),
  so their NOKPROBE_SYMBOL() annotations are also removed.

Aside from the new instrumentability, there should be no functional
change as a result of this patch.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-3-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/exception.h |  3 ++-
 arch/arm64/kernel/entry-common.c   |  4 ++--
 arch/arm64/kernel/traps.c          | 22 ++++++++++++----------
 3 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h
index a31584c63a6c..cc5b2203d876 100644
--- a/arch/arm64/include/asm/exception.h
+++ b/arch/arm64/include/asm/exception.h
@@ -33,7 +33,8 @@ asmlinkage void exit_to_user_mode(void);
 void arm64_enter_nmi(struct pt_regs *regs);
 void arm64_exit_nmi(struct pt_regs *regs);
 void do_mem_abort(unsigned long addr, unsigned int esr, struct pt_regs *regs);
-void do_undefinstr(struct pt_regs *regs, unsigned long esr);
+void do_el0_undef(struct pt_regs *regs, unsigned long esr);
+void do_el1_undef(struct pt_regs *regs, unsigned long esr);
 void do_el0_bti(struct pt_regs *regs);
 void do_el1_bti(struct pt_regs *regs, unsigned long esr);
 asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr);
diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c
index 397c55468ed8..7a8cd856ee85 100644
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -136,7 +136,7 @@ static void noinstr el1_undef(struct pt_regs *regs, unsigned long esr)
 {
 	enter_from_kernel_mode(regs);
 	local_daif_inherit(regs);
-	do_undefinstr(regs, esr);
+	do_el1_undef(regs, esr);
 	local_daif_mask();
 	exit_to_kernel_mode(regs);
 }
@@ -332,7 +332,7 @@ static void noinstr el0_undef(struct pt_regs *regs, unsigned long esr)
 {
 	enter_from_user_mode();
 	local_daif_restore(DAIF_PROCCTX);
-	do_undefinstr(regs, esr);
+	do_el0_undef(regs, esr);
 }
 
 static void noinstr el0_bti(struct pt_regs *regs)
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index cc57ffe0503a..a2dfce6493d2 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -395,7 +395,7 @@ void arm64_notify_segfault(unsigned long addr)
 	force_signal_inject(SIGSEGV, code, addr, 0);
 }
 
-void do_undefinstr(struct pt_regs *regs, unsigned long esr)
+void do_el0_undef(struct pt_regs *regs, unsigned long esr)
 {
 	/* check for AArch32 breakpoint instructions */
 	if (!aarch32_break_handler(regs))
@@ -404,12 +404,16 @@ void do_undefinstr(struct pt_regs *regs, unsigned long esr)
 	if (call_undef_hook(regs) == 0)
 		return;
 
-	if (!user_mode(regs))
-		die("Oops - Undefined instruction", regs, esr);
-
 	force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
 }
-NOKPROBE_SYMBOL(do_undefinstr);
+
+void do_el1_undef(struct pt_regs *regs, unsigned long esr)
+{
+	if (call_undef_hook(regs) == 0)
+		return;
+
+	die("Oops - Undefined instruction", regs, esr);
+}
 
 void do_el0_bti(struct pt_regs *regs)
 {
@@ -420,7 +424,6 @@ void do_el1_bti(struct pt_regs *regs, unsigned long esr)
 {
 	die("Oops - BTI", regs, esr);
 }
-NOKPROBE_SYMBOL(do_el1_bti);
 
 void do_el0_fpac(struct pt_regs *regs, unsigned long esr)
 {
@@ -435,7 +438,6 @@ void do_el1_fpac(struct pt_regs *regs, unsigned long esr)
 	 */
 	die("Oops - FPAC", regs, esr);
 }
-NOKPROBE_SYMBOL(do_el1_fpac);
 
 #define __user_cache_maint(insn, address, res)			\
 	if (address >= user_addr_max()) {			\
@@ -671,7 +673,7 @@ void do_el0_cp15(unsigned long esr, struct pt_regs *regs)
 		hook_base = cp15_64_hooks;
 		break;
 	default:
-		do_undefinstr(regs, esr);
+		do_el0_undef(regs, esr);
 		return;
 	}
 
@@ -686,7 +688,7 @@ void do_el0_cp15(unsigned long esr, struct pt_regs *regs)
 	 * EL0. Fall back to our usual undefined instruction handler
 	 * so that we handle these consistently.
 	 */
-	do_undefinstr(regs, esr);
+	do_el0_undef(regs, esr);
 }
 #endif
 
@@ -705,7 +707,7 @@ void do_el0_sys(unsigned long esr, struct pt_regs *regs)
 	 * back to our usual undefined instruction handler so that we handle
 	 * these consistently.
 	 */
-	do_undefinstr(regs, esr);
+	do_el0_undef(regs, esr);
 }
 
 static const char *esr_class_str[] = {

From 0edde7fd1c3b5d0f52eb024ea8ef92e191d3dbe9 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:38 +0000
Subject: [PATCH 0069/1043] arm64: factor out EL1 SSBS emulation hook

commit bff8f413c71ffc3cb679dbd9a5632b33af563f9f upstream.

Currently call_undef_hook() is used to handle UNDEFINED exceptions from
EL0 and EL1. As support for deprecated instructions may be enabled
independently, the handlers for individual instructions are organised as
a linked list of struct undef_hook which can be manipulated dynamically.
As this can be manipulated dynamically, the list is protected with a
raw_spinlock which must be acquired when handling UNDEFINED exceptions
or when manipulating the list of handlers.

This locking is unfortunate as it serialises handling of UNDEFINED
exceptions, and requires RCU to be enabled for lockdep, requiring the
use of RCU_NONIDLE() in resume path of cpu_suspend() since commit:

  a2c42bbabbe260b7 ("arm64: spectre: Prevent lockdep splat on v4 mitigation enable path")

The list of UNDEFINED handlers largely consist of handlers for
exceptions taken from EL0, and the only handler for exceptions taken
from EL1 handles `MSR SSBS, #imm` on CPUs which feature PSTATE.SSBS but
lack the corresponding MSR (Immediate) instruction. Other than this we
never expect to take an UNDEFINED exception from EL1 in normal
operation.

This patch reworks do_el0_undef() to invoke the EL1 SSBS handler
directly, relegating call_undef_hook() to only handle EL0 UNDEFs. This
removes redundant work to iterate the list for EL1 UNDEFs, and removes
the need for locking, permitting EL1 UNDEFs to be handled in parallel
without contention.

The RCU_NONIDLE() call in cpu_suspend() will be removed in a subsequent
patch, as there are other potential issues with the use of
instrumentable code and RCU in the CPU suspend code.

I've tested this by forcing the detection of SSBS on a CPU that doesn't
have it, and verifying that the try_emulate_el1_ssbs() callback is
invoked.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-4-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/spectre.h |  2 ++
 arch/arm64/kernel/proton-pack.c  | 26 +++++++-------------------
 arch/arm64/kernel/traps.c        | 15 ++++++++-------
 3 files changed, 17 insertions(+), 26 deletions(-)

diff --git a/arch/arm64/include/asm/spectre.h b/arch/arm64/include/asm/spectre.h
index 4b3a5f050f71..e48afcb69392 100644
--- a/arch/arm64/include/asm/spectre.h
+++ b/arch/arm64/include/asm/spectre.h
@@ -18,6 +18,7 @@ enum mitigation_state {
 	SPECTRE_VULNERABLE,
 };
 
+struct pt_regs;
 struct task_struct;
 
 enum mitigation_state arm64_get_spectre_v2_state(void);
@@ -33,4 +34,5 @@ enum mitigation_state arm64_get_spectre_bhb_state(void);
 bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, int scope);
 u8 spectre_bhb_loop_affected(int scope);
 void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *__unused);
+bool try_emulate_el1_ssbs(struct pt_regs *regs, u32 instr);
 #endif	/* __ASM_SPECTRE_H */
diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c
index faa8a6bf2376..9c0e9d9eed6e 100644
--- a/arch/arm64/kernel/proton-pack.c
+++ b/arch/arm64/kernel/proton-pack.c
@@ -537,10 +537,13 @@ bool has_spectre_v4(const struct arm64_cpu_capabilities *cap, int scope)
 	return state != SPECTRE_UNAFFECTED;
 }
 
-static int ssbs_emulation_handler(struct pt_regs *regs, u32 instr)
+bool try_emulate_el1_ssbs(struct pt_regs *regs, u32 instr)
 {
-	if (user_mode(regs))
-		return 1;
+	const u32 instr_mask = ~(1U << PSTATE_Imm_shift);
+	const u32 instr_val = 0xd500401f | PSTATE_SSBS;
+
+	if ((instr & instr_mask) != instr_val)
+		return false;
 
 	if (instr & BIT(PSTATE_Imm_shift))
 		regs->pstate |= PSR_SSBS_BIT;
@@ -548,19 +551,11 @@ static int ssbs_emulation_handler(struct pt_regs *regs, u32 instr)
 		regs->pstate &= ~PSR_SSBS_BIT;
 
 	arm64_skip_faulting_instruction(regs, 4);
-	return 0;
+	return true;
 }
 
-static struct undef_hook ssbs_emulation_hook = {
-	.instr_mask	= ~(1U << PSTATE_Imm_shift),
-	.instr_val	= 0xd500401f | PSTATE_SSBS,
-	.fn		= ssbs_emulation_handler,
-};
-
 static enum mitigation_state spectre_v4_enable_hw_mitigation(void)
 {
-	static bool undef_hook_registered = false;
-	static DEFINE_RAW_SPINLOCK(hook_lock);
 	enum mitigation_state state;
 
 	/*
@@ -571,13 +566,6 @@ static enum mitigation_state spectre_v4_enable_hw_mitigation(void)
 	if (state != SPECTRE_MITIGATED || !this_cpu_has_cap(ARM64_SSBS))
 		return state;
 
-	raw_spin_lock(&hook_lock);
-	if (!undef_hook_registered) {
-		register_undef_hook(&ssbs_emulation_hook);
-		undef_hook_registered = true;
-	}
-	raw_spin_unlock(&hook_lock);
-
 	if (spectre_v4_mitigations_off()) {
 		sysreg_clear_set(sctlr_el1, 0, SCTLR_ELx_DSSBS);
 		asm volatile(SET_PSTATE_SSBS(1));
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index a2dfce6493d2..15d490ef7462 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -311,12 +311,7 @@ static int call_undef_hook(struct pt_regs *regs)
 	int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
 	void __user *pc = (void __user *)instruction_pointer(regs);
 
-	if (!user_mode(regs)) {
-		__le32 instr_le;
-		if (get_kernel_nofault(instr_le, (__force __le32 *)pc))
-			goto exit;
-		instr = le32_to_cpu(instr_le);
-	} else if (compat_thumb_mode(regs)) {
+	if (compat_thumb_mode(regs)) {
 		/* 16-bit Thumb instruction */
 		__le16 instr_le;
 		if (get_user(instr_le, (__le16 __user *)pc))
@@ -409,9 +404,15 @@ void do_el0_undef(struct pt_regs *regs, unsigned long esr)
 
 void do_el1_undef(struct pt_regs *regs, unsigned long esr)
 {
-	if (call_undef_hook(regs) == 0)
+	u32 insn;
+
+	if (aarch64_insn_read((void *)regs->pc, &insn))
+		goto out_err;
+
+	if (try_emulate_el1_ssbs(regs, insn))
 		return;
 
+out_err:
 	die("Oops - Undefined instruction", regs, esr);
 }
 

From 15e964971ff701c661936aa6103d51a895f32e24 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:39 +0000
Subject: [PATCH 0070/1043] arm64: factor insn read out of call_undef_hook()

commit dbfbd87efa79575491af0ba1a87bf567eaea6cae upstream.

Subsequent patches will rework EL0 UNDEF handling, removing the need for
struct undef_hook and call_undef_hook. In preparation for those changes,
this patch factors the logic for reading user instructions out of
call_undef_hook() and into a new user_insn_read() helper, matching the
style of the existing aarch64_insn_read() helper used for reading kernel
instructions.

There should be no functional change as a result of this patch.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-5-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/traps.c | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 15d490ef7462..be9c7bb89e98 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -303,25 +303,22 @@ void unregister_undef_hook(struct undef_hook *hook)
 	raw_spin_unlock_irqrestore(&undef_lock, flags);
 }
 
-static int call_undef_hook(struct pt_regs *regs)
+static int user_insn_read(struct pt_regs *regs, u32 *insnp)
 {
-	struct undef_hook *hook;
-	unsigned long flags;
 	u32 instr;
-	int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
 	void __user *pc = (void __user *)instruction_pointer(regs);
 
 	if (compat_thumb_mode(regs)) {
 		/* 16-bit Thumb instruction */
 		__le16 instr_le;
 		if (get_user(instr_le, (__le16 __user *)pc))
-			goto exit;
+			return -EFAULT;
 		instr = le16_to_cpu(instr_le);
 		if (aarch32_insn_is_wide(instr)) {
 			u32 instr2;
 
 			if (get_user(instr_le, (__le16 __user *)(pc + 2)))
-				goto exit;
+				return -EFAULT;
 			instr2 = le16_to_cpu(instr_le);
 			instr = (instr << 16) | instr2;
 		}
@@ -329,10 +326,20 @@ static int call_undef_hook(struct pt_regs *regs)
 		/* 32-bit ARM instruction */
 		__le32 instr_le;
 		if (get_user(instr_le, (__le32 __user *)pc))
-			goto exit;
+			return -EFAULT;
 		instr = le32_to_cpu(instr_le);
 	}
 
+	*insnp = instr;
+	return 0;
+}
+
+static int call_undef_hook(struct pt_regs *regs, u32 instr)
+{
+	struct undef_hook *hook;
+	unsigned long flags;
+	int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
+
 	raw_spin_lock_irqsave(&undef_lock, flags);
 	list_for_each_entry(hook, &undef_hook, node)
 		if ((instr & hook->instr_mask) == hook->instr_val &&
@@ -340,7 +347,7 @@ static int call_undef_hook(struct pt_regs *regs)
 			fn = hook->fn;
 
 	raw_spin_unlock_irqrestore(&undef_lock, flags);
-exit:
+
 	return fn ? fn(regs, instr) : 1;
 }
 
@@ -392,13 +399,19 @@ void arm64_notify_segfault(unsigned long addr)
 
 void do_el0_undef(struct pt_regs *regs, unsigned long esr)
 {
+	u32 insn;
+
 	/* check for AArch32 breakpoint instructions */
 	if (!aarch32_break_handler(regs))
 		return;
 
-	if (call_undef_hook(regs) == 0)
+	if (user_insn_read(regs, &insn))
+		goto out_err;
+
+	if (call_undef_hook(regs, insn) == 0)
 		return;
 
+out_err:
 	force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
 }
 

From 5aa232345e4d18a40b3e0590c04e2f931903d46a Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:40 +0000
Subject: [PATCH 0071/1043] arm64: rework EL0 MRS emulation

commit f5962add74b61f8ae31c6311f75ca35d7e1d2d8f upstream.

On CPUs without FEAT_IDST, ID register emulation is slower than it needs
to be, as all threads contend for the same lock to perform the
emulation. This patch reworks the emulation to avoid this unnecessary
contention.

On CPUs with FEAT_IDST (which is mandatory from ARMv8.4 onwards), EL0
accesses to ID registers result in a SYS trap, and emulation of these is
handled with a sys64_hook. These hooks are statically allocated, and no
locking is required to iterate through the hooks and perform the
emulation, allowing emulation to occur in parallel with no contention.

On CPUs without FEAT_IDST, EL0 accesses to ID registers result in an
UNDEFINED exception, and emulation of these accesses is handled with an
undef_hook. When an EL0 MRS instruction is trapped to EL1, the kernel
finds the relevant handler by iterating through all of the undef_hooks,
requiring undef_lock to be held during this lookup.

This locking is only required to safely traverse the list of undef_hooks
(as it can be concurrently modified), and the actual emulation of the
MRS does not require any mutual exclusion. This locking is an
unfortunate bottleneck, especially given that MRS emulation is enabled
unconditionally and is never disabled.

This patch reworks the non-FEAT_IDST MRS emulation logic so that it can
be invoked directly from do_el0_undef(). This removes the bottleneck,
allowing MRS traps to be handled entirely in parallel, and is a stepping
stone to making all of the undef_hooks lock-free.

I've tested this in a 64-vCPU VM on a 64-CPU ThunderX2 host, with a
benchmark which spawns a number of threads which each try to read
ID_AA64ISAR0_EL1 1000000 times. This is vastly more contention than will
ever be seen in realistic usage, but clearly demonstrates the removal of
the bottleneck:

  | Threads || Time (seconds)                       |
  |         || Before           || After            |
  |         || Real   | System  || Real   | System  |
  |---------++--------+---------++--------+---------|
  |       1 ||   0.29 |    0.20 ||   0.24 |    0.12 |
  |       2 ||   0.35 |    0.51 ||   0.23 |    0.27 |
  |       4 ||   1.08 |    3.87 ||   0.24 |    0.56 |
  |       8 ||   4.31 |   33.60 ||   0.24 |    1.11 |
  |      16 ||   9.47 |  149.39 ||   0.23 |    2.15 |
  |      32 ||  19.07 |  605.27 ||   0.24 |    4.38 |
  |      64 ||  65.40 | 3609.09 ||   0.33 |   11.27 |

Aside from the speedup, there should be no functional change as a result
of this patch.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-6-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/cpufeature.h |  3 ++-
 arch/arm64/kernel/cpufeature.c      | 23 +++++------------------
 arch/arm64/kernel/traps.c           |  3 +++
 3 files changed, 10 insertions(+), 19 deletions(-)

diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 31ba0ac7db63..7a2007c57d3c 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -759,7 +759,8 @@ static inline bool system_supports_tlb_range(void)
 		cpus_have_const_cap(ARM64_HAS_TLB_RANGE);
 }
 
-extern int do_emulate_mrs(struct pt_regs *regs, u32 sys_reg, u32 rt);
+int do_emulate_mrs(struct pt_regs *regs, u32 sys_reg, u32 rt);
+bool try_emulate_mrs(struct pt_regs *regs, u32 isn);
 
 static inline u32 id_aa64mmfr0_parange_to_phys_shift(int parange)
 {
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index f3767c144593..1f0a2deafd64 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -2852,35 +2852,22 @@ int do_emulate_mrs(struct pt_regs *regs, u32 sys_reg, u32 rt)
 	return rc;
 }
 
-static int emulate_mrs(struct pt_regs *regs, u32 insn)
+bool try_emulate_mrs(struct pt_regs *regs, u32 insn)
 {
 	u32 sys_reg, rt;
 
+	if (compat_user_mode(regs) || !aarch64_insn_is_mrs(insn))
+		return false;
+
 	/*
 	 * sys_reg values are defined as used in mrs/msr instruction.
 	 * shift the imm value to get the encoding.
 	 */
 	sys_reg = (u32)aarch64_insn_decode_immediate(AARCH64_INSN_IMM_16, insn) << 5;
 	rt = aarch64_insn_decode_register(AARCH64_INSN_REGTYPE_RT, insn);
-	return do_emulate_mrs(regs, sys_reg, rt);
+	return do_emulate_mrs(regs, sys_reg, rt) == 0;
 }
 
-static struct undef_hook mrs_hook = {
-	.instr_mask = 0xfff00000,
-	.instr_val  = 0xd5300000,
-	.pstate_mask = PSR_AA32_MODE_MASK,
-	.pstate_val = PSR_MODE_EL0t,
-	.fn = emulate_mrs,
-};
-
-static int __init enable_mrs_emulation(void)
-{
-	register_undef_hook(&mrs_hook);
-	return 0;
-}
-
-core_initcall(enable_mrs_emulation);
-
 ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr,
 			  char *buf)
 {
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index be9c7bb89e98..7117837a8559 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -408,6 +408,9 @@ void do_el0_undef(struct pt_regs *regs, unsigned long esr)
 	if (user_insn_read(regs, &insn))
 		goto out_err;
 
+	if (try_emulate_mrs(regs, insn))
+		return;
+
 	if (call_undef_hook(regs, insn) == 0)
 		return;
 

From 2202536144bc37b6db8c6ebad09079108441e0c7 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:41 +0000
Subject: [PATCH 0072/1043] arm64: armv8_deprecated: fold ops into
 insn_emulation

commit b4453cc8a7ebbd45436a8cd3ffeaa069ceac146f upstream.

The code for emulating deprecated instructions has two related
structures: struct insn_emulation_ops and struct insn_emulation, where
each struct insn_emulation_ops is associated 1-1 with a struct
insn_emulation.

It would be simpler to combine the two into a single structure, removing
the need for (unconditional) dynamic allocation at boot time, and
simplifying some runtime pointer chasing.

This patch merges the two structures together.

There should be no functional change as a result of this patch.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-7-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/armv8_deprecated.c | 76 ++++++++++++----------------
 1 file changed, 33 insertions(+), 43 deletions(-)

diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index 91b8a8378ba3..ada20ed7ecb6 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -41,16 +41,12 @@ enum legacy_insn_status {
 	INSN_OBSOLETE,
 };
 
-struct insn_emulation_ops {
-	const char		*name;
-	enum legacy_insn_status	status;
-	struct undef_hook	*hooks;
-	int			(*set_hw_mode)(bool enable);
-};
-
 struct insn_emulation {
-	struct list_head node;
-	struct insn_emulation_ops *ops;
+	const char			*name;
+	struct list_head		node;
+	enum legacy_insn_status		status;
+	struct undef_hook		*hooks;
+	int				(*set_hw_mode)(bool enable);
 	int current_mode;
 	int min;
 	int max;
@@ -61,48 +57,48 @@ static int nr_insn_emulated __initdata;
 static DEFINE_RAW_SPINLOCK(insn_emulation_lock);
 static DEFINE_MUTEX(insn_emulation_mutex);
 
-static void register_emulation_hooks(struct insn_emulation_ops *ops)
+static void register_emulation_hooks(struct insn_emulation *insn)
 {
 	struct undef_hook *hook;
 
-	BUG_ON(!ops->hooks);
+	BUG_ON(!insn->hooks);
 
-	for (hook = ops->hooks; hook->instr_mask; hook++)
+	for (hook = insn->hooks; hook->instr_mask; hook++)
 		register_undef_hook(hook);
 
-	pr_notice("Registered %s emulation handler\n", ops->name);
+	pr_notice("Registered %s emulation handler\n", insn->name);
 }
 
-static void remove_emulation_hooks(struct insn_emulation_ops *ops)
+static void remove_emulation_hooks(struct insn_emulation *insn)
 {
 	struct undef_hook *hook;
 
-	BUG_ON(!ops->hooks);
+	BUG_ON(!insn->hooks);
 
-	for (hook = ops->hooks; hook->instr_mask; hook++)
+	for (hook = insn->hooks; hook->instr_mask; hook++)
 		unregister_undef_hook(hook);
 
-	pr_notice("Removed %s emulation handler\n", ops->name);
+	pr_notice("Removed %s emulation handler\n", insn->name);
 }
 
 static void enable_insn_hw_mode(void *data)
 {
 	struct insn_emulation *insn = (struct insn_emulation *)data;
-	if (insn->ops->set_hw_mode)
-		insn->ops->set_hw_mode(true);
+	if (insn->set_hw_mode)
+		insn->set_hw_mode(true);
 }
 
 static void disable_insn_hw_mode(void *data)
 {
 	struct insn_emulation *insn = (struct insn_emulation *)data;
-	if (insn->ops->set_hw_mode)
-		insn->ops->set_hw_mode(false);
+	if (insn->set_hw_mode)
+		insn->set_hw_mode(false);
 }
 
 /* Run set_hw_mode(mode) on all active CPUs */
 static int run_all_cpu_set_hw_mode(struct insn_emulation *insn, bool enable)
 {
-	if (!insn->ops->set_hw_mode)
+	if (!insn->set_hw_mode)
 		return -EINVAL;
 	if (enable)
 		on_each_cpu(enable_insn_hw_mode, (void *)insn, true);
@@ -126,9 +122,9 @@ static int run_all_insn_set_hw_mode(unsigned int cpu)
 	raw_spin_lock_irqsave(&insn_emulation_lock, flags);
 	list_for_each_entry(insn, &insn_emulation, node) {
 		bool enable = (insn->current_mode == INSN_HW);
-		if (insn->ops->set_hw_mode && insn->ops->set_hw_mode(enable)) {
+		if (insn->set_hw_mode && insn->set_hw_mode(enable)) {
 			pr_warn("CPU[%u] cannot support the emulation of %s",
-				cpu, insn->ops->name);
+				cpu, insn->name);
 			rc = -EINVAL;
 		}
 	}
@@ -145,11 +141,11 @@ static int update_insn_emulation_mode(struct insn_emulation *insn,
 	case INSN_UNDEF: /* Nothing to be done */
 		break;
 	case INSN_EMULATE:
-		remove_emulation_hooks(insn->ops);
+		remove_emulation_hooks(insn);
 		break;
 	case INSN_HW:
 		if (!run_all_cpu_set_hw_mode(insn, false))
-			pr_notice("Disabled %s support\n", insn->ops->name);
+			pr_notice("Disabled %s support\n", insn->name);
 		break;
 	}
 
@@ -157,31 +153,25 @@ static int update_insn_emulation_mode(struct insn_emulation *insn,
 	case INSN_UNDEF:
 		break;
 	case INSN_EMULATE:
-		register_emulation_hooks(insn->ops);
+		register_emulation_hooks(insn);
 		break;
 	case INSN_HW:
 		ret = run_all_cpu_set_hw_mode(insn, true);
 		if (!ret)
-			pr_notice("Enabled %s support\n", insn->ops->name);
+			pr_notice("Enabled %s support\n", insn->name);
 		break;
 	}
 
 	return ret;
 }
 
-static void __init register_insn_emulation(struct insn_emulation_ops *ops)
+static void __init register_insn_emulation(struct insn_emulation *insn)
 {
 	unsigned long flags;
-	struct insn_emulation *insn;
 
-	insn = kzalloc(sizeof(*insn), GFP_KERNEL);
-	if (!insn)
-		return;
-
-	insn->ops = ops;
 	insn->min = INSN_UNDEF;
 
-	switch (ops->status) {
+	switch (insn->status) {
 	case INSN_DEPRECATED:
 		insn->current_mode = INSN_EMULATE;
 		/* Disable the HW mode if it was turned on at early boot time */
@@ -247,7 +237,7 @@ static void __init register_insn_emulation_sysctl(void)
 		sysctl->mode = 0644;
 		sysctl->maxlen = sizeof(int);
 
-		sysctl->procname = insn->ops->name;
+		sysctl->procname = insn->name;
 		sysctl->data = &insn->current_mode;
 		sysctl->extra1 = &insn->min;
 		sysctl->extra2 = &insn->max;
@@ -451,7 +441,7 @@ static struct undef_hook swp_hooks[] = {
 	{ }
 };
 
-static struct insn_emulation_ops swp_ops = {
+static struct insn_emulation insn_swp = {
 	.name = "swp",
 	.status = INSN_OBSOLETE,
 	.hooks = swp_hooks,
@@ -538,7 +528,7 @@ static struct undef_hook cp15_barrier_hooks[] = {
 	{ }
 };
 
-static struct insn_emulation_ops cp15_barrier_ops = {
+static struct insn_emulation insn_cp15_barrier = {
 	.name = "cp15_barrier",
 	.status = INSN_DEPRECATED,
 	.hooks = cp15_barrier_hooks,
@@ -611,7 +601,7 @@ static struct undef_hook setend_hooks[] = {
 	{}
 };
 
-static struct insn_emulation_ops setend_ops = {
+static struct insn_emulation insn_setend = {
 	.name = "setend",
 	.status = INSN_DEPRECATED,
 	.hooks = setend_hooks,
@@ -625,14 +615,14 @@ static struct insn_emulation_ops setend_ops = {
 static int __init armv8_deprecated_init(void)
 {
 	if (IS_ENABLED(CONFIG_SWP_EMULATION))
-		register_insn_emulation(&swp_ops);
+		register_insn_emulation(&insn_swp);
 
 	if (IS_ENABLED(CONFIG_CP15_BARRIER_EMULATION))
-		register_insn_emulation(&cp15_barrier_ops);
+		register_insn_emulation(&insn_cp15_barrier);
 
 	if (IS_ENABLED(CONFIG_SETEND_EMULATION)) {
 		if (system_supports_mixed_endian_el0())
-			register_insn_emulation(&setend_ops);
+			register_insn_emulation(&insn_setend);
 		else
 			pr_info("setend instruction emulation is not supported on this system\n");
 	}

From 0b6a7a9f6d944682237bd61bce7f590ebda6e716 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:42 +0000
Subject: [PATCH 0073/1043] arm64: armv8_deprecated move emulation functions

commit 25eeac0cfe7c97ade1be07340e11e7143aab57a6 upstream.

Subsequent patches will rework the logic in armv8_deprecated.c.

In preparation for subsequent changes, this patch moves the emulation
logic earlier in the file, and moves the infrastructure later in the
file. This will make subsequent diffs simpler and easier to read.

This is purely a move. There should be no functional change as a result
of this patch.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-8-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/armv8_deprecated.c | 394 +++++++++++++--------------
 1 file changed, 197 insertions(+), 197 deletions(-)

diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index ada20ed7ecb6..529a877a1bb2 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -52,203 +52,6 @@ struct insn_emulation {
 	int max;
 };
 
-static LIST_HEAD(insn_emulation);
-static int nr_insn_emulated __initdata;
-static DEFINE_RAW_SPINLOCK(insn_emulation_lock);
-static DEFINE_MUTEX(insn_emulation_mutex);
-
-static void register_emulation_hooks(struct insn_emulation *insn)
-{
-	struct undef_hook *hook;
-
-	BUG_ON(!insn->hooks);
-
-	for (hook = insn->hooks; hook->instr_mask; hook++)
-		register_undef_hook(hook);
-
-	pr_notice("Registered %s emulation handler\n", insn->name);
-}
-
-static void remove_emulation_hooks(struct insn_emulation *insn)
-{
-	struct undef_hook *hook;
-
-	BUG_ON(!insn->hooks);
-
-	for (hook = insn->hooks; hook->instr_mask; hook++)
-		unregister_undef_hook(hook);
-
-	pr_notice("Removed %s emulation handler\n", insn->name);
-}
-
-static void enable_insn_hw_mode(void *data)
-{
-	struct insn_emulation *insn = (struct insn_emulation *)data;
-	if (insn->set_hw_mode)
-		insn->set_hw_mode(true);
-}
-
-static void disable_insn_hw_mode(void *data)
-{
-	struct insn_emulation *insn = (struct insn_emulation *)data;
-	if (insn->set_hw_mode)
-		insn->set_hw_mode(false);
-}
-
-/* Run set_hw_mode(mode) on all active CPUs */
-static int run_all_cpu_set_hw_mode(struct insn_emulation *insn, bool enable)
-{
-	if (!insn->set_hw_mode)
-		return -EINVAL;
-	if (enable)
-		on_each_cpu(enable_insn_hw_mode, (void *)insn, true);
-	else
-		on_each_cpu(disable_insn_hw_mode, (void *)insn, true);
-	return 0;
-}
-
-/*
- * Run set_hw_mode for all insns on a starting CPU.
- * Returns:
- *  0 		- If all the hooks ran successfully.
- * -EINVAL	- At least one hook is not supported by the CPU.
- */
-static int run_all_insn_set_hw_mode(unsigned int cpu)
-{
-	int rc = 0;
-	unsigned long flags;
-	struct insn_emulation *insn;
-
-	raw_spin_lock_irqsave(&insn_emulation_lock, flags);
-	list_for_each_entry(insn, &insn_emulation, node) {
-		bool enable = (insn->current_mode == INSN_HW);
-		if (insn->set_hw_mode && insn->set_hw_mode(enable)) {
-			pr_warn("CPU[%u] cannot support the emulation of %s",
-				cpu, insn->name);
-			rc = -EINVAL;
-		}
-	}
-	raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
-	return rc;
-}
-
-static int update_insn_emulation_mode(struct insn_emulation *insn,
-				       enum insn_emulation_mode prev)
-{
-	int ret = 0;
-
-	switch (prev) {
-	case INSN_UNDEF: /* Nothing to be done */
-		break;
-	case INSN_EMULATE:
-		remove_emulation_hooks(insn);
-		break;
-	case INSN_HW:
-		if (!run_all_cpu_set_hw_mode(insn, false))
-			pr_notice("Disabled %s support\n", insn->name);
-		break;
-	}
-
-	switch (insn->current_mode) {
-	case INSN_UNDEF:
-		break;
-	case INSN_EMULATE:
-		register_emulation_hooks(insn);
-		break;
-	case INSN_HW:
-		ret = run_all_cpu_set_hw_mode(insn, true);
-		if (!ret)
-			pr_notice("Enabled %s support\n", insn->name);
-		break;
-	}
-
-	return ret;
-}
-
-static void __init register_insn_emulation(struct insn_emulation *insn)
-{
-	unsigned long flags;
-
-	insn->min = INSN_UNDEF;
-
-	switch (insn->status) {
-	case INSN_DEPRECATED:
-		insn->current_mode = INSN_EMULATE;
-		/* Disable the HW mode if it was turned on at early boot time */
-		run_all_cpu_set_hw_mode(insn, false);
-		insn->max = INSN_HW;
-		break;
-	case INSN_OBSOLETE:
-		insn->current_mode = INSN_UNDEF;
-		insn->max = INSN_EMULATE;
-		break;
-	}
-
-	raw_spin_lock_irqsave(&insn_emulation_lock, flags);
-	list_add(&insn->node, &insn_emulation);
-	nr_insn_emulated++;
-	raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
-
-	/* Register any handlers if required */
-	update_insn_emulation_mode(insn, INSN_UNDEF);
-}
-
-static int emulation_proc_handler(struct ctl_table *table, int write,
-				  void *buffer, size_t *lenp,
-				  loff_t *ppos)
-{
-	int ret = 0;
-	struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode);
-	enum insn_emulation_mode prev_mode = insn->current_mode;
-
-	mutex_lock(&insn_emulation_mutex);
-	ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
-
-	if (ret || !write || prev_mode == insn->current_mode)
-		goto ret;
-
-	ret = update_insn_emulation_mode(insn, prev_mode);
-	if (ret) {
-		/* Mode change failed, revert to previous mode. */
-		insn->current_mode = prev_mode;
-		update_insn_emulation_mode(insn, INSN_UNDEF);
-	}
-ret:
-	mutex_unlock(&insn_emulation_mutex);
-	return ret;
-}
-
-static void __init register_insn_emulation_sysctl(void)
-{
-	unsigned long flags;
-	int i = 0;
-	struct insn_emulation *insn;
-	struct ctl_table *insns_sysctl, *sysctl;
-
-	insns_sysctl = kcalloc(nr_insn_emulated + 1, sizeof(*sysctl),
-			       GFP_KERNEL);
-	if (!insns_sysctl)
-		return;
-
-	raw_spin_lock_irqsave(&insn_emulation_lock, flags);
-	list_for_each_entry(insn, &insn_emulation, node) {
-		sysctl = &insns_sysctl[i];
-
-		sysctl->mode = 0644;
-		sysctl->maxlen = sizeof(int);
-
-		sysctl->procname = insn->name;
-		sysctl->data = &insn->current_mode;
-		sysctl->extra1 = &insn->min;
-		sysctl->extra2 = &insn->max;
-		sysctl->proc_handler = emulation_proc_handler;
-		i++;
-	}
-	raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
-
-	register_sysctl("abi", insns_sysctl);
-}
-
 /*
  *  Implement emulation of the SWP/SWPB instructions using load-exclusive and
  *  store-exclusive.
@@ -608,6 +411,203 @@ static struct insn_emulation insn_setend = {
 	.set_hw_mode = setend_set_hw_mode,
 };
 
+static LIST_HEAD(insn_emulation);
+static int nr_insn_emulated __initdata;
+static DEFINE_RAW_SPINLOCK(insn_emulation_lock);
+static DEFINE_MUTEX(insn_emulation_mutex);
+
+static void register_emulation_hooks(struct insn_emulation *insn)
+{
+	struct undef_hook *hook;
+
+	BUG_ON(!insn->hooks);
+
+	for (hook = insn->hooks; hook->instr_mask; hook++)
+		register_undef_hook(hook);
+
+	pr_notice("Registered %s emulation handler\n", insn->name);
+}
+
+static void remove_emulation_hooks(struct insn_emulation *insn)
+{
+	struct undef_hook *hook;
+
+	BUG_ON(!insn->hooks);
+
+	for (hook = insn->hooks; hook->instr_mask; hook++)
+		unregister_undef_hook(hook);
+
+	pr_notice("Removed %s emulation handler\n", insn->name);
+}
+
+static void enable_insn_hw_mode(void *data)
+{
+	struct insn_emulation *insn = (struct insn_emulation *)data;
+	if (insn->set_hw_mode)
+		insn->set_hw_mode(true);
+}
+
+static void disable_insn_hw_mode(void *data)
+{
+	struct insn_emulation *insn = (struct insn_emulation *)data;
+	if (insn->set_hw_mode)
+		insn->set_hw_mode(false);
+}
+
+/* Run set_hw_mode(mode) on all active CPUs */
+static int run_all_cpu_set_hw_mode(struct insn_emulation *insn, bool enable)
+{
+	if (!insn->set_hw_mode)
+		return -EINVAL;
+	if (enable)
+		on_each_cpu(enable_insn_hw_mode, (void *)insn, true);
+	else
+		on_each_cpu(disable_insn_hw_mode, (void *)insn, true);
+	return 0;
+}
+
+/*
+ * Run set_hw_mode for all insns on a starting CPU.
+ * Returns:
+ *  0 		- If all the hooks ran successfully.
+ * -EINVAL	- At least one hook is not supported by the CPU.
+ */
+static int run_all_insn_set_hw_mode(unsigned int cpu)
+{
+	int rc = 0;
+	unsigned long flags;
+	struct insn_emulation *insn;
+
+	raw_spin_lock_irqsave(&insn_emulation_lock, flags);
+	list_for_each_entry(insn, &insn_emulation, node) {
+		bool enable = (insn->current_mode == INSN_HW);
+		if (insn->set_hw_mode && insn->set_hw_mode(enable)) {
+			pr_warn("CPU[%u] cannot support the emulation of %s",
+				cpu, insn->name);
+			rc = -EINVAL;
+		}
+	}
+	raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
+	return rc;
+}
+
+static int update_insn_emulation_mode(struct insn_emulation *insn,
+				       enum insn_emulation_mode prev)
+{
+	int ret = 0;
+
+	switch (prev) {
+	case INSN_UNDEF: /* Nothing to be done */
+		break;
+	case INSN_EMULATE:
+		remove_emulation_hooks(insn);
+		break;
+	case INSN_HW:
+		if (!run_all_cpu_set_hw_mode(insn, false))
+			pr_notice("Disabled %s support\n", insn->name);
+		break;
+	}
+
+	switch (insn->current_mode) {
+	case INSN_UNDEF:
+		break;
+	case INSN_EMULATE:
+		register_emulation_hooks(insn);
+		break;
+	case INSN_HW:
+		ret = run_all_cpu_set_hw_mode(insn, true);
+		if (!ret)
+			pr_notice("Enabled %s support\n", insn->name);
+		break;
+	}
+
+	return ret;
+}
+
+static void __init register_insn_emulation(struct insn_emulation *insn)
+{
+	unsigned long flags;
+
+	insn->min = INSN_UNDEF;
+
+	switch (insn->status) {
+	case INSN_DEPRECATED:
+		insn->current_mode = INSN_EMULATE;
+		/* Disable the HW mode if it was turned on at early boot time */
+		run_all_cpu_set_hw_mode(insn, false);
+		insn->max = INSN_HW;
+		break;
+	case INSN_OBSOLETE:
+		insn->current_mode = INSN_UNDEF;
+		insn->max = INSN_EMULATE;
+		break;
+	}
+
+	raw_spin_lock_irqsave(&insn_emulation_lock, flags);
+	list_add(&insn->node, &insn_emulation);
+	nr_insn_emulated++;
+	raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
+
+	/* Register any handlers if required */
+	update_insn_emulation_mode(insn, INSN_UNDEF);
+}
+
+static int emulation_proc_handler(struct ctl_table *table, int write,
+				  void *buffer, size_t *lenp,
+				  loff_t *ppos)
+{
+	int ret = 0;
+	struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode);
+	enum insn_emulation_mode prev_mode = insn->current_mode;
+
+	mutex_lock(&insn_emulation_mutex);
+	ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+
+	if (ret || !write || prev_mode == insn->current_mode)
+		goto ret;
+
+	ret = update_insn_emulation_mode(insn, prev_mode);
+	if (ret) {
+		/* Mode change failed, revert to previous mode. */
+		insn->current_mode = prev_mode;
+		update_insn_emulation_mode(insn, INSN_UNDEF);
+	}
+ret:
+	mutex_unlock(&insn_emulation_mutex);
+	return ret;
+}
+
+static void __init register_insn_emulation_sysctl(void)
+{
+	unsigned long flags;
+	int i = 0;
+	struct insn_emulation *insn;
+	struct ctl_table *insns_sysctl, *sysctl;
+
+	insns_sysctl = kcalloc(nr_insn_emulated + 1, sizeof(*sysctl),
+			       GFP_KERNEL);
+	if (!insns_sysctl)
+		return;
+
+	raw_spin_lock_irqsave(&insn_emulation_lock, flags);
+	list_for_each_entry(insn, &insn_emulation, node) {
+		sysctl = &insns_sysctl[i];
+
+		sysctl->mode = 0644;
+		sysctl->maxlen = sizeof(int);
+
+		sysctl->procname = insn->name;
+		sysctl->data = &insn->current_mode;
+		sysctl->extra1 = &insn->min;
+		sysctl->extra2 = &insn->max;
+		sysctl->proc_handler = emulation_proc_handler;
+		i++;
+	}
+	raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
+
+	register_sysctl("abi", insns_sysctl);
+}
+
 /*
  * Invoked as core_initcall, which guarantees that the instruction
  * emulation is ready for userspace.

From 45a26d2a5394a29844ad530ef7a4ff3a81de88a3 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:43 +0000
Subject: [PATCH 0074/1043] arm64: armv8_deprecated: move aarch32 helper
 earlier

commit 0c5f416219da3795dc8b33e5bb7865a6b3c4e55c upstream.

Subsequent patches will rework the logic in armv8_deprecated.c.

In preparation for subsequent changes, this patch moves some shared logic
earlier in the file. This will make subsequent diffs simpler and easier to
read.

At the same time, drop the `__kprobes` annotation from
aarch32_check_condition(), as this is only used for traps from compat
userspace, and has no risk of recursion within kprobes. As this is the
last kprobes annotation in armve8_deprecated.c, we no longer need to
include <asm/kprobes.h>.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-9-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/armv8_deprecated.c | 39 ++++++++++++++--------------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index 529a877a1bb2..98dc7f8b8c08 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -17,7 +17,6 @@
 #include <asm/sysreg.h>
 #include <asm/system_misc.h>
 #include <asm/traps.h>
-#include <asm/kprobes.h>
 
 #define CREATE_TRACE_POINTS
 #include "trace-events-emulation.h"
@@ -52,6 +51,25 @@ struct insn_emulation {
 	int max;
 };
 
+#define ARM_OPCODE_CONDTEST_FAIL   0
+#define ARM_OPCODE_CONDTEST_PASS   1
+#define ARM_OPCODE_CONDTEST_UNCOND 2
+
+#define	ARM_OPCODE_CONDITION_UNCOND	0xf
+
+static unsigned int aarch32_check_condition(u32 opcode, u32 psr)
+{
+	u32 cc_bits  = opcode >> 28;
+
+	if (cc_bits != ARM_OPCODE_CONDITION_UNCOND) {
+		if ((*aarch32_opcode_cond_checks[cc_bits])(psr))
+			return ARM_OPCODE_CONDTEST_PASS;
+		else
+			return ARM_OPCODE_CONDTEST_FAIL;
+	}
+	return ARM_OPCODE_CONDTEST_UNCOND;
+}
+
 /*
  *  Implement emulation of the SWP/SWPB instructions using load-exclusive and
  *  store-exclusive.
@@ -138,25 +156,6 @@ static int emulate_swpX(unsigned int address, unsigned int *data,
 	return res;
 }
 
-#define ARM_OPCODE_CONDTEST_FAIL   0
-#define ARM_OPCODE_CONDTEST_PASS   1
-#define ARM_OPCODE_CONDTEST_UNCOND 2
-
-#define	ARM_OPCODE_CONDITION_UNCOND	0xf
-
-static unsigned int __kprobes aarch32_check_condition(u32 opcode, u32 psr)
-{
-	u32 cc_bits  = opcode >> 28;
-
-	if (cc_bits != ARM_OPCODE_CONDITION_UNCOND) {
-		if ((*aarch32_opcode_cond_checks[cc_bits])(psr))
-			return ARM_OPCODE_CONDTEST_PASS;
-		else
-			return ARM_OPCODE_CONDTEST_FAIL;
-	}
-	return ARM_OPCODE_CONDTEST_UNCOND;
-}
-
 /*
  * swp_handler logs the id of calling process, dissects the instruction, sanity
  * checks the memory location, calls emulate_swpX for the actual operation and

From da7603cedb7da6e2e7150054e838079e3fbf65a9 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 11 Oct 2023 10:05:44 +0000
Subject: [PATCH 0075/1043] arm64: armv8_deprecated: rework deprected
 instruction handling

commit 124c49b1b5d947b7180c5d6cbb09ddf76ea45ea2 upstream.

Support for deprecated instructions can be enabled or disabled at
runtime. To handle this, the code in armv8_deprecated.c registers and
unregisters undef_hooks, and makes cross CPU calls to configure HW
support. This is rather complicated, and the synchronization required to
make this safe ends up serializing the handling of instructions which
have been trapped.

This patch simplifies the deprecated instruction handling by removing
the dynamic registration and unregistration, and changing the trap
handling code to determine whether a handler should be invoked. This
removes the need for dynamic list management, and simplifies the locking
requirements, making it possible to handle trapped instructions entirely
in parallel.

Where changing the emulation state requires a cross-call, this is
serialized by locally disabling interrupts, ensuring that the CPU is not
left in an inconsistent state.

To simplify sysctl management, each insn_emulation is given a separate
sysctl table, permitting these to be registered separately. The core
sysctl code will iterate over all of these when walking sysfs.

I've tested this with userspace programs which use each of the
deprecated instructions, and I've concurrently modified the support
level for each of the features back-and-forth between HW and emulated to
check that there are no spurious SIGILLs sent to userspace when the
support level is changed.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-10-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/traps.h       |  19 +-
 arch/arm64/kernel/armv8_deprecated.c | 289 ++++++++++++++-------------
 arch/arm64/kernel/traps.c            |  40 +---
 3 files changed, 155 insertions(+), 193 deletions(-)

diff --git a/arch/arm64/include/asm/traps.h b/arch/arm64/include/asm/traps.h
index d96dc2c7c09d..ca8f19956b92 100644
--- a/arch/arm64/include/asm/traps.h
+++ b/arch/arm64/include/asm/traps.h
@@ -13,17 +13,16 @@
 
 struct pt_regs;
 
-struct undef_hook {
-	struct list_head node;
-	u32 instr_mask;
-	u32 instr_val;
-	u64 pstate_mask;
-	u64 pstate_val;
-	int (*fn)(struct pt_regs *regs, u32 instr);
-};
+#ifdef CONFIG_ARMV8_DEPRECATED
+bool try_emulate_armv8_deprecated(struct pt_regs *regs, u32 insn);
+#else
+static inline bool
+try_emulate_armv8_deprecated(struct pt_regs *regs, u32 insn)
+{
+	return false;
+}
+#endif /* CONFIG_ARMV8_DEPRECATED */
 
-void register_undef_hook(struct undef_hook *hook);
-void unregister_undef_hook(struct undef_hook *hook);
 void force_signal_inject(int signal, int code, unsigned long address, unsigned int err);
 void arm64_notify_segfault(unsigned long addr);
 void arm64_force_sig_fault(int signo, int code, void __user *addr, const char *str);
diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index 98dc7f8b8c08..fd529c6c108b 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -38,17 +38,24 @@ enum insn_emulation_mode {
 enum legacy_insn_status {
 	INSN_DEPRECATED,
 	INSN_OBSOLETE,
+	INSN_UNAVAILABLE,
 };
 
 struct insn_emulation {
 	const char			*name;
-	struct list_head		node;
 	enum legacy_insn_status		status;
-	struct undef_hook		*hooks;
+	bool				(*try_emulate)(struct pt_regs *regs,
+						       u32 insn);
 	int				(*set_hw_mode)(bool enable);
+
 	int current_mode;
 	int min;
 	int max;
+
+	/*
+	 * sysctl for this emulation + a sentinal entry.
+	 */
+	struct ctl_table sysctl[2];
 };
 
 #define ARM_OPCODE_CONDTEST_FAIL   0
@@ -70,6 +77,7 @@ static unsigned int aarch32_check_condition(u32 opcode, u32 psr)
 	return ARM_OPCODE_CONDTEST_UNCOND;
 }
 
+#ifdef CONFIG_SWP_EMULATION
 /*
  *  Implement emulation of the SWP/SWPB instructions using load-exclusive and
  *  store-exclusive.
@@ -228,28 +236,27 @@ static int swp_handler(struct pt_regs *regs, u32 instr)
 	return 0;
 }
 
-/*
- * Only emulate SWP/SWPB executed in ARM state/User mode.
- * The kernel must be SWP free and SWP{B} does not exist in Thumb.
- */
-static struct undef_hook swp_hooks[] = {
-	{
-		.instr_mask	= 0x0fb00ff0,
-		.instr_val	= 0x01000090,
-		.pstate_mask	= PSR_AA32_MODE_MASK,
-		.pstate_val	= PSR_AA32_MODE_USR,
-		.fn		= swp_handler
-	},
-	{ }
-};
+static bool try_emulate_swp(struct pt_regs *regs, u32 insn)
+{
+	/* SWP{B} only exists in ARM state and does not exist in Thumb */
+	if (!compat_user_mode(regs) || compat_thumb_mode(regs))
+		return false;
+
+	if ((insn & 0x0fb00ff0) != 0x01000090)
+		return false;
+
+	return swp_handler(regs, insn) == 0;
+}
 
 static struct insn_emulation insn_swp = {
 	.name = "swp",
 	.status = INSN_OBSOLETE,
-	.hooks = swp_hooks,
+	.try_emulate = try_emulate_swp,
 	.set_hw_mode = NULL,
 };
+#endif /* CONFIG_SWP_EMULATION */
 
+#ifdef CONFIG_CP15_BARRIER_EMULATION
 static int cp15barrier_handler(struct pt_regs *regs, u32 instr)
 {
 	perf_sw_event(PERF_COUNT_SW_EMULATION_FAULTS, 1, regs, regs->pc);
@@ -312,31 +319,29 @@ static int cp15_barrier_set_hw_mode(bool enable)
 	return 0;
 }
 
-static struct undef_hook cp15_barrier_hooks[] = {
-	{
-		.instr_mask	= 0x0fff0fdf,
-		.instr_val	= 0x0e070f9a,
-		.pstate_mask	= PSR_AA32_MODE_MASK,
-		.pstate_val	= PSR_AA32_MODE_USR,
-		.fn		= cp15barrier_handler,
-	},
-	{
-		.instr_mask	= 0x0fff0fff,
-		.instr_val	= 0x0e070f95,
-		.pstate_mask	= PSR_AA32_MODE_MASK,
-		.pstate_val	= PSR_AA32_MODE_USR,
-		.fn		= cp15barrier_handler,
-	},
-	{ }
-};
+static bool try_emulate_cp15_barrier(struct pt_regs *regs, u32 insn)
+{
+	if (!compat_user_mode(regs) || compat_thumb_mode(regs))
+		return false;
+
+	if ((insn & 0x0fff0fdf) == 0x0e070f9a)
+		return cp15barrier_handler(regs, insn) == 0;
+
+	if ((insn & 0x0fff0fff) == 0x0e070f95)
+		return cp15barrier_handler(regs, insn) == 0;
+
+	return false;
+}
 
 static struct insn_emulation insn_cp15_barrier = {
 	.name = "cp15_barrier",
 	.status = INSN_DEPRECATED,
-	.hooks = cp15_barrier_hooks,
+	.try_emulate = try_emulate_cp15_barrier,
 	.set_hw_mode = cp15_barrier_set_hw_mode,
 };
+#endif /* CONFIG_CP15_BARRIER_EMULATION */
 
+#ifdef CONFIG_SETEND_EMULATION
 static int setend_set_hw_mode(bool enable)
 {
 	if (!cpu_supports_mixed_endian_el0())
@@ -384,61 +389,41 @@ static int t16_setend_handler(struct pt_regs *regs, u32 instr)
 	return rc;
 }
 
-static struct undef_hook setend_hooks[] = {
-	{
-		.instr_mask	= 0xfffffdff,
-		.instr_val	= 0xf1010000,
-		.pstate_mask	= PSR_AA32_MODE_MASK,
-		.pstate_val	= PSR_AA32_MODE_USR,
-		.fn		= a32_setend_handler,
-	},
-	{
-		/* Thumb mode */
-		.instr_mask	= 0xfffffff7,
-		.instr_val	= 0x0000b650,
-		.pstate_mask	= (PSR_AA32_T_BIT | PSR_AA32_MODE_MASK),
-		.pstate_val	= (PSR_AA32_T_BIT | PSR_AA32_MODE_USR),
-		.fn		= t16_setend_handler,
-	},
-	{}
-};
+static bool try_emulate_setend(struct pt_regs *regs, u32 insn)
+{
+	if (compat_thumb_mode(regs) &&
+	    (insn & 0xfffffff7) == 0x0000b650)
+		return t16_setend_handler(regs, insn) == 0;
+
+	if (compat_user_mode(regs) &&
+	    (insn & 0xfffffdff) == 0xf1010000)
+		return a32_setend_handler(regs, insn) == 0;
+
+	return false;
+}
 
 static struct insn_emulation insn_setend = {
 	.name = "setend",
 	.status = INSN_DEPRECATED,
-	.hooks = setend_hooks,
+	.try_emulate = try_emulate_setend,
 	.set_hw_mode = setend_set_hw_mode,
 };
+#endif /* CONFIG_SETEND_EMULATION */
+
+static struct insn_emulation *insn_emulations[] = {
+#ifdef CONFIG_SWP_EMULATION
+	&insn_swp,
+#endif
+#ifdef CONFIG_CP15_BARRIER_EMULATION
+	&insn_cp15_barrier,
+#endif
+#ifdef CONFIG_SETEND_EMULATION
+	&insn_setend,
+#endif
+};
 
-static LIST_HEAD(insn_emulation);
-static int nr_insn_emulated __initdata;
-static DEFINE_RAW_SPINLOCK(insn_emulation_lock);
 static DEFINE_MUTEX(insn_emulation_mutex);
 
-static void register_emulation_hooks(struct insn_emulation *insn)
-{
-	struct undef_hook *hook;
-
-	BUG_ON(!insn->hooks);
-
-	for (hook = insn->hooks; hook->instr_mask; hook++)
-		register_undef_hook(hook);
-
-	pr_notice("Registered %s emulation handler\n", insn->name);
-}
-
-static void remove_emulation_hooks(struct insn_emulation *insn)
-{
-	struct undef_hook *hook;
-
-	BUG_ON(!insn->hooks);
-
-	for (hook = insn->hooks; hook->instr_mask; hook++)
-		unregister_undef_hook(hook);
-
-	pr_notice("Removed %s emulation handler\n", insn->name);
-}
-
 static void enable_insn_hw_mode(void *data)
 {
 	struct insn_emulation *insn = (struct insn_emulation *)data;
@@ -473,20 +458,27 @@ static int run_all_cpu_set_hw_mode(struct insn_emulation *insn, bool enable)
  */
 static int run_all_insn_set_hw_mode(unsigned int cpu)
 {
+	int i;
 	int rc = 0;
 	unsigned long flags;
-	struct insn_emulation *insn;
 
-	raw_spin_lock_irqsave(&insn_emulation_lock, flags);
-	list_for_each_entry(insn, &insn_emulation, node) {
-		bool enable = (insn->current_mode == INSN_HW);
+	/*
+	 * Disable IRQs to serialize against an IPI from
+	 * run_all_cpu_set_hw_mode(), ensuring the HW is programmed to the most
+	 * recent enablement state if the two race with one another.
+	 */
+	local_irq_save(flags);
+	for (i = 0; i < ARRAY_SIZE(insn_emulations); i++) {
+		struct insn_emulation *insn = insn_emulations[i];
+		bool enable = READ_ONCE(insn->current_mode) == INSN_HW;
 		if (insn->set_hw_mode && insn->set_hw_mode(enable)) {
 			pr_warn("CPU[%u] cannot support the emulation of %s",
 				cpu, insn->name);
 			rc = -EINVAL;
 		}
 	}
-	raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
+	local_irq_restore(flags);
+
 	return rc;
 }
 
@@ -499,7 +491,6 @@ static int update_insn_emulation_mode(struct insn_emulation *insn,
 	case INSN_UNDEF: /* Nothing to be done */
 		break;
 	case INSN_EMULATE:
-		remove_emulation_hooks(insn);
 		break;
 	case INSN_HW:
 		if (!run_all_cpu_set_hw_mode(insn, false))
@@ -511,7 +502,6 @@ static int update_insn_emulation_mode(struct insn_emulation *insn,
 	case INSN_UNDEF:
 		break;
 	case INSN_EMULATE:
-		register_emulation_hooks(insn);
 		break;
 	case INSN_HW:
 		ret = run_all_cpu_set_hw_mode(insn, true);
@@ -523,34 +513,6 @@ static int update_insn_emulation_mode(struct insn_emulation *insn,
 	return ret;
 }
 
-static void __init register_insn_emulation(struct insn_emulation *insn)
-{
-	unsigned long flags;
-
-	insn->min = INSN_UNDEF;
-
-	switch (insn->status) {
-	case INSN_DEPRECATED:
-		insn->current_mode = INSN_EMULATE;
-		/* Disable the HW mode if it was turned on at early boot time */
-		run_all_cpu_set_hw_mode(insn, false);
-		insn->max = INSN_HW;
-		break;
-	case INSN_OBSOLETE:
-		insn->current_mode = INSN_UNDEF;
-		insn->max = INSN_EMULATE;
-		break;
-	}
-
-	raw_spin_lock_irqsave(&insn_emulation_lock, flags);
-	list_add(&insn->node, &insn_emulation);
-	nr_insn_emulated++;
-	raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
-
-	/* Register any handlers if required */
-	update_insn_emulation_mode(insn, INSN_UNDEF);
-}
-
 static int emulation_proc_handler(struct ctl_table *table, int write,
 				  void *buffer, size_t *lenp,
 				  loff_t *ppos)
@@ -568,7 +530,7 @@ static int emulation_proc_handler(struct ctl_table *table, int write,
 	ret = update_insn_emulation_mode(insn, prev_mode);
 	if (ret) {
 		/* Mode change failed, revert to previous mode. */
-		insn->current_mode = prev_mode;
+		WRITE_ONCE(insn->current_mode, prev_mode);
 		update_insn_emulation_mode(insn, INSN_UNDEF);
 	}
 ret:
@@ -576,21 +538,34 @@ static int emulation_proc_handler(struct ctl_table *table, int write,
 	return ret;
 }
 
-static void __init register_insn_emulation_sysctl(void)
+static void __init register_insn_emulation(struct insn_emulation *insn)
 {
-	unsigned long flags;
-	int i = 0;
-	struct insn_emulation *insn;
-	struct ctl_table *insns_sysctl, *sysctl;
+	struct ctl_table *sysctl;
 
-	insns_sysctl = kcalloc(nr_insn_emulated + 1, sizeof(*sysctl),
-			       GFP_KERNEL);
-	if (!insns_sysctl)
-		return;
+	insn->min = INSN_UNDEF;
 
-	raw_spin_lock_irqsave(&insn_emulation_lock, flags);
-	list_for_each_entry(insn, &insn_emulation, node) {
-		sysctl = &insns_sysctl[i];
+	switch (insn->status) {
+	case INSN_DEPRECATED:
+		insn->current_mode = INSN_EMULATE;
+		/* Disable the HW mode if it was turned on at early boot time */
+		run_all_cpu_set_hw_mode(insn, false);
+		insn->max = INSN_HW;
+		break;
+	case INSN_OBSOLETE:
+		insn->current_mode = INSN_UNDEF;
+		insn->max = INSN_EMULATE;
+		break;
+	case INSN_UNAVAILABLE:
+		insn->current_mode = INSN_UNDEF;
+		insn->max = INSN_UNDEF;
+		break;
+	}
+
+	/* Program the HW if required */
+	update_insn_emulation_mode(insn, INSN_UNDEF);
+
+	if (insn->status != INSN_UNAVAILABLE) {
+		sysctl = &insn->sysctl[0];
 
 		sysctl->mode = 0644;
 		sysctl->maxlen = sizeof(int);
@@ -600,11 +575,34 @@ static void __init register_insn_emulation_sysctl(void)
 		sysctl->extra1 = &insn->min;
 		sysctl->extra2 = &insn->max;
 		sysctl->proc_handler = emulation_proc_handler;
-		i++;
-	}
-	raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
 
-	register_sysctl("abi", insns_sysctl);
+		register_sysctl("abi", sysctl);
+	}
+}
+
+bool try_emulate_armv8_deprecated(struct pt_regs *regs, u32 insn)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(insn_emulations); i++) {
+		struct insn_emulation *ie = insn_emulations[i];
+
+		if (ie->status == INSN_UNAVAILABLE)
+			continue;
+
+		/*
+		 * A trap may race with the mode being changed
+		 * INSN_EMULATE<->INSN_HW. Try to emulate the instruction to
+		 * avoid a spurious UNDEF.
+		 */
+		if (READ_ONCE(ie->current_mode) == INSN_UNDEF)
+			continue;
+
+		if (ie->try_emulate(regs, insn))
+			return true;
+	}
+
+	return false;
 }
 
 /*
@@ -613,24 +611,27 @@ static void __init register_insn_emulation_sysctl(void)
  */
 static int __init armv8_deprecated_init(void)
 {
-	if (IS_ENABLED(CONFIG_SWP_EMULATION))
-		register_insn_emulation(&insn_swp);
+	int i;
 
-	if (IS_ENABLED(CONFIG_CP15_BARRIER_EMULATION))
-		register_insn_emulation(&insn_cp15_barrier);
+#ifdef CONFIG_SETEND_EMULATION
+	if (!system_supports_mixed_endian_el0()) {
+		insn_setend.status = INSN_UNAVAILABLE;
+		pr_info("setend instruction emulation is not supported on this system\n");
+	}
 
-	if (IS_ENABLED(CONFIG_SETEND_EMULATION)) {
-		if (system_supports_mixed_endian_el0())
-			register_insn_emulation(&insn_setend);
-		else
-			pr_info("setend instruction emulation is not supported on this system\n");
+#endif
+	for (i = 0; i < ARRAY_SIZE(insn_emulations); i++) {
+		struct insn_emulation *ie = insn_emulations[i];
+
+		if (ie->status == INSN_UNAVAILABLE)
+			continue;
+
+		register_insn_emulation(ie);
 	}
 
 	cpuhp_setup_state_nocalls(CPUHP_AP_ARM64_ISNDEP_STARTING,
 				  "arm64/isndep:starting",
 				  run_all_insn_set_hw_mode, NULL);
-	register_insn_emulation_sysctl();
-
 	return 0;
 }
 
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 7117837a8559..10a58017d024 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -282,27 +282,6 @@ void arm64_skip_faulting_instruction(struct pt_regs *regs, unsigned long size)
 		regs->pstate &= ~PSR_BTYPE_MASK;
 }
 
-static LIST_HEAD(undef_hook);
-static DEFINE_RAW_SPINLOCK(undef_lock);
-
-void register_undef_hook(struct undef_hook *hook)
-{
-	unsigned long flags;
-
-	raw_spin_lock_irqsave(&undef_lock, flags);
-	list_add(&hook->node, &undef_hook);
-	raw_spin_unlock_irqrestore(&undef_lock, flags);
-}
-
-void unregister_undef_hook(struct undef_hook *hook)
-{
-	unsigned long flags;
-
-	raw_spin_lock_irqsave(&undef_lock, flags);
-	list_del(&hook->node);
-	raw_spin_unlock_irqrestore(&undef_lock, flags);
-}
-
 static int user_insn_read(struct pt_regs *regs, u32 *insnp)
 {
 	u32 instr;
@@ -334,23 +313,6 @@ static int user_insn_read(struct pt_regs *regs, u32 *insnp)
 	return 0;
 }
 
-static int call_undef_hook(struct pt_regs *regs, u32 instr)
-{
-	struct undef_hook *hook;
-	unsigned long flags;
-	int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
-
-	raw_spin_lock_irqsave(&undef_lock, flags);
-	list_for_each_entry(hook, &undef_hook, node)
-		if ((instr & hook->instr_mask) == hook->instr_val &&
-			(regs->pstate & hook->pstate_mask) == hook->pstate_val)
-			fn = hook->fn;
-
-	raw_spin_unlock_irqrestore(&undef_lock, flags);
-
-	return fn ? fn(regs, instr) : 1;
-}
-
 void force_signal_inject(int signal, int code, unsigned long address, unsigned int err)
 {
 	const char *desc;
@@ -411,7 +373,7 @@ void do_el0_undef(struct pt_regs *regs, unsigned long esr)
 	if (try_emulate_mrs(regs, insn))
 		return;
 
-	if (call_undef_hook(regs, insn) == 0)
+	if (try_emulate_armv8_deprecated(regs, insn))
 		return;
 
 out_err:

From 489818719a88e129f00719ca301379f7b720788a Mon Sep 17 00:00:00 2001
From: Ren Zhijie <renzhijie2@huawei.com>
Date: Wed, 11 Oct 2023 10:05:45 +0000
Subject: [PATCH 0076/1043] arm64: armv8_deprecated: fix unused-function error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 223d3a0d30b6e9f979f5642e430e1753d3e29f89 upstream.

If CONFIG_SWP_EMULATION is not set and
CONFIG_CP15_BARRIER_EMULATION is not set,
aarch64-linux-gnu complained about unused-function :

arch/arm64/kernel/armv8_deprecated.c:67:21: error: ‘aarch32_check_condition’ defined but not used [-Werror=unused-function]
 static unsigned int aarch32_check_condition(u32 opcode, u32 psr)
                     ^~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors

To fix this warning, modify aarch32_check_condition() with __maybe_unused.

Fixes: 0c5f416219da ("arm64: armv8_deprecated: move aarch32 helper earlier")
Signed-off-by: Ren Zhijie <renzhijie2@huawei.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Link: https://lore.kernel.org/r/20221124022429.19024-1-renzhijie2@huawei.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/armv8_deprecated.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index fd529c6c108b..f0ba854f0045 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -64,7 +64,7 @@ struct insn_emulation {
 
 #define	ARM_OPCODE_CONDITION_UNCOND	0xf
 
-static unsigned int aarch32_check_condition(u32 opcode, u32 psr)
+static unsigned int __maybe_unused aarch32_check_condition(u32 opcode, u32 psr)
 {
 	u32 cc_bits  = opcode >> 28;
 

From f022576aa03c2385ea7f2b27ee5b331e43abf624 Mon Sep 17 00:00:00 2001
From: "yangx.jy@fujitsu.com" <yangx.jy@fujitsu.com>
Date: Wed, 31 Aug 2022 08:16:29 +0000
Subject: [PATCH 0077/1043] RDMA/srp: Set scmnd->result only when scmnd is not
 NULL

commit 12f35199a2c0551187edbf8eb01379f0598659fa upstream.

This change fixes the following kernel NULL pointer dereference
which is reproduced by blktests srp/007 occasionally.

BUG: kernel NULL pointer dereference, address: 0000000000000170
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 9 Comm: kworker/0:1H Kdump: loaded Not tainted 6.0.0-rc1+ #37
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qemu.org 04/01/2014
Workqueue:  0x0 (kblockd)
RIP: 0010:srp_recv_done+0x176/0x500 [ib_srp]
Code: 00 4d 85 ff 0f 84 52 02 00 00 48 c7 82 80 02 00 00 00 00 00 00 4c 89 df 4c 89 14 24 e8 53 d3 4a f6 4c 8b 14 24 41 0f b6 42 13 <41> 89 87 70 01 00 00 41 0f b6 52 12 f6 c2 02 74 44 41 8b 42 1c b9
RSP: 0018:ffffaef7c0003e28 EFLAGS: 00000282
RAX: 0000000000000000 RBX: ffff9bc9486dea60 RCX: 0000000000000000
RDX: 0000000000000102 RSI: ffffffffb76bbd0e RDI: 00000000ffffffff
RBP: ffff9bc980099a00 R08: 0000000000000001 R09: 0000000000000001
R10: ffff9bca53ef0000 R11: ffff9bc980099a10 R12: ffff9bc956e14000
R13: ffff9bc9836b9cb0 R14: ffff9bc9557b4480 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff9bc97ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 0000000007e04000 CR4: 00000000000006f0
Call Trace:
 <IRQ>
 __ib_process_cq+0xb7/0x280 [ib_core]
 ib_poll_handler+0x2b/0x130 [ib_core]
 irq_poll_softirq+0x93/0x150
 __do_softirq+0xee/0x4b8
 irq_exit_rcu+0xf7/0x130
 sysvec_apic_timer_interrupt+0x8e/0xc0
 </IRQ>

Fixes: ad215aaea4f9 ("RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent")
Link: https://lore.kernel.org/r/20220831081626.18712-1-yangx.jy@fujitsu.com
Signed-off-by: Xiao Yang <yangx.jy@fujitsu.com>
Acked-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/ulp/srp/ib_srp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 12bc24ee2d13..d392097f3d0f 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1955,7 +1955,8 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp)
 		if (scmnd) {
 			req = scsi_cmd_priv(scmnd);
 			scmnd = srp_claim_req(ch, req, NULL, scmnd);
-		} else {
+		}
+		if (!scmnd) {
 			shost_printk(KERN_ERR, target->scsi_host,
 				     "Null scmnd for RSP w/tag %#016llx received on ch %td / QP %#x\n",
 				     rsp->tag, ch - target->ch, ch->qp->qp_num);

From db375fa550c038c993473f715fb9239010ef5745 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Thu, 8 Sep 2022 16:31:39 -0700
Subject: [PATCH 0078/1043] RDMA/srp: Fix srp_abort()

commit 6dbe4a8dead84de474483910b02ec9e6a10fc1a9 upstream.

Fix the code for converting a SCSI command pointer into an SRP request
pointer.

Cc: Xiao Yang <yangx.jy@fujitsu.com>
Fixes: ad215aaea4f9 ("RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20220908233139.3042628-1-bvanassche@acm.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/ulp/srp/ib_srp.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index d392097f3d0f..68df080263f2 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -2778,15 +2778,13 @@ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun,
 static int srp_abort(struct scsi_cmnd *scmnd)
 {
 	struct srp_target_port *target = host_to_target(scmnd->device->host);
-	struct srp_request *req = (struct srp_request *) scmnd->host_scribble;
+	struct srp_request *req = scsi_cmd_priv(scmnd);
 	u32 tag;
 	u16 ch_idx;
 	struct srp_rdma_ch *ch;
 
 	shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
 
-	if (!req)
-		return SUCCESS;
 	tag = blk_mq_unique_tag(scmnd->request);
 	ch_idx = blk_mq_unique_tag_to_hwq(tag);
 	if (WARN_ON_ONCE(ch_idx >= target->ch_count))

From db9aafa19547833240f58c2998aed7baf414dc82 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Thu, 5 Oct 2023 10:12:01 +0900
Subject: [PATCH 0079/1043] ravb: Fix use-after-free issue in
 ravb_tx_timeout_work()

commit 3971442870713de527684398416970cf025b4f89 upstream.

The ravb_stop() should call cancel_work_sync(). Otherwise,
ravb_tx_timeout_work() is possible to use the freed priv after
ravb_remove() was called like below:

CPU0			CPU1
			ravb_tx_timeout()
ravb_remove()
unregister_netdev()
free_netdev(ndev)
// free priv
			ravb_tx_timeout_work()
			// use priv

unregister_netdev() will call .ndo_stop() so that ravb_stop() is
called. And, after phy_stop() is called, netif_carrier_off()
is also called. So that .ndo_tx_timeout() will not be called
after phy_stop().

Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Reported-by: Zheng Wang <zyytlz.wz@163.com>
Closes: https://lore.kernel.org/netdev/20230725030026.1664873-1-zyytlz.wz@163.com/
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/20231005011201.14368-3-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/renesas/ravb_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index a59da6a11976..f218bacec001 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1706,6 +1706,8 @@ static int ravb_close(struct net_device *ndev)
 			of_phy_deregister_fixed_link(np);
 	}
 
+	cancel_work_sync(&priv->work);
+
 	if (priv->chip_id != RCAR_GEN2) {
 		free_irq(priv->tx_irqs[RAVB_NC], ndev);
 		free_irq(priv->rx_irqs[RAVB_NC], ndev);

From c44b14469af07217074f6d83f08168a7aa438dd4 Mon Sep 17 00:00:00 2001
From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date: Thu, 24 Jun 2021 10:05:05 +0200
Subject: [PATCH 0080/1043] dev_forward_skb: do not scrub skb mark within the
 same name space

commit ff70202b2d1ad522275c6aadc8c53519b6a22c57 upstream.

The goal is to keep the mark during a bpf_redirect(), like it is done for
legacy encapsulation / decapsulation, when there is no x-netns.
This was initially done in commit 213dd74aee76 ("skbuff: Do not scrub skb
mark within the same name space").

When the call to skb_scrub_packet() was added in dev_forward_skb() (commit
8b27f27797ca ("skb: allow skb_scrub_packet() to be used by tunnels")), the
second argument (xnet) was set to true to force a call to skb_orphan(). At
this time, the mark was always cleanned up by skb_scrub_packet(), whatever
xnet value was.
This call to skb_orphan() was removed later in commit
9c4c325252c5 ("skbuff: preserve sock reference when scrubbing the skb.").
But this 'true' stayed here without any real reason.

Let's correctly set xnet in ____dev_forward_skb(), this function has access
to the previous interface and to the new interface.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/netdevice.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 302abfc2a1f6..e814ce78a196 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3972,7 +3972,7 @@ static __always_inline int ____dev_forward_skb(struct net_device *dev,
 		return NET_RX_DROP;
 	}
 
-	skb_scrub_packet(skb, true);
+	skb_scrub_packet(skb, !net_eq(dev_net(dev), dev_net(skb->dev)));
 	skb->priority = 0;
 	return 0;
 }

From bf97ea76eac5072ee2307475b6dea9266a84bcc8 Mon Sep 17 00:00:00 2001
From: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Date: Sat, 21 Jan 2023 12:39:42 +0900
Subject: [PATCH 0081/1043] lib/Kconfig.debug: do not enable DEBUG_PREEMPT by
 default

commit cc6003916ed46d7a67d91ee32de0f9138047d55f upstream.

In workloads where this_cpu operations are frequently performed,
enabling DEBUG_PREEMPT may result in significant increase in
runtime overhead due to frequent invocation of
__this_cpu_preempt_check() function.

This can be demonstrated through benchmarks such as hackbench where this
configuration results in a 10% reduction in performance, primarily due to
the added overhead within memcg charging path.

Therefore, do not to enable DEBUG_PREEMPT by default and make users aware
of its potential impact on performance in some workloads.

hackbench-process-sockets
		      debug_preempt	 no_debug_preempt
Amean     1       0.4743 (   0.00%)      0.4295 *   9.45%*
Amean     4       1.4191 (   0.00%)      1.2650 *  10.86%*
Amean     7       2.2677 (   0.00%)      2.0094 *  11.39%*
Amean     12      3.6821 (   0.00%)      3.2115 *  12.78%*
Amean     21      6.6752 (   0.00%)      5.7956 *  13.18%*
Amean     30      9.6646 (   0.00%)      8.5197 *  11.85%*
Amean     48     15.3363 (   0.00%)     13.5559 *  11.61%*
Amean     79     24.8603 (   0.00%)     22.0597 *  11.27%*
Amean     96     30.1240 (   0.00%)     26.8073 *  11.01%*

Link: https://lkml.kernel.org/r/20230121033942.350387-1-42.hyeyoo@gmail.com
Signed-off-by: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Acked-by: Roman Gushchin <roman.gushchin@linux.dev>
Acked-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Cc: Ben Segall <bsegall@google.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Steven Rostedt (Google) <rostedt@goodmis.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Valentin Schneider <vschneid@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Luiz Capitulino <luizcap@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/Kconfig.debug | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 19c28a34c5f1..24ca61cf86dd 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1136,13 +1136,16 @@ config DEBUG_TIMEKEEPING
 config DEBUG_PREEMPT
 	bool "Debug preemptible kernel"
 	depends on DEBUG_KERNEL && PREEMPTION && TRACE_IRQFLAGS_SUPPORT
-	default y
 	help
 	  If you say Y here then the kernel will use a debug variant of the
 	  commonly used smp_processor_id() function and will print warnings
 	  if kernel code uses it in a preemption-unsafe way. Also, the kernel
 	  will detect preemption count underflows.
 
+	  This option has potential to introduce high runtime overhead,
+	  depending on workload as it triggers debugging routines for each
+	  this_cpu operation. It should only be used for debugging purposes.
+
 menu "Lock Debugging (spinlocks, mutexes, etc...)"
 
 config LOCK_DEBUGGING_SUPPORT

From f10690787d2cf691a10bf0e7a9be574d1fda6bbe Mon Sep 17 00:00:00 2001
From: Liam Mark <lmark@codeaurora.org>
Date: Wed, 30 Jun 2021 18:52:43 -0700
Subject: [PATCH 0082/1043] mm/memory_hotplug: rate limit page migration
 warnings

commit 786dee864804f8e851cf0f258df2ccbb4ee03d80 upstream.

When offlining memory the system can attempt to migrate a lot of pages, if
there are problems with migration this can flood the logs.  Printing all
the data hogs the CPU and cause some RT threads to run for a long time,
which may have some bad consequences.

Rate limit the page migration warnings in order to avoid this.

Link: https://lkml.kernel.org/r/20210505140542.24935-1-georgi.djakov@linaro.org
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
Cc: David Hildenbrand <david@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <pjy@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/memory_hotplug.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 9ec9e1e67705..5286945470b9 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1279,6 +1279,8 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
 	struct page *page, *head;
 	int ret = 0;
 	LIST_HEAD(source);
+	static DEFINE_RATELIMIT_STATE(migrate_rs, DEFAULT_RATELIMIT_INTERVAL,
+				      DEFAULT_RATELIMIT_BURST);
 
 	for (pfn = start_pfn; pfn < end_pfn; pfn++) {
 		if (!pfn_valid(pfn))
@@ -1325,8 +1327,10 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
 						    page_is_file_lru(page));
 
 		} else {
-			pr_warn("failed to isolate pfn %lx\n", pfn);
-			dump_page(page, "isolation failed");
+			if (__ratelimit(&migrate_rs)) {
+				pr_warn("failed to isolate pfn %lx\n", pfn);
+				dump_page(page, "isolation failed");
+			}
 		}
 		put_page(page);
 	}
@@ -1355,9 +1359,11 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn)
 			(unsigned long)&mtc, MIGRATE_SYNC, MR_MEMORY_HOTPLUG);
 		if (ret) {
 			list_for_each_entry(page, &source, lru) {
-				pr_warn("migrating pfn %lx failed ret:%d ",
-				       page_to_pfn(page), ret);
-				dump_page(page, "migration failure");
+				if (__ratelimit(&migrate_rs)) {
+					pr_warn("migrating pfn %lx failed ret:%d\n",
+						page_to_pfn(page), ret);
+					dump_page(page, "migration failure");
+				}
 			}
 			putback_movable_pages(&source);
 		}

From aec24b09630002c0b6b8cf46db8538e82d0e6f94 Mon Sep 17 00:00:00 2001
From: Bagas Sanjaya <bagasdotme@gmail.com>
Date: Wed, 24 Aug 2022 10:58:04 +0700
Subject: [PATCH 0083/1043] Documentation: sysctl: align cells in second
 content column

commit 1faa34672f8a17a3e155e74bde9648564e9480d6 upstream.

Stephen Rothwell reported htmldocs warning when merging net-next tree:

Documentation/admin-guide/sysctl/net.rst:37: WARNING: Malformed table.
Text in column margin in table line 4.

========= =================== = ========== ==================
Directory Content               Directory  Content
========= =================== = ========== ==================
802       E802 protocol         mptcp     Multipath TCP
appletalk Appletalk protocol    netfilter Network Filter
ax25      AX25                  netrom     NET/ROM
bridge    Bridging              rose      X.25 PLP layer
core      General parameter     tipc      TIPC
ethernet  Ethernet protocol     unix      Unix domain sockets
ipv4      IP version 4          x25       X.25 protocol
ipv6      IP version 6
========= =================== = ========== ==================

The warning above is caused by cells in second "Content" column of
/proc/sys/net subdirectory table which are in column margin.

Align these cells against the column header to fix the warning.

Link: https://lore.kernel.org/linux-next/20220823134905.57ed08d5@canb.auug.org.au/
Fixes: 1202cdd665315c ("Remove DECnet support from kernel")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Link: https://lore.kernel.org/r/20220824035804.204322-1-bagasdotme@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/admin-guide/sysctl/net.rst | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/Documentation/admin-guide/sysctl/net.rst b/Documentation/admin-guide/sysctl/net.rst
index 4f1a686b4b64..1ba6c0b9c161 100644
--- a/Documentation/admin-guide/sysctl/net.rst
+++ b/Documentation/admin-guide/sysctl/net.rst
@@ -31,18 +31,18 @@ see only some of them, depending on your kernel's configuration.
 
 Table : Subdirectories in /proc/sys/net
 
- ========= =================== = ========== ==================
+ ========= =================== = ========== ===================
  Directory Content               Directory  Content
- ========= =================== = ========== ==================
- 802       E802 protocol         mptcp     Multipath TCP
- appletalk Appletalk protocol    netfilter Network Filter
+ ========= =================== = ========== ===================
+ 802       E802 protocol         mptcp      Multipath TCP
+ appletalk Appletalk protocol    netfilter  Network Filter
  ax25      AX25                  netrom     NET/ROM
- bridge    Bridging              rose      X.25 PLP layer
- core      General parameter     tipc      TIPC
- ethernet  Ethernet protocol     unix      Unix domain sockets
- ipv4      IP version 4          x25       X.25 protocol
+ bridge    Bridging              rose       X.25 PLP layer
+ core      General parameter     tipc       TIPC
+ ethernet  Ethernet protocol     unix       Unix domain sockets
+ ipv4      IP version 4          x25        X.25 protocol
  ipv6      IP version 6
- ========= =================== = ========== ==================
+ ========= =================== = ========== ===================
 
 1. /proc/sys/net/core - Network core options
 ============================================

From 241f230324337ed5eae3846a554fb6d15169872c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ricardo=20Ca=C3=B1uelo?= <ricardo.canuelo@collabora.com>
Date: Wed, 30 Aug 2023 12:04:18 +0200
Subject: [PATCH 0084/1043] usb: hub: Guard against accesses to uninitialized
 BOS descriptors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit f74a7afc224acd5e922c7a2e52244d891bbe44ee upstream.

Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h
access fields inside udev->bos without checking if it was allocated and
initialized. If usb_get_bos_descriptor() fails for whatever
reason, udev->bos will be NULL and those accesses will result in a
crash:

BUG: kernel NULL pointer dereference, address: 0000000000000018
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1>
Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021
Workqueue: usb_hub_wq hub_event
RIP: 0010:hub_port_reset+0x193/0x788
Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9
RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310
RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840
RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0
Call Trace:
hub_event+0x73f/0x156e
? hub_activate+0x5b7/0x68f
process_one_work+0x1a2/0x487
worker_thread+0x11a/0x288
kthread+0x13a/0x152
? process_one_work+0x487/0x487
? kthread_associate_blkcg+0x70/0x70
ret_from_fork+0x1f/0x30

Fall back to a default behavior if the BOS descriptor isn't accessible
and skip all the functionalities that depend on it: LPM support checks,
Super Speed capabilitiy checks, U1/U2 states setup.

Signed-off-by: Ricardo Cañuelo <ricardo.canuelo@collabora.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230830100418.1952143-1-ricardo.canuelo@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/hub.c | 28 ++++++++++++++++++++++++----
 drivers/usb/core/hub.h |  2 +-
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 580604596499..b91b01c2c5de 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -149,6 +149,10 @@ int usb_device_supports_lpm(struct usb_device *udev)
 	if (udev->quirks & USB_QUIRK_NO_LPM)
 		return 0;
 
+	/* Skip if the device BOS descriptor couldn't be read */
+	if (!udev->bos)
+		return 0;
+
 	/* USB 2.1 (and greater) devices indicate LPM support through
 	 * their USB 2.0 Extended Capabilities BOS descriptor.
 	 */
@@ -325,6 +329,10 @@ static void usb_set_lpm_parameters(struct usb_device *udev)
 	if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER)
 		return;
 
+	/* Skip if the device BOS descriptor couldn't be read */
+	if (!udev->bos)
+		return;
+
 	hub = usb_hub_to_struct_hub(udev->parent);
 	/* It doesn't take time to transition the roothub into U0, since it
 	 * doesn't have an upstream link.
@@ -2684,7 +2692,8 @@ int usb_authorize_device(struct usb_device *usb_dev)
 }
 
 /*
- * Return 1 if port speed is SuperSpeedPlus, 0 otherwise
+ * Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the
+ * capability couldn't be checked.
  * check it from the link protocol field of the current speed ID attribute.
  * current speed ID is got from ext port status request. Sublink speed attribute
  * table is returned with the hub BOS SSP device capability descriptor
@@ -2694,8 +2703,12 @@ static int port_speed_is_ssp(struct usb_device *hdev, int speed_id)
 	int ssa_count;
 	u32 ss_attr;
 	int i;
-	struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap;
+	struct usb_ssp_cap_descriptor *ssp_cap;
 
+	if (!hdev->bos)
+		return 0;
+
+	ssp_cap = hdev->bos->ssp_cap;
 	if (!ssp_cap)
 		return 0;
 
@@ -4114,8 +4127,15 @@ static void usb_enable_link_state(struct usb_hcd *hcd, struct usb_device *udev,
 		enum usb3_link_state state)
 {
 	int timeout, ret;
-	__u8 u1_mel = udev->bos->ss_cap->bU1devExitLat;
-	__le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat;
+	__u8 u1_mel;
+	__le16 u2_mel;
+
+	/* Skip if the device BOS descriptor couldn't be read */
+	if (!udev->bos)
+		return;
+
+	u1_mel = udev->bos->ss_cap->bU1devExitLat;
+	u2_mel = udev->bos->ss_cap->bU2DevExitLat;
 
 	/* If the device says it doesn't have *any* exit latency to come out of
 	 * U1 or U2, it's probably lying.  Assume it doesn't implement that link
diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h
index 22ea1f4f2d66..db4c7e2c5960 100644
--- a/drivers/usb/core/hub.h
+++ b/drivers/usb/core/hub.h
@@ -141,7 +141,7 @@ static inline int hub_is_superspeedplus(struct usb_device *hdev)
 {
 	return (hdev->descriptor.bDeviceProtocol == USB_HUB_PR_SS &&
 		le16_to_cpu(hdev->descriptor.bcdUSB) >= 0x0310 &&
-		hdev->bos->ssp_cap);
+		hdev->bos && hdev->bos->ssp_cap);
 }
 
 static inline unsigned hub_power_on_good_delay(struct usb_hub *hub)

From 0e025a4528f41fed8fc16c9515211dba319b0fda Mon Sep 17 00:00:00 2001
From: "Lee, Chun-Yi" <jlee@suse.com>
Date: Sun, 1 Oct 2023 16:59:31 +0800
Subject: [PATCH 0085/1043] Bluetooth: hci_event: Ignore NULL link key

commit 33155c4aae5260475def6f7438e4e35564f4f3ba upstream.

This change is used to relieve CVE-2020-26555. The description of the
CVE:

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification
1.0B through 5.2 may permit an unauthenticated nearby device to spoof
the BD_ADDR of the peer device to complete pairing without knowledge
of the PIN. [1]

The detail of this attack is in IEEE paper:
BlueMirror: Reflections on Bluetooth Pairing and Provisioning Protocols
[2]

It's a reflection attack. The paper mentioned that attacker can induce
the attacked target to generate null link key (zero key) without PIN
code. In BR/EDR, the key generation is actually handled in the controller
which is below HCI.

Thus, we can ignore null link key in the handler of "Link Key Notification
event" to relieve the attack. A similar implementation also shows in
btstack project. [3]

v3: Drop the connection when null link key be detected.

v2:
- Used Link: tag instead of Closes:
- Used bt_dev_dbg instead of BT_DBG
- Added Fixes: tag

Cc: stable@vger.kernel.org
Fixes: 55ed8ca10f35 ("Bluetooth: Implement link key handling for the management interface")
Link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26555 [1]
Link: https://ieeexplore.ieee.org/abstract/document/9474325/authors#authors [2]
Link: https://github.com/bluekitchen/btstack/blob/master/src/hci.c#L3722 [3]
Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_event.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index eb111504afc6..d6a0552b9e18 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4065,6 +4065,15 @@ static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
 	if (!conn)
 		goto unlock;
 
+	/* Ignore NULL link key against CVE-2020-26555 */
+	if (!memcmp(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
+		bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
+			   &ev->bdaddr);
+		hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+		hci_conn_drop(conn);
+		goto unlock;
+	}
+
 	hci_conn_hold(conn);
 	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
 	hci_conn_drop(conn);

From ab950561bca416489c0a5b0587a2a54acae234b1 Mon Sep 17 00:00:00 2001
From: "Lee, Chun-Yi" <jlee@suse.com>
Date: Sun, 1 Oct 2023 16:59:58 +0800
Subject: [PATCH 0086/1043] Bluetooth: Reject connection with the device which
 has same BD_ADDR

commit 1ffc6f8cc33268731fcf9629fc4438f6db1191fc upstream.

This change is used to relieve CVE-2020-26555. The description of
the CVE:

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification
1.0B through 5.2 may permit an unauthenticated nearby device to spoof
the BD_ADDR of the peer device to complete pairing without knowledge
of the PIN. [1]

The detail of this attack is in IEEE paper:
BlueMirror: Reflections on Bluetooth Pairing and Provisioning Protocols
[2]

It's a reflection attack. The paper mentioned that attacker can induce
the attacked target to generate null link key (zero key) without PIN
code. In BR/EDR, the key generation is actually handled in the controller
which is below HCI.

A condition of this attack is that attacker should change the
BR_ADDR of his hacking device (Host B) to equal to the BR_ADDR with
the target device being attacked (Host A).

Thus, we reject the connection with device which has same BD_ADDR
both on HCI_Create_Connection and HCI_Connection_Request to prevent
the attack. A similar implementation also shows in btstack project.
[3][4]

Cc: stable@vger.kernel.org
Link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26555 [1]
Link: https://ieeexplore.ieee.org/abstract/document/9474325/authors#authors [2]
Link: https://github.com/bluekitchen/btstack/blob/master/src/hci.c#L3523 [3]
Link: https://github.com/bluekitchen/btstack/blob/master/src/hci.c#L7297 [4]
Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_conn.c  |  9 +++++++++
 net/bluetooth/hci_event.c | 11 +++++++++++
 2 files changed, 20 insertions(+)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 140d9764c77e..f93a5ef919d1 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1249,6 +1249,15 @@ struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
 		return ERR_PTR(-EOPNOTSUPP);
 	}
 
+	/* Reject outgoing connection to device with same BD ADDR against
+	 * CVE-2020-26555
+	 */
+	if (!bacmp(&hdev->bdaddr, dst)) {
+		bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
+			   dst);
+		return ERR_PTR(-ECONNREFUSED);
+	}
+
 	acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 	if (!acl) {
 		acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d6a0552b9e18..76f94fafeebc 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2701,6 +2701,17 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 	BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
 	       ev->link_type);
 
+	/* Reject incoming connection from device with same BD ADDR against
+	 * CVE-2020-26555
+	 */
+	if (!bacmp(&hdev->bdaddr, &ev->bdaddr))
+	{
+		bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
+			   &ev->bdaddr);
+		hci_reject_conn(hdev, &ev->bdaddr);
+		return;
+	}
+
 	mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
 				      &flags);
 

From 40a33a129d99639921ce00d274cca44ba282f1ac Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Wed, 4 Oct 2023 20:42:24 +0800
Subject: [PATCH 0087/1043] Bluetooth: Fix a refcnt underflow problem for
 hci_conn

commit c7f59461f5a78994613afc112cdd73688aef9076 upstream.

Syzbot reports a warning as follows:

WARNING: CPU: 1 PID: 26946 at net/bluetooth/hci_conn.c:619
hci_conn_timeout+0x122/0x210 net/bluetooth/hci_conn.c:619
...
Call Trace:
 <TASK>
 process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
 process_scheduled_works kernel/workqueue.c:2703 [inline]
 worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
 kthread+0x33c/0x440 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 </TASK>

It is because the HCI_EV_SIMPLE_PAIR_COMPLETE event handler drops
hci_conn directly without check Simple Pairing whether be enabled. But
the Simple Pairing process can only be used if both sides have the
support enabled in the host stack.

Add hci_conn_ssp_enabled() for hci_conn in HCI_EV_IO_CAPA_REQUEST and
HCI_EV_SIMPLE_PAIR_COMPLETE event handlers to fix the problem.

Fixes: 0493684ed239 ("[Bluetooth] Disable disconnect timer during Simple Pairing")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_event.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 76f94fafeebc..b9c4bc1e3c86 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4617,7 +4617,7 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 	hci_dev_lock(hdev);
 
 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
-	if (!conn)
+	if (!conn || !hci_conn_ssp_enabled(conn))
 		goto unlock;
 
 	hci_conn_hold(conn);
@@ -4862,7 +4862,7 @@ static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
 	hci_dev_lock(hdev);
 
 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
-	if (!conn)
+	if (!conn || !hci_conn_ssp_enabled(conn))
 		goto unlock;
 
 	/* Reset the authentication requirement to unknown */

From c6878fa1730b8d9d59068b61593c63c7031f70e9 Mon Sep 17 00:00:00 2001
From: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
Date: Wed, 20 Sep 2023 17:30:07 +0200
Subject: [PATCH 0088/1043] Bluetooth: vhci: Fix race when opening vhci device

commit 92d4abd66f7080075793970fc8f241239e58a9e7 upstream.

When the vhci device is opened in the two-step way, i.e.: open device
then write a vendor packet with requested controller type, the device
shall respond with a vendor packet which includes HCI index of created
interface.

When the virtual HCI is created, the host sends a reset request to the
controller. This request is processed by the vhci_send_frame() function.
However, this request is send by a different thread, so it might happen
that this HCI request will be received before the vendor response is
queued in the read queue. This results in the HCI vendor response and
HCI reset request inversion in the read queue which leads to improper
behavior of btvirt:

> dmesg
[1754256.640122] Bluetooth: MGMT ver 1.22
[1754263.023806] Bluetooth: MGMT ver 1.22
[1754265.043775] Bluetooth: hci1: Opcode 0x c03 failed: -110

In order to synchronize vhci two-step open/setup process with virtual
HCI initialization, this patch adds internal lock when queuing data in
the vhci_send_frame() function.

Signed-off-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/bluetooth/hci_vhci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index 8469f9876dd2..31d70bad83d2 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -67,7 +67,10 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 	struct vhci_data *data = hci_get_drvdata(hdev);
 
 	memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
+
+	mutex_lock(&data->open_mutex);
 	skb_queue_tail(&data->readq, skb);
+	mutex_unlock(&data->open_mutex);
 
 	wake_up_interruptible(&data->read_wait);
 	return 0;

From 7e83d15e0ca2fdad203df5f8a0d5b47dd083eb2e Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Thu, 5 Oct 2023 14:12:19 -0700
Subject: [PATCH 0089/1043] Bluetooth: hci_event: Fix coding style

commit 35d91d95a0cd61ebb90e0246dc917fd25e519b8c upstream.

This fixes the following code style problem:

ERROR: that open brace { should be on the previous line
+	if (!bacmp(&hdev->bdaddr, &ev->bdaddr))
+	{

Fixes: 1ffc6f8cc332 ("Bluetooth: Reject connection with the device which has same BD_ADDR")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_event.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index b9c4bc1e3c86..5401e6abe205 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2704,8 +2704,7 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 	/* Reject incoming connection from device with same BD ADDR against
 	 * CVE-2020-26555
 	 */
-	if (!bacmp(&hdev->bdaddr, &ev->bdaddr))
-	{
+	if (!bacmp(&hdev->bdaddr, &ev->bdaddr)) {
 		bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
 			   &ev->bdaddr);
 		hci_reject_conn(hdev, &ev->bdaddr);

From a56c436b4335537df91f8446adbd5c02a2b0ced6 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 9 Oct 2023 22:31:31 +0200
Subject: [PATCH 0090/1043] Bluetooth: avoid memcmp() out of bounds warning

commit 9d1a3c74746428102d55371fbf74b484733937d9 upstream.

bacmp() is a wrapper around memcpy(), which contain compile-time
checks for buffer overflow. Since the hci_conn_request_evt() also calls
bt_dev_dbg() with an implicit NULL pointer check, the compiler is now
aware of a case where 'hdev' is NULL and treats this as meaning that
zero bytes are available:

In file included from net/bluetooth/hci_event.c:32:
In function 'bacmp',
    inlined from 'hci_conn_request_evt' at net/bluetooth/hci_event.c:3276:7:
include/net/bluetooth/bluetooth.h:364:16: error: 'memcmp' specified bound 6 exceeds source size 0 [-Werror=stringop-overread]
  364 |         return memcmp(ba1, ba2, sizeof(bdaddr_t));
      |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Add another NULL pointer check before the bacmp() to ensure the compiler
understands the code flow enough to not warn about it.  Since the patch
that introduced the warning is marked for stable backports, this one
should also go that way to avoid introducing build regressions.

Fixes: 1ffc6f8cc332 ("Bluetooth: Reject connection with the device which has same BD_ADDR")
Cc: Kees Cook <keescook@chromium.org>
Cc: "Lee, Chun-Yi" <jlee@suse.com>
Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_event.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 5401e6abe205..c0a210324141 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2704,7 +2704,7 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 	/* Reject incoming connection from device with same BD ADDR against
 	 * CVE-2020-26555
 	 */
-	if (!bacmp(&hdev->bdaddr, &ev->bdaddr)) {
+	if (hdev && !bacmp(&hdev->bdaddr, &ev->bdaddr)) {
 		bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
 			   &ev->bdaddr);
 		hci_reject_conn(hdev, &ev->bdaddr);

From 95d68fdc71ba605825831b32a8d89c3901fc7c03 Mon Sep 17 00:00:00 2001
From: Jesse Brandeburg <jesse.brandeburg@intel.com>
Date: Tue, 10 Oct 2023 13:30:59 -0700
Subject: [PATCH 0091/1043] ice: fix over-shifted variable

commit 242e34500a32631f85c2b4eb6cb42a368a39e54f upstream.

Since the introduction of the ice driver the code has been
double-shifting the RSS enabling field, because the define already has
shifts in it and can't have the regular pattern of "a << shiftval &
mask" applied.

Most places in the code got it right, but one line was still wrong. Fix
this one location for easy backports to stable. An in-progress patch
fixes the defines to "standard" and will be applied as part of the
regular -next process sometime after this one.

Fixes: d76a60ba7afb ("ice: Add support for VLANs and offloads")
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
CC: stable@vger.kernel.org
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://lore.kernel.org/r/20231010203101.406248-1-jacob.e.keller@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/ice/ice_lib.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
index ea8d868c8f30..e99c8c10bc61 100644
--- a/drivers/net/ethernet/intel/ice/ice_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_lib.c
@@ -931,8 +931,7 @@ static void ice_set_rss_vsi_ctx(struct ice_vsi_ctx *ctxt, struct ice_vsi *vsi)
 
 	ctxt->info.q_opt_rss = ((lut_type << ICE_AQ_VSI_Q_OPT_RSS_LUT_S) &
 				ICE_AQ_VSI_Q_OPT_RSS_LUT_M) |
-				((hash_type << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) &
-				 ICE_AQ_VSI_Q_OPT_RSS_HASH_M);
+				(hash_type & ICE_AQ_VSI_Q_OPT_RSS_HASH_M);
 }
 
 /**

From 2e64f4c732cb129c73f04dee2213aeb8ecb1e27c Mon Sep 17 00:00:00 2001
From: Jesse Brandeburg <jesse.brandeburg@intel.com>
Date: Wed, 11 Oct 2023 16:33:33 -0700
Subject: [PATCH 0092/1043] ice: reset first in crash dump kernels

commit 0288c3e709e5fabd51e84715c5c798a02f43061a upstream.

When the system boots into the crash dump kernel after a panic, the ice
networking device may still have pending transactions that can cause errors
or machine checks when the device is re-enabled. This can prevent the crash
dump kernel from loading the driver or collecting the crash data.

To avoid this issue, perform a function level reset (FLR) on the ice device
via PCIe config space before enabling it on the crash kernel. This will
clear any outstanding transactions and stop all queues and interrupts.
Restore the config space after the FLR, otherwise it was found in testing
that the driver wouldn't load successfully.

The following sequence causes the original issue:
- Load the ice driver with modprobe ice
- Enable SR-IOV with 2 VFs: echo 2 > /sys/class/net/eth0/device/sriov_num_vfs
- Trigger a crash with echo c > /proc/sysrq-trigger
- Load the ice driver again (or let it load automatically) with modprobe ice
- The system crashes again during pcim_enable_device()

Fixes: 837f08fdecbe ("ice: Add basic driver framework for Intel(R) E800 Series")
Reported-by: Vishal Agrawal <vagrawal@redhat.com>
Reviewed-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Link: https://lore.kernel.org/r/20231011233334.336092-3-jacob.e.keller@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/ice/ice_main.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index d2ee760f9294..02f72fbec104 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -6,6 +6,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <generated/utsrelease.h>
+#include <linux/crash_dump.h>
 #include "ice.h"
 #include "ice_base.h"
 #include "ice_lib.h"
@@ -4025,6 +4026,20 @@ ice_probe(struct pci_dev *pdev, const struct pci_device_id __always_unused *ent)
 		return -EINVAL;
 	}
 
+	/* when under a kdump kernel initiate a reset before enabling the
+	 * device in order to clear out any pending DMA transactions. These
+	 * transactions can cause some systems to machine check when doing
+	 * the pcim_enable_device() below.
+	 */
+	if (is_kdump_kernel()) {
+		pci_save_state(pdev);
+		pci_clear_master(pdev);
+		err = pcie_flr(pdev);
+		if (err)
+			return err;
+		pci_restore_state(pdev);
+	}
+
 	/* this driver uses devres, see
 	 * Documentation/driver-api/driver-model/devres.rst
 	 */

From c95fa5b20fe03609e0894656fa43c18045b5097e Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date: Fri, 13 Oct 2023 20:41:29 +0200
Subject: [PATCH 0093/1043] nfc: nci: fix possible NULL pointer dereference in
 send_acknowledge()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 7937609cd387246aed994e81aa4fa951358fba41 upstream.

Handle memory allocation failure from nci_skb_alloc() (calling
alloc_skb()) to avoid possible NULL pointer dereference.

Reported-by: 黄思聪 <huangsicong@iie.ac.cn>
Fixes: 391d8a2da787 ("NFC: Add NCI over SPI receive")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20231013184129.18738-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/nci/spi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/nfc/nci/spi.c b/net/nfc/nci/spi.c
index 7d8e10e27c20..0651640d6868 100644
--- a/net/nfc/nci/spi.c
+++ b/net/nfc/nci/spi.c
@@ -151,6 +151,8 @@ static int send_acknowledge(struct nci_spi *nspi, u8 acknowledge)
 	int ret;
 
 	skb = nci_skb_alloc(nspi->ndev, 0, GFP_KERNEL);
+	if (!skb)
+		return -ENOMEM;
 
 	/* add the NCI SPI header to the start of the buffer */
 	hdr = skb_push(skb, NCI_SPI_HDR_LEN);

From 4cbac83549dd87da9ffa41a74e004f743285478e Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro@kernel.org>
Date: Fri, 6 Oct 2023 10:21:04 +0200
Subject: [PATCH 0094/1043] regmap: fix NULL deref on lookup

commit c6df843348d6b71ea986266c12831cb60c2cf325 upstream.

Not all regmaps have a name so make sure to check for that to avoid
dereferencing a NULL pointer when dev_get_regmap() is used to lookup a
named regmap.

Fixes: e84861fec32d ("regmap: dev_get_regmap_match(): fix string comparison")
Cc: stable@vger.kernel.org      # 5.8
Cc: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20231006082104.16707-1-johan+linaro@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/regmap/regmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 55a30afc14a0..3edff8606ac9 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1511,7 +1511,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data)
 
 	/* If the user didn't specify a name match any */
 	if (data)
-		return !strcmp((*r)->name, data);
+		return (*r)->name && !strcmp((*r)->name, data);
 	else
 		return 1;
 }

From 459af3fb81e6e2f6cf8ea7b67f3b9062b0361f96 Mon Sep 17 00:00:00 2001
From: Jim Mattson <jmattson@google.com>
Date: Mon, 25 Sep 2023 17:34:47 +0000
Subject: [PATCH 0095/1043] KVM: x86: Mask LVTPC when handling a PMI

commit a16eb25b09c02a54c1c1b449d4b6cfa2cf3f013a upstream.

Per the SDM, "When the local APIC handles a performance-monitoring
counters interrupt, it automatically sets the mask flag in the LVT
performance counter register."  Add this behavior to KVM's local APIC
emulation.

Failure to mask the LVTPC entry results in spurious PMIs, e.g. when
running Linux as a guest, PMI handlers that do a "late_ack" spew a large
number of "dazed and confused" spurious NMI warnings.

Fixes: f5132b01386b ("KVM: Expose a version 2 architectural PMU to a guests")
Cc: stable@vger.kernel.org
Signed-off-by: Jim Mattson <jmattson@google.com>
Tested-by: Mingwei Zhang <mizhang@google.com>
Signed-off-by: Mingwei Zhang <mizhang@google.com>
Link: https://lore.kernel.org/r/20230925173448.3518223-3-mizhang@google.com
[sean: massage changelog, correct Fixes]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/lapic.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 21189804524a..a40408895e23 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2397,13 +2397,17 @@ int kvm_apic_local_deliver(struct kvm_lapic *apic, int lvt_type)
 {
 	u32 reg = kvm_lapic_get_reg(apic, lvt_type);
 	int vector, mode, trig_mode;
+	int r;
 
 	if (kvm_apic_hw_enabled(apic) && !(reg & APIC_LVT_MASKED)) {
 		vector = reg & APIC_VECTOR_MASK;
 		mode = reg & APIC_MODE_MASK;
 		trig_mode = reg & APIC_LVT_LEVEL_TRIGGER;
-		return __apic_accept_irq(apic, mode, vector, 1, trig_mode,
-					NULL);
+
+		r = __apic_accept_irq(apic, mode, vector, 1, trig_mode, NULL);
+		if (r && lvt_type == APIC_LVTPC)
+			kvm_lapic_set_reg(apic, APIC_LVTPC, reg | APIC_LVT_MASKED);
+		return r;
 	}
 	return 0;
 }

From d78c5d8c23c3f0e24168ea98760016665bf92a79 Mon Sep 17 00:00:00 2001
From: "Borislav Petkov (AMD)" <bp@alien8.de>
Date: Thu, 5 Oct 2023 11:06:36 +0200
Subject: [PATCH 0096/1043] x86/sev: Disable MMIO emulation from user mode

Upstream commit: a37cd2a59d0cb270b1bba568fd3a3b8668b9d3ba

A virt scenario can be constructed where MMIO memory can be user memory.
When that happens, a race condition opens between when the hardware
raises the #VC and when the #VC handler gets to emulate the instruction.

If the MOVS is replaced with a MOVS accessing kernel memory in that
small race window, then write to kernel memory happens as the access
checks are not done at emulation time.

Disable MMIO emulation in user mode temporarily until a sensible use
case appears and justifies properly handling the race window.

Fixes: 0118b604c2c9 ("x86/sev-es: Handle MMIO String Instructions")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: Tom Dohrmann <erbse.13@gmx.de>
Cc: <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/sev-es.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c
index f441002c2327..ec2150b6fdc5 100644
--- a/arch/x86/kernel/sev-es.c
+++ b/arch/x86/kernel/sev-es.c
@@ -970,6 +970,9 @@ static enum es_result vc_handle_mmio(struct ghcb *ghcb,
 	enum es_result ret;
 	long *reg_data;
 
+	if (user_mode(ctxt->regs))
+		return ES_UNSUPPORTED;
+
 	switch (insn->opcode.bytes[0]) {
 	/* MMIO Write */
 	case 0x88:

From 5bb9ba7dafbe18e027e335f74372ca65f07f7edd Mon Sep 17 00:00:00 2001
From: Joerg Roedel <jroedel@suse.de>
Date: Wed, 21 Jun 2023 17:42:42 +0200
Subject: [PATCH 0097/1043] x86/sev: Check IOBM for IOIO exceptions from
 user-space

Upstream commit: b9cb9c45583b911e0db71d09caa6b56469eb2bdf

Check the IO permission bitmap (if present) before emulating IOIO #VC
exceptions for user-space. These permissions are checked by hardware
already before the #VC is raised, but due to the VC-handler decoding
race it needs to be checked again in software.

Fixes: 25189d08e516 ("x86/sev-es: Add support for handling IOIO exceptions")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: Tom Dohrmann <erbse.13@gmx.de>
Cc: <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/boot/compressed/sev-es.c |  5 +++++
 arch/x86/kernel/sev-es-shared.c   | 22 +++++++++++++++-------
 arch/x86/kernel/sev-es.c          | 27 +++++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/arch/x86/boot/compressed/sev-es.c b/arch/x86/boot/compressed/sev-es.c
index 27826c265aab..0c2c87696d03 100644
--- a/arch/x86/boot/compressed/sev-es.c
+++ b/arch/x86/boot/compressed/sev-es.c
@@ -106,6 +106,11 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt,
 	return ES_OK;
 }
 
+static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t size)
+{
+	return ES_OK;
+}
+
 #undef __init
 #undef __pa
 #define __init
diff --git a/arch/x86/kernel/sev-es-shared.c b/arch/x86/kernel/sev-es-shared.c
index 82db4014deb2..ec699f113fa9 100644
--- a/arch/x86/kernel/sev-es-shared.c
+++ b/arch/x86/kernel/sev-es-shared.c
@@ -281,6 +281,9 @@ static enum es_result vc_insn_string_write(struct es_em_ctxt *ctxt,
 static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)
 {
 	struct insn *insn = &ctxt->insn;
+	size_t size;
+	u64 port;
+
 	*exitinfo = 0;
 
 	switch (insn->opcode.bytes[0]) {
@@ -289,7 +292,7 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)
 	case 0x6d:
 		*exitinfo |= IOIO_TYPE_INS;
 		*exitinfo |= IOIO_SEG_ES;
-		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+		port	   = ctxt->regs->dx & 0xffff;
 		break;
 
 	/* OUTS opcodes */
@@ -297,41 +300,43 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)
 	case 0x6f:
 		*exitinfo |= IOIO_TYPE_OUTS;
 		*exitinfo |= IOIO_SEG_DS;
-		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+		port	   = ctxt->regs->dx & 0xffff;
 		break;
 
 	/* IN immediate opcodes */
 	case 0xe4:
 	case 0xe5:
 		*exitinfo |= IOIO_TYPE_IN;
-		*exitinfo |= (u8)insn->immediate.value << 16;
+		port	   = (u8)insn->immediate.value & 0xffff;
 		break;
 
 	/* OUT immediate opcodes */
 	case 0xe6:
 	case 0xe7:
 		*exitinfo |= IOIO_TYPE_OUT;
-		*exitinfo |= (u8)insn->immediate.value << 16;
+		port	   = (u8)insn->immediate.value & 0xffff;
 		break;
 
 	/* IN register opcodes */
 	case 0xec:
 	case 0xed:
 		*exitinfo |= IOIO_TYPE_IN;
-		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+		port	   = ctxt->regs->dx & 0xffff;
 		break;
 
 	/* OUT register opcodes */
 	case 0xee:
 	case 0xef:
 		*exitinfo |= IOIO_TYPE_OUT;
-		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+		port	   = ctxt->regs->dx & 0xffff;
 		break;
 
 	default:
 		return ES_DECODE_FAILED;
 	}
 
+	*exitinfo |= port << 16;
+
 	switch (insn->opcode.bytes[0]) {
 	case 0x6c:
 	case 0x6e:
@@ -341,12 +346,15 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)
 	case 0xee:
 		/* Single byte opcodes */
 		*exitinfo |= IOIO_DATA_8;
+		size       = 1;
 		break;
 	default:
 		/* Length determined by instruction parsing */
 		*exitinfo |= (insn->opnd_bytes == 2) ? IOIO_DATA_16
 						     : IOIO_DATA_32;
+		size       = (insn->opnd_bytes == 2) ? 2 : 4;
 	}
+
 	switch (insn->addr_bytes) {
 	case 2:
 		*exitinfo |= IOIO_ADDR_16;
@@ -362,7 +370,7 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)
 	if (insn_has_rep_prefix(insn))
 		*exitinfo |= IOIO_REP;
 
-	return ES_OK;
+	return vc_ioio_check(ctxt, (u16)port, size);
 }
 
 static enum es_result vc_handle_ioio(struct ghcb *ghcb, struct es_em_ctxt *ctxt)
diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c
index ec2150b6fdc5..b6f9fe0d6173 100644
--- a/arch/x86/kernel/sev-es.c
+++ b/arch/x86/kernel/sev-es.c
@@ -448,6 +448,33 @@ static enum es_result vc_slow_virt_to_phys(struct ghcb *ghcb, struct es_em_ctxt
 	return ES_OK;
 }
 
+static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t size)
+{
+	BUG_ON(size > 4);
+
+	if (user_mode(ctxt->regs)) {
+		struct thread_struct *t = &current->thread;
+		struct io_bitmap *iobm = t->io_bitmap;
+		size_t idx;
+
+		if (!iobm)
+			goto fault;
+
+		for (idx = port; idx < port + size; ++idx) {
+			if (test_bit(idx, iobm->bitmap))
+				goto fault;
+		}
+	}
+
+	return ES_OK;
+
+fault:
+	ctxt->fi.vector = X86_TRAP_GP;
+	ctxt->fi.error_code = 0;
+
+	return ES_EXCEPTION;
+}
+
 /* Include code shared with pre-decompression boot stage */
 #include "sev-es-shared.c"
 

From 6550cbe25de182f6c0176909a90b324cb375133f Mon Sep 17 00:00:00 2001
From: Joerg Roedel <jroedel@suse.de>
Date: Mon, 16 Oct 2023 14:42:50 +0200
Subject: [PATCH 0098/1043] x86/sev: Check for user-space IOIO pointing to
 kernel space

Upstream commit: 63e44bc52047f182601e7817da969a105aa1f721

Check the memory operand of INS/OUTS before emulating the instruction.
The #VC exception can get raised from user-space, but the memory operand
can be manipulated to access kernel memory before the emulation actually
begins and after the exception handler has run.

  [ bp: Massage commit message. ]

Fixes: 597cfe48212a ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/boot/compressed/sev-es.c |  5 +++++
 arch/x86/kernel/sev-es-shared.c   | 31 +++++++++++++++++++++++++++++--
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/arch/x86/boot/compressed/sev-es.c b/arch/x86/boot/compressed/sev-es.c
index 0c2c87696d03..e23748fa2d5f 100644
--- a/arch/x86/boot/compressed/sev-es.c
+++ b/arch/x86/boot/compressed/sev-es.c
@@ -111,6 +111,11 @@ static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t si
 	return ES_OK;
 }
 
+static bool fault_in_kernel_space(unsigned long address)
+{
+	return false;
+}
+
 #undef __init
 #undef __pa
 #define __init
diff --git a/arch/x86/kernel/sev-es-shared.c b/arch/x86/kernel/sev-es-shared.c
index ec699f113fa9..e9f8a2bc5de9 100644
--- a/arch/x86/kernel/sev-es-shared.c
+++ b/arch/x86/kernel/sev-es-shared.c
@@ -217,6 +217,23 @@ void __init do_vc_no_ghcb(struct pt_regs *regs, unsigned long exit_code)
 		asm volatile("hlt\n");
 }
 
+static enum es_result vc_insn_string_check(struct es_em_ctxt *ctxt,
+					   unsigned long address,
+					   bool write)
+{
+	if (user_mode(ctxt->regs) && fault_in_kernel_space(address)) {
+		ctxt->fi.vector     = X86_TRAP_PF;
+		ctxt->fi.error_code = X86_PF_USER;
+		ctxt->fi.cr2        = address;
+		if (write)
+			ctxt->fi.error_code |= X86_PF_WRITE;
+
+		return ES_EXCEPTION;
+	}
+
+	return ES_OK;
+}
+
 static enum es_result vc_insn_string_read(struct es_em_ctxt *ctxt,
 					  void *src, char *buf,
 					  unsigned int data_size,
@@ -224,7 +241,12 @@ static enum es_result vc_insn_string_read(struct es_em_ctxt *ctxt,
 					  bool backwards)
 {
 	int i, b = backwards ? -1 : 1;
-	enum es_result ret = ES_OK;
+	unsigned long address = (unsigned long)src;
+	enum es_result ret;
+
+	ret = vc_insn_string_check(ctxt, address, false);
+	if (ret != ES_OK)
+		return ret;
 
 	for (i = 0; i < count; i++) {
 		void *s = src + (i * data_size * b);
@@ -245,7 +267,12 @@ static enum es_result vc_insn_string_write(struct es_em_ctxt *ctxt,
 					   bool backwards)
 {
 	int i, s = backwards ? -1 : 1;
-	enum es_result ret = ES_OK;
+	unsigned long address = (unsigned long)dst;
+	enum es_result ret;
+
+	ret = vc_insn_string_check(ctxt, address, true);
+	if (ret != ES_OK)
+		return ret;
 
 	for (i = 0; i < count; i++) {
 		void *d = dst + (i * data_size * s);

From fe37e56ed47d8789f2be2076fed7c1a6085c60de Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Wed, 18 Oct 2023 11:23:53 -0700
Subject: [PATCH 0099/1043] tcp: check mptcp-level constraints for backlog
 coalescing

commit 6db8a37dfc541e059851652cfd4f0bb13b8ff6af upstream.

The MPTCP protocol can acquire the subflow-level socket lock and
cause the tcp backlog usage. When inserting new skbs into the
backlog, the stack will try to coalesce them.

Currently, we have no check in place to ensure that such coalescing
will respect the MPTCP-level DSS, and that may cause data stream
corruption, as reported by Christoph.

Address the issue by adding the relevant admission check for coalescing
in tcp_add_backlog().

Note the issue is not easy to reproduce, as the MPTCP protocol tries
hard to avoid acquiring the subflow-level socket lock.

Fixes: 648ef4b88673 ("mptcp: Implement MPTCP receive path")
Cc: stable@vger.kernel.org
Reported-by: Christoph Paasch <cpaasch@apple.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/420
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <martineau@kernel.org>
Link: https://lore.kernel.org/r/20231018-send-net-20231018-v1-2-17ecb002e41d@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_ipv4.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index b40780fde791..7a94acbd9f14 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1832,6 +1832,7 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb)
 #ifdef CONFIG_TLS_DEVICE
 	    tail->decrypted != skb->decrypted ||
 #endif
+	    !mptcp_skb_can_collapse(tail, skb) ||
 	    thtail->doff != th->doff ||
 	    memcmp(thtail + 1, th + 1, hdrlen - sizeof(*th)))
 		goto no_coalesce;

From 287401f92c57dd0006ab9c18295edc42ef08f87d Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Sun, 8 Oct 2023 19:36:53 +0200
Subject: [PATCH 0100/1043] netfilter: nft_payload: fix wrong mac header
 matching
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit d351c1ea2de3e36e608fc355d8ae7d0cc80e6cd6 upstream.

mcast packets get looped back to the local machine.
Such packets have a 0-length mac header, we should treat
this like "mac header not set" and abort rule evaluation.

As-is, we just copy data from the network header instead.

Fixes: 96518518cc41 ("netfilter: add nftables")
Reported-by: Blažej Krajňák <krajnak@levonet.sk>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nft_payload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index b2b63c3653d4..56f6c05362ae 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -93,7 +93,7 @@ void nft_payload_eval(const struct nft_expr *expr,
 
 	switch (priv->base) {
 	case NFT_PAYLOAD_LL_HEADER:
-		if (!skb_mac_header_was_set(skb))
+		if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) == 0)
 			goto err;
 
 		if (skb_vlan_tag_present(skb)) {

From e985d78bdcf37f7ef73666a43b0d2407715f00d3 Mon Sep 17 00:00:00 2001
From: Sagi Grimberg <sagi@grimberg.me>
Date: Mon, 2 Oct 2023 13:54:28 +0300
Subject: [PATCH 0101/1043] nvmet-tcp: Fix a possible UAF in queue
 intialization setup

commit d920abd1e7c4884f9ecd0749d1921b7ab19ddfbd upstream.

From Alon:
"Due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel,
a malicious user can cause a UAF and a double free, which may lead to
RCE (may also lead to an LPE in case the attacker already has local
privileges)."

Hence, when a queue initialization fails after the ahash requests are
allocated, it is guaranteed that the queue removal async work will be
called, hence leave the deallocation to the queue removal.

Also, be extra careful not to continue processing the socket, so set
queue rcv_state to NVMET_TCP_RECV_ERR upon a socket error.

Cc: stable@vger.kernel.org
Reported-by: Alon Zahavi <zahavi.alon@gmail.com>
Tested-by: Alon Zahavi <zahavi.alon@gmail.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/target/tcp.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 2ddbd4f4f628..7ce22d173fc7 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -336,6 +336,7 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue)
 
 static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status)
 {
+	queue->rcv_state = NVMET_TCP_RECV_ERR;
 	if (status == -EPIPE || status == -ECONNRESET)
 		kernel_sock_shutdown(queue->sock, SHUT_RDWR);
 	else
@@ -882,15 +883,11 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue)
 	iov.iov_len = sizeof(*icresp);
 	ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
 	if (ret < 0)
-		goto free_crypto;
+		return ret; /* queue removal will cleanup */
 
 	queue->state = NVMET_TCP_Q_LIVE;
 	nvmet_prepare_receive_pdu(queue);
 	return 0;
-free_crypto:
-	if (queue->hdr_digest || queue->data_digest)
-		nvmet_tcp_free_crypto(queue);
-	return ret;
 }
 
 static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue,

From 88c493297e4011958cf5a73098272fa1a64998e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
Date: Thu, 12 Oct 2023 16:28:01 +0300
Subject: [PATCH 0102/1043] drm/i915: Retry gtt fault when out of fence
 registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e339c6d628fe66c9b64bf31040a55770952aec57 upstream.

If we can't find a free fence register to handle a fault in the GMADR
range just return VM_FAULT_NOPAGE without populating the PTE so that
userspace will retry the access and trigger another fault. Eventually
we should find a free fence and the fault will get properly handled.

A further improvement idea might be to reserve a fence (or one per CPU?)
for the express purpose of handling faults without having to retry. But
that would require some additional work.

Looks like this may have gotten broken originally by
commit 39965b376601 ("drm/i915: don't trash the gtt when running out of fences")
as that changed the errno to -EDEADLK which wasn't handle by the gtt
fault code either. But later in commit 2feeb52859fc ("drm/i915/gt: Fix
-EDEADLK handling regression") I changed it again to -ENOBUFS as -EDEADLK
was now getting used for the ww mutex dance. So this fix only makes
sense after that last commit.

Cc: stable@vger.kernel.org
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9479
Fixes: 2feeb52859fc ("drm/i915/gt: Fix -EDEADLK handling regression")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231012132801.16292-1-ville.syrjala@linux.intel.com
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
(cherry picked from commit 7f403caabe811b88ab0de3811ff3f4782c415761)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/i915/gem/i915_gem_mman.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
index 92dd65befbcb..01a88b03bc6d 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
@@ -222,6 +222,7 @@ static vm_fault_t i915_error_to_vmf_fault(int err)
 	case 0:
 	case -EAGAIN:
 	case -ENOSPC: /* transient failure to evict? */
+	case -ENOBUFS: /* temporarily out of fences? */
 	case -ERESTARTSYS:
 	case -EINTR:
 	case -EBUSY:

From 8c6c3d0b9f2e4cbb53dd0c2a78baef8bae5b1a46 Mon Sep 17 00:00:00 2001
From: Manish Chopra <manishc@marvell.com>
Date: Fri, 13 Oct 2023 18:48:12 +0530
Subject: [PATCH 0103/1043] qed: fix LL2 RX buffer allocation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 2f3389c73832ad90b63208c0fc281ad080114c7a upstream.

Driver allocates the LL2 rx buffers from kmalloc()
area to construct the skb using slab_build_skb()

The required size allocation seems to have overlooked
for accounting both skb_shared_info size and device
placement padding bytes which results into the below
panic when doing skb_put() for a standard MTU sized frame.

skbuff: skb_over_panic: text:ffffffffc0b0225f len:1514 put:1514
head:ff3dabceaf39c000 data:ff3dabceaf39c042 tail:0x62c end:0x566
dev:<NULL>
…
skb_panic+0x48/0x4a
skb_put.cold+0x10/0x10
qed_ll2b_complete_rx_packet+0x14f/0x260 [qed]
qed_ll2_rxq_handle_completion.constprop.0+0x169/0x200 [qed]
qed_ll2_rxq_completion+0xba/0x320 [qed]
qed_int_sp_dpc+0x1a7/0x1e0 [qed]

This patch fixes this by accouting skb_shared_info and device
placement padding size bytes when allocating the buffers.

Cc: David S. Miller <davem@davemloft.net>
Fixes: 0a7fb11c23c0 ("qed: Add Light L2 support")
Signed-off-by: Manish Chopra <manishc@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index f2c8273dce67..3f59834a0d3a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -87,7 +87,10 @@ static void qed_ll2b_complete_tx_packet(void *cxt,
 static int qed_ll2_alloc_buffer(struct qed_dev *cdev,
 				u8 **data, dma_addr_t *phys_addr)
 {
-	*data = kmalloc(cdev->ll2->rx_size, GFP_ATOMIC);
+	size_t size = cdev->ll2->rx_size + NET_SKB_PAD +
+		      SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+
+	*data = kmalloc(size, GFP_ATOMIC);
 	if (!(*data)) {
 		DP_INFO(cdev, "Failed to allocate LL2 buffer data\n");
 		return -ENOMEM;
@@ -2541,7 +2544,7 @@ static int qed_ll2_start(struct qed_dev *cdev, struct qed_ll2_params *params)
 	INIT_LIST_HEAD(&cdev->ll2->list);
 	spin_lock_init(&cdev->ll2->lock);
 
-	cdev->ll2->rx_size = NET_SKB_PAD + ETH_HLEN +
+	cdev->ll2->rx_size = PRM_DMA_PAD_BYTES_NUM + ETH_HLEN +
 			     L1_CACHE_BYTES + params->mtu;
 
 	/* Allocate memory for LL2.

From 4d78b9dc79d5a3c44d8106e6b71f2b14ea86804e Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 8 Sep 2023 18:13:59 +0000
Subject: [PATCH 0104/1043] xfrm: fix a data-race in xfrm_gen_index()

commit 3e4bc23926b83c3c67e5f61ae8571602754131a6 upstream.

xfrm_gen_index() mutual exclusion uses net->xfrm.xfrm_policy_lock.

This means we must use a per-netns idx_generator variable,
instead of a static one.
Alternative would be to use an atomic variable.

syzbot reported:

BUG: KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy_insert

write to 0xffffffff87005938 of 4 bytes by task 29466 on cpu 0:
xfrm_gen_index net/xfrm/xfrm_policy.c:1385 [inline]
xfrm_sk_policy_insert+0x262/0x640 net/xfrm/xfrm_policy.c:2347
xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639
do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943
ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012
rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054
sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697
__sys_setsockopt+0x1c9/0x230 net/socket.c:2263
__do_sys_setsockopt net/socket.c:2274 [inline]
__se_sys_setsockopt net/socket.c:2271 [inline]
__x64_sys_setsockopt+0x66/0x80 net/socket.c:2271
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffffffff87005938 of 4 bytes by task 29460 on cpu 1:
xfrm_sk_policy_insert+0x13e/0x640
xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639
do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943
ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012
rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054
sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697
__sys_setsockopt+0x1c9/0x230 net/socket.c:2263
__do_sys_setsockopt net/socket.c:2274 [inline]
__se_sys_setsockopt net/socket.c:2271 [inline]
__x64_sys_setsockopt+0x66/0x80 net/socket.c:2271
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x00006ad8 -> 0x00006b18

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 29460 Comm: syz-executor.1 Not tainted 6.5.0-rc5-syzkaller-00243-g9106536c1aa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023

Fixes: 1121994c803f ("netns xfrm: policy insertion in netns")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/netns/xfrm.h | 1 +
 net/xfrm/xfrm_policy.c   | 6 ++----
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
index 69e4161462fb..7b87da22b295 100644
--- a/include/net/netns/xfrm.h
+++ b/include/net/netns/xfrm.h
@@ -49,6 +49,7 @@ struct netns_xfrm {
 	struct list_head	policy_all;
 	struct hlist_head	*policy_byidx;
 	unsigned int		policy_idx_hmask;
+	unsigned int		idx_generator;
 	struct hlist_head	policy_inexact[XFRM_POLICY_MAX];
 	struct xfrm_policy_hash	policy_bydst[XFRM_POLICY_MAX];
 	unsigned int		policy_count[XFRM_POLICY_MAX * 2];
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 465d28341ed6..664d55957feb 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1371,8 +1371,6 @@ EXPORT_SYMBOL(xfrm_policy_hash_rebuild);
  * of an absolute inpredictability of ordering of rules. This will not pass. */
 static u32 xfrm_gen_index(struct net *net, int dir, u32 index)
 {
-	static u32 idx_generator;
-
 	for (;;) {
 		struct hlist_head *list;
 		struct xfrm_policy *p;
@@ -1380,8 +1378,8 @@ static u32 xfrm_gen_index(struct net *net, int dir, u32 index)
 		int found;
 
 		if (!index) {
-			idx = (idx_generator | dir);
-			idx_generator += 8;
+			idx = (net->xfrm.idx_generator | dir);
+			net->xfrm.idx_generator += 8;
 		} else {
 			idx = index;
 			index = 0;

From 4ba4eec4f40d4ea82d77258179f76eeb6fce0f7f Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Tue, 5 Sep 2023 13:23:03 +0000
Subject: [PATCH 0105/1043] xfrm: interface: use DEV_STATS_INC()

commit f7c4e3e5d4f6609b4725a97451948ca2e425379a upstream.

syzbot/KCSAN reported data-races in xfrm whenever dev->stats fields
are updated.

It appears all of these updates can happen from multiple cpus.

Adopt SMP safe DEV_STATS_INC() to update dev->stats fields.

BUG: KCSAN: data-race in xfrmi_xmit / xfrmi_xmit

read-write to 0xffff88813726b160 of 8 bytes by task 23986 on cpu 1:
xfrmi_xmit+0x74e/0xb20 net/xfrm/xfrm_interface_core.c:583
__netdev_start_xmit include/linux/netdevice.h:4889 [inline]
netdev_start_xmit include/linux/netdevice.h:4903 [inline]
xmit_one net/core/dev.c:3544 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560
__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340
dev_queue_xmit include/linux/netdevice.h:3082 [inline]
neigh_connected_output+0x231/0x2a0 net/core/neighbour.c:1581
neigh_output include/net/neighbour.h:542 [inline]
ip_finish_output2+0x74a/0x850 net/ipv4/ip_output.c:230
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:318
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:432
dst_output include/net/dst.h:458 [inline]
ip_local_out net/ipv4/ip_output.c:127 [inline]
ip_send_skb+0x72/0xe0 net/ipv4/ip_output.c:1487
udp_send_skb+0x6a4/0x990 net/ipv4/udp.c:963
udp_sendmsg+0x1249/0x12d0 net/ipv4/udp.c:1246
inet_sendmsg+0x63/0x80 net/ipv4/af_inet.c:840
sock_sendmsg_nosec net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
____sys_sendmsg+0x37c/0x4d0 net/socket.c:2540
___sys_sendmsg net/socket.c:2594 [inline]
__sys_sendmmsg+0x269/0x500 net/socket.c:2680
__do_sys_sendmmsg net/socket.c:2709 [inline]
__se_sys_sendmmsg net/socket.c:2706 [inline]
__x64_sys_sendmmsg+0x57/0x60 net/socket.c:2706
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

read-write to 0xffff88813726b160 of 8 bytes by task 23987 on cpu 0:
xfrmi_xmit+0x74e/0xb20 net/xfrm/xfrm_interface_core.c:583
__netdev_start_xmit include/linux/netdevice.h:4889 [inline]
netdev_start_xmit include/linux/netdevice.h:4903 [inline]
xmit_one net/core/dev.c:3544 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560
__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340
dev_queue_xmit include/linux/netdevice.h:3082 [inline]
neigh_connected_output+0x231/0x2a0 net/core/neighbour.c:1581
neigh_output include/net/neighbour.h:542 [inline]
ip_finish_output2+0x74a/0x850 net/ipv4/ip_output.c:230
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:318
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:432
dst_output include/net/dst.h:458 [inline]
ip_local_out net/ipv4/ip_output.c:127 [inline]
ip_send_skb+0x72/0xe0 net/ipv4/ip_output.c:1487
udp_send_skb+0x6a4/0x990 net/ipv4/udp.c:963
udp_sendmsg+0x1249/0x12d0 net/ipv4/udp.c:1246
inet_sendmsg+0x63/0x80 net/ipv4/af_inet.c:840
sock_sendmsg_nosec net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
____sys_sendmsg+0x37c/0x4d0 net/socket.c:2540
___sys_sendmsg net/socket.c:2594 [inline]
__sys_sendmmsg+0x269/0x500 net/socket.c:2680
__do_sys_sendmmsg net/socket.c:2709 [inline]
__se_sys_sendmmsg net/socket.c:2706 [inline]
__x64_sys_sendmmsg+0x57/0x60 net/socket.c:2706
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x00000000000010d7 -> 0x00000000000010d8

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 23987 Comm: syz-executor.5 Not tainted 6.5.0-syzkaller-10885-g0468be89b3fa #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023

Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/xfrm/xfrm_interface_core.c | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c
index 4eeec3367575..9eaf0174d998 100644
--- a/net/xfrm/xfrm_interface_core.c
+++ b/net/xfrm/xfrm_interface_core.c
@@ -274,8 +274,8 @@ static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
 	skb->dev = dev;
 
 	if (err) {
-		dev->stats.rx_errors++;
-		dev->stats.rx_dropped++;
+		DEV_STATS_INC(dev, rx_errors);
+		DEV_STATS_INC(dev, rx_dropped);
 
 		return 0;
 	}
@@ -309,7 +309,6 @@ static int
 xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 {
 	struct xfrm_if *xi = netdev_priv(dev);
-	struct net_device_stats *stats = &xi->dev->stats;
 	struct dst_entry *dst = skb_dst(skb);
 	unsigned int length = skb->len;
 	struct net_device *tdev;
@@ -335,7 +334,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 	tdev = dst->dev;
 
 	if (tdev == dev) {
-		stats->collisions++;
+		DEV_STATS_INC(dev, collisions);
 		net_warn_ratelimited("%s: Local routing loop detected!\n",
 				     dev->name);
 		goto tx_err_dst_release;
@@ -378,13 +377,13 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 		tstats->tx_packets++;
 		u64_stats_update_end(&tstats->syncp);
 	} else {
-		stats->tx_errors++;
-		stats->tx_aborted_errors++;
+		DEV_STATS_INC(dev, tx_errors);
+		DEV_STATS_INC(dev, tx_aborted_errors);
 	}
 
 	return 0;
 tx_err_link_failure:
-	stats->tx_carrier_errors++;
+	DEV_STATS_INC(dev, tx_carrier_errors);
 	dst_link_failure(skb);
 tx_err_dst_release:
 	dst_release(dst);
@@ -394,7 +393,6 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct xfrm_if *xi = netdev_priv(dev);
-	struct net_device_stats *stats = &xi->dev->stats;
 	struct dst_entry *dst = skb_dst(skb);
 	struct flowi fl;
 	int ret;
@@ -411,7 +409,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
 			dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
 			if (dst->error) {
 				dst_release(dst);
-				stats->tx_carrier_errors++;
+				DEV_STATS_INC(dev, tx_carrier_errors);
 				goto tx_err;
 			}
 			skb_dst_set(skb, dst);
@@ -427,7 +425,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
 			fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
 			rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
 			if (IS_ERR(rt)) {
-				stats->tx_carrier_errors++;
+				DEV_STATS_INC(dev, tx_carrier_errors);
 				goto tx_err;
 			}
 			skb_dst_set(skb, &rt->dst);
@@ -446,8 +444,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
 	return NETDEV_TX_OK;
 
 tx_err:
-	stats->tx_errors++;
-	stats->tx_dropped++;
+	DEV_STATS_INC(dev, tx_errors);
+	DEV_STATS_INC(dev, tx_dropped);
 	kfree_skb(skb);
 	return NETDEV_TX_OK;
 }

From 2ca00d93f2b1cde551f91cad17d7c53af8e3bd29 Mon Sep 17 00:00:00 2001
From: Ma Ke <make_ruc2021@163.com>
Date: Mon, 9 Oct 2023 09:13:37 +0800
Subject: [PATCH 0106/1043] net: ipv4: fix return value check in
 esp_remove_trailer

commit 513f61e2193350c7a345da98559b80f61aec4fa6 upstream.

In esp_remove_trailer(), to avoid an unexpected result returned by
pskb_trim, we should check the return value of pskb_trim().

Signed-off-by: Ma Ke <make_ruc2021@163.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/esp4.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 28252029bd79..412a3c153cad 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -741,7 +741,9 @@ static inline int esp_remove_trailer(struct sk_buff *skb)
 		skb->csum = csum_block_sub(skb->csum, csumdiff,
 					   skb->len - trimlen);
 	}
-	pskb_trim(skb, skb->len - trimlen);
+	ret = pskb_trim(skb, skb->len - trimlen);
+	if (unlikely(ret))
+		return ret;
 
 	ret = nexthdr[1];
 

From 8023c7e90007861a353b9e1a3abd9e158369c104 Mon Sep 17 00:00:00 2001
From: Ma Ke <make_ruc2021@163.com>
Date: Sat, 7 Oct 2023 08:59:53 +0800
Subject: [PATCH 0107/1043] net: ipv6: fix return value check in
 esp_remove_trailer

commit dad4e491e30b20f4dc615c9da65d2142d703b5c2 upstream.

In esp_remove_trailer(), to avoid an unexpected result returned by
pskb_trim, we should check the return value of pskb_trim().

Signed-off-by: Ma Ke <make_ruc2021@163.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/esp6.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index cb28f8928f9e..fddc811bbde1 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -776,7 +776,9 @@ static inline int esp_remove_trailer(struct sk_buff *skb)
 		skb->csum = csum_block_sub(skb->csum, csumdiff,
 					   skb->len - trimlen);
 	}
-	pskb_trim(skb, skb->len - trimlen);
+	ret = pskb_trim(skb, skb->len - trimlen);
+	if (unlikely(ret))
+		return ret;
 
 	ret = nexthdr[1];
 

From 805b38062e2857cc34f3cf2b1bd44980c6ba8944 Mon Sep 17 00:00:00 2001
From: Josua Mayer <josua@solid-run.com>
Date: Wed, 4 Oct 2023 18:39:28 +0200
Subject: [PATCH 0108/1043] net: rfkill: gpio: prevent value glitch during
 probe

commit b2f750c3a80b285cd60c9346f8c96bd0a2a66cde upstream.

When either reset- or shutdown-gpio have are initially deasserted,
e.g. after a reboot - or when the hardware does not include pull-down,
there will be a short toggle of both IOs to logical 0 and back to 1.

It seems that the rfkill default is unblocked, so the driver should not
glitch to output low during probe.
It can lead e.g. to unexpected lte modem reconnect:

[1] root@localhost:~# dmesg | grep "usb 2-1"
[    2.136124] usb 2-1: new SuperSpeed USB device number 2 using xhci-hcd
[   21.215278] usb 2-1: USB disconnect, device number 2
[   28.833977] usb 2-1: new SuperSpeed USB device number 3 using xhci-hcd

The glitch has been discovered on an arm64 board, now that device-tree
support for the rfkill-gpio driver has finally appeared :).

Change the flags for devm_gpiod_get_optional from GPIOD_OUT_LOW to
GPIOD_ASIS to avoid any glitches.
The rfkill driver will set the intended value during rfkill_sync_work.

Fixes: 7176ba23f8b5 ("net: rfkill: add generic gpio rfkill driver")
Signed-off-by: Josua Mayer <josua@solid-run.com>
Link: https://lore.kernel.org/r/20231004163928.14609-1-josua@solid-run.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rfkill/rfkill-gpio.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c
index f5afc9bcdee6..2cc95c8dc4c7 100644
--- a/net/rfkill/rfkill-gpio.c
+++ b/net/rfkill/rfkill-gpio.c
@@ -98,13 +98,13 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
 
 	rfkill->clk = devm_clk_get(&pdev->dev, NULL);
 
-	gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_OUT_LOW);
+	gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_ASIS);
 	if (IS_ERR(gpio))
 		return PTR_ERR(gpio);
 
 	rfkill->reset_gpio = gpio;
 
-	gpio = devm_gpiod_get_optional(&pdev->dev, "shutdown", GPIOD_OUT_LOW);
+	gpio = devm_gpiod_get_optional(&pdev->dev, "shutdown", GPIOD_ASIS);
 	if (IS_ERR(gpio))
 		return PTR_ERR(gpio);
 

From c39c31c5265b743dd02a82d2d6cb2f0222f57864 Mon Sep 17 00:00:00 2001
From: Neal Cardwell <ncardwell@google.com>
Date: Sun, 15 Oct 2023 13:47:00 -0400
Subject: [PATCH 0109/1043] tcp: fix excessive TLP and RACK timeouts from HZ
 rounding

commit 1c2709cfff1dedbb9591e989e2f001484208d914 upstream.

We discovered from packet traces of slow loss recovery on kernels with
the default HZ=250 setting (and min_rtt < 1ms) that after reordering,
when receiving a SACKed sequence range, the RACK reordering timer was
firing after about 16ms rather than the desired value of roughly
min_rtt/4 + 2ms. The problem is largely due to the RACK reorder timer
calculation adding in TCP_TIMEOUT_MIN, which is 2 jiffies. On kernels
with HZ=250, this is 2*4ms = 8ms. The TLP timer calculation has the
exact same issue.

This commit fixes the TLP transmit timer and RACK reordering timer
floor calculation to more closely match the intended 2ms floor even on
kernels with HZ=250. It does this by adding in a new
TCP_TIMEOUT_MIN_US floor of 2000 us and then converting to jiffies,
instead of the current approach of converting to jiffies and then
adding th TCP_TIMEOUT_MIN value of 2 jiffies.

Our testing has verified that on kernels with HZ=1000, as expected,
this does not produce significant changes in behavior, but on kernels
with the default HZ=250 the latency improvement can be large. For
example, our tests show that for HZ=250 kernels at low RTTs this fix
roughly halves the latency for the RACK reorder timer: instead of
mostly firing at 16ms it mostly fires at 8ms.

Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Fixes: bb4d991a28cc ("tcp: adjust tail loss probe timeout")
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20231015174700.2206872-1-ncardwell.sw@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/tcp.h       | 3 +++
 net/ipv4/tcp_output.c   | 9 +++++----
 net/ipv4/tcp_recovery.c | 2 +-
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index cb4b2fddd9eb..772e59391028 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -141,6 +141,9 @@ void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define TCP_RTO_MAX	((unsigned)(120*HZ))
 #define TCP_RTO_MIN	((unsigned)(HZ/5))
 #define TCP_TIMEOUT_MIN	(2U) /* Min timeout for TCP timers in jiffies */
+
+#define TCP_TIMEOUT_MIN_US (2*USEC_PER_MSEC) /* Min TCP timeout in microsecs */
+
 #define TCP_TIMEOUT_INIT ((unsigned)(1*HZ))	/* RFC6298 2.1 initial RTO value	*/
 #define TCP_TIMEOUT_FALLBACK ((unsigned)(3*HZ))	/* RFC 1122 initial RTO value, now
 						 * used as a fallback RTO for the
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 6c14d67715d1..eba5d7c0a6ac 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2727,7 +2727,7 @@ bool tcp_schedule_loss_probe(struct sock *sk, bool advancing_rto)
 {
 	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
-	u32 timeout, rto_delta_us;
+	u32 timeout, timeout_us, rto_delta_us;
 	int early_retrans;
 
 	/* Don't do any loss probe on a Fast Open connection before 3WHS
@@ -2751,11 +2751,12 @@ bool tcp_schedule_loss_probe(struct sock *sk, bool advancing_rto)
 	 * sample is available then probe after TCP_TIMEOUT_INIT.
 	 */
 	if (tp->srtt_us) {
-		timeout = usecs_to_jiffies(tp->srtt_us >> 2);
+		timeout_us = tp->srtt_us >> 2;
 		if (tp->packets_out == 1)
-			timeout += TCP_RTO_MIN;
+			timeout_us += tcp_rto_min_us(sk);
 		else
-			timeout += TCP_TIMEOUT_MIN;
+			timeout_us += TCP_TIMEOUT_MIN_US;
+		timeout = usecs_to_jiffies(timeout_us);
 	} else {
 		timeout = TCP_TIMEOUT_INIT;
 	}
diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c
index 21fc9859d421..f84c5804e2db 100644
--- a/net/ipv4/tcp_recovery.c
+++ b/net/ipv4/tcp_recovery.c
@@ -109,7 +109,7 @@ bool tcp_rack_mark_lost(struct sock *sk)
 	tp->rack.advanced = 0;
 	tcp_rack_detect_loss(sk, &timeout);
 	if (timeout) {
-		timeout = usecs_to_jiffies(timeout) + TCP_TIMEOUT_MIN;
+		timeout = usecs_to_jiffies(timeout + TCP_TIMEOUT_MIN_US);
 		inet_csk_reset_xmit_timer(sk, ICSK_TIME_REO_TIMEOUT,
 					  timeout, inet_csk(sk)->icsk_rto);
 	}

From f828e15db3c736a2150d546069b894eacca8e4bd Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Tue, 17 Oct 2023 12:45:26 +0000
Subject: [PATCH 0110/1043] tcp: tsq: relax tcp_small_queue_check() when rtx
 queue contains a single skb

commit f921a4a5bffa8a0005b190fb9421a7fc1fd716b6 upstream.

In commit 75eefc6c59fd ("tcp: tsq: add a shortcut in tcp_small_queue_check()")
we allowed to send an skb regardless of TSQ limits being hit if rtx queue
was empty or had a single skb, in order to better fill the pipe
when/if TX completions were slow.

Then later, commit 75c119afe14f ("tcp: implement rb-tree based
retransmit queue") accidentally removed the special case for
one skb in rtx queue.

Stefan Wahren reported a regression in single TCP flow throughput
using a 100Mbit fec link, starting from commit 65466904b015 ("tcp: adjust
TSO packet sizes based on min_rtt"). This last commit only made the
regression more visible, because it locked the TCP flow on a particular
behavior where TSQ prevented two skbs being pushed downstream,
adding silences on the wire between each TSO packet.

Many thanks to Stefan for his invaluable help !

Fixes: 75c119afe14f ("tcp: implement rb-tree based retransmit queue")
Link: https://lore.kernel.org/netdev/7f31ddc8-9971-495e-a1f6-819df542e0af@gmx.net/
Reported-by: Stefan Wahren <wahrenst@gmx.net>
Tested-by: Stefan Wahren <wahrenst@gmx.net>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Link: https://lore.kernel.org/r/20231017124526.4060202-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_output.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index eba5d7c0a6ac..4df287885dd7 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2482,6 +2482,18 @@ static bool tcp_pacing_check(struct sock *sk)
 	return true;
 }
 
+static bool tcp_rtx_queue_empty_or_single_skb(const struct sock *sk)
+{
+	const struct rb_node *node = sk->tcp_rtx_queue.rb_node;
+
+	/* No skb in the rtx queue. */
+	if (!node)
+		return true;
+
+	/* Only one skb in rtx queue. */
+	return !node->rb_left && !node->rb_right;
+}
+
 /* TCP Small Queues :
  * Control number of packets in qdisc/devices to two packets / or ~1 ms.
  * (These limits are doubled for retransmits)
@@ -2519,12 +2531,12 @@ static bool tcp_small_queue_check(struct sock *sk, const struct sk_buff *skb,
 		limit += extra_bytes;
 	}
 	if (refcount_read(&sk->sk_wmem_alloc) > limit) {
-		/* Always send skb if rtx queue is empty.
+		/* Always send skb if rtx queue is empty or has one skb.
 		 * No need to wait for TX completion to call us back,
 		 * after softirq/tasklet schedule.
 		 * This helps when TX completions are delayed too much.
 		 */
-		if (tcp_rtx_queue_empty(sk))
+		if (tcp_rtx_queue_empty_or_single_skb(sk))
 			return false;
 
 		set_bit(TSQ_THROTTLED, &sk->sk_tsq_flags);

From 1cef1a2d5c22f598da5b0431baf1a90609ce23a2 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 16 Oct 2023 18:08:51 +0000
Subject: [PATCH 0111/1043] tun: prevent negative ifindex

commit cbfbfe3aee718dc4c3c837f5d2463170ee59d78c upstream.

After commit 956db0a13b47 ("net: warn about attempts to register
negative ifindex") syzbot is able to trigger the following splat.

Negative ifindex are not supported.

WARNING: CPU: 1 PID: 6003 at net/core/dev.c:9596 dev_index_reserve+0x104/0x210
Modules linked in:
CPU: 1 PID: 6003 Comm: syz-executor926 Not tainted 6.6.0-rc4-syzkaller-g19af4a4ed414 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : dev_index_reserve+0x104/0x210
lr : dev_index_reserve+0x100/0x210
sp : ffff800096a878e0
x29: ffff800096a87930 x28: ffff0000d04380d0 x27: ffff0000d04380f8
x26: ffff0000d04380f0 x25: 1ffff00012d50f20 x24: 1ffff00012d50f1c
x23: dfff800000000000 x22: ffff8000929c21c0 x21: 00000000ffffffea
x20: ffff0000d04380e0 x19: ffff800096a87900 x18: ffff800096a874c0
x17: ffff800084df5008 x16: ffff80008051f9c4 x15: 0000000000000001
x14: 1fffe0001a087198 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000d41c9bc0 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff800091763d88 x4 : 0000000000000000 x3 : ffff800084e04748
x2 : 0000000000000001 x1 : 00000000fead71c7 x0 : 0000000000000000
Call trace:
dev_index_reserve+0x104/0x210
register_netdevice+0x598/0x1074 net/core/dev.c:10084
tun_set_iff+0x630/0xb0c drivers/net/tun.c:2850
__tun_chr_ioctl+0x788/0x2af8 drivers/net/tun.c:3118
tun_chr_ioctl+0x38/0x4c drivers/net/tun.c:3403
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:857
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
irq event stamp: 11348
hardirqs last enabled at (11347): [<ffff80008a716574>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (11347): [<ffff80008a716574>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
hardirqs last disabled at (11348): [<ffff80008a627820>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:436
softirqs last enabled at (11138): [<ffff8000887ca53c>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last enabled at (11138): [<ffff8000887ca53c>] release_sock+0x15c/0x1b0 net/core/sock.c:3531
softirqs last disabled at (11136): [<ffff8000887ca41c>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (11136): [<ffff8000887ca41c>] release_sock+0x3c/0x1b0 net/core/sock.c:3518

Fixes: fb7589a16216 ("tun: Add ability to create tun device with given index")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20231016180851.3560092-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/tun.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 191bf0df1466..0b25b59f4403 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -3064,10 +3064,11 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
 	struct net *net = sock_net(&tfile->sk);
 	struct tun_struct *tun;
 	void __user* argp = (void __user*)arg;
-	unsigned int ifindex, carrier;
+	unsigned int carrier;
 	struct ifreq ifr;
 	kuid_t owner;
 	kgid_t group;
+	int ifindex;
 	int sndbuf;
 	int vnet_hdr_sz;
 	int le;
@@ -3124,7 +3125,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
 		ret = -EFAULT;
 		if (copy_from_user(&ifindex, argp, sizeof(ifindex)))
 			goto unlock;
-
+		ret = -EINVAL;
+		if (ifindex < 0)
+			goto unlock;
 		ret = 0;
 		tfile->ifindex = ifindex;
 		goto unlock;

From 250cd610f8c46788914b8bfe641c8ec6f8db036c Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Tue, 17 Oct 2023 19:23:04 +0000
Subject: [PATCH 0112/1043] ipv4: fib: annotate races around nh->nh_saddr_genid
 and nh->nh_saddr

commit 195374d893681da43a39796e53b30ac4f20400c4 upstream.

syzbot reported a data-race while accessing nh->nh_saddr_genid [1]

Add annotations, but leave the code lazy as intended.

[1]
BUG: KCSAN: data-race in fib_select_path / fib_select_path

write to 0xffff8881387166f0 of 4 bytes by task 6778 on cpu 1:
fib_info_update_nhc_saddr net/ipv4/fib_semantics.c:1334 [inline]
fib_result_prefsrc net/ipv4/fib_semantics.c:1354 [inline]
fib_select_path+0x292/0x330 net/ipv4/fib_semantics.c:2269
ip_route_output_key_hash_rcu+0x659/0x12c0 net/ipv4/route.c:2810
ip_route_output_key_hash net/ipv4/route.c:2644 [inline]
__ip_route_output_key include/net/route.h:134 [inline]
ip_route_output_flow+0xa6/0x150 net/ipv4/route.c:2872
send4+0x1f5/0x520 drivers/net/wireguard/socket.c:61
wg_socket_send_skb_to_peer+0x94/0x130 drivers/net/wireguard/socket.c:175
wg_socket_send_buffer_to_peer+0xd6/0x100 drivers/net/wireguard/socket.c:200
wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
wg_packet_handshake_send_worker+0x10c/0x150 drivers/net/wireguard/send.c:51
process_one_work kernel/workqueue.c:2630 [inline]
process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703
worker_thread+0x525/0x730 kernel/workqueue.c:2784
kthread+0x1d7/0x210 kernel/kthread.c:388
ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

read to 0xffff8881387166f0 of 4 bytes by task 6759 on cpu 0:
fib_result_prefsrc net/ipv4/fib_semantics.c:1350 [inline]
fib_select_path+0x1cb/0x330 net/ipv4/fib_semantics.c:2269
ip_route_output_key_hash_rcu+0x659/0x12c0 net/ipv4/route.c:2810
ip_route_output_key_hash net/ipv4/route.c:2644 [inline]
__ip_route_output_key include/net/route.h:134 [inline]
ip_route_output_flow+0xa6/0x150 net/ipv4/route.c:2872
send4+0x1f5/0x520 drivers/net/wireguard/socket.c:61
wg_socket_send_skb_to_peer+0x94/0x130 drivers/net/wireguard/socket.c:175
wg_socket_send_buffer_to_peer+0xd6/0x100 drivers/net/wireguard/socket.c:200
wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
wg_packet_handshake_send_worker+0x10c/0x150 drivers/net/wireguard/send.c:51
process_one_work kernel/workqueue.c:2630 [inline]
process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703
worker_thread+0x525/0x730 kernel/workqueue.c:2784
kthread+0x1d7/0x210 kernel/kthread.c:388
ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

value changed: 0x959d3217 -> 0x959d3218

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 6759 Comm: kworker/u4:15 Not tainted 6.6.0-rc4-syzkaller-00029-gcbf3a2cb156a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker

Fixes: 436c3b66ec98 ("ipv4: Invalidate nexthop cache nh_saddr more correctly.")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20231017192304.82626-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/fib_semantics.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index ed20d6ac10dc..5f786cff2e41 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1345,15 +1345,18 @@ __be32 fib_info_update_nhc_saddr(struct net *net, struct fib_nh_common *nhc,
 				 unsigned char scope)
 {
 	struct fib_nh *nh;
+	__be32 saddr;
 
 	if (nhc->nhc_family != AF_INET)
 		return inet_select_addr(nhc->nhc_dev, 0, scope);
 
 	nh = container_of(nhc, struct fib_nh, nh_common);
-	nh->nh_saddr = inet_select_addr(nh->fib_nh_dev, nh->fib_nh_gw4, scope);
-	nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
+	saddr = inet_select_addr(nh->fib_nh_dev, nh->fib_nh_gw4, scope);
 
-	return nh->nh_saddr;
+	WRITE_ONCE(nh->nh_saddr, saddr);
+	WRITE_ONCE(nh->nh_saddr_genid, atomic_read(&net->ipv4.dev_addr_genid));
+
+	return saddr;
 }
 
 __be32 fib_result_prefsrc(struct net *net, struct fib_result *res)
@@ -1367,8 +1370,9 @@ __be32 fib_result_prefsrc(struct net *net, struct fib_result *res)
 		struct fib_nh *nh;
 
 		nh = container_of(nhc, struct fib_nh, nh_common);
-		if (nh->nh_saddr_genid == atomic_read(&net->ipv4.dev_addr_genid))
-			return nh->nh_saddr;
+		if (READ_ONCE(nh->nh_saddr_genid) ==
+		    atomic_read(&net->ipv4.dev_addr_genid))
+			return READ_ONCE(nh->nh_saddr);
 	}
 
 	return fib_info_update_nhc_saddr(net, nhc, res->fi->fib_scope);

From 9b5661bda3920223a523e3c2c0b1ae57fc8bc5c1 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Mon, 16 Oct 2023 20:28:10 +0300
Subject: [PATCH 0113/1043] net: usb: smsc95xx: Fix an error code in
 smsc95xx_reset()

commit c53647a5df9e66dd9fedf240198e1fe50d88c286 upstream.

Return a negative error code instead of success.

Fixes: 2f7ca802bdae ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/147927f0-9ada-45cc-81ff-75a19dd30b76@moroto.mountain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/smsc95xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 975f52605867..9297f2078fd2 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -863,7 +863,7 @@ static int smsc95xx_reset(struct usbnet *dev)
 
 	if (timeout >= 100) {
 		netdev_warn(dev->net, "timeout waiting for completion of Lite Reset\n");
-		return ret;
+		return -ETIMEDOUT;
 	}
 
 	ret = smsc95xx_write_reg(dev, PM_CTRL, PM_CTL_PHY_RST_);

From a53fc0641683755b3334d35fbd465ec838206747 Mon Sep 17 00:00:00 2001
From: Michal Schmidt <mschmidt@redhat.com>
Date: Wed, 11 Oct 2023 16:33:32 -0700
Subject: [PATCH 0114/1043] i40e: prevent crash on probe if hw registers have
 invalid values

commit fc6f716a5069180c40a8c9b63631e97da34f64a3 upstream.

The hardware provides the indexes of the first and the last available
queue and VF. From the indexes, the driver calculates the numbers of
queues and VFs. In theory, a faulty device might say the last index is
smaller than the first index. In that case, the driver's calculation
would underflow, it would attempt to write to non-existent registers
outside of the ioremapped range and crash.

I ran into this not by having a faulty device, but by an operator error.
I accidentally ran a QE test meant for i40e devices on an ice device.
The test used 'echo i40e > /sys/...ice PCI device.../driver_override',
bound the driver to the device and crashed in one of the wr32 calls in
i40e_clear_hw.

Add checks to prevent underflows in the calculations of num_queues and
num_vfs. With this fix, the wrong device probing reports errors and
returns a failure without crashing.

Fixes: 838d41d92a90 ("i40e: clear all queues and interrupts")
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Link: https://lore.kernel.org/r/20231011233334.336092-2-jacob.e.keller@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/intel/i40e/i40e_common.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
index ba109073d605..59a467f7aba3 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -1339,7 +1339,7 @@ void i40e_clear_hw(struct i40e_hw *hw)
 		     I40E_PFLAN_QALLOC_FIRSTQ_SHIFT;
 	j = (val & I40E_PFLAN_QALLOC_LASTQ_MASK) >>
 	    I40E_PFLAN_QALLOC_LASTQ_SHIFT;
-	if (val & I40E_PFLAN_QALLOC_VALID_MASK)
+	if (val & I40E_PFLAN_QALLOC_VALID_MASK && j >= base_queue)
 		num_queues = (j - base_queue) + 1;
 	else
 		num_queues = 0;
@@ -1349,7 +1349,7 @@ void i40e_clear_hw(struct i40e_hw *hw)
 	    I40E_PF_VT_PFALLOC_FIRSTVF_SHIFT;
 	j = (val & I40E_PF_VT_PFALLOC_LASTVF_MASK) >>
 	    I40E_PF_VT_PFALLOC_LASTVF_SHIFT;
-	if (val & I40E_PF_VT_PFALLOC_VALID_MASK)
+	if (val & I40E_PF_VT_PFALLOC_VALID_MASK && j >= i)
 		num_vfs = (j - i) + 1;
 	else
 		num_vfs = 0;

From 923e47c0b40a92d34c4b91299b6637f6747a2440 Mon Sep 17 00:00:00 2001
From: Jinjie Ruan <ruanjinjie@huawei.com>
Date: Wed, 11 Oct 2023 11:24:19 +0800
Subject: [PATCH 0115/1043] net: dsa: bcm_sf2: Fix possible memory leak in
 bcm_sf2_mdio_register()

commit 61b40cefe51af005c72dbdcf975a3d166c6e6406 upstream.

In bcm_sf2_mdio_register(), the class_find_device() will call get_device()
to increment reference count for priv->master_mii_bus->dev if
of_mdio_find_bus() succeeds. If mdiobus_alloc() or mdiobus_register()
fails, it will call get_device() twice without decrement reference count
for the device. And it is the same if bcm_sf2_mdio_register() succeeds but
fails in bcm_sf2_sw_probe(), or if bcm_sf2_sw_probe() succeeds. If the
reference count has not decremented to zero, the dev related resource will
not be freed.

So remove the get_device() in bcm_sf2_mdio_register(), and call
put_device() if mdiobus_alloc() or mdiobus_register() fails and in
bcm_sf2_mdio_unregister() to solve the issue.

And as Simon suggested, unwind from errors for bcm_sf2_mdio_register() and
just return 0 if it succeeds to make it cleaner.

Fixes: 461cd1b03e32 ("net: dsa: bcm_sf2: Register our slave MDIO bus")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Suggested-by: Simon Horman <horms@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://lore.kernel.org/r/20231011032419.2423290-1-ruanjinjie@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/bcm_sf2.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index f2f890e559f3..a5849663f65c 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -497,17 +497,16 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds)
 	dn = of_find_compatible_node(NULL, NULL, "brcm,unimac-mdio");
 	priv->master_mii_bus = of_mdio_find_bus(dn);
 	if (!priv->master_mii_bus) {
-		of_node_put(dn);
-		return -EPROBE_DEFER;
+		err = -EPROBE_DEFER;
+		goto err_of_node_put;
 	}
 
-	get_device(&priv->master_mii_bus->dev);
 	priv->master_mii_dn = dn;
 
 	priv->slave_mii_bus = mdiobus_alloc();
 	if (!priv->slave_mii_bus) {
-		of_node_put(dn);
-		return -ENOMEM;
+		err = -ENOMEM;
+		goto err_put_master_mii_bus_dev;
 	}
 
 	priv->slave_mii_bus->priv = priv;
@@ -564,11 +563,17 @@ static int bcm_sf2_mdio_register(struct dsa_switch *ds)
 	}
 
 	err = mdiobus_register(priv->slave_mii_bus);
-	if (err && dn) {
-		mdiobus_free(priv->slave_mii_bus);
-		of_node_put(dn);
-	}
+	if (err && dn)
+		goto err_free_slave_mii_bus;
 
+	return 0;
+
+err_free_slave_mii_bus:
+	mdiobus_free(priv->slave_mii_bus);
+err_put_master_mii_bus_dev:
+	put_device(&priv->master_mii_bus->dev);
+err_of_node_put:
+	of_node_put(dn);
 	return err;
 }
 
@@ -576,6 +581,7 @@ static void bcm_sf2_mdio_unregister(struct bcm_sf2_priv *priv)
 {
 	mdiobus_unregister(priv->slave_mii_bus);
 	mdiobus_free(priv->slave_mii_bus);
+	put_device(&priv->master_mii_bus->dev);
 	of_node_put(priv->master_mii_dn);
 }
 

From 36848adbdebaedf38ea4e9d9989200be6446ec82 Mon Sep 17 00:00:00 2001
From: Pedro Tammela <pctammela@mojatatu.com>
Date: Tue, 17 Oct 2023 11:36:02 -0300
Subject: [PATCH 0116/1043] net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it
 becomes a inner curve

commit a13b67c9a015c4e21601ef9aa4ec9c5d972df1b4 upstream.

Christian Theune says:
   I upgraded from 6.1.38 to 6.1.55 this morning and it broke my traffic shaping script,
   leaving me with a non-functional uplink on a remote router.

A 'rt' curve cannot be used as a inner curve (parent class), but we were
allowing such configurations since the qdisc was introduced. Such
configurations would trigger a UAF as Budimir explains:
   The parent will have vttree_insert() called on it in init_vf(),
   but will not have vttree_remove() called on it in update_vf()
   because it does not have the HFSC_FSC flag set.

The qdisc always assumes that inner classes have the HFSC_FSC flag set.
This is by design as it doesn't make sense 'qdisc wise' for an 'rt'
curve to be an inner curve.

Budimir's original patch disallows users to add classes with a 'rt'
parent, but this is too strict as it breaks users that have been using
'rt' as a inner class. Another approach, taken by this patch, is to
upgrade the inner 'rt' into a 'sc', warning the user in the process.
It avoids the UAF reported by Budimir while also being more permissive
to bad scripts/users/code using 'rt' as a inner class.

Users checking the `tc class ls [...]` or `tc class get [...]` dumps would
observe the curve change and are potentially breaking with this change.

v1->v2: https://lore.kernel.org/all/20231013151057.2611860-1-pctammela@mojatatu.com/
- Correct 'Fixes' tag and merge with revert (Jakub)

Cc: Christian Theune <ct@flyingcircus.io>
Cc: Budimir Markovic <markovicbudimir@gmail.com>
Fixes: b3d26c5702c7 ("net/sched: sch_hfsc: Ensure inner classes have fsc curve")
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20231017143602.3191556-1-pctammela@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/sch_hfsc.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 6076294a632c..adcf87d417ae 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -903,6 +903,14 @@ hfsc_change_usc(struct hfsc_class *cl, struct tc_service_curve *usc,
 	cl->cl_flags |= HFSC_USC;
 }
 
+static void
+hfsc_upgrade_rt(struct hfsc_class *cl)
+{
+	cl->cl_fsc = cl->cl_rsc;
+	rtsc_init(&cl->cl_virtual, &cl->cl_fsc, cl->cl_vt, cl->cl_total);
+	cl->cl_flags |= HFSC_FSC;
+}
+
 static const struct nla_policy hfsc_policy[TCA_HFSC_MAX + 1] = {
 	[TCA_HFSC_RSC]	= { .len = sizeof(struct tc_service_curve) },
 	[TCA_HFSC_FSC]	= { .len = sizeof(struct tc_service_curve) },
@@ -1012,10 +1020,6 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 		if (parent == NULL)
 			return -ENOENT;
 	}
-	if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) {
-		NL_SET_ERR_MSG(extack, "Invalid parent - parent class must have FSC");
-		return -EINVAL;
-	}
 
 	if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0)
 		return -EINVAL;
@@ -1068,6 +1072,12 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 	cl->cf_tree = RB_ROOT;
 
 	sch_tree_lock(sch);
+	/* Check if the inner class is a misconfigured 'rt' */
+	if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) {
+		NL_SET_ERR_MSG(extack,
+			       "Forced curve change on parent 'rt' to 'sc'");
+		hfsc_upgrade_rt(parent);
+	}
 	qdisc_class_hash_insert(&q->clhash, &cl->cl_common);
 	list_add_tail(&cl->siblings, &parent->children);
 	if (parent->level == 0)

From 9cef803e9ed0f9b95e87fbb6bcd90de1100eda24 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Mon, 16 Oct 2023 14:49:04 +0200
Subject: [PATCH 0117/1043] neighbor: tracing: Move pin6 inside CONFIG_IPV6=y
 section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 2915240eddba96b37de4c7e9a3d0ac6f9548454b upstream.

When CONFIG_IPV6=n, and building with W=1:

    In file included from include/trace/define_trace.h:102,
		     from include/trace/events/neigh.h:255,
		     from net/core/net-traces.c:51:
    include/trace/events/neigh.h: In function ‘trace_event_raw_event_neigh_create’:
    include/trace/events/neigh.h:42:34: error: variable ‘pin6’ set but not used [-Werror=unused-but-set-variable]
       42 |                 struct in6_addr *pin6;
	  |                                  ^~~~
    include/trace/trace_events.h:402:11: note: in definition of macro ‘DECLARE_EVENT_CLASS’
      402 |         { assign; }                                                     \
	  |           ^~~~~~
    include/trace/trace_events.h:44:30: note: in expansion of macro ‘PARAMS’
       44 |                              PARAMS(assign),                   \
	  |                              ^~~~~~
    include/trace/events/neigh.h:23:1: note: in expansion of macro ‘TRACE_EVENT’
       23 | TRACE_EVENT(neigh_create,
	  | ^~~~~~~~~~~
    include/trace/events/neigh.h:41:9: note: in expansion of macro ‘TP_fast_assign’
       41 |         TP_fast_assign(
	  |         ^~~~~~~~~~~~~~
    In file included from include/trace/define_trace.h:103,
		     from include/trace/events/neigh.h:255,
		     from net/core/net-traces.c:51:
    include/trace/events/neigh.h: In function ‘perf_trace_neigh_create’:
    include/trace/events/neigh.h:42:34: error: variable ‘pin6’ set but not used [-Werror=unused-but-set-variable]
       42 |                 struct in6_addr *pin6;
	  |                                  ^~~~
    include/trace/perf.h:51:11: note: in definition of macro ‘DECLARE_EVENT_CLASS’
       51 |         { assign; }                                                     \
	  |           ^~~~~~
    include/trace/trace_events.h:44:30: note: in expansion of macro ‘PARAMS’
       44 |                              PARAMS(assign),                   \
	  |                              ^~~~~~
    include/trace/events/neigh.h:23:1: note: in expansion of macro ‘TRACE_EVENT’
       23 | TRACE_EVENT(neigh_create,
	  | ^~~~~~~~~~~
    include/trace/events/neigh.h:41:9: note: in expansion of macro ‘TP_fast_assign’
       41 |         TP_fast_assign(
	  |         ^~~~~~~~~~~~~~

Indeed, the variable pin6 is declared and initialized unconditionally,
while it is only used and needlessly re-initialized when support for
IPv6 is enabled.

Fix this by dropping the unused variable initialization, and moving the
variable declaration inside the existing section protected by a check
for CONFIG_IPV6.

Fixes: fc651001d2c5ca4f ("neighbor: Add tracepoint to __neigh_create")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Simon Horman <horms@kernel.org> # build-tested
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/trace/events/neigh.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/trace/events/neigh.h b/include/trace/events/neigh.h
index 62bb17516713..5ade62ac49b4 100644
--- a/include/trace/events/neigh.h
+++ b/include/trace/events/neigh.h
@@ -39,7 +39,6 @@ TRACE_EVENT(neigh_create,
 	),
 
 	TP_fast_assign(
-		struct in6_addr *pin6;
 		__be32 *p32;
 
 		__entry->family = tbl->family;
@@ -47,7 +46,6 @@ TRACE_EVENT(neigh_create,
 		__entry->entries = atomic_read(&tbl->gc_entries);
 		__entry->created = n != NULL;
 		__entry->gc_exempt = exempt_from_gc;
-		pin6 = (struct in6_addr *)__entry->primary_key6;
 		p32 = (__be32 *)__entry->primary_key4;
 
 		if (tbl->family == AF_INET)
@@ -57,6 +55,8 @@ TRACE_EVENT(neigh_create,
 
 #if IS_ENABLED(CONFIG_IPV6)
 		if (tbl->family == AF_INET6) {
+			struct in6_addr *pin6;
+
 			pin6 = (struct in6_addr *)__entry->primary_key6;
 			*pin6 = *(struct in6_addr *)pkey;
 		}

From 068e4ecea226aaa321d3f82b22d601f899f13ce1 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 17 Oct 2023 12:28:27 +0200
Subject: [PATCH 0118/1043] netfilter: nft_set_rbtree: .deactivate fails if
 element has expired

commit d111692a59c1470ae530cbb39bcf0346c950ecc7 upstream.

This allows to remove an expired element which is not possible in other
existing set backends, this is more noticeable if gc-interval is high so
expired elements remain in the tree. On-demand gc also does not help in
this case, because this is delete element path. Return NULL if element
has expired.

Fixes: 8d8540c4f5e0 ("netfilter: nft_set_rbtree: add timeout support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nft_set_rbtree.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 17abf17b673e..12d9d0d0c602 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -570,6 +570,8 @@ static void *nft_rbtree_deactivate(const struct net *net,
 				   nft_rbtree_interval_end(this)) {
 				parent = parent->rb_right;
 				continue;
+			} else if (nft_set_elem_expired(&rbe->ext)) {
+				break;
 			} else if (!nft_set_elem_active(&rbe->ext, genmask)) {
 				parent = parent->rb_left;
 				continue;

From 482fa2345f03276b827ff46309f5b0ee711fe672 Mon Sep 17 00:00:00 2001
From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Date: Mon, 16 Oct 2023 14:08:59 +0000
Subject: [PATCH 0119/1043] net: pktgen: Fix interface flags printing

commit 1d30162f35c7a73fc2f8cdcdcdbd690bedb99d1a upstream.

Device flags are displayed incorrectly:
1) The comparison (i == F_FLOW_SEQ) is always false, because F_FLOW_SEQ
is equal to (1 << FLOW_SEQ_SHIFT) == 2048, and the maximum value
of the 'i' variable is (NR_PKT_FLAG - 1) == 17. It should be compared
with FLOW_SEQ_SHIFT.

2) Similarly to the F_IPSEC flag.

3) Also add spaces to the print end of the string literal "spi:%u"
to prevent the output from merging with the flag that follows.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: 99c6d3d20d62 ("pktgen: Remove brute-force printing of flags")
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/pktgen.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 3fba429f1f57..c1e3d3bea128 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -645,19 +645,19 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
 	seq_puts(seq, "     Flags: ");
 
 	for (i = 0; i < NR_PKT_FLAGS; i++) {
-		if (i == F_FLOW_SEQ)
+		if (i == FLOW_SEQ_SHIFT)
 			if (!pkt_dev->cflows)
 				continue;
 
-		if (pkt_dev->flags & (1 << i))
+		if (pkt_dev->flags & (1 << i)) {
 			seq_printf(seq, "%s  ", pkt_flag_names[i]);
-		else if (i == F_FLOW_SEQ)
-			seq_puts(seq, "FLOW_RND  ");
-
 #ifdef CONFIG_XFRM
-		if (i == F_IPSEC && pkt_dev->spi)
-			seq_printf(seq, "spi:%u", pkt_dev->spi);
+			if (i == IPSEC_SHIFT && pkt_dev->spi)
+				seq_printf(seq, "spi:%u  ", pkt_dev->spi);
 #endif
+		} else if (i == FLOW_SEQ_SHIFT) {
+			seq_puts(seq, "FLOW_RND  ");
+		}
 	}
 
 	seq_puts(seq, "\n");

From faa9a9d07c06b41919d3f93e907a2b5be2cd3826 Mon Sep 17 00:00:00 2001
From: Mika Westerberg <mika.westerberg@linux.intel.com>
Date: Fri, 18 Aug 2023 15:27:46 +0300
Subject: [PATCH 0120/1043] thunderbolt: Workaround an IOMMU fault on certain
 systems with Intel Maple Ridge

[ Upstream commit 582620d9f6b352552bc9a3316fe2b1c3acd8742d ]

On some systems the IOMMU blocks the first couple of driver ready
messages to the connection manager firmware as can be seen in below
excerpts:

  thunderbolt 0000:06:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0010 address=0xbb0e3400 flags=0x0020]

or

  DMAR: DRHD: handling fault status reg 2
  DMAR: [DMA Write] Request device [04:00.0] PASID ffffffff fault addr 69974000 [fault reason 05] PTE Write access is not set

The reason is unknown and hard to debug because we were not able to
reproduce this locally. This only happens on certain systems with Intel
Maple Ridge Thunderbolt controller. If there is a device connected when
the driver is loaded the issue does not happen either. Only when there
is nothing connected (so typically when the system is booted up).

We can work this around by sending the driver ready several times. After
a couple of retries the message goes through and the controller works
just fine. For this reason make the number of retries a parameter for
icm_request() and then for Maple Ridge (and Titan Ridge as they us the
same function but this should not matter) increase number of retries
while shortening the timeout accordingly.

Reported-by: Werner Sembach <wse@tuxedocomputers.com>
Reported-by: Konrad J Hambrick <kjhambrick@gmail.com>
Reported-by: Calvin Walton <calvin.walton@kepstin.ca>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=214259
Cc: stable@vger.kernel.org
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thunderbolt/icm.c | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
index b2fb3397310e..90f1d9a53461 100644
--- a/drivers/thunderbolt/icm.c
+++ b/drivers/thunderbolt/icm.c
@@ -41,6 +41,7 @@
 #define PHY_PORT_CS1_LINK_STATE_SHIFT	26
 
 #define ICM_TIMEOUT			5000	/* ms */
+#define ICM_RETRIES			3
 #define ICM_APPROVE_TIMEOUT		10000	/* ms */
 #define ICM_MAX_LINK			4
 
@@ -280,10 +281,9 @@ static bool icm_copy(struct tb_cfg_request *req, const struct ctl_pkg *pkg)
 
 static int icm_request(struct tb *tb, const void *request, size_t request_size,
 		       void *response, size_t response_size, size_t npackets,
-		       unsigned int timeout_msec)
+		       int retries, unsigned int timeout_msec)
 {
 	struct icm *icm = tb_priv(tb);
-	int retries = 3;
 
 	do {
 		struct tb_cfg_request *req;
@@ -394,7 +394,7 @@ static int icm_fr_get_route(struct tb *tb, u8 link, u8 depth, u64 *route)
 		return -ENOMEM;
 
 	ret = icm_request(tb, &request, sizeof(request), switches,
-			  sizeof(*switches), npackets, ICM_TIMEOUT);
+			  sizeof(*switches), npackets, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		goto err_free;
 
@@ -447,7 +447,7 @@ icm_fr_driver_ready(struct tb *tb, enum tb_security_level *security_level,
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -472,7 +472,7 @@ static int icm_fr_approve_switch(struct tb *tb, struct tb_switch *sw)
 	memset(&reply, 0, sizeof(reply));
 	/* Use larger timeout as establishing tunnels can take some time */
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_APPROVE_TIMEOUT);
+			  1, ICM_RETRIES, ICM_APPROVE_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -499,7 +499,7 @@ static int icm_fr_add_switch_key(struct tb *tb, struct tb_switch *sw)
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -527,7 +527,7 @@ static int icm_fr_challenge_switch_key(struct tb *tb, struct tb_switch *sw,
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -559,7 +559,7 @@ static int icm_fr_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd)
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -996,7 +996,7 @@ icm_tr_driver_ready(struct tb *tb, enum tb_security_level *security_level,
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, 20000);
+			  1, 10, 2000);
 	if (ret)
 		return ret;
 
@@ -1026,7 +1026,7 @@ static int icm_tr_approve_switch(struct tb *tb, struct tb_switch *sw)
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_APPROVE_TIMEOUT);
+			  1, ICM_RETRIES, ICM_APPROVE_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -1054,7 +1054,7 @@ static int icm_tr_add_switch_key(struct tb *tb, struct tb_switch *sw)
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -1083,7 +1083,7 @@ static int icm_tr_challenge_switch_key(struct tb *tb, struct tb_switch *sw,
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -1115,7 +1115,7 @@ static int icm_tr_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd)
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -1141,7 +1141,7 @@ static int icm_tr_xdomain_tear_down(struct tb *tb, struct tb_xdomain *xd,
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -1460,7 +1460,7 @@ icm_ar_driver_ready(struct tb *tb, enum tb_security_level *security_level,
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -1486,7 +1486,7 @@ static int icm_ar_get_route(struct tb *tb, u8 link, u8 depth, u64 *route)
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -1507,7 +1507,7 @@ static int icm_ar_get_boot_acl(struct tb *tb, uuid_t *uuids, size_t nuuids)
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -1568,7 +1568,7 @@ static int icm_ar_set_boot_acl(struct tb *tb, const uuid_t *uuids,
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, ICM_TIMEOUT);
+			  1, ICM_RETRIES, ICM_TIMEOUT);
 	if (ret)
 		return ret;
 
@@ -1590,7 +1590,7 @@ icm_icl_driver_ready(struct tb *tb, enum tb_security_level *security_level,
 
 	memset(&reply, 0, sizeof(reply));
 	ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
-			  1, 20000);
+			  1, ICM_RETRIES, 20000);
 	if (ret)
 		return ret;
 

From 196896455bd10625bed6d81e9e3b114d6d61e2d3 Mon Sep 17 00:00:00 2001
From: John Garry <john.garry@huawei.com>
Date: Wed, 2 Dec 2020 18:36:54 +0800
Subject: [PATCH 0121/1043] resource: Add irqresource_disabled()

[ Upstream commit 9806731db684a475ade1e95d166089b9edbd9da3 ]

Add a common function to set the fields for a irq resource to disabled,
which mimics what is done in acpi_dev_irqresource_disabled(), with a view
to replace that function.

Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://lore.kernel.org/r/1606905417-183214-3-git-send-email-john.garry@huawei.com
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/ioport.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/linux/ioport.h b/include/linux/ioport.h
index 5135d4b86cd6..f9bf374f9633 100644
--- a/include/linux/ioport.h
+++ b/include/linux/ioport.h
@@ -307,6 +307,13 @@ struct resource *devm_request_free_mem_region(struct device *dev,
 struct resource *request_free_mem_region(struct resource *base,
 		unsigned long size, const char *name);
 
+static inline void irqresource_disabled(struct resource *res, u32 irq)
+{
+	res->start = irq;
+	res->end = irq;
+	res->flags = IORESOURCE_IRQ | IORESOURCE_DISABLED | IORESOURCE_UNSET;
+}
+
 #ifdef CONFIG_IO_STRICT_DEVMEM
 void revoke_devmem(struct resource *res);
 #else

From 8a8918b510802e0de137634b442d7ee10a0f0b89 Mon Sep 17 00:00:00 2001
From: John Garry <john.garry@huawei.com>
Date: Wed, 2 Dec 2020 18:36:55 +0800
Subject: [PATCH 0122/1043] ACPI: Drop acpi_dev_irqresource_disabled()

[ Upstream commit 1c3f69b4543af0aad514c127298e5ea40392575d ]

The functionality of acpi_dev_irqresource_disabled() is same as in common
irqresource_disabled(), so drop acpi_dev_irqresource_disabled() in favour
of that function.

Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://lore.kernel.org/r/1606905417-183214-4-git-send-email-john.garry@huawei.com
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/resource.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index f2f5f1dc7c61..20a7892c6d3f 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -380,13 +380,6 @@ unsigned int acpi_dev_get_irq_type(int triggering, int polarity)
 }
 EXPORT_SYMBOL_GPL(acpi_dev_get_irq_type);
 
-static void acpi_dev_irqresource_disabled(struct resource *res, u32 gsi)
-{
-	res->start = gsi;
-	res->end = gsi;
-	res->flags = IORESOURCE_IRQ | IORESOURCE_DISABLED | IORESOURCE_UNSET;
-}
-
 static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
 				     u8 triggering, u8 polarity, u8 shareable,
 				     bool legacy)
@@ -394,7 +387,7 @@ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
 	int irq, p, t;
 
 	if (!valid_IRQ(gsi)) {
-		acpi_dev_irqresource_disabled(res, gsi);
+		irqresource_disabled(res, gsi);
 		return;
 	}
 
@@ -426,7 +419,7 @@ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
 		res->start = irq;
 		res->end = irq;
 	} else {
-		acpi_dev_irqresource_disabled(res, gsi);
+		irqresource_disabled(res, gsi);
 	}
 }
 
@@ -463,7 +456,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
 		 */
 		irq = &ares->data.irq;
 		if (index >= irq->interrupt_count) {
-			acpi_dev_irqresource_disabled(res, 0);
+			irqresource_disabled(res, 0);
 			return false;
 		}
 		acpi_dev_get_irqresource(res, irq->interrupts[index],
@@ -473,7 +466,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
 	case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
 		ext_irq = &ares->data.extended_irq;
 		if (index >= ext_irq->interrupt_count) {
-			acpi_dev_irqresource_disabled(res, 0);
+			irqresource_disabled(res, 0);
 			return false;
 		}
 		if (is_gsi(ext_irq))
@@ -481,7 +474,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
 					 ext_irq->triggering, ext_irq->polarity,
 					 ext_irq->shareable, false);
 		else
-			acpi_dev_irqresource_disabled(res, 0);
+			irqresource_disabled(res, 0);
 		break;
 	default:
 		res->flags = 0;

From ffcb69e923aa03ff1aeb27cbf00a95aa5bf3c205 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Wed, 15 Sep 2021 21:09:05 +0800
Subject: [PATCH 0123/1043] ACPI: resources: Add DMI-based legacy IRQ override
 quirk

[ Upstream commit 892a012699fc0b91a2ed6309078936191447f480 ]

After the commit 0ec4e55e9f57 ("ACPI: resources: Add checks for ACPI
IRQ override") is reverted, the keyboard on Medion laptops can't
work again.

To fix the keyboard issue, add a DMI-based override check that will
not affect other machines along the lines of prt_quirks[] in
drivers/acpi/pci_irq.c.

If similar issues are seen on other platforms, the quirk table could
be expanded in the future.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213031
BugLink: http://bugs.launchpad.net/bugs/1909814
Suggested-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reported-by: Manuel Krause <manuelkrause@netscape.net>
Tested-by: Manuel Krause <manuelkrause@netscape.net>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/resource.c | 49 +++++++++++++++++++++++++++++++++++++++--
 1 file changed, 47 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 20a7892c6d3f..bf7c2deafb0a 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -16,6 +16,7 @@
 #include <linux/ioport.h>
 #include <linux/slab.h>
 #include <linux/irq.h>
+#include <linux/dmi.h>
 
 #ifdef CONFIG_X86
 #define valid_IRQ(i) (((i) != 0) && ((i) != 2))
@@ -380,9 +381,51 @@ unsigned int acpi_dev_get_irq_type(int triggering, int polarity)
 }
 EXPORT_SYMBOL_GPL(acpi_dev_get_irq_type);
 
+static const struct dmi_system_id medion_laptop[] = {
+	{
+		.ident = "MEDION P15651",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
+			DMI_MATCH(DMI_BOARD_NAME, "M15T"),
+		},
+	},
+	{ }
+};
+
+struct irq_override_cmp {
+	const struct dmi_system_id *system;
+	unsigned char irq;
+	unsigned char triggering;
+	unsigned char polarity;
+	unsigned char shareable;
+};
+
+static const struct irq_override_cmp skip_override_table[] = {
+	{ medion_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0 },
+};
+
+static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,
+				  u8 shareable)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(skip_override_table); i++) {
+		const struct irq_override_cmp *entry = &skip_override_table[i];
+
+		if (dmi_check_system(entry->system) &&
+		    entry->irq == gsi &&
+		    entry->triggering == triggering &&
+		    entry->polarity == polarity &&
+		    entry->shareable == shareable)
+			return false;
+	}
+
+	return true;
+}
+
 static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
 				     u8 triggering, u8 polarity, u8 shareable,
-				     bool legacy)
+				     bool check_override)
 {
 	int irq, p, t;
 
@@ -401,7 +444,9 @@ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
 	 * using extended IRQ descriptors we take the IRQ configuration
 	 * from _CRS directly.
 	 */
-	if (legacy && !acpi_get_override_irq(gsi, &t, &p)) {
+	if (check_override &&
+	    acpi_dev_irq_override(gsi, triggering, polarity, shareable) &&
+	    !acpi_get_override_irq(gsi, &t, &p)) {
 		u8 trig = t ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE;
 		u8 pol = p ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH;
 

From 7f26f0ac38544d9b9566ebe6350d009122ecfeba Mon Sep 17 00:00:00 2001
From: Tamim Khan <tamim@fusetak.com>
Date: Sun, 28 Aug 2022 23:04:19 -0400
Subject: [PATCH 0124/1043] ACPI: resource: Skip IRQ override on Asus Vivobook
 K3402ZA/K3502ZA

[ Upstream commit e12dee3736731e24b1e7367f87d66ac0fcd73ce7 ]

In the ACPI DSDT table for Asus VivoBook K3402ZA/K3502ZA
IRQ 1 is described as ActiveLow; however, the kernel overrides
it to Edge_High. This prevents the internal keyboard from working
on these laptops. In order to fix this add these laptops to the
skip_override_table so that the kernel does not override IRQ 1 to
Edge_High.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216158
Reviewed-by: Hui Wang <hui.wang@canonical.com>
Tested-by: Tamim Khan <tamim@fusetak.com>
Tested-by: Sunand <sunandchakradhar@gmail.com>
Signed-off-by: Tamim Khan <tamim@fusetak.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/resource.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index bf7c2deafb0a..602c44821fb4 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -392,6 +392,24 @@ static const struct dmi_system_id medion_laptop[] = {
 	{ }
 };
 
+static const struct dmi_system_id asus_laptop[] = {
+	{
+		.ident = "Asus Vivobook K3402ZA",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "K3402ZA"),
+		},
+	},
+	{
+		.ident = "Asus Vivobook K3502ZA",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "K3502ZA"),
+		},
+	},
+	{ }
+};
+
 struct irq_override_cmp {
 	const struct dmi_system_id *system;
 	unsigned char irq;
@@ -402,6 +420,7 @@ struct irq_override_cmp {
 
 static const struct irq_override_cmp skip_override_table[] = {
 	{ medion_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0 },
+	{ asus_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0 },
 };
 
 static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,

From e0014184cd114e7f1da2922925fdbad7529c2817 Mon Sep 17 00:00:00 2001
From: Kellen Renshaw <kellen.renshaw@canonical.com>
Date: Wed, 21 Sep 2022 10:24:22 -0700
Subject: [PATCH 0125/1043] ACPI: resource: Add ASUS model S5402ZA to quirks

[ Upstream commit 6e5cbe7c4b41824e500acbb42411da692d1435f1 ]

The Asus Vivobook S5402ZA has the same keyboard issue as Asus Vivobook
K3402ZA/K3502ZA. The kernel overrides IRQ 1 to Edge_High when it
should be Active_Low.

This patch adds the S5402ZA model to the quirk list.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216158
Tested-by: Kellen Renshaw <kellen.renshaw@canonical.com>
Signed-off-by: Kellen Renshaw <kellen.renshaw@canonical.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/resource.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 602c44821fb4..50ab81a333cd 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -407,6 +407,13 @@ static const struct dmi_system_id asus_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "K3502ZA"),
 		},
 	},
+	{
+		.ident = "Asus Vivobook S5402ZA",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "S5402ZA"),
+		},
+	},
 	{ }
 };
 

From 980dd4dfb9e8079e544dcb04b008721d40d996cb Mon Sep 17 00:00:00 2001
From: Tamim Khan <tamim@fusetak.com>
Date: Fri, 14 Oct 2022 01:19:31 -0400
Subject: [PATCH 0126/1043] ACPI: resource: Skip IRQ override on Asus Vivobook
 S5602ZA

[ Upstream commit b5f9223a105d9b56954ad1ca3eace4eaf26c99ed ]

Like the Asus Vivobook K3402ZA/K3502ZA/S5402ZA Asus Vivobook S5602ZA
has an ACPI DSDT table the describes IRQ 1 as ActiveLow while the kernel
overrides it to Edge_High. This prevents the keyboard on this laptop
from working. To fix this add this laptop to the skip_override_table so
that the kernel does not override IRQ 1.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216579
Tested-by: Dzmitry <wrkedm@gmail.com>
Signed-off-by: Tamim Khan <tamim@fusetak.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/resource.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 50ab81a333cd..7438e57455d1 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -414,6 +414,13 @@ static const struct dmi_system_id asus_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "S5402ZA"),
 		},
 	},
+	{
+		.ident = "Asus Vivobook S5602ZA",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
+		},
+	},
 	{ }
 };
 

From 1b4659e283bcffb60ce78efb54b40fe9a5fb38c9 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Thu, 15 Dec 2022 10:44:43 +0100
Subject: [PATCH 0127/1043] ACPI: resource: Add Asus ExpertBook B2502 to Asus
 quirks

[ Upstream commit 7203481fd12b1257938519efb2460ea02b9236ee ]

The Asus ExpertBook B2502 has the same keyboard issue as Asus Vivobook
K3402ZA/K3502ZA. The kernel overrides IRQ 1 to Edge_High when it
should be Active_Low.

This patch adds the ExpertBook B2502 model to the existing
quirk list of Asus laptops with this issue.

Fixes: b5f9223a105d ("ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA")
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2142574
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/resource.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 7438e57455d1..f76147272b33 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
 		},
 	},
+	{
+		.ident = "Asus ExpertBook B2502",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "B2502CBA"),
+		},
+	},
 	{ }
 };
 

From 3a58c28bff797deda7dcbcd3542c22ec6b94a8f3 Mon Sep 17 00:00:00 2001
From: Tamim Khan <tamim@fusetak.com>
Date: Fri, 30 Dec 2022 00:58:39 -0500
Subject: [PATCH 0128/1043] ACPI: resource: Skip IRQ override on Asus
 Expertbook B2402CBA

[ Upstream commit 77c7248882385397cd7dffe9e1437f59f32ce2de ]

Like the Asus Expertbook B2502CBA and various Asus Vivobook laptops,
the Asus Expertbook B2402CBA has an ACPI DSDT table that describes IRQ 1
as ActiveLow while the kernel overrides it to Edge_High. This prevents the
keyboard from working. To fix this issue, add this laptop to the
skip_override_table so that the kernel does not override IRQ 1.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216864
Tested-by: zelenat <zelenat@gmail.com>
Signed-off-by: Tamim Khan <tamim@fusetak.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/resource.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index f76147272b33..57e8ba44df74 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
 		},
 	},
+	{
+		.ident = "Asus ExpertBook B2402CBA",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "B2402CBA"),
+		},
+	},
 	{
 		.ident = "Asus ExpertBook B2502",
 		.matches = {

From 7d0728e7ac04b19126d2d981a76a6b1b92f06857 Mon Sep 17 00:00:00 2001
From: Paul Menzel <pmenzel@molgen.mpg.de>
Date: Tue, 11 Apr 2023 20:31:44 +0200
Subject: [PATCH 0129/1043] ACPI: resource: Skip IRQ override on ASUS
 ExpertBook B1502CBA

[ Upstream commit 05cda427126f30ce3fc8ffd82fd6f5196398d502 ]

Like the ASUS ExpertBook B2502CBA and various ASUS Vivobook laptops, the
ASUS ExpertBook B1502CBA has an ACPI DSDT table that describes IRQ 1 as
ActiveLow while the kernel overrides it to Edge_High.

    $ sudo dmesg | grep DMI
    DMI: ASUSTeK COMPUTER INC. ASUS EXPERTBOOK B1502CBA_B1502CBA/B1502CBA, BIOS B1502CBA.300 01/18/2023
    $ grep -A 40 PS2K dsdt.dsl | grep IRQ -A 1
                    IRQ (Level, ActiveLow, Exclusive, )
                        {1}

This prevents the keyboard from working. To fix this issue, add this laptop
to the skip_override_table so that the kernel does not override IRQ 1.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=217323
Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/resource.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 57e8ba44df74..a49acf8ddaca 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
 		},
 	},
+	{
+		.ident = "Asus ExpertBook B1502CBA",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "B1502CBA"),
+		},
+	},
 	{
 		.ident = "Asus ExpertBook B2402CBA",
 		.matches = {

From cb868d8857ae2e46f61c253e2b83263d46503c14 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 12 Sep 2023 12:08:27 +0200
Subject: [PATCH 0130/1043] ACPI: resource: Skip IRQ override on ASUS
 ExpertBook B1402CBA

[ Upstream commit c1ed72171ed580fbf159e703b77685aa4b0d0df5 ]

Like various other ASUS ExpertBook-s, the ASUS ExpertBook B1402CBA
has an ACPI DSDT table that describes IRQ 1 as ActiveLow while
the kernel overrides it to EdgeHigh.

This prevents the keyboard from working. To fix this issue, add this laptop
to the skip_override_table so that the kernel does not override IRQ 1.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217901
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/resource.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index a49acf8ddaca..bfd821173f86 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
 		},
 	},
+	{
+		.ident = "Asus ExpertBook B1402CBA",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "B1402CBA"),
+		},
+	},
 	{
 		.ident = "Asus ExpertBook B1502CBA",
 		.matches = {

From 69f40ce372b9269ea90fb747acea53f89b4043e6 Mon Sep 17 00:00:00 2001
From: Waiman Long <longman@redhat.com>
Date: Fri, 14 Jan 2022 14:07:58 -0800
Subject: [PATCH 0131/1043] selftests/vm: make charge_reserved_hugetlb.sh work
 with existing cgroup setting

[ Upstream commit 209376ed2a8431ccb4c40fdcef11194fc1e749b0 ]

The hugetlb cgroup reservation test charge_reserved_hugetlb.sh assume
that no cgroup filesystems are mounted before running the test.  That is
not true in many cases.  As a result, the test fails to run.  Fix that
by querying the current cgroup mount setting and using the existing
cgroup setup instead before attempting to freshly mount a cgroup
filesystem.

Similar change is also made for hugetlb_reparenting_test.sh as well,
though it still has problem if cgroup v2 isn't used.

The patched test scripts were run on a centos 8 based system to verify
that they ran properly.

Link: https://lkml.kernel.org/r/20220106201359.1646575-1-longman@redhat.com
Fixes: 29750f71a9b4 ("hugetlb_cgroup: add hugetlb_cgroup reservation tests")
Signed-off-by: Waiman Long <longman@redhat.com>
Acked-by: Mina Almasry <almasrymina@google.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Stable-dep-of: bbe246f875d0 ("selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../selftests/vm/charge_reserved_hugetlb.sh   | 34 +++++++++++--------
 .../selftests/vm/hugetlb_reparenting_test.sh  | 21 +++++++-----
 .../selftests/vm/write_hugetlb_memory.sh      |  2 +-
 3 files changed, 34 insertions(+), 23 deletions(-)

diff --git a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
index 18d33684faad..71d3cf3bf130 100644
--- a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
+++ b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
@@ -21,19 +21,23 @@ if [[ "$1" == "-cgroup-v2" ]]; then
   reservation_usage_file=rsvd.current
 fi
 
-cgroup_path=/dev/cgroup/memory
-if [[ ! -e $cgroup_path ]]; then
-  mkdir -p $cgroup_path
-  if [[ $cgroup2 ]]; then
+if [[ $cgroup2 ]]; then
+  cgroup_path=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
+  if [[ -z "$cgroup_path" ]]; then
+    cgroup_path=/dev/cgroup/memory
     mount -t cgroup2 none $cgroup_path
-  else
+    do_umount=1
+  fi
+  echo "+hugetlb" >$cgroup_path/cgroup.subtree_control
+else
+  cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
+  if [[ -z "$cgroup_path" ]]; then
+    cgroup_path=/dev/cgroup/memory
     mount -t cgroup memory,hugetlb $cgroup_path
+    do_umount=1
   fi
 fi
-
-if [[ $cgroup2 ]]; then
-  echo "+hugetlb" >/dev/cgroup/memory/cgroup.subtree_control
-fi
+export cgroup_path
 
 function cleanup() {
   if [[ $cgroup2 ]]; then
@@ -105,7 +109,7 @@ function setup_cgroup() {
 
 function wait_for_hugetlb_memory_to_get_depleted() {
   local cgroup="$1"
-  local path="/dev/cgroup/memory/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
+  local path="$cgroup_path/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
   # Wait for hugetlbfs memory to get depleted.
   while [ $(cat $path) != 0 ]; do
     echo Waiting for hugetlb memory to get depleted.
@@ -118,7 +122,7 @@ function wait_for_hugetlb_memory_to_get_reserved() {
   local cgroup="$1"
   local size="$2"
 
-  local path="/dev/cgroup/memory/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
+  local path="$cgroup_path/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
   # Wait for hugetlbfs memory to get written.
   while [ $(cat $path) != $size ]; do
     echo Waiting for hugetlb memory reservation to reach size $size.
@@ -131,7 +135,7 @@ function wait_for_hugetlb_memory_to_get_written() {
   local cgroup="$1"
   local size="$2"
 
-  local path="/dev/cgroup/memory/$cgroup/hugetlb.${MB}MB.$fault_usage_file"
+  local path="$cgroup_path/$cgroup/hugetlb.${MB}MB.$fault_usage_file"
   # Wait for hugetlbfs memory to get written.
   while [ $(cat $path) != $size ]; do
     echo Waiting for hugetlb memory to reach size $size.
@@ -571,5 +575,7 @@ for populate in "" "-o"; do
   done     # populate
 done       # method
 
-umount $cgroup_path
-rmdir $cgroup_path
+if [[ $do_umount ]]; then
+  umount $cgroup_path
+  rmdir $cgroup_path
+fi
diff --git a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
index d11d1febccc3..54234e12288c 100644
--- a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
+++ b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
@@ -15,19 +15,24 @@ if [[ "$1" == "-cgroup-v2" ]]; then
   usage_file=current
 fi
 
-CGROUP_ROOT='/dev/cgroup/memory'
-MNT='/mnt/huge/'
 
-if [[ ! -e $CGROUP_ROOT ]]; then
-  mkdir -p $CGROUP_ROOT
-  if [[ $cgroup2 ]]; then
+if [[ $cgroup2 ]]; then
+  CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
+  if [[ -z "$CGROUP_ROOT" ]]; then
+    CGROUP_ROOT=/dev/cgroup/memory
     mount -t cgroup2 none $CGROUP_ROOT
-    sleep 1
-    echo "+hugetlb +memory" >$CGROUP_ROOT/cgroup.subtree_control
-  else
+    do_umount=1
+  fi
+  echo "+hugetlb +memory" >$CGROUP_ROOT/cgroup.subtree_control
+else
+  CGROUP_ROOT=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
+  if [[ -z "$CGROUP_ROOT" ]]; then
+    CGROUP_ROOT=/dev/cgroup/memory
     mount -t cgroup memory,hugetlb $CGROUP_ROOT
+    do_umount=1
   fi
 fi
+MNT='/mnt/huge/'
 
 function get_machine_hugepage_size() {
   hpz=$(grep -i hugepagesize /proc/meminfo)
diff --git a/tools/testing/selftests/vm/write_hugetlb_memory.sh b/tools/testing/selftests/vm/write_hugetlb_memory.sh
index d3d0d108924d..70a02301f4c2 100644
--- a/tools/testing/selftests/vm/write_hugetlb_memory.sh
+++ b/tools/testing/selftests/vm/write_hugetlb_memory.sh
@@ -14,7 +14,7 @@ want_sleep=$8
 reserve=$9
 
 echo "Putting task in cgroup '$cgroup'"
-echo $$ > /dev/cgroup/memory/"$cgroup"/cgroup.procs
+echo $$ > ${cgroup_path:-/dev/cgroup/memory}/"$cgroup"/cgroup.procs
 
 echo "Method is $method"
 

From d6316f592988ebb12a86e0c028a131572c11fcee Mon Sep 17 00:00:00 2001
From: Juntong Deng <juntong.deng@outlook.com>
Date: Wed, 27 Sep 2023 02:19:44 +0800
Subject: [PATCH 0132/1043] selftests/mm: fix awk usage in
 charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause
 error

[ Upstream commit bbe246f875d064ecfb872fe4f66152e743dfd22d ]

According to the awk manual, the -e option does not need to be specified
in front of 'program' (unless you need to mix program-file).

The redundant -e option can cause error when users use awk tools other
than gawk (for example, mawk does not support the -e option).

Error Example:
awk: not an option: -e

Link: https://lkml.kernel.org/r/VI1P193MB075228810591AF2FDD7D42C599C3A@VI1P193MB0752.EURP193.PROD.OUTLOOK.COM
Signed-off-by: Juntong Deng <juntong.deng@outlook.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/vm/charge_reserved_hugetlb.sh  | 4 ++--
 tools/testing/selftests/vm/hugetlb_reparenting_test.sh | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
index 71d3cf3bf130..7536ff2f890a 100644
--- a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
+++ b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
@@ -22,7 +22,7 @@ if [[ "$1" == "-cgroup-v2" ]]; then
 fi
 
 if [[ $cgroup2 ]]; then
-  cgroup_path=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
+  cgroup_path=$(mount -t cgroup2 | head -1 | awk '{print $3}')
   if [[ -z "$cgroup_path" ]]; then
     cgroup_path=/dev/cgroup/memory
     mount -t cgroup2 none $cgroup_path
@@ -30,7 +30,7 @@ if [[ $cgroup2 ]]; then
   fi
   echo "+hugetlb" >$cgroup_path/cgroup.subtree_control
 else
-  cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
+  cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk '{print $3}')
   if [[ -z "$cgroup_path" ]]; then
     cgroup_path=/dev/cgroup/memory
     mount -t cgroup memory,hugetlb $cgroup_path
diff --git a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
index 54234e12288c..c665b16f1e37 100644
--- a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
+++ b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
@@ -17,7 +17,7 @@ fi
 
 
 if [[ $cgroup2 ]]; then
-  CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
+  CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk '{print $3}')
   if [[ -z "$CGROUP_ROOT" ]]; then
     CGROUP_ROOT=/dev/cgroup/memory
     mount -t cgroup2 none $CGROUP_ROOT
@@ -25,7 +25,7 @@ if [[ $cgroup2 ]]; then
   fi
   echo "+hugetlb +memory" >$CGROUP_ROOT/cgroup.subtree_control
 else
-  CGROUP_ROOT=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
+  CGROUP_ROOT=$(mount -t cgroup | grep ",hugetlb" | awk '{print $3}')
   if [[ -z "$CGROUP_ROOT" ]]; then
     CGROUP_ROOT=/dev/cgroup/memory
     mount -t cgroup memory,hugetlb $CGROUP_ROOT

From 95b9f1e3927b70a3b5edecf1bcba8c2e363b18b2 Mon Sep 17 00:00:00 2001
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Date: Wed, 10 Mar 2021 19:42:44 -0800
Subject: [PATCH 0133/1043] usb: core: Track SuperSpeed Plus GenXxY

[ Upstream commit 0299809be415567366b66f248eed93848b8dc9f3 ]

Introduce ssp_rate field to usb_device structure to capture the
connected SuperSpeed Plus signaling rate generation and lane count with
the corresponding usb_ssp_rate enum.

Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/b7805d121e5ae4ad5ae144bd860b6ac04ee47436.1615432770.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: f74a7afc224a ("usb: hub: Guard against accesses to uninitialized BOS descriptors")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/core/hcd.c |  6 +++-
 drivers/usb/core/hub.c | 78 ++++++++++++++++++++++++++++++++++++++++++
 include/linux/usb.h    |  2 ++
 3 files changed, 85 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 63bb04d262d8..0a77717d6af2 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2745,6 +2745,7 @@ int usb_add_hcd(struct usb_hcd *hcd,
 
 	rhdev->rx_lanes = 1;
 	rhdev->tx_lanes = 1;
+	rhdev->ssp_rate = USB_SSP_GEN_UNKNOWN;
 
 	switch (hcd->speed) {
 	case HCD_USB11:
@@ -2762,8 +2763,11 @@ int usb_add_hcd(struct usb_hcd *hcd,
 	case HCD_USB32:
 		rhdev->rx_lanes = 2;
 		rhdev->tx_lanes = 2;
-		fallthrough;
+		rhdev->ssp_rate = USB_SSP_GEN_2x2;
+		rhdev->speed = USB_SPEED_SUPER_PLUS;
+		break;
 	case HCD_USB31:
+		rhdev->ssp_rate = USB_SSP_GEN_2x1;
 		rhdev->speed = USB_SPEED_SUPER_PLUS;
 		break;
 	default:
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index b91b01c2c5de..cfcd4f2ffffa 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -31,6 +31,7 @@
 #include <linux/pm_qos.h>
 #include <linux/kobject.h>
 
+#include <linux/bitfield.h>
 #include <linux/uaccess.h>
 #include <asm/byteorder.h>
 
@@ -2691,6 +2692,81 @@ int usb_authorize_device(struct usb_device *usb_dev)
 	return result;
 }
 
+/**
+ * get_port_ssp_rate - Match the extended port status to SSP rate
+ * @hdev: The hub device
+ * @ext_portstatus: extended port status
+ *
+ * Match the extended port status speed id to the SuperSpeed Plus sublink speed
+ * capability attributes. Base on the number of connected lanes and speed,
+ * return the corresponding enum usb_ssp_rate.
+ */
+static enum usb_ssp_rate get_port_ssp_rate(struct usb_device *hdev,
+					   u32 ext_portstatus)
+{
+	struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap;
+	u32 attr;
+	u8 speed_id;
+	u8 ssac;
+	u8 lanes;
+	int i;
+
+	if (!ssp_cap)
+		goto out;
+
+	speed_id = ext_portstatus & USB_EXT_PORT_STAT_RX_SPEED_ID;
+	lanes = USB_EXT_PORT_RX_LANES(ext_portstatus) + 1;
+
+	ssac = le32_to_cpu(ssp_cap->bmAttributes) &
+		USB_SSP_SUBLINK_SPEED_ATTRIBS;
+
+	for (i = 0; i <= ssac; i++) {
+		u8 ssid;
+
+		attr = le32_to_cpu(ssp_cap->bmSublinkSpeedAttr[i]);
+		ssid = FIELD_GET(USB_SSP_SUBLINK_SPEED_SSID, attr);
+		if (speed_id == ssid) {
+			u16 mantissa;
+			u8 lse;
+			u8 type;
+
+			/*
+			 * Note: currently asymmetric lane types are only
+			 * applicable for SSIC operate in SuperSpeed protocol
+			 */
+			type = FIELD_GET(USB_SSP_SUBLINK_SPEED_ST, attr);
+			if (type == USB_SSP_SUBLINK_SPEED_ST_ASYM_RX ||
+			    type == USB_SSP_SUBLINK_SPEED_ST_ASYM_TX)
+				goto out;
+
+			if (FIELD_GET(USB_SSP_SUBLINK_SPEED_LP, attr) !=
+			    USB_SSP_SUBLINK_SPEED_LP_SSP)
+				goto out;
+
+			lse = FIELD_GET(USB_SSP_SUBLINK_SPEED_LSE, attr);
+			mantissa = FIELD_GET(USB_SSP_SUBLINK_SPEED_LSM, attr);
+
+			/* Convert to Gbps */
+			for (; lse < USB_SSP_SUBLINK_SPEED_LSE_GBPS; lse++)
+				mantissa /= 1000;
+
+			if (mantissa >= 10 && lanes == 1)
+				return USB_SSP_GEN_2x1;
+
+			if (mantissa >= 10 && lanes == 2)
+				return USB_SSP_GEN_2x2;
+
+			if (mantissa >= 5 && lanes == 2)
+				return USB_SSP_GEN_1x2;
+
+			goto out;
+		}
+	}
+
+out:
+	return USB_SSP_GEN_UNKNOWN;
+}
+
 /*
  * Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the
  * capability couldn't be checked.
@@ -2878,9 +2954,11 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
 		/* extended portstatus Rx and Tx lane count are zero based */
 		udev->rx_lanes = USB_EXT_PORT_RX_LANES(ext_portstatus) + 1;
 		udev->tx_lanes = USB_EXT_PORT_TX_LANES(ext_portstatus) + 1;
+		udev->ssp_rate = get_port_ssp_rate(hub->hdev, ext_portstatus);
 	} else {
 		udev->rx_lanes = 1;
 		udev->tx_lanes = 1;
+		udev->ssp_rate = USB_SSP_GEN_UNKNOWN;
 	}
 	if (hub_is_wusb(hub))
 		udev->speed = USB_SPEED_WIRELESS;
diff --git a/include/linux/usb.h b/include/linux/usb.h
index bc5923772703..8bc1119afc31 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -565,6 +565,7 @@ struct usb3_lpm_parameters {
  * @speed: device speed: high/full/low (or error)
  * @rx_lanes: number of rx lanes in use, USB 3.2 adds dual-lane support
  * @tx_lanes: number of tx lanes in use, USB 3.2 adds dual-lane support
+ * @ssp_rate: SuperSpeed Plus phy signaling rate and lane count
  * @tt: Transaction Translator info; used with low/full speed dev, highspeed hub
  * @ttport: device port on that tt hub
  * @toggle: one bit for each endpoint, with ([0] = IN, [1] = OUT) endpoints
@@ -642,6 +643,7 @@ struct usb_device {
 	enum usb_device_speed	speed;
 	unsigned int		rx_lanes;
 	unsigned int		tx_lanes;
+	enum usb_ssp_rate	ssp_rate;
 
 	struct usb_tt	*tt;
 	int		ttport;

From e2b4de13e5f978eb138c059b2120f64d2e35763a Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Thu, 2 Feb 2023 17:04:59 +0200
Subject: [PATCH 0134/1043] xhci: cleanup xhci_hub_control port references

[ Upstream commit faaae0190dcd1e230616c85bbc3b339f27ba5b81 ]

Both port number and port structure of a port are referred to several
times when handing hub requests in xhci.

Use more suitable data types and readable names for these.
Cleanup only, no functional changes

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-6-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-hub.c | 123 ++++++++++++++++++------------------
 1 file changed, 63 insertions(+), 60 deletions(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 7bb306741807..c2a8d455eeac 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1108,11 +1108,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 	u16 test_mode = 0;
 	struct xhci_hub *rhub;
 	struct xhci_port **ports;
+	struct xhci_port *port;
+	int portnum1;
 
 	rhub = xhci_get_rhub(hcd);
 	ports = rhub->ports;
 	max_ports = rhub->num_ports;
 	bus_state = &rhub->bus_state;
+	portnum1 = wIndex & 0xff;
 
 	spin_lock_irqsave(&xhci->lock, flags);
 	switch (typeReq) {
@@ -1146,10 +1149,12 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 		spin_unlock_irqrestore(&xhci->lock, flags);
 		return retval;
 	case GetPortStatus:
-		if (!wIndex || wIndex > max_ports)
+		if (!portnum1 || portnum1 > max_ports)
 			goto error;
+
 		wIndex--;
-		temp = readl(ports[wIndex]->addr);
+		port = ports[portnum1 - 1];
+		temp = readl(port->addr);
 		if (temp == ~(u32)0) {
 			xhci_hc_died(xhci);
 			retval = -ENODEV;
@@ -1162,7 +1167,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 			goto error;
 
 		xhci_dbg(xhci, "Get port status %d-%d read: 0x%x, return 0x%x",
-			 hcd->self.busnum, wIndex + 1, temp, status);
+			 hcd->self.busnum, portnum1, temp, status);
 
 		put_unaligned(cpu_to_le32(status), (__le32 *) buf);
 		/* if USB 3.1 extended port status return additional 4 bytes */
@@ -1174,7 +1179,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 				retval = -EINVAL;
 				break;
 			}
-			port_li = readl(ports[wIndex]->addr + PORTLI);
+			port_li = readl(port->addr + PORTLI);
 			status = xhci_get_ext_port_status(temp, port_li);
 			put_unaligned_le32(status, &buf[4]);
 		}
@@ -1188,11 +1193,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 			test_mode = (wIndex & 0xff00) >> 8;
 		/* The MSB of wIndex is the U1/U2 timeout */
 		timeout = (wIndex & 0xff00) >> 8;
+
 		wIndex &= 0xff;
-		if (!wIndex || wIndex > max_ports)
+		if (!portnum1 || portnum1 > max_ports)
 			goto error;
+
+		port = ports[portnum1 - 1];
 		wIndex--;
-		temp = readl(ports[wIndex]->addr);
+		temp = readl(port->addr);
 		if (temp == ~(u32)0) {
 			xhci_hc_died(xhci);
 			retval = -ENODEV;
@@ -1202,11 +1210,10 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 		/* FIXME: What new port features do we need to support? */
 		switch (wValue) {
 		case USB_PORT_FEAT_SUSPEND:
-			temp = readl(ports[wIndex]->addr);
+			temp = readl(port->addr);
 			if ((temp & PORT_PLS_MASK) != XDEV_U0) {
 				/* Resume the port to U0 first */
-				xhci_set_link_state(xhci, ports[wIndex],
-							XDEV_U0);
+				xhci_set_link_state(xhci, port, XDEV_U0);
 				spin_unlock_irqrestore(&xhci->lock, flags);
 				msleep(10);
 				spin_lock_irqsave(&xhci->lock, flags);
@@ -1215,16 +1222,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 			 * a port unless the port reports that it is in the
 			 * enabled (PED = ‘1’,PLS < ‘3’) state.
 			 */
-			temp = readl(ports[wIndex]->addr);
+			temp = readl(port->addr);
 			if ((temp & PORT_PE) == 0 || (temp & PORT_RESET)
 				|| (temp & PORT_PLS_MASK) >= XDEV_U3) {
 				xhci_warn(xhci, "USB core suspending port %d-%d not in U0/U1/U2\n",
-					  hcd->self.busnum, wIndex + 1);
+					  hcd->self.busnum, portnum1);
 				goto error;
 			}
 
 			slot_id = xhci_find_slot_id_by_port(hcd, xhci,
-					wIndex + 1);
+							    portnum1);
 			if (!slot_id) {
 				xhci_warn(xhci, "slot_id is zero\n");
 				goto error;
@@ -1234,21 +1241,21 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 			xhci_stop_device(xhci, slot_id, 1);
 			spin_lock_irqsave(&xhci->lock, flags);
 
-			xhci_set_link_state(xhci, ports[wIndex], XDEV_U3);
+			xhci_set_link_state(xhci, port, XDEV_U3);
 
 			spin_unlock_irqrestore(&xhci->lock, flags);
 			msleep(10); /* wait device to enter */
 			spin_lock_irqsave(&xhci->lock, flags);
 
-			temp = readl(ports[wIndex]->addr);
+			temp = readl(port->addr);
 			bus_state->suspended_ports |= 1 << wIndex;
 			break;
 		case USB_PORT_FEAT_LINK_STATE:
-			temp = readl(ports[wIndex]->addr);
+			temp = readl(port->addr);
 			/* Disable port */
 			if (link_state == USB_SS_PORT_LS_SS_DISABLED) {
 				xhci_dbg(xhci, "Disable port %d-%d\n",
-					 hcd->self.busnum, wIndex + 1);
+					 hcd->self.busnum, portnum1);
 				temp = xhci_port_state_to_neutral(temp);
 				/*
 				 * Clear all change bits, so that we get a new
@@ -1257,18 +1264,17 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 				temp |= PORT_CSC | PORT_PEC | PORT_WRC |
 					PORT_OCC | PORT_RC | PORT_PLC |
 					PORT_CEC;
-				writel(temp | PORT_PE, ports[wIndex]->addr);
-				temp = readl(ports[wIndex]->addr);
+				writel(temp | PORT_PE, port->addr);
+				temp = readl(port->addr);
 				break;
 			}
 
 			/* Put link in RxDetect (enable port) */
 			if (link_state == USB_SS_PORT_LS_RX_DETECT) {
 				xhci_dbg(xhci, "Enable port %d-%d\n",
-					 hcd->self.busnum, wIndex + 1);
-				xhci_set_link_state(xhci, ports[wIndex],
-							link_state);
-				temp = readl(ports[wIndex]->addr);
+					 hcd->self.busnum, portnum1);
+				xhci_set_link_state(xhci, port,	link_state);
+				temp = readl(port->addr);
 				break;
 			}
 
@@ -1298,11 +1304,10 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 				}
 
 				xhci_dbg(xhci, "Enable compliance mode transition for port %d-%d\n",
-					 hcd->self.busnum, wIndex + 1);
-				xhci_set_link_state(xhci, ports[wIndex],
-						link_state);
+					 hcd->self.busnum, portnum1);
+				xhci_set_link_state(xhci, port, link_state);
 
-				temp = readl(ports[wIndex]->addr);
+				temp = readl(port->addr);
 				break;
 			}
 			/* Port must be enabled */
@@ -1313,8 +1318,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 			/* Can't set port link state above '3' (U3) */
 			if (link_state > USB_SS_PORT_LS_U3) {
 				xhci_warn(xhci, "Cannot set port %d-%d link state %d\n",
-					  hcd->self.busnum, wIndex + 1,
-					  link_state);
+					  hcd->self.busnum, portnum1, link_state);
 				goto error;
 			}
 
@@ -1339,8 +1343,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 					reinit_completion(&bus_state->u3exit_done[wIndex]);
 				}
 				if (pls <= XDEV_U3) /* U1, U2, U3 */
-					xhci_set_link_state(xhci, ports[wIndex],
-							    USB_SS_PORT_LS_U0);
+					xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U0);
 				if (!wait_u0) {
 					if (pls > XDEV_U3)
 						goto error;
@@ -1350,16 +1353,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 				if (!wait_for_completion_timeout(&bus_state->u3exit_done[wIndex],
 								 msecs_to_jiffies(500)))
 					xhci_dbg(xhci, "missing U0 port change event for port %d-%d\n",
-						 hcd->self.busnum, wIndex + 1);
+						 hcd->self.busnum, portnum1);
 				spin_lock_irqsave(&xhci->lock, flags);
-				temp = readl(ports[wIndex]->addr);
+				temp = readl(port->addr);
 				break;
 			}
 
 			if (link_state == USB_SS_PORT_LS_U3) {
 				int retries = 16;
 				slot_id = xhci_find_slot_id_by_port(hcd, xhci,
-						wIndex + 1);
+								    portnum1);
 				if (slot_id) {
 					/* unlock to execute stop endpoint
 					 * commands */
@@ -1368,16 +1371,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 					xhci_stop_device(xhci, slot_id, 1);
 					spin_lock_irqsave(&xhci->lock, flags);
 				}
-				xhci_set_link_state(xhci, ports[wIndex], USB_SS_PORT_LS_U3);
+				xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U3);
 				spin_unlock_irqrestore(&xhci->lock, flags);
 				while (retries--) {
 					usleep_range(4000, 8000);
-					temp = readl(ports[wIndex]->addr);
+					temp = readl(port->addr);
 					if ((temp & PORT_PLS_MASK) == XDEV_U3)
 						break;
 				}
 				spin_lock_irqsave(&xhci->lock, flags);
-				temp = readl(ports[wIndex]->addr);
+				temp = readl(port->addr);
 				bus_state->suspended_ports |= 1 << wIndex;
 			}
 			break;
@@ -1392,39 +1395,38 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 			break;
 		case USB_PORT_FEAT_RESET:
 			temp = (temp | PORT_RESET);
-			writel(temp, ports[wIndex]->addr);
+			writel(temp, port->addr);
 
-			temp = readl(ports[wIndex]->addr);
+			temp = readl(port->addr);
 			xhci_dbg(xhci, "set port reset, actual port %d-%d status  = 0x%x\n",
-				 hcd->self.busnum, wIndex + 1, temp);
+				 hcd->self.busnum, portnum1, temp);
 			break;
 		case USB_PORT_FEAT_REMOTE_WAKE_MASK:
-			xhci_set_remote_wake_mask(xhci, ports[wIndex],
-						  wake_mask);
-			temp = readl(ports[wIndex]->addr);
+			xhci_set_remote_wake_mask(xhci, port, wake_mask);
+			temp = readl(port->addr);
 			xhci_dbg(xhci, "set port remote wake mask, actual port %d-%d status  = 0x%x\n",
-				 hcd->self.busnum, wIndex + 1, temp);
+				 hcd->self.busnum, portnum1, temp);
 			break;
 		case USB_PORT_FEAT_BH_PORT_RESET:
 			temp |= PORT_WR;
-			writel(temp, ports[wIndex]->addr);
-			temp = readl(ports[wIndex]->addr);
+			writel(temp, port->addr);
+			temp = readl(port->addr);
 			break;
 		case USB_PORT_FEAT_U1_TIMEOUT:
 			if (hcd->speed < HCD_USB3)
 				goto error;
-			temp = readl(ports[wIndex]->addr + PORTPMSC);
+			temp = readl(port->addr + PORTPMSC);
 			temp &= ~PORT_U1_TIMEOUT_MASK;
 			temp |= PORT_U1_TIMEOUT(timeout);
-			writel(temp, ports[wIndex]->addr + PORTPMSC);
+			writel(temp, port->addr + PORTPMSC);
 			break;
 		case USB_PORT_FEAT_U2_TIMEOUT:
 			if (hcd->speed < HCD_USB3)
 				goto error;
-			temp = readl(ports[wIndex]->addr + PORTPMSC);
+			temp = readl(port->addr + PORTPMSC);
 			temp &= ~PORT_U2_TIMEOUT_MASK;
 			temp |= PORT_U2_TIMEOUT(timeout);
-			writel(temp, ports[wIndex]->addr + PORTPMSC);
+			writel(temp, port->addr + PORTPMSC);
 			break;
 		case USB_PORT_FEAT_TEST:
 			/* 4.19.6 Port Test Modes (USB2 Test Mode) */
@@ -1440,13 +1442,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 			goto error;
 		}
 		/* unblock any posted writes */
-		temp = readl(ports[wIndex]->addr);
+		temp = readl(port->addr);
 		break;
 	case ClearPortFeature:
-		if (!wIndex || wIndex > max_ports)
+		if (!portnum1 || portnum1 > max_ports)
 			goto error;
+
+		port = ports[portnum1 - 1];
+
 		wIndex--;
-		temp = readl(ports[wIndex]->addr);
+		temp = readl(port->addr);
 		if (temp == ~(u32)0) {
 			xhci_hc_died(xhci);
 			retval = -ENODEV;
@@ -1456,7 +1461,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 		temp = xhci_port_state_to_neutral(temp);
 		switch (wValue) {
 		case USB_PORT_FEAT_SUSPEND:
-			temp = readl(ports[wIndex]->addr);
+			temp = readl(port->addr);
 			xhci_dbg(xhci, "clear USB_PORT_FEAT_SUSPEND\n");
 			xhci_dbg(xhci, "PORTSC %04x\n", temp);
 			if (temp & PORT_RESET)
@@ -1467,20 +1472,18 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 
 				set_bit(wIndex, &bus_state->resuming_ports);
 				usb_hcd_start_port_resume(&hcd->self, wIndex);
-				xhci_set_link_state(xhci, ports[wIndex],
-						    XDEV_RESUME);
+				xhci_set_link_state(xhci, port, XDEV_RESUME);
 				spin_unlock_irqrestore(&xhci->lock, flags);
 				msleep(USB_RESUME_TIMEOUT);
 				spin_lock_irqsave(&xhci->lock, flags);
-				xhci_set_link_state(xhci, ports[wIndex],
-							XDEV_U0);
+				xhci_set_link_state(xhci, port, XDEV_U0);
 				clear_bit(wIndex, &bus_state->resuming_ports);
 				usb_hcd_end_port_resume(&hcd->self, wIndex);
 			}
 			bus_state->port_c_suspend |= 1 << wIndex;
 
 			slot_id = xhci_find_slot_id_by_port(hcd, xhci,
-					wIndex + 1);
+					portnum1);
 			if (!slot_id) {
 				xhci_dbg(xhci, "slot_id is zero\n");
 				goto error;
@@ -1498,11 +1501,11 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 		case USB_PORT_FEAT_C_PORT_LINK_STATE:
 		case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
 			xhci_clear_port_change_bit(xhci, wValue, wIndex,
-					ports[wIndex]->addr, temp);
+					port->addr, temp);
 			break;
 		case USB_PORT_FEAT_ENABLE:
 			xhci_disable_port(hcd, xhci, wIndex,
-					ports[wIndex]->addr, temp);
+					port->addr, temp);
 			break;
 		case USB_PORT_FEAT_POWER:
 			xhci_set_port_power(xhci, hcd, wIndex, false, &flags);

From d44c9285ce354d8735a1fe071285cf5ed0a2241b Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Thu, 2 Feb 2023 17:05:01 +0200
Subject: [PATCH 0135/1043] xhci: move port specific items such as state
 completions to port structure

[ Upstream commit 2996e9fc00c378987c18ecbafe5624581b18c0d6 ]

Now that we have a port structure for each port it makes sense to
move per port variables, timestamps and completions there.
Get rid of storing bitfileds and arrays of port specific items per bus.

Move
unsigned long           resume_done;
insigned long		rexit_ports
struct completion       rexit_done;
struct completion       u3exit_done;

Rename rexit_ports to rexit_active, and remove a redundant hcd
speed check while checking if rexit_active is set.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-8-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-hub.c  | 31 +++++++++++++++----------------
 drivers/usb/host/xhci-mem.c  | 10 +++-------
 drivers/usb/host/xhci-ring.c | 13 ++++++-------
 drivers/usb/host/xhci.h      |  9 ++++-----
 4 files changed, 28 insertions(+), 35 deletions(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index c2a8d455eeac..f836710bcd6e 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -838,7 +838,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
 		return -EINVAL;
 	}
 	/* did port event handler already start resume timing? */
-	if (!bus_state->resume_done[wIndex]) {
+	if (!port->resume_done) {
 		/* If not, maybe we are in a host initated resume? */
 		if (test_bit(wIndex, &bus_state->resuming_ports)) {
 			/* Host initated resume doesn't time the resume
@@ -855,28 +855,27 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
 				msecs_to_jiffies(USB_RESUME_TIMEOUT);
 
 			set_bit(wIndex, &bus_state->resuming_ports);
-			bus_state->resume_done[wIndex] = timeout;
+			port->resume_done = timeout;
 			mod_timer(&hcd->rh_timer, timeout);
 			usb_hcd_start_port_resume(&hcd->self, wIndex);
 		}
 	/* Has resume been signalled for USB_RESUME_TIME yet? */
-	} else if (time_after_eq(jiffies, bus_state->resume_done[wIndex])) {
+	} else if (time_after_eq(jiffies, port->resume_done)) {
 		int time_left;
 
 		xhci_dbg(xhci, "resume USB2 port %d-%d\n",
 			 hcd->self.busnum, wIndex + 1);
 
-		bus_state->resume_done[wIndex] = 0;
+		port->resume_done = 0;
 		clear_bit(wIndex, &bus_state->resuming_ports);
-
-		set_bit(wIndex, &bus_state->rexit_ports);
+		port->rexit_active = true;
 
 		xhci_test_and_clear_bit(xhci, port, PORT_PLC);
 		xhci_set_link_state(xhci, port, XDEV_U0);
 
 		spin_unlock_irqrestore(&xhci->lock, *flags);
 		time_left = wait_for_completion_timeout(
-			&bus_state->rexit_done[wIndex],
+			&port->rexit_done,
 			msecs_to_jiffies(XHCI_MAX_REXIT_TIMEOUT_MS));
 		spin_lock_irqsave(&xhci->lock, *flags);
 
@@ -895,7 +894,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
 			xhci_warn(xhci, "Port resume timed out, port %d-%d: 0x%x\n",
 				  hcd->self.busnum, wIndex + 1, port_status);
 			*status |= USB_PORT_STAT_SUSPEND;
-			clear_bit(wIndex, &bus_state->rexit_ports);
+			port->rexit_active = false;
 		}
 
 		usb_hcd_end_port_resume(&hcd->self, wIndex);
@@ -1002,10 +1001,10 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
 		if (link_state == XDEV_U2)
 			*status |= USB_PORT_STAT_L1;
 		if (link_state == XDEV_U0) {
-			if (bus_state->resume_done[portnum])
+			if (port->resume_done)
 				usb_hcd_end_port_resume(&port->rhub->hcd->self,
 							portnum);
-			bus_state->resume_done[portnum] = 0;
+			port->resume_done = 0;
 			clear_bit(portnum, &bus_state->resuming_ports);
 			if (bus_state->suspended_ports & (1 << portnum)) {
 				bus_state->suspended_ports &= ~(1 << portnum);
@@ -1077,11 +1076,11 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
 	 * Clear stale usb2 resume signalling variables in case port changed
 	 * state during resume signalling. For example on error
 	 */
-	if ((bus_state->resume_done[wIndex] ||
+	if ((port->resume_done ||
 	     test_bit(wIndex, &bus_state->resuming_ports)) &&
 	    (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
 	    (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
-		bus_state->resume_done[wIndex] = 0;
+		port->resume_done = 0;
 		clear_bit(wIndex, &bus_state->resuming_ports);
 		usb_hcd_end_port_resume(&hcd->self, wIndex);
 	}
@@ -1340,7 +1339,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 				    pls == XDEV_RESUME ||
 				    pls == XDEV_RECOVERY) {
 					wait_u0 = true;
-					reinit_completion(&bus_state->u3exit_done[wIndex]);
+					reinit_completion(&port->u3exit_done);
 				}
 				if (pls <= XDEV_U3) /* U1, U2, U3 */
 					xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U0);
@@ -1350,7 +1349,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 					break;
 				}
 				spin_unlock_irqrestore(&xhci->lock, flags);
-				if (!wait_for_completion_timeout(&bus_state->u3exit_done[wIndex],
+				if (!wait_for_completion_timeout(&port->u3exit_done,
 								 msecs_to_jiffies(500)))
 					xhci_dbg(xhci, "missing U0 port change event for port %d-%d\n",
 						 hcd->self.busnum, portnum1);
@@ -1589,8 +1588,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
 
 		if ((temp & mask) != 0 ||
 			(bus_state->port_c_suspend & 1 << i) ||
-			(bus_state->resume_done[i] && time_after_eq(
-			    jiffies, bus_state->resume_done[i]))) {
+			(ports[i]->resume_done && time_after_eq(
+			    jiffies, ports[i]->resume_done))) {
 			buf[(i + 1) / 8] |= 1 << (i + 1) % 8;
 			status = 1;
 		}
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 390bdf823e08..006e1b15fbda 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2336,6 +2336,9 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
 		xhci->hw_ports[i].addr = &xhci->op_regs->port_status_base +
 			NUM_PORT_REGS * i;
 		xhci->hw_ports[i].hw_portnum = i;
+
+		init_completion(&xhci->hw_ports[i].rexit_done);
+		init_completion(&xhci->hw_ports[i].u3exit_done);
 	}
 
 	xhci->rh_bw = kcalloc_node(num_ports, sizeof(*xhci->rh_bw), flags,
@@ -2603,13 +2606,6 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
 	 */
 	for (i = 0; i < MAX_HC_SLOTS; i++)
 		xhci->devs[i] = NULL;
-	for (i = 0; i < USB_MAXCHILDREN; i++) {
-		xhci->usb2_rhub.bus_state.resume_done[i] = 0;
-		xhci->usb3_rhub.bus_state.resume_done[i] = 0;
-		/* Only the USB 2.0 completions will ever be used. */
-		init_completion(&xhci->usb2_rhub.bus_state.rexit_done[i]);
-		init_completion(&xhci->usb3_rhub.bus_state.u3exit_done[i]);
-	}
 
 	if (scratchpad_alloc(xhci, flags))
 		goto fail;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 248bfa3020de..ada9977c41aa 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1851,7 +1851,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
 			goto cleanup;
 		} else if (!test_bit(hcd_portnum, &bus_state->resuming_ports)) {
 			xhci_dbg(xhci, "resume HS port %d\n", port_id);
-			bus_state->resume_done[hcd_portnum] = jiffies +
+			port->resume_done = jiffies +
 				msecs_to_jiffies(USB_RESUME_TIMEOUT);
 			set_bit(hcd_portnum, &bus_state->resuming_ports);
 			/* Do the rest in GetPortStatus after resume time delay.
@@ -1860,7 +1860,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
 			 */
 			set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
 			mod_timer(&hcd->rh_timer,
-				  bus_state->resume_done[hcd_portnum]);
+				  port->resume_done);
 			usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
 			bogus_port_status = true;
 		}
@@ -1872,7 +1872,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
 	     (portsc & PORT_PLS_MASK) == XDEV_U1 ||
 	     (portsc & PORT_PLS_MASK) == XDEV_U2)) {
 		xhci_dbg(xhci, "resume SS port %d finished\n", port_id);
-		complete(&bus_state->u3exit_done[hcd_portnum]);
+		complete(&port->u3exit_done);
 		/* We've just brought the device into U0/1/2 through either the
 		 * Resume state after a device remote wakeup, or through the
 		 * U3Exit state after a host-initiated resume.  If it's a device
@@ -1897,10 +1897,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
 	 * RExit to a disconnect state).  If so, let the the driver know it's
 	 * out of the RExit state.
 	 */
-	if (!DEV_SUPERSPEED_ANY(portsc) && hcd->speed < HCD_USB3 &&
-			test_and_clear_bit(hcd_portnum,
-				&bus_state->rexit_ports)) {
-		complete(&bus_state->rexit_done[hcd_portnum]);
+	if (hcd->speed < HCD_USB3 && port->rexit_active) {
+		complete(&port->rexit_done);
+		port->rexit_active = false;
 		bogus_port_status = true;
 		goto cleanup;
 	}
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 6a7c05940e66..14eb13a85fce 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1699,13 +1699,8 @@ struct xhci_bus_state {
 	u32			port_c_suspend;
 	u32			suspended_ports;
 	u32			port_remote_wakeup;
-	unsigned long		resume_done[USB_MAXCHILDREN];
 	/* which ports have started to resume */
 	unsigned long		resuming_ports;
-	/* Which ports are waiting on RExit to U0 transition. */
-	unsigned long		rexit_ports;
-	struct completion	rexit_done[USB_MAXCHILDREN];
-	struct completion	u3exit_done[USB_MAXCHILDREN];
 };
 
 
@@ -1729,6 +1724,10 @@ struct xhci_port {
 	struct xhci_hub		*rhub;
 	struct xhci_port_cap	*port_cap;
 	unsigned int		lpm_incapable:1;
+	unsigned long		resume_done;
+	bool			rexit_active;
+	struct completion	rexit_done;
+	struct completion	u3exit_done;
 };
 
 struct xhci_hub {

From e7abc4b18d1a10271ff723cd5a09e0cc03f9a61b Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Thu, 2 Feb 2023 17:05:03 +0200
Subject: [PATCH 0136/1043] xhci: rename resume_done to resume_timestamp

[ Upstream commit a909d629ae77b97b6288bc3cfe68560454bf79c6 ]

resume_done is just a timestamp, avoid confusing it with completions
related to port state transitions that are named *_done

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-10-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-hub.c  | 20 ++++++++++----------
 drivers/usb/host/xhci-ring.c |  4 ++--
 drivers/usb/host/xhci.h      |  2 +-
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index f836710bcd6e..39c58b1782d5 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -838,7 +838,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
 		return -EINVAL;
 	}
 	/* did port event handler already start resume timing? */
-	if (!port->resume_done) {
+	if (!port->resume_timestamp) {
 		/* If not, maybe we are in a host initated resume? */
 		if (test_bit(wIndex, &bus_state->resuming_ports)) {
 			/* Host initated resume doesn't time the resume
@@ -855,18 +855,18 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
 				msecs_to_jiffies(USB_RESUME_TIMEOUT);
 
 			set_bit(wIndex, &bus_state->resuming_ports);
-			port->resume_done = timeout;
+			port->resume_timestamp = timeout;
 			mod_timer(&hcd->rh_timer, timeout);
 			usb_hcd_start_port_resume(&hcd->self, wIndex);
 		}
 	/* Has resume been signalled for USB_RESUME_TIME yet? */
-	} else if (time_after_eq(jiffies, port->resume_done)) {
+	} else if (time_after_eq(jiffies, port->resume_timestamp)) {
 		int time_left;
 
 		xhci_dbg(xhci, "resume USB2 port %d-%d\n",
 			 hcd->self.busnum, wIndex + 1);
 
-		port->resume_done = 0;
+		port->resume_timestamp = 0;
 		clear_bit(wIndex, &bus_state->resuming_ports);
 		port->rexit_active = true;
 
@@ -1001,10 +1001,10 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
 		if (link_state == XDEV_U2)
 			*status |= USB_PORT_STAT_L1;
 		if (link_state == XDEV_U0) {
-			if (port->resume_done)
+			if (port->resume_timestamp)
 				usb_hcd_end_port_resume(&port->rhub->hcd->self,
 							portnum);
-			port->resume_done = 0;
+			port->resume_timestamp = 0;
 			clear_bit(portnum, &bus_state->resuming_ports);
 			if (bus_state->suspended_ports & (1 << portnum)) {
 				bus_state->suspended_ports &= ~(1 << portnum);
@@ -1076,11 +1076,11 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
 	 * Clear stale usb2 resume signalling variables in case port changed
 	 * state during resume signalling. For example on error
 	 */
-	if ((port->resume_done ||
+	if ((port->resume_timestamp ||
 	     test_bit(wIndex, &bus_state->resuming_ports)) &&
 	    (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
 	    (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
-		port->resume_done = 0;
+		port->resume_timestamp = 0;
 		clear_bit(wIndex, &bus_state->resuming_ports);
 		usb_hcd_end_port_resume(&hcd->self, wIndex);
 	}
@@ -1588,8 +1588,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
 
 		if ((temp & mask) != 0 ||
 			(bus_state->port_c_suspend & 1 << i) ||
-			(ports[i]->resume_done && time_after_eq(
-			    jiffies, ports[i]->resume_done))) {
+			(ports[i]->resume_timestamp && time_after_eq(
+			    jiffies, ports[i]->resume_timestamp))) {
 			buf[(i + 1) / 8] |= 1 << (i + 1) % 8;
 			status = 1;
 		}
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index ada9977c41aa..5ee095a5d38a 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1851,7 +1851,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
 			goto cleanup;
 		} else if (!test_bit(hcd_portnum, &bus_state->resuming_ports)) {
 			xhci_dbg(xhci, "resume HS port %d\n", port_id);
-			port->resume_done = jiffies +
+			port->resume_timestamp = jiffies +
 				msecs_to_jiffies(USB_RESUME_TIMEOUT);
 			set_bit(hcd_portnum, &bus_state->resuming_ports);
 			/* Do the rest in GetPortStatus after resume time delay.
@@ -1860,7 +1860,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
 			 */
 			set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
 			mod_timer(&hcd->rh_timer,
-				  port->resume_done);
+				  port->resume_timestamp);
 			usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
 			bogus_port_status = true;
 		}
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 14eb13a85fce..bb3c362a194b 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1724,7 +1724,7 @@ struct xhci_port {
 	struct xhci_hub		*rhub;
 	struct xhci_port_cap	*port_cap;
 	unsigned int		lpm_incapable:1;
-	unsigned long		resume_done;
+	unsigned long		resume_timestamp;
 	bool			rexit_active;
 	struct completion	rexit_done;
 	struct completion	u3exit_done;

From 92088dd8862749e100a14fcc4ad49ced60a97e3e Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Thu, 2 Feb 2023 17:05:04 +0200
Subject: [PATCH 0137/1043] xhci: clear usb2 resume related variables in one
 place.

[ Upstream commit 0e6275452ce26d7ff274a5c1b15ed581a26f7986 ]

Initially resume related USB2 variables were cleared once port
successfully resumed to U0. Later code was added to clean up
stale resume variables in case of port failed to resume to U0.

Clear the variables in one place after port is no longer resuming
or in suspended U3 state.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-11-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-hub.c | 38 ++++++++++++++++---------------------
 1 file changed, 16 insertions(+), 22 deletions(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 39c58b1782d5..0aac8fcd3779 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -985,7 +985,6 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
 	struct xhci_bus_state *bus_state;
 	u32 link_state;
 	u32 portnum;
-	int ret;
 
 	bus_state = &port->rhub->bus_state;
 	link_state = portsc & PORT_PLS_MASK;
@@ -1001,23 +1000,30 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
 		if (link_state == XDEV_U2)
 			*status |= USB_PORT_STAT_L1;
 		if (link_state == XDEV_U0) {
-			if (port->resume_timestamp)
-				usb_hcd_end_port_resume(&port->rhub->hcd->self,
-							portnum);
-			port->resume_timestamp = 0;
-			clear_bit(portnum, &bus_state->resuming_ports);
 			if (bus_state->suspended_ports & (1 << portnum)) {
 				bus_state->suspended_ports &= ~(1 << portnum);
 				bus_state->port_c_suspend |= 1 << portnum;
 			}
 		}
 		if (link_state == XDEV_RESUME) {
-			ret = xhci_handle_usb2_port_link_resume(port, status,
-								portsc, flags);
-			if (ret)
-				return;
+			xhci_handle_usb2_port_link_resume(port, status, portsc,
+							  flags);
 		}
 	}
+
+	/*
+	 * Clear usb2 resume signalling variables if port is no longer suspended
+	 * or resuming. Port either resumed to U0/U1/U2, disconnected, or in a
+	 * error state. Resume related variables should be cleared in all those cases.
+	 */
+	if ((link_state != XDEV_U3 &&
+	     link_state != XDEV_RESUME) &&
+	    (port->resume_timestamp ||
+	     test_bit(portnum, &bus_state->resuming_ports))) {
+		port->resume_timestamp = 0;
+		clear_bit(portnum, &bus_state->resuming_ports);
+		usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
+	}
 }
 
 /*
@@ -1072,18 +1078,6 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
 	else
 		xhci_get_usb2_port_status(port, &status, raw_port_status,
 					  flags);
-	/*
-	 * Clear stale usb2 resume signalling variables in case port changed
-	 * state during resume signalling. For example on error
-	 */
-	if ((port->resume_timestamp ||
-	     test_bit(wIndex, &bus_state->resuming_ports)) &&
-	    (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
-	    (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
-		port->resume_timestamp = 0;
-		clear_bit(wIndex, &bus_state->resuming_ports);
-		usb_hcd_end_port_resume(&hcd->self, wIndex);
-	}
 
 	if (bus_state->port_c_suspend & (1 << wIndex))
 		status |= USB_PORT_STAT_C_SUSPEND << 16;

From 1c034c6e224d6e7d3cec230e72a89c4ba326f861 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Thu, 2 Feb 2023 17:05:05 +0200
Subject: [PATCH 0138/1043] xhci: decouple usb2 port resume and get_port_status
 request handling

[ Upstream commit b0425784b942fffbbdb804896197f1dbccda37c5 ]

The get port status hub request code in xhci-hub.c will complete usb2
port resume signalling if signalling has been going on for long enough.

The code that completes the resume signalling, and the code that returns
the port status have gotten too intertwined, so separate them a bit.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-12-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-hub.c | 47 ++++++++++++++++++++-----------------
 1 file changed, 25 insertions(+), 22 deletions(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 0aac8fcd3779..b8dad0a3aab3 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -819,7 +819,7 @@ static void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status,
 }
 
 static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
-					     u32 *status, u32 portsc,
+					     u32 portsc,
 					     unsigned long *flags)
 {
 	struct xhci_bus_state *bus_state;
@@ -834,7 +834,6 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
 	wIndex = port->hcd_portnum;
 
 	if ((portsc & PORT_RESET) || !(portsc & PORT_PE)) {
-		*status = 0xffffffff;
 		return -EINVAL;
 	}
 	/* did port event handler already start resume timing? */
@@ -868,6 +867,8 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
 
 		port->resume_timestamp = 0;
 		clear_bit(wIndex, &bus_state->resuming_ports);
+
+		reinit_completion(&port->rexit_done);
 		port->rexit_active = true;
 
 		xhci_test_and_clear_bit(xhci, port, PORT_PLC);
@@ -884,7 +885,6 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
 							    wIndex + 1);
 			if (!slot_id) {
 				xhci_dbg(xhci, "slot_id is zero\n");
-				*status = 0xffffffff;
 				return -ENODEV;
 			}
 			xhci_ring_device(xhci, slot_id);
@@ -893,22 +893,19 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
 
 			xhci_warn(xhci, "Port resume timed out, port %d-%d: 0x%x\n",
 				  hcd->self.busnum, wIndex + 1, port_status);
-			*status |= USB_PORT_STAT_SUSPEND;
-			port->rexit_active = false;
+			/*
+			 * keep rexit_active set if U0 transition failed so we
+			 * know to report PORT_STAT_SUSPEND status back to
+			 * usbcore. It will be cleared later once the port is
+			 * out of RESUME/U3 state
+			 */
 		}
 
 		usb_hcd_end_port_resume(&hcd->self, wIndex);
 		bus_state->port_c_suspend |= 1 << wIndex;
 		bus_state->suspended_ports &= ~(1 << wIndex);
-	} else {
-		/*
-		 * The resume has been signaling for less than
-		 * USB_RESUME_TIME. Report the port status as SUSPEND,
-		 * let the usbcore check port status again and clear
-		 * resume signaling later.
-		 */
-		*status |= USB_PORT_STAT_SUSPEND;
 	}
+
 	return 0;
 }
 
@@ -985,6 +982,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
 	struct xhci_bus_state *bus_state;
 	u32 link_state;
 	u32 portnum;
+	int err;
 
 	bus_state = &port->rhub->bus_state;
 	link_state = portsc & PORT_PLS_MASK;
@@ -1006,8 +1004,12 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
 			}
 		}
 		if (link_state == XDEV_RESUME) {
-			xhci_handle_usb2_port_link_resume(port, status, portsc,
-							  flags);
+			err = xhci_handle_usb2_port_link_resume(port, portsc,
+								flags);
+			if (err < 0)
+				*status = 0xffffffff;
+			else if (port->resume_timestamp || port->rexit_active)
+				*status |= USB_PORT_STAT_SUSPEND;
 		}
 	}
 
@@ -1016,13 +1018,14 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
 	 * or resuming. Port either resumed to U0/U1/U2, disconnected, or in a
 	 * error state. Resume related variables should be cleared in all those cases.
 	 */
-	if ((link_state != XDEV_U3 &&
-	     link_state != XDEV_RESUME) &&
-	    (port->resume_timestamp ||
-	     test_bit(portnum, &bus_state->resuming_ports))) {
-		port->resume_timestamp = 0;
-		clear_bit(portnum, &bus_state->resuming_ports);
-		usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
+	if (link_state != XDEV_U3 && link_state != XDEV_RESUME) {
+		if (port->resume_timestamp ||
+		    test_bit(portnum, &bus_state->resuming_ports)) {
+			port->resume_timestamp = 0;
+			clear_bit(portnum, &bus_state->resuming_ports);
+			usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
+		}
+		port->rexit_active = 0;
 	}
 }
 

From fc778e9d7995dece6eadc7ba995e38befd7d4645 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Fri, 15 Sep 2023 17:31:06 +0300
Subject: [PATCH 0139/1043] xhci: track port suspend state correctly in
 unsuccessful resume cases

[ Upstream commit d7cdfc319b2bcf6899ab0a05eec0958bc802a9a1 ]

xhci-hub.c tracks suspended ports in a suspended_port bitfield.
This is checked when responding to a Get_Status(PORT) request to see if a
port in running U0 state was recently resumed, and adds the required
USB_PORT_STAT_C_SUSPEND change bit in those cases.

The suspended_port bit was left uncleared if a device is disconnected
during suspend. The bit remained set even when a new device was connected
and enumerated. The set bit resulted in a incorrect Get_Status(PORT)
response with a bogus USB_PORT_STAT_C_SUSPEND change
bit set once the new device reached U0 link state.

USB_PORT_STAT_C_SUSPEND change bit is only used for USB2 ports, but
xhci-hub keeps track of both USB2 and USB3 suspended ports.

Cc: stable@vger.kernel.org
Reported-by: Wesley Cheng <quic_wcheng@quicinc.com>
Closes: https://lore.kernel.org/linux-usb/d68aa806-b26a-0e43-42fb-b8067325e967@quicinc.com/
Fixes: 1d5810b6923c ("xhci: Rework port suspend structures for limited ports.")
Tested-by: Wesley Cheng <quic_wcheng@quicinc.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230915143108.1532163-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-hub.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index b8dad0a3aab3..e92f920256b2 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -957,19 +957,19 @@ static void xhci_get_usb3_port_status(struct xhci_port *port, u32 *status,
 		*status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
 
 	/* USB3 specific wPortStatus bits */
-	if (portsc & PORT_POWER) {
+	if (portsc & PORT_POWER)
 		*status |= USB_SS_PORT_STAT_POWER;
-		/* link state handling */
-		if (link_state == XDEV_U0)
-			bus_state->suspended_ports &= ~(1 << portnum);
-	}
 
-	/* remote wake resume signaling complete */
-	if (bus_state->port_remote_wakeup & (1 << portnum) &&
+	/* no longer suspended or resuming */
+	if (link_state != XDEV_U3 &&
 	    link_state != XDEV_RESUME &&
 	    link_state != XDEV_RECOVERY) {
-		bus_state->port_remote_wakeup &= ~(1 << portnum);
-		usb_hcd_end_port_resume(&hcd->self, portnum);
+		/* remote wake resume signaling complete */
+		if (bus_state->port_remote_wakeup & (1 << portnum)) {
+			bus_state->port_remote_wakeup &= ~(1 << portnum);
+			usb_hcd_end_port_resume(&hcd->self, portnum);
+		}
+		bus_state->suspended_ports &= ~(1 << portnum);
 	}
 
 	xhci_hub_report_usb3_link_state(xhci, status, portsc);
@@ -1026,6 +1026,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
 			usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
 		}
 		port->rexit_active = 0;
+		bus_state->suspended_ports &= ~(1 << portnum);
 	}
 }
 

From be300358b55dd7e2275bb3f7aac8251e10cd01dd Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Mon, 8 May 2023 11:20:12 +0300
Subject: [PATCH 0140/1043] serial: 8250: omap: Fix imprecise external abort
 for omap_8250_pm()

[ Upstream commit 398cecc24846e867b9f90a0bd22730e3df6b05be ]

We must idle the uart only after serial8250_unregister_port(). Otherwise
unbinding the uart via sysfs while doing cat on the port produces an
imprecise external abort:

mem_serial_in from omap_8250_pm+0x44/0xf4
omap_8250_pm from uart_hangup+0xe0/0x194
uart_hangup from __tty_hangup.part.0+0x37c/0x3a8
__tty_hangup.part.0 from uart_remove_one_port+0x9c/0x22c
uart_remove_one_port from serial8250_unregister_port+0x60/0xe8
serial8250_unregister_port from omap8250_remove+0x6c/0xd0
omap8250_remove from platform_remove+0x28/0x54

Turns out the driver needs to have runtime PM functional before the
driver probe calls serial8250_register_8250_port(). And it needs
runtime PM after driver remove calls serial8250_unregister_port().

On probe, we need to read registers before registering the port in
omap_serial_fill_features_erratas(). We do that with custom uart_read()
already.

On remove, after serial8250_unregister_port(), we need to write to the
uart registers to idle the device. Let's add a custom uart_write() for
that.

Currently the uart register access depends on port->membase to be
initialized, which won't work after serial8250_unregister_port().
Let's use priv->membase instead, and use it for runtime PM related
functions to remove the dependency to port->membase for early and
late register access.

Note that during use, we need to check for a valid port in the runtime PM
related functions. This is needed for the optional wakeup configuration.
We now need to set the drvdata a bit earlier so it's available for the
runtime PM functions.

With the port checks in runtime PM functions, the old checks for priv in
omap8250_runtime_suspend() and omap8250_runtime_resume() functions are no
longer needed and are removed.

Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20230508082014.23083-3-tony@atomide.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 560706eff7c8 ("serial: 8250_omap: Fix errors with no_console_suspend")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_omap.c | 70 ++++++++++++++++-------------
 1 file changed, 38 insertions(+), 32 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index e26ac3f42e05..a6f0a74858ea 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -32,6 +32,7 @@
 #include "8250.h"
 
 #define DEFAULT_CLK_SPEED	48000000
+#define OMAP_UART_REGSHIFT	2
 
 #define UART_ERRATA_i202_MDR1_ACCESS	(1 << 0)
 #define OMAP_UART_WER_HAS_TX_WAKEUP	(1 << 1)
@@ -109,6 +110,7 @@
 #define UART_OMAP_RX_LVL		0x19
 
 struct omap8250_priv {
+	void __iomem *membase;
 	int line;
 	u8 habit;
 	u8 mdr1;
@@ -152,9 +154,14 @@ static void omap_8250_rx_dma_flush(struct uart_8250_port *p);
 static inline void omap_8250_rx_dma_flush(struct uart_8250_port *p) { }
 #endif
 
-static u32 uart_read(struct uart_8250_port *up, u32 reg)
+static u32 uart_read(struct omap8250_priv *priv, u32 reg)
 {
-	return readl(up->port.membase + (reg << up->port.regshift));
+	return readl(priv->membase + (reg << OMAP_UART_REGSHIFT));
+}
+
+static void uart_write(struct omap8250_priv *priv, u32 reg, u32 val)
+{
+	writel(val, priv->membase + (reg << OMAP_UART_REGSHIFT));
 }
 
 /*
@@ -552,7 +559,7 @@ static void omap_serial_fill_features_erratas(struct uart_8250_port *up,
 	u32 mvr, scheme;
 	u16 revision, major, minor;
 
-	mvr = uart_read(up, UART_OMAP_MVER);
+	mvr = uart_read(priv, UART_OMAP_MVER);
 
 	/* Check revision register scheme */
 	scheme = mvr >> OMAP_UART_MVR_SCHEME_SHIFT;
@@ -1336,7 +1343,7 @@ static int omap8250_probe(struct platform_device *pdev)
 		UPF_HARD_FLOW;
 	up.port.private_data = priv;
 
-	up.port.regshift = 2;
+	up.port.regshift = OMAP_UART_REGSHIFT;
 	up.port.fifosize = 64;
 	up.tx_loadsz = 64;
 	up.capabilities = UART_CAP_FIFO;
@@ -1397,6 +1404,8 @@ static int omap8250_probe(struct platform_device *pdev)
 			 DEFAULT_CLK_SPEED);
 	}
 
+	priv->membase = membase;
+	priv->line = -ENODEV;
 	priv->latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE;
 	priv->calc_latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE;
 	cpu_latency_qos_add_request(&priv->pm_qos_request, priv->latency);
@@ -1404,6 +1413,8 @@ static int omap8250_probe(struct platform_device *pdev)
 
 	spin_lock_init(&priv->rx_dma_lock);
 
+	platform_set_drvdata(pdev, priv);
+
 	device_init_wakeup(&pdev->dev, true);
 	pm_runtime_enable(&pdev->dev);
 	pm_runtime_use_autosuspend(&pdev->dev);
@@ -1465,7 +1476,6 @@ static int omap8250_probe(struct platform_device *pdev)
 		goto err;
 	}
 	priv->line = ret;
-	platform_set_drvdata(pdev, priv);
 	pm_runtime_mark_last_busy(&pdev->dev);
 	pm_runtime_put_autosuspend(&pdev->dev);
 	return 0;
@@ -1487,11 +1497,12 @@ static int omap8250_remove(struct platform_device *pdev)
 	if (err)
 		return err;
 
+	serial8250_unregister_port(priv->line);
+	priv->line = -ENODEV;
 	pm_runtime_dont_use_autosuspend(&pdev->dev);
 	pm_runtime_put_sync(&pdev->dev);
 	flush_work(&priv->qos_work);
 	pm_runtime_disable(&pdev->dev);
-	serial8250_unregister_port(priv->line);
 	cpu_latency_qos_remove_request(&priv->pm_qos_request);
 	device_init_wakeup(&pdev->dev, false);
 	return 0;
@@ -1577,7 +1588,6 @@ static int omap8250_lost_context(struct uart_8250_port *up)
 static int omap8250_soft_reset(struct device *dev)
 {
 	struct omap8250_priv *priv = dev_get_drvdata(dev);
-	struct uart_8250_port *up = serial8250_get_port(priv->line);
 	int timeout = 100;
 	int sysc;
 	int syss;
@@ -1591,20 +1601,20 @@ static int omap8250_soft_reset(struct device *dev)
 	 * needing omap8250_soft_reset() quirk. Do it in two writes as
 	 * recommended in the comment for omap8250_update_scr().
 	 */
-	serial_out(up, UART_OMAP_SCR, OMAP_UART_SCR_DMAMODE_1);
-	serial_out(up, UART_OMAP_SCR,
+	uart_write(priv, UART_OMAP_SCR, OMAP_UART_SCR_DMAMODE_1);
+	uart_write(priv, UART_OMAP_SCR,
 		   OMAP_UART_SCR_DMAMODE_1 | OMAP_UART_SCR_DMAMODE_CTL);
 
-	sysc = serial_in(up, UART_OMAP_SYSC);
+	sysc = uart_read(priv, UART_OMAP_SYSC);
 
 	/* softreset the UART */
 	sysc |= OMAP_UART_SYSC_SOFTRESET;
-	serial_out(up, UART_OMAP_SYSC, sysc);
+	uart_write(priv, UART_OMAP_SYSC, sysc);
 
 	/* By experiments, 1us enough for reset complete on AM335x */
 	do {
 		udelay(1);
-		syss = serial_in(up, UART_OMAP_SYSS);
+		syss = uart_read(priv, UART_OMAP_SYSS);
 	} while (--timeout && !(syss & OMAP_UART_SYSS_RESETDONE));
 
 	if (!timeout) {
@@ -1618,13 +1628,10 @@ static int omap8250_soft_reset(struct device *dev)
 static int omap8250_runtime_suspend(struct device *dev)
 {
 	struct omap8250_priv *priv = dev_get_drvdata(dev);
-	struct uart_8250_port *up;
+	struct uart_8250_port *up = NULL;
 
-	/* In case runtime-pm tries this before we are setup */
-	if (!priv)
-		return 0;
-
-	up = serial8250_get_port(priv->line);
+	if (priv->line >= 0)
+		up = serial8250_get_port(priv->line);
 	/*
 	 * When using 'no_console_suspend', the console UART must not be
 	 * suspended. Since driver suspend is managed by runtime suspend,
@@ -1632,7 +1639,7 @@ static int omap8250_runtime_suspend(struct device *dev)
 	 * active during suspend.
 	 */
 	if (priv->is_suspending && !console_suspend_enabled) {
-		if (uart_console(&up->port))
+		if (up && uart_console(&up->port))
 			return -EBUSY;
 	}
 
@@ -1643,13 +1650,15 @@ static int omap8250_runtime_suspend(struct device *dev)
 		if (ret)
 			return ret;
 
-		/* Restore to UART mode after reset (for wakeup) */
-		omap8250_update_mdr1(up, priv);
-		/* Restore wakeup enable register */
-		serial_out(up, UART_OMAP_WER, priv->wer);
+		if (up) {
+			/* Restore to UART mode after reset (for wakeup) */
+			omap8250_update_mdr1(up, priv);
+			/* Restore wakeup enable register */
+			serial_out(up, UART_OMAP_WER, priv->wer);
+		}
 	}
 
-	if (up->dma && up->dma->rxchan)
+	if (up && up->dma && up->dma->rxchan)
 		omap_8250_rx_dma_flush(up);
 
 	priv->latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE;
@@ -1661,18 +1670,15 @@ static int omap8250_runtime_suspend(struct device *dev)
 static int omap8250_runtime_resume(struct device *dev)
 {
 	struct omap8250_priv *priv = dev_get_drvdata(dev);
-	struct uart_8250_port *up;
+	struct uart_8250_port *up = NULL;
 
-	/* In case runtime-pm tries this before we are setup */
-	if (!priv)
-		return 0;
+	if (priv->line >= 0)
+		up = serial8250_get_port(priv->line);
 
-	up = serial8250_get_port(priv->line);
-
-	if (omap8250_lost_context(up))
+	if (up && omap8250_lost_context(up))
 		omap8250_restore_regs(up);
 
-	if (up->dma && up->dma->rxchan && !(priv->habit & UART_HAS_EFR2))
+	if (up && up->dma && up->dma->rxchan && !(priv->habit & UART_HAS_EFR2))
 		omap_8250_rx_dma(up);
 
 	priv->latency = priv->calc_latency;

From 1ac717000403a24af181c5b6276eb0d694f7b1c5 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Tue, 26 Sep 2023 09:13:17 +0300
Subject: [PATCH 0141/1043] serial: 8250_omap: Fix errors with
 no_console_suspend

[ Upstream commit 560706eff7c8e5621b0d63afe0866e0e1906e87e ]

We now get errors on system suspend if no_console_suspend is set as
reported by Thomas. The errors started with commit 20a41a62618d ("serial:
8250_omap: Use force_suspend and resume for system suspend").

Let's fix the issue by checking for console_suspend_enabled in the system
suspend and resume path.

Note that with this fix the checks for console_suspend_enabled in
omap8250_runtime_suspend() become useless. We now keep runtime PM usage
count for an attached kernel console starting with commit bedb404e91bb
("serial: 8250_port: Don't use power management for kernel console").

Fixes: 20a41a62618d ("serial: 8250_omap: Use force_suspend and resume for system suspend")
Cc: stable <stable@kernel.org>
Cc: Udit Kumar <u-kumar1@ti.com>
Reported-by: Thomas Richard <thomas.richard@bootlin.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Tested-by: Thomas Richard <thomas.richard@bootlin.com>
Reviewed-by: Dhruva Gole <d-gole@ti.com>
Link: https://lore.kernel.org/r/20230926061319.15140-1-tony@atomide.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_omap.c | 25 ++++++++++---------------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index a6f0a74858ea..e7e84aa2c5f8 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -1532,7 +1532,7 @@ static int omap8250_suspend(struct device *dev)
 {
 	struct omap8250_priv *priv = dev_get_drvdata(dev);
 	struct uart_8250_port *up = serial8250_get_port(priv->line);
-	int err;
+	int err = 0;
 
 	serial8250_suspend_port(priv->line);
 
@@ -1542,7 +1542,8 @@ static int omap8250_suspend(struct device *dev)
 	if (!device_may_wakeup(dev))
 		priv->wer = 0;
 	serial_out(up, UART_OMAP_WER, priv->wer);
-	err = pm_runtime_force_suspend(dev);
+	if (uart_console(&up->port) && console_suspend_enabled)
+		err = pm_runtime_force_suspend(dev);
 	flush_work(&priv->qos_work);
 
 	return err;
@@ -1551,11 +1552,15 @@ static int omap8250_suspend(struct device *dev)
 static int omap8250_resume(struct device *dev)
 {
 	struct omap8250_priv *priv = dev_get_drvdata(dev);
+	struct uart_8250_port *up = serial8250_get_port(priv->line);
 	int err;
 
-	err = pm_runtime_force_resume(dev);
-	if (err)
-		return err;
+	if (uart_console(&up->port) && console_suspend_enabled) {
+		err = pm_runtime_force_resume(dev);
+		if (err)
+			return err;
+	}
+
 	serial8250_resume_port(priv->line);
 	/* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */
 	pm_runtime_mark_last_busy(dev);
@@ -1632,16 +1637,6 @@ static int omap8250_runtime_suspend(struct device *dev)
 
 	if (priv->line >= 0)
 		up = serial8250_get_port(priv->line);
-	/*
-	 * When using 'no_console_suspend', the console UART must not be
-	 * suspended. Since driver suspend is managed by runtime suspend,
-	 * preventing runtime suspend (by returning error) will keep device
-	 * active during suspend.
-	 */
-	if (priv->is_suspending && !console_suspend_enabled) {
-		if (up && uart_console(&up->port))
-			return -EBUSY;
-	}
 
 	if (priv->habit & UART_ERRATA_CLOCK_DISABLE) {
 		int ret;

From ebba01fcd562b0a9728c5c8c13b199747d4992ed Mon Sep 17 00:00:00 2001
From: Yongqiang Sun <yongqiang.sun@amd.com>
Date: Fri, 16 Oct 2020 09:25:05 -0400
Subject: [PATCH 0142/1043] drm/amd/display: only check available pipe to
 disable vbios mode.

[ Upstream commit 850d2fcf3e346a35e4e59e310b867e90e3ef8e5a ]

[Why & How]
1. only need to check first ODM pipe.
2. Only need to check eDP which is on.

Signed-off-by: Yongqiang Sun <yongqiang.sun@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: 23645bca9830 ("drm/amd/display: Don't set dpms_off for seamless boot")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 099542dd3154..9cf287124fe4 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -862,12 +862,16 @@ static void disable_vbios_mode_if_required(
 		if (stream == NULL)
 			continue;
 
+		// only looking for first odm pipe
+		if (pipe->prev_odm_pipe)
+			continue;
+
 		if (stream->link->local_sink &&
 			stream->link->local_sink->sink_signal == SIGNAL_TYPE_EDP) {
 			link = stream->link;
 		}
 
-		if (link != NULL) {
+		if (link != NULL && link->link_enc->funcs->is_dig_enabled(link->link_enc)) {
 			unsigned int enc_inst, tg_inst = 0;
 			unsigned int pix_clk_100hz;
 

From cedcbf61dfce2717f7133c7e5408524ad36f8268 Mon Sep 17 00:00:00 2001
From: Daniel Miess <daniel.miess@amd.com>
Date: Fri, 29 Sep 2023 13:04:33 -0400
Subject: [PATCH 0143/1043] drm/amd/display: Don't set dpms_off for seamless
 boot

[ Upstream commit 23645bca98304a2772f0de96f97370dd567d0ae6 ]

[Why]
eDPs fail to light up with seamless boot enabled

[How]
When seamless boot is enabled don't configure dpms_off
in disable_vbios_mode_if_required.

Reviewed-by: Charlene Liu <charlene.liu@amd.com>
Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Daniel Miess <daniel.miess@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 9cf287124fe4..36a9e9c84ed4 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -862,6 +862,9 @@ static void disable_vbios_mode_if_required(
 		if (stream == NULL)
 			continue;
 
+		if (stream->apply_seamless_boot_optimization)
+			continue;
+
 		// only looking for first odm pipe
 		if (pipe->prev_odm_pipe)
 			continue;

From 86502f1b63aa7d3466d245731673d70ea2c8c9f4 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 17 Aug 2021 23:51:54 +0200
Subject: [PATCH 0144/1043] drm/connector: Give connector sysfs devices there
 own device_type

[ Upstream commit 331de7db3012b8e8e8d77beebc8f743e288d4c42 ]

Give connector sysfs devices there own device_type, this allows us to
check if a device passed to functions dealing with generic devices is
a drm_connector or not.

A check like this is necessary in the drm_connector_acpi_bus_match()
function added in the next patch in this series.

Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://lore.kernel.org/r/20210817215201.795062-2-hdegoede@redhat.com
Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_sysfs.c | 50 +++++++++++++++++++++++++++----------
 1 file changed, 37 insertions(+), 13 deletions(-)

diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index f0336c804639..a3b71478c590 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -50,6 +50,10 @@ static struct device_type drm_sysfs_device_minor = {
 	.name = "drm_minor"
 };
 
+static struct device_type drm_sysfs_device_connector = {
+	.name = "drm_connector",
+};
+
 struct class *drm_class;
 
 static char *drm_devnode(struct device *dev, umode_t *mode)
@@ -102,6 +106,11 @@ void drm_sysfs_destroy(void)
 	drm_class = NULL;
 }
 
+static void drm_sysfs_release(struct device *dev)
+{
+	kfree(dev);
+}
+
 /*
  * Connector properties
  */
@@ -274,27 +283,47 @@ static const struct attribute_group *connector_dev_groups[] = {
 int drm_sysfs_connector_add(struct drm_connector *connector)
 {
 	struct drm_device *dev = connector->dev;
+	struct device *kdev;
+	int r;
 
 	if (connector->kdev)
 		return 0;
 
-	connector->kdev =
-		device_create_with_groups(drm_class, dev->primary->kdev, 0,
-					  connector, connector_dev_groups,
-					  "card%d-%s", dev->primary->index,
-					  connector->name);
+	kdev = kzalloc(sizeof(*kdev), GFP_KERNEL);
+	if (!kdev)
+		return -ENOMEM;
+
+	device_initialize(kdev);
+	kdev->class = drm_class;
+	kdev->type = &drm_sysfs_device_connector;
+	kdev->parent = dev->primary->kdev;
+	kdev->groups = connector_dev_groups;
+	kdev->release = drm_sysfs_release;
+	dev_set_drvdata(kdev, connector);
+
+	r = dev_set_name(kdev, "card%d-%s", dev->primary->index, connector->name);
+	if (r)
+		goto err_free;
+
 	DRM_DEBUG("adding \"%s\" to sysfs\n",
 		  connector->name);
 
-	if (IS_ERR(connector->kdev)) {
-		DRM_ERROR("failed to register connector device: %ld\n", PTR_ERR(connector->kdev));
-		return PTR_ERR(connector->kdev);
+	r = device_add(kdev);
+	if (r) {
+		drm_err(dev, "failed to register connector device: %d\n", r);
+		goto err_free;
 	}
 
+	connector->kdev = kdev;
+
 	if (connector->ddc)
 		return sysfs_create_link(&connector->kdev->kobj,
 				 &connector->ddc->dev.kobj, "ddc");
 	return 0;
+
+err_free:
+	put_device(kdev);
+	return r;
 }
 
 void drm_sysfs_connector_remove(struct drm_connector *connector)
@@ -375,11 +404,6 @@ void drm_sysfs_connector_status_event(struct drm_connector *connector,
 }
 EXPORT_SYMBOL(drm_sysfs_connector_status_event);
 
-static void drm_sysfs_release(struct device *dev)
-{
-	kfree(dev);
-}
-
 struct device *drm_sysfs_minor_alloc(struct drm_minor *minor)
 {
 	const char *minor_str;

From 89b1868bab4883b2abd4796bc1965db1565ad6ad Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 17 Aug 2021 23:51:55 +0200
Subject: [PATCH 0145/1043] drm/connector: Add a fwnode pointer to
 drm_connector and register with ACPI (v2)

[ Upstream commit 48c429c6d18db115c277b75000152d8fa4cd35d0 ]

Add a fwnode pointer to struct drm_connector and register an acpi_bus_type
for the connectors with the ACPI subsystem (when CONFIG_ACPI is enabled).

The adding of the fwnode pointer allows drivers to associate a fwnode
that represents a connector with that connector.

When the new fwnode pointer points to an ACPI-companion, then the new
acpi_bus_type will cause the ACPI subsys to bind the device instantiated
for the connector with the fwnode by calling acpi_bind_one(). This will
result in a firmware_node symlink under /sys/class/card#-<connecter-name>/
which helps to verify that the fwnode-s and connectors are properly
matched.

Changes in v2:
- Make drm_connector_cleanup() call fwnode_handle_put() on
  connector->fwnode and document this

Co-developed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://lore.kernel.org/r/20210817215201.795062-3-hdegoede@redhat.com
Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_connector.c |  2 ++
 drivers/gpu/drm/drm_sysfs.c     | 37 +++++++++++++++++++++++++++++++++
 include/drm/drm_connector.h     |  8 +++++++
 3 files changed, 47 insertions(+)

diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 9c3bbe2c3e6f..c08501a5620d 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -471,6 +471,8 @@ void drm_connector_cleanup(struct drm_connector *connector)
 	drm_mode_object_unregister(dev, &connector->base);
 	kfree(connector->name);
 	connector->name = NULL;
+	fwnode_handle_put(connector->fwnode);
+	connector->fwnode = NULL;
 	spin_lock_irq(&dev->mode_config.connector_list_lock);
 	list_del(&connector->head);
 	dev->mode_config.num_connector--;
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index a3b71478c590..71a0d9596efe 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -10,6 +10,7 @@
  * Copyright (c) 2003-2004 IBM Corp.
  */
 
+#include <linux/acpi.h>
 #include <linux/device.h>
 #include <linux/err.h>
 #include <linux/export.h>
@@ -56,6 +57,39 @@ static struct device_type drm_sysfs_device_connector = {
 
 struct class *drm_class;
 
+#ifdef CONFIG_ACPI
+static bool drm_connector_acpi_bus_match(struct device *dev)
+{
+	return dev->type == &drm_sysfs_device_connector;
+}
+
+static struct acpi_device *drm_connector_acpi_find_companion(struct device *dev)
+{
+	struct drm_connector *connector = to_drm_connector(dev);
+
+	return to_acpi_device_node(connector->fwnode);
+}
+
+static struct acpi_bus_type drm_connector_acpi_bus = {
+	.name = "drm_connector",
+	.match = drm_connector_acpi_bus_match,
+	.find_companion = drm_connector_acpi_find_companion,
+};
+
+static void drm_sysfs_acpi_register(void)
+{
+	register_acpi_bus_type(&drm_connector_acpi_bus);
+}
+
+static void drm_sysfs_acpi_unregister(void)
+{
+	unregister_acpi_bus_type(&drm_connector_acpi_bus);
+}
+#else
+static void drm_sysfs_acpi_register(void) { }
+static void drm_sysfs_acpi_unregister(void) { }
+#endif
+
 static char *drm_devnode(struct device *dev, umode_t *mode)
 {
 	return kasprintf(GFP_KERNEL, "dri/%s", dev_name(dev));
@@ -89,6 +123,8 @@ int drm_sysfs_init(void)
 	}
 
 	drm_class->devnode = drm_devnode;
+
+	drm_sysfs_acpi_register();
 	return 0;
 }
 
@@ -101,6 +137,7 @@ void drm_sysfs_destroy(void)
 {
 	if (IS_ERR_OR_NULL(drm_class))
 		return;
+	drm_sysfs_acpi_unregister();
 	class_remove_file(drm_class, &class_attr_version.attr);
 	class_destroy(drm_class);
 	drm_class = NULL;
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index 928136556174..ffad68f775cc 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -1174,6 +1174,14 @@ struct drm_connector {
 	struct device *kdev;
 	/** @attr: sysfs attributes */
 	struct device_attribute *attr;
+	/**
+	 * @fwnode: associated fwnode supplied by platform firmware
+	 *
+	 * Drivers can set this to associate a fwnode with a connector, drivers
+	 * are expected to get a reference on the fwnode when setting this.
+	 * drm_connector_cleanup() will call fwnode_handle_put() on this.
+	 */
+	struct fwnode_handle *fwnode;
 
 	/**
 	 * @head:

From 6e55f6a8a4986ecd43d235b9b0120e06c400b3d6 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 17 Aug 2021 23:51:56 +0200
Subject: [PATCH 0146/1043] drm/connector: Add drm_connector_find_by_fwnode()
 function (v3)

[ Upstream commit 3d3f7c1e68691574c1d87cd0f9f2348323bc0199 ]

Add a function to find a connector based on a fwnode.

This will be used by the new drm_connector_oob_hotplug_event()
function which is added by the next patch in this patch-set.

Changes in v2:
- Complete rewrite to use a global connector list in drm_connector.c
  rather then using a class-dev-iter in drm_sysfs.c

Changes in v3:
- Add forward declaration for struct fwnode_handle to drm_crtc_internal.h
  (fixes warning reported by kernel test robot <lkp@intel.com>)

Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://lore.kernel.org/r/20210817215201.795062-4-hdegoede@redhat.com
Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_connector.c     | 50 +++++++++++++++++++++++++++++
 drivers/gpu/drm/drm_crtc_internal.h |  2 ++
 include/drm/drm_connector.h         |  8 +++++
 3 files changed, 60 insertions(+)

diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index c08501a5620d..fc06f73acd3c 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -64,6 +64,14 @@
  * support can instead use e.g. drm_helper_hpd_irq_event().
  */
 
+/*
+ * Global connector list for drm_connector_find_by_fwnode().
+ * Note drm_connector_[un]register() first take connector->lock and then
+ * take the connector_list_lock.
+ */
+static DEFINE_MUTEX(connector_list_lock);
+static LIST_HEAD(connector_list);
+
 struct drm_conn_prop_enum_list {
 	int type;
 	const char *name;
@@ -265,6 +273,7 @@ int drm_connector_init(struct drm_device *dev,
 		goto out_put_type_id;
 	}
 
+	INIT_LIST_HEAD(&connector->global_connector_list_entry);
 	INIT_LIST_HEAD(&connector->probed_modes);
 	INIT_LIST_HEAD(&connector->modes);
 	mutex_init(&connector->mutex);
@@ -534,6 +543,9 @@ int drm_connector_register(struct drm_connector *connector)
 	/* Let userspace know we have a new connector */
 	drm_sysfs_hotplug_event(connector->dev);
 
+	mutex_lock(&connector_list_lock);
+	list_add_tail(&connector->global_connector_list_entry, &connector_list);
+	mutex_unlock(&connector_list_lock);
 	goto unlock;
 
 err_debugfs:
@@ -562,6 +574,10 @@ void drm_connector_unregister(struct drm_connector *connector)
 		return;
 	}
 
+	mutex_lock(&connector_list_lock);
+	list_del_init(&connector->global_connector_list_entry);
+	mutex_unlock(&connector_list_lock);
+
 	if (connector->funcs->early_unregister)
 		connector->funcs->early_unregister(connector);
 
@@ -2464,6 +2480,40 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
 	return ret;
 }
 
+/**
+ * drm_connector_find_by_fwnode - Find a connector based on the associated fwnode
+ * @fwnode: fwnode for which to find the matching drm_connector
+ *
+ * This functions looks up a drm_connector based on its associated fwnode. When
+ * a connector is found a reference to the connector is returned. The caller must
+ * call drm_connector_put() to release this reference when it is done with the
+ * connector.
+ *
+ * Returns: A reference to the found connector or an ERR_PTR().
+ */
+struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode)
+{
+	struct drm_connector *connector, *found = ERR_PTR(-ENODEV);
+
+	if (!fwnode)
+		return ERR_PTR(-ENODEV);
+
+	mutex_lock(&connector_list_lock);
+
+	list_for_each_entry(connector, &connector_list, global_connector_list_entry) {
+		if (connector->fwnode == fwnode ||
+		    (connector->fwnode && connector->fwnode->secondary == fwnode)) {
+			drm_connector_get(connector);
+			found = connector;
+			break;
+		}
+	}
+
+	mutex_unlock(&connector_list_lock);
+
+	return found;
+}
+
 
 /**
  * DOC: Tile group
diff --git a/drivers/gpu/drm/drm_crtc_internal.h b/drivers/gpu/drm/drm_crtc_internal.h
index da96b2f64d7e..c3577eaee416 100644
--- a/drivers/gpu/drm/drm_crtc_internal.h
+++ b/drivers/gpu/drm/drm_crtc_internal.h
@@ -57,6 +57,7 @@ struct drm_property;
 struct edid;
 struct kref;
 struct work_struct;
+struct fwnode_handle;
 
 /* drm_crtc.c */
 int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
@@ -182,6 +183,7 @@ int drm_connector_set_obj_prop(struct drm_mode_object *obj,
 int drm_connector_create_standard_properties(struct drm_device *dev);
 const char *drm_get_connector_force_name(enum drm_connector_force force);
 void drm_connector_free_work_fn(struct work_struct *work);
+struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode);
 
 /* IOCTL */
 int drm_connector_property_set_ioctl(struct drm_device *dev,
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index ffad68f775cc..d6c7554f1d40 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -1193,6 +1193,14 @@ struct drm_connector {
 	 */
 	struct list_head head;
 
+	/**
+	 * @global_connector_list_entry:
+	 *
+	 * Connector entry in the global connector-list, used by
+	 * drm_connector_find_by_fwnode().
+	 */
+	struct list_head global_connector_list_entry;
+
 	/** @base: base KMS object */
 	struct drm_mode_object base;
 

From 2ea6a14e8a5512755bbeb0db774385e99448ea8f Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 17 Aug 2021 23:51:57 +0200
Subject: [PATCH 0147/1043] drm/connector: Add support for out-of-band hotplug
 notification (v3)

[ Upstream commit 72ad49682dde3d9de5708b8699dc8e0b44962322 ]

Add a new drm_connector_oob_hotplug_event() function and
oob_hotplug_event drm_connector_funcs member.

On some hardware a hotplug event notification may come from outside the
display driver / device. An example of this is some USB Type-C setups
where the hardware muxes the DisplayPort data and aux-lines but does
not pass the altmode HPD status bit to the GPU's DP HPD pin.

In cases like this the new drm_connector_oob_hotplug_event() function can
be used to report these out-of-band events.

Changes in v2:
- Make drm_connector_oob_hotplug_event() take a fwnode as argument and
  have it call drm_connector_find_by_fwnode() internally. This allows
  making drm_connector_find_by_fwnode() a drm-internal function and
  avoids code outside the drm subsystem potentially holding on the
  a drm_connector reference for a longer period.

Changes in v3:
- Drop the data argument to the drm_connector_oob_hotplug_event
  function since it is not used atm. This can be re-added later when
  a use for it actually arises.

Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://lore.kernel.org/r/20210817215201.795062-5-hdegoede@redhat.com
Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_connector.c | 27 +++++++++++++++++++++++++++
 include/drm/drm_connector.h     |  9 +++++++++
 2 files changed, 36 insertions(+)

diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index fc06f73acd3c..c4ed4f1b369c 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -2514,6 +2514,33 @@ struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode)
 	return found;
 }
 
+/**
+ * drm_connector_oob_hotplug_event - Report out-of-band hotplug event to connector
+ * @connector: connector to report the event on
+ *
+ * On some hardware a hotplug event notification may come from outside the display
+ * driver / device. An example of this is some USB Type-C setups where the hardware
+ * muxes the DisplayPort data and aux-lines but does not pass the altmode HPD
+ * status bit to the GPU's DP HPD pin.
+ *
+ * This function can be used to report these out-of-band events after obtaining
+ * a drm_connector reference through calling drm_connector_find_by_fwnode().
+ */
+void drm_connector_oob_hotplug_event(struct fwnode_handle *connector_fwnode)
+{
+	struct drm_connector *connector;
+
+	connector = drm_connector_find_by_fwnode(connector_fwnode);
+	if (IS_ERR(connector))
+		return;
+
+	if (connector->funcs->oob_hotplug_event)
+		connector->funcs->oob_hotplug_event(connector);
+
+	drm_connector_put(connector);
+}
+EXPORT_SYMBOL(drm_connector_oob_hotplug_event);
+
 
 /**
  * DOC: Tile group
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index d6c7554f1d40..03d39532c708 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -1030,6 +1030,14 @@ struct drm_connector_funcs {
 	 */
 	void (*atomic_print_state)(struct drm_printer *p,
 				   const struct drm_connector_state *state);
+
+	/**
+	 * @oob_hotplug_event:
+	 *
+	 * This will get called when a hotplug-event for a drm-connector
+	 * has been received from a source outside the display driver / device.
+	 */
+	void (*oob_hotplug_event)(struct drm_connector *connector);
 };
 
 /**
@@ -1612,6 +1620,7 @@ drm_connector_is_unregistered(struct drm_connector *connector)
 		DRM_CONNECTOR_UNREGISTERED;
 }
 
+void drm_connector_oob_hotplug_event(struct fwnode_handle *connector_fwnode);
 const char *drm_get_connector_type_name(unsigned int connector_type);
 const char *drm_get_connector_status_name(enum drm_connector_status status);
 const char *drm_get_subpixel_order_name(enum subpixel_order order);

From f25a13d318b8eb6fb48673376b585a990e605e93 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 17 Aug 2021 23:52:01 +0200
Subject: [PATCH 0148/1043] usb: typec: altmodes/displayport: Notify drm subsys
 of hotplug events

[ Upstream commit 7f811394878535ed9a6849717de8c2959ae38899 ]

Use the new drm_connector_oob_hotplug_event() functions to let drm/kms
drivers know about DisplayPort over Type-C hotplug events.

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://lore.kernel.org/r/20210817215201.795062-9-hdegoede@redhat.com
Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/altmodes/Kconfig       |  1 +
 drivers/usb/typec/altmodes/displayport.c | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/drivers/usb/typec/altmodes/Kconfig b/drivers/usb/typec/altmodes/Kconfig
index 60d375e9c3c7..1a6b5e872b0d 100644
--- a/drivers/usb/typec/altmodes/Kconfig
+++ b/drivers/usb/typec/altmodes/Kconfig
@@ -4,6 +4,7 @@ menu "USB Type-C Alternate Mode drivers"
 
 config TYPEC_DP_ALTMODE
 	tristate "DisplayPort Alternate Mode driver"
+	depends on DRM
 	help
 	  DisplayPort USB Type-C Alternate Mode allows DisplayPort
 	  displays and adapters to be attached to the USB Type-C
diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
index 0d4b1c0eeefb..8083d5faf0c9 100644
--- a/drivers/usb/typec/altmodes/displayport.c
+++ b/drivers/usb/typec/altmodes/displayport.c
@@ -11,8 +11,10 @@
 #include <linux/delay.h>
 #include <linux/mutex.h>
 #include <linux/module.h>
+#include <linux/property.h>
 #include <linux/usb/pd_vdo.h>
 #include <linux/usb/typec_dp.h>
+#include <drm/drm_connector.h>
 #include "displayport.h"
 
 #define DP_HEADER(_dp, cmd)		(VDO((_dp)->alt->svid, 1, cmd) | \
@@ -57,11 +59,13 @@ struct dp_altmode {
 	struct typec_displayport_data data;
 
 	enum dp_state state;
+	bool hpd;
 
 	struct mutex lock; /* device lock */
 	struct work_struct work;
 	struct typec_altmode *alt;
 	const struct typec_altmode *port;
+	struct fwnode_handle *connector_fwnode;
 };
 
 static int dp_altmode_notify(struct dp_altmode *dp)
@@ -122,6 +126,7 @@ static int dp_altmode_configure(struct dp_altmode *dp, u8 con)
 static int dp_altmode_status_update(struct dp_altmode *dp)
 {
 	bool configured = !!DP_CONF_GET_PIN_ASSIGN(dp->data.conf);
+	bool hpd = !!(dp->data.status & DP_STATUS_HPD_STATE);
 	u8 con = DP_STATUS_CONNECTION(dp->data.status);
 	int ret = 0;
 
@@ -134,6 +139,11 @@ static int dp_altmode_status_update(struct dp_altmode *dp)
 		ret = dp_altmode_configure(dp, con);
 		if (!ret)
 			dp->state = DP_STATE_CONFIGURE;
+	} else {
+		if (dp->hpd != hpd) {
+			drm_connector_oob_hotplug_event(dp->connector_fwnode);
+			dp->hpd = hpd;
+		}
 	}
 
 	return ret;
@@ -526,6 +536,7 @@ static const struct attribute_group dp_altmode_group = {
 int dp_altmode_probe(struct typec_altmode *alt)
 {
 	const struct typec_altmode *port = typec_altmode_get_partner(alt);
+	struct fwnode_handle *fwnode;
 	struct dp_altmode *dp;
 	int ret;
 
@@ -554,6 +565,11 @@ int dp_altmode_probe(struct typec_altmode *alt)
 	alt->desc = "DisplayPort";
 	alt->ops = &dp_altmode_ops;
 
+	fwnode = dev_fwnode(alt->dev.parent->parent); /* typec_port fwnode */
+	dp->connector_fwnode = fwnode_find_reference(fwnode, "displayport", 0);
+	if (IS_ERR(dp->connector_fwnode))
+		dp->connector_fwnode = NULL;
+
 	typec_altmode_set_drvdata(alt, dp);
 
 	dp->state = DP_STATE_ENTER;
@@ -569,6 +585,13 @@ void dp_altmode_remove(struct typec_altmode *alt)
 
 	sysfs_remove_group(&alt->dev.kobj, &dp_altmode_group);
 	cancel_work_sync(&dp->work);
+
+	if (dp->connector_fwnode) {
+		if (dp->hpd)
+			drm_connector_oob_hotplug_event(dp->connector_fwnode);
+
+		fwnode_handle_put(dp->connector_fwnode);
+	}
 }
 EXPORT_SYMBOL_GPL(dp_altmode_remove);
 

From 9ed14f807f4f768ab06de395c1dfea7a31eea55e Mon Sep 17 00:00:00 2001
From: RD Babiera <rdbabiera@google.com>
Date: Mon, 9 Oct 2023 21:00:58 +0000
Subject: [PATCH 0149/1043] usb: typec: altmodes/displayport: Signal hpd low
 when exiting mode

[ Upstream commit 89434b069e460967624903b049e5cf5c9e6b99b9 ]

Upon receiving an ACK for a sent EXIT_MODE message, the DisplayPort
driver currently resets the status and configuration of the port partner.
The hpd signal is not updated despite being part of the status, so the
Display stack can still transmit video despite typec_altmode_exit placing
the lanes in a Safe State.

Set hpd to low when a sent EXIT_MODE message is ACK'ed.

Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode")
Cc: stable@vger.kernel.org
Signed-off-by: RD Babiera <rdbabiera@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20231009210057.3773877-2-rdbabiera@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/altmodes/displayport.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
index 8083d5faf0c9..def903e9d2ab 100644
--- a/drivers/usb/typec/altmodes/displayport.c
+++ b/drivers/usb/typec/altmodes/displayport.c
@@ -285,6 +285,11 @@ static int dp_altmode_vdm(struct typec_altmode *alt,
 		case CMD_EXIT_MODE:
 			dp->data.status = 0;
 			dp->data.conf = 0;
+			if (dp->hpd) {
+				drm_connector_oob_hotplug_event(dp->connector_fwnode);
+				dp->hpd = false;
+				sysfs_notify(&dp->alt->dev.kobj, "displayport", "hpd");
+			}
 			break;
 		case DP_CMD_STATUS_UPDATE:
 			dp->data.status = *vdo;

From d69131b48feab7dc3ca08268d256e42d0e716fa0 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Mon, 11 Sep 2023 07:07:38 +0300
Subject: [PATCH 0150/1043] ARM: dts: ti: omap: Fix noisy serial with
 overrun-throttle-ms for mapphone

[ Upstream commit 5ad37b5e30433afa7a5513e3eb61f69fa0976785 ]

On mapphone devices we may get lots of noise on the micro-USB port in debug
uart mode until the phy-cpcap-usb driver probes. Let's limit the noise by
using overrun-throttle-ms.

Note that there is also a related separate issue where the charger cable
connected may cause random sysrq requests until phy-cpcap-usb probes that
still remains.

Cc: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Cc: Carl Philipp Klemm <philipp@uvos.xyz>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Pavel Machek <pavel@ucw.cz>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/motorola-mapphone-common.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/motorola-mapphone-common.dtsi b/arch/arm/boot/dts/motorola-mapphone-common.dtsi
index 8cb26b924d3c..f9392a135d38 100644
--- a/arch/arm/boot/dts/motorola-mapphone-common.dtsi
+++ b/arch/arm/boot/dts/motorola-mapphone-common.dtsi
@@ -765,6 +765,7 @@ &uart1 {
 &uart3 {
 	interrupts-extended = <&wakeupgen GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH
 			       &omap4_pmx_core 0x17c>;
+	overrun-throttle-ms = <500>;
 };
 
 &uart4 {

From 9801e2798b637a5dfc9f410287a9dcbc7dcf238a Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Fri, 8 Sep 2023 18:20:23 +0100
Subject: [PATCH 0151/1043] btrfs: return -EUCLEAN for delayed tree ref with a
 ref count not equals to 1

[ Upstream commit 1bf76df3fee56d6637718e267f7c34ed70d0c7dc ]

When running a delayed tree reference, if we find a ref count different
from 1, we return -EIO. This isn't an IO error, as it indicates either a
bug in the delayed refs code or a memory corruption, so change the error
code from -EIO to -EUCLEAN. Also tag the branch as 'unlikely' as this is
not expected to ever happen, and change the error message to print the
tree block's bytenr without the parenthesis (and there was a missing space
between the 'block' word and the opening parenthesis), for consistency as
that's the style we used everywhere else.

Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/extent-tree.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 4d2f25ebe304..8f62e171053b 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1641,12 +1641,12 @@ static int run_delayed_tree_ref(struct btrfs_trans_handle *trans,
 		parent = ref->parent;
 	ref_root = ref->root;
 
-	if (node->ref_mod != 1) {
+	if (unlikely(node->ref_mod != 1)) {
 		btrfs_err(trans->fs_info,
-	"btree block(%llu) has %d references rather than 1: action %d ref_root %llu parent %llu",
+	"btree block %llu has %d references rather than 1: action %d ref_root %llu parent %llu",
 			  node->bytenr, node->ref_mod, node->action, ref_root,
 			  parent);
-		return -EIO;
+		return -EUCLEAN;
 	}
 	if (node->action == BTRFS_ADD_DELAYED_REF && insert_reserved) {
 		BUG_ON(!extent_op || !extent_op->update_flags);

From 840b912df51894e4f1cf8df228835098e0e31adc Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Tue, 5 Sep 2023 12:15:24 -0400
Subject: [PATCH 0152/1043] btrfs: initialize start_slot in
 btrfs_log_prealloc_extents
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b4c639f699349880b7918b861e1bd360442ec450 ]

Jens reported a compiler warning when using
CONFIG_CC_OPTIMIZE_FOR_SIZE=y that looks like this

  fs/btrfs/tree-log.c: In function ‘btrfs_log_prealloc_extents’:
  fs/btrfs/tree-log.c:4828:23: warning: ‘start_slot’ may be used
  uninitialized [-Wmaybe-uninitialized]
   4828 |                 ret = copy_items(trans, inode, dst_path, path,
	|                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   4829 |                                  start_slot, ins_nr, 1, 0);
	|                                  ~~~~~~~~~~~~~~~~~~~~~~~~~
  fs/btrfs/tree-log.c:4725:13: note: ‘start_slot’ was declared here
   4725 |         int start_slot;
	|             ^~~~~~~~~~

The compiler is incorrect, as we only use this code when ins_len > 0,
and when ins_len > 0 we have start_slot properly initialized.  However
we generally find the -Wmaybe-uninitialized warnings valuable, so
initialize start_slot to get rid of the warning.

Reported-by: Jens Axboe <axboe@kernel.dk>
Tested-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/tree-log.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 9a8dc16673b4..10a0913ffb49 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -4337,7 +4337,7 @@ static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans,
 	struct extent_buffer *leaf;
 	int slot;
 	int ins_nr = 0;
-	int start_slot;
+	int start_slot = 0;
 	int ret;
 
 	if (!(inode->flags & BTRFS_INODE_PREALLOC))

From 4b472c25a597463cb00a606d28d23d5e0f5f0040 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Sat, 23 Sep 2023 23:54:06 +0200
Subject: [PATCH 0153/1043] i2c: mux: Avoid potential false error message in
 i2c_mux_add_adapter

[ Upstream commit b13e59e74ff71a1004e0508107e91e9a84fd7388 ]

I2C_CLASS_DEPRECATED is a flag and not an actual class.
There's nothing speaking against both, parent and child, having
I2C_CLASS_DEPRECATED set. Therefore exclude it from the check.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Acked-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/i2c-mux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 774507b54b57..c90cec8d9656 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -340,7 +340,7 @@ int i2c_mux_add_adapter(struct i2c_mux_core *muxc,
 		priv->adap.lock_ops = &i2c_parent_lock_ops;
 
 	/* Sanity check on class */
-	if (i2c_mux_parent_classes(parent) & class)
+	if (i2c_mux_parent_classes(parent) & class & ~I2C_CLASS_DEPRECATED)
 		dev_err(&parent->dev,
 			"Segment %d behind mux can't share classes with ancestors\n",
 			chan_id);

From b4fcf1a0bbd01e8ce71611b9154c2203d38089dd Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Wed, 13 Sep 2023 09:33:12 -0400
Subject: [PATCH 0154/1043] overlayfs: set ctime when setting mtime and atime

[ Upstream commit 03dbab3bba5f009d053635c729d1244f2c8bad38 ]

Nathan reported that he was seeing the new warning in
setattr_copy_mgtime pop when starting podman containers. Overlayfs is
trying to set the atime and mtime via notify_change without also
setting the ctime.

POSIX states that when the atime and mtime are updated via utimes() that
we must also update the ctime to the current time. The situation with
overlayfs copy-up is analogies, so add ATTR_CTIME to the bitmask.
notify_change will fill in the value.

Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Christian Brauner <brauner@kernel.org>
Acked-by: Amir Goldstein <amir73il@gmail.com>
Message-Id: <20230913-ctime-v1-1-c6bc509cbc27@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/overlayfs/copy_up.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 7ef3c87f8a23..65ac504595ba 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -243,7 +243,7 @@ static int ovl_set_timestamps(struct dentry *upperdentry, struct kstat *stat)
 {
 	struct iattr attr = {
 		.ia_valid =
-		     ATTR_ATIME | ATTR_MTIME | ATTR_ATIME_SET | ATTR_MTIME_SET,
+		     ATTR_ATIME | ATTR_MTIME | ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_CTIME,
 		.ia_atime = stat->atime,
 		.ia_mtime = stat->mtime,
 	};

From 22c3641bef9c484a1234a03ae5bb8f7710574dba Mon Sep 17 00:00:00 2001
From: Chengfeng Ye <dg573847474@gmail.com>
Date: Tue, 26 Sep 2023 10:29:14 +0000
Subject: [PATCH 0155/1043] gpio: timberdale: Fix potential deadlock on
 &tgpio->lock

[ Upstream commit 9e8bc2dda5a7a8e2babc9975f4b11c9a6196e490 ]

As timbgpio_irq_enable()/timbgpio_irq_disable() callback could be
executed under irq context, it could introduce double locks on
&tgpio->lock if it preempts other execution units requiring
the same locks.

timbgpio_gpio_set()
--> timbgpio_update_bit()
--> spin_lock(&tgpio->lock)
<interrupt>
   --> timbgpio_irq_disable()
   --> spin_lock_irqsave(&tgpio->lock)

This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.

To prevent the potential deadlock, the patch uses spin_lock_irqsave()
on &tgpio->lock inside timbgpio_gpio_set() to prevent the possible
deadlock scenario.

Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-timberdale.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-timberdale.c b/drivers/gpio/gpio-timberdale.c
index de14949a3fe5..92c1f2baa4bf 100644
--- a/drivers/gpio/gpio-timberdale.c
+++ b/drivers/gpio/gpio-timberdale.c
@@ -43,9 +43,10 @@ static int timbgpio_update_bit(struct gpio_chip *gpio, unsigned index,
 	unsigned offset, bool enabled)
 {
 	struct timbgpio *tgpio = gpiochip_get_data(gpio);
+	unsigned long flags;
 	u32 reg;
 
-	spin_lock(&tgpio->lock);
+	spin_lock_irqsave(&tgpio->lock, flags);
 	reg = ioread32(tgpio->membase + offset);
 
 	if (enabled)
@@ -54,7 +55,7 @@ static int timbgpio_update_bit(struct gpio_chip *gpio, unsigned index,
 		reg &= ~(1 << index);
 
 	iowrite32(reg, tgpio->membase + offset);
-	spin_unlock(&tgpio->lock);
+	spin_unlock_irqrestore(&tgpio->lock, flags);
 
 	return 0;
 }

From fb60e9c0004253b68254ab952f0c3ad7b495cbb8 Mon Sep 17 00:00:00 2001
From: Damien Le Moal <dlemoal@kernel.org>
Date: Tue, 12 Sep 2023 09:08:40 +0900
Subject: [PATCH 0156/1043] ata: libata-eh: Fix compilation warning in
 ata_eh_link_report()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 49728bdc702391902a473b9393f1620eea32acb0 ]

The 6 bytes length of the tries_buf string in ata_eh_link_report() is
too short and results in a gcc compilation warning with W-!:

drivers/ata/libata-eh.c: In function ‘ata_eh_link_report’:
drivers/ata/libata-eh.c:2371:59: warning: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 4 [-Wformat-truncation=]
 2371 |                 snprintf(tries_buf, sizeof(tries_buf), " t%d",
      |                                                           ^~
drivers/ata/libata-eh.c:2371:56: note: directive argument in the range [-2147483648, 4]
 2371 |                 snprintf(tries_buf, sizeof(tries_buf), " t%d",
      |                                                        ^~~~~~
drivers/ata/libata-eh.c:2371:17: note: ‘snprintf’ output between 4 and 14 bytes into a destination of size 6
 2371 |                 snprintf(tries_buf, sizeof(tries_buf), " t%d",
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 2372 |                          ap->eh_tries);
      |                          ~~~~~~~~~~~~~

Avoid this warning by increasing the string size to 16B.

Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libata-eh.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 5fb3eda0a280..2308c2be85a1 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2224,7 +2224,7 @@ static void ata_eh_link_report(struct ata_link *link)
 	struct ata_eh_context *ehc = &link->eh_context;
 	struct ata_queued_cmd *qc;
 	const char *frozen, *desc;
-	char tries_buf[6] = "";
+	char tries_buf[16] = "";
 	int tag, nr_failed = 0;
 
 	if (ehc->i.flags & ATA_EHI_QUIET)

From a59636cdd84a6f182cea32b0f8569718d81dbbb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20L=C3=A9ger?= <cleger@rivosinc.com>
Date: Fri, 29 Sep 2023 21:16:37 +0200
Subject: [PATCH 0157/1043] tracing: relax trace_event_eval_update() execution
 with cond_resched()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 23cce5f25491968b23fb9c399bbfb25f13870cd9 ]

When kernel is compiled without preemption, the eval_map_work_func()
(which calls trace_event_eval_update()) will not be preempted up to its
complete execution. This can actually cause a problem since if another
CPU call stop_machine(), the call will have to wait for the
eval_map_work_func() function to finish executing in the workqueue
before being able to be scheduled. This problem was observe on a SMP
system at boot time, when the CPU calling the initcalls executed
clocksource_done_booting() which in the end calls stop_machine(). We
observed a 1 second delay because one CPU was executing
eval_map_work_func() and was not preempted by the stop_machine() task.

Adding a call to cond_resched() in trace_event_eval_update() allows
other tasks to be executed and thus continue working asynchronously
like before without blocking any pending task at boot time.

Link: https://lore.kernel.org/linux-trace-kernel/20230929191637.416931-1-cleger@rivosinc.com

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Clément Léger <cleger@rivosinc.com>
Tested-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace_events.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 321cfda1b333..c7f0a02442e5 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -2451,6 +2451,7 @@ void trace_event_eval_update(struct trace_eval_map **map, int len)
 				update_event_printk(call, map[i]);
 			}
 		}
+		cond_resched();
 	}
 	up_write(&trace_event_sem);
 }

From 115f2c88fde3c71de913f9e7772cfb13149d4010 Mon Sep 17 00:00:00 2001
From: Ma Ke <make_ruc2021@163.com>
Date: Mon, 18 Sep 2023 10:40:59 +0800
Subject: [PATCH 0158/1043] HID: holtek: fix slab-out-of-bounds Write in
 holtek_kbd_input_event

[ Upstream commit ffe3b7837a2bb421df84d0177481db9f52c93a71 ]

There is a slab-out-of-bounds Write bug in hid-holtek-kbd driver.
The problem is the driver assumes the device must have an input
but some malicious devices violate this assumption.

Fix this by checking hid_device's input is non-empty before its usage.

Signed-off-by: Ma Ke <make_ruc2021@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-holtek-kbd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c
index 403506b9697e..b346d68a06f5 100644
--- a/drivers/hid/hid-holtek-kbd.c
+++ b/drivers/hid/hid-holtek-kbd.c
@@ -130,6 +130,10 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
 		return -ENODEV;
 
 	boot_hid = usb_get_intfdata(boot_interface);
+	if (list_empty(&boot_hid->inputs)) {
+		hid_err(hid, "no inputs found\n");
+		return -ENODEV;
+	}
 	boot_hid_input = list_first_entry(&boot_hid->inputs,
 		struct hid_input, list);
 

From 65f5da6df8975b5df6411a000770ea1722937e7d Mon Sep 17 00:00:00 2001
From: Ying Hsu <yinghsu@chromium.org>
Date: Thu, 7 Sep 2023 04:39:34 +0000
Subject: [PATCH 0159/1043] Bluetooth: Avoid redundant authentication

[ Upstream commit 1d8e801422d66e4b8c7b187c52196bef94eed887 ]

While executing the Android 13 CTS Verifier Secure Server test on a
ChromeOS device, it was observed that the Bluetooth host initiates
authentication for an RFCOMM connection after SSP completes.
When this happens, some Intel Bluetooth controllers, like AC9560, would
disconnect with "Connection Rejected due to Security Reasons (0x0e)".

Historically, BlueZ did not mandate this authentication while an
authenticated combination key was already in use for the connection.
This behavior was changed since commit 7b5a9241b780
("Bluetooth: Introduce requirements for security level 4").
So, this patch addresses the aforementioned disconnection issue by
restoring the previous behavior.

Signed-off-by: Ying Hsu <yinghsu@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_conn.c | 63 ++++++++++++++++++++++------------------
 1 file changed, 35 insertions(+), 28 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index f93a5ef919d1..a9f6089a2ae2 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1435,34 +1435,41 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
 	if (!test_bit(HCI_CONN_AUTH, &conn->flags))
 		goto auth;
 
-	/* An authenticated FIPS approved combination key has sufficient
-	 * security for security level 4. */
-	if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
-	    sec_level == BT_SECURITY_FIPS)
-		goto encrypt;
-
-	/* An authenticated combination key has sufficient security for
-	   security level 3. */
-	if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
-	     conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
-	    sec_level == BT_SECURITY_HIGH)
-		goto encrypt;
-
-	/* An unauthenticated combination key has sufficient security for
-	   security level 1 and 2. */
-	if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
-	     conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
-	    (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
-		goto encrypt;
-
-	/* A combination key has always sufficient security for the security
-	   levels 1 or 2. High security level requires the combination key
-	   is generated using maximum PIN code length (16).
-	   For pre 2.1 units. */
-	if (conn->key_type == HCI_LK_COMBINATION &&
-	    (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
-	     conn->pin_length == 16))
-		goto encrypt;
+	switch (conn->key_type) {
+	case HCI_LK_AUTH_COMBINATION_P256:
+		/* An authenticated FIPS approved combination key has
+		 * sufficient security for security level 4 or lower.
+		 */
+		if (sec_level <= BT_SECURITY_FIPS)
+			goto encrypt;
+		break;
+	case HCI_LK_AUTH_COMBINATION_P192:
+		/* An authenticated combination key has sufficient security for
+		 * security level 3 or lower.
+		 */
+		if (sec_level <= BT_SECURITY_HIGH)
+			goto encrypt;
+		break;
+	case HCI_LK_UNAUTH_COMBINATION_P192:
+	case HCI_LK_UNAUTH_COMBINATION_P256:
+		/* An unauthenticated combination key has sufficient security
+		 * for security level 2 or lower.
+		 */
+		if (sec_level <= BT_SECURITY_MEDIUM)
+			goto encrypt;
+		break;
+	case HCI_LK_COMBINATION:
+		/* A combination key has always sufficient security for the
+		 * security levels 2 or lower. High security level requires the
+		 * combination key is generated using maximum PIN code length
+		 * (16). For pre 2.1 units.
+		 */
+		if (sec_level <= BT_SECURITY_MEDIUM || conn->pin_length == 16)
+			goto encrypt;
+		break;
+	default:
+		break;
+	}
 
 auth:
 	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))

From ffb060b136dd75a033ced0fc0aed2882c02e8b56 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Fri, 15 Sep 2023 14:42:27 -0700
Subject: [PATCH 0160/1043] Bluetooth: hci_core: Fix build warnings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit dcda165706b9fbfd685898d46a6749d7d397e0c0 ]

This fixes the following warnings:

net/bluetooth/hci_core.c: In function ‘hci_register_dev’:
net/bluetooth/hci_core.c:2620:54: warning: ‘%d’ directive output may
be truncated writing between 1 and 10 bytes into a region of size 5
[-Wformat-truncation=]
 2620 |         snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
      |                                                      ^~
net/bluetooth/hci_core.c:2620:50: note: directive argument in the range
[0, 2147483647]
 2620 |         snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
      |                                                  ^~~~~~~
net/bluetooth/hci_core.c:2620:9: note: ‘snprintf’ output between 5 and
14 bytes into a destination of size 8
 2620 |         snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/bluetooth/hci_core.h | 2 +-
 net/bluetooth/hci_core.c         | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 11a92bb4d7a9..e33433ec4a98 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -287,7 +287,7 @@ struct hci_dev {
 	struct list_head list;
 	struct mutex	lock;
 
-	char		name[8];
+	const char	*name;
 	unsigned long	flags;
 	__u16		id;
 	__u8		bus;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 46e1e51ff28e..e33fe4b1c4e2 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3734,7 +3734,11 @@ int hci_register_dev(struct hci_dev *hdev)
 	if (id < 0)
 		return id;
 
-	snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
+	error = dev_set_name(&hdev->dev, "hci%u", id);
+	if (error)
+		return error;
+
+	hdev->name = dev_name(&hdev->dev);
 	hdev->id = id;
 
 	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
@@ -3756,8 +3760,6 @@ int hci_register_dev(struct hci_dev *hdev)
 	if (!IS_ERR_OR_NULL(bt_debugfs))
 		hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
 
-	dev_set_name(&hdev->dev, "%s", hdev->name);
-
 	error = device_add(&hdev->dev);
 	if (error < 0)
 		goto err_wqueue;

From 8de7f7058314e9d4618d84696f654e6c1e392fcb Mon Sep 17 00:00:00 2001
From: Ilan Peer <ilan.peer@intel.com>
Date: Mon, 18 Sep 2023 14:10:54 +0300
Subject: [PATCH 0161/1043] wifi: cfg80211: Fix 6GHz scan configuration

[ Upstream commit 0914468adf92296c4cba8a2134e06e3dea150f2e ]

When the scan request includes a non broadcast BSSID, when adding the
scan parameters for 6GHz collocated scanning, do not include entries
that do not match the given BSSID.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230918140607.6d31d2a96baf.I6c4e3e3075d1d1878ee41f45190fdc6b86f18708@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/scan.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index f59691936e5b..1e6dfe204ff3 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -875,6 +875,10 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
 		    !cfg80211_find_ssid_match(ap, request))
 			continue;
 
+		if (!is_broadcast_ether_addr(request->bssid) &&
+		    !ether_addr_equal(request->bssid, ap->bssid))
+			continue;
+
 		if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid)
 			continue;
 

From fde6d84daa0f690c252817a25928281ba554bd15 Mon Sep 17 00:00:00 2001
From: Wen Gong <quic_wgong@quicinc.com>
Date: Tue, 1 Aug 2023 02:47:51 -0400
Subject: [PATCH 0162/1043] wifi: mac80211: allow transmitting EAPOL frames
 with tainted key

[ Upstream commit 61304336c67358d49a989e5e0060d8c99bad6ca8 ]

Lower layer device driver stop/wake TX by calling ieee80211_stop_queue()/
ieee80211_wake_queue() while hw scan. Sometimes hw scan and PTK rekey are
running in parallel, when M4 sent from wpa_supplicant arrive while the TX
queue is stopped, then the M4 will pending send, and then new key install
from wpa_supplicant. After TX queue wake up by lower layer device driver,
the M4 will be dropped by below call stack.

When key install started, the current key flag is set KEY_FLAG_TAINTED in
ieee80211_pairwise_rekey(), and then mac80211 wait key install complete by
lower layer device driver. Meanwhile ieee80211_tx_h_select_key() will return
TX_DROP for the M4 in step 12 below, and then ieee80211_free_txskb() called
by ieee80211_tx_dequeue(), so the M4 will not send and free, then the rekey
process failed becaue AP not receive M4. Please see details in steps below.

There are a interval between KEY_FLAG_TAINTED set for current key flag and
install key complete by lower layer device driver, the KEY_FLAG_TAINTED is
set in this interval, all packet including M4 will be dropped in this
interval, the interval is step 8~13 as below.

issue steps:
      TX thread                 install key thread
1.   stop_queue                      -idle-
2.   sending M4                      -idle-
3.   M4 pending                      -idle-
4.     -idle-                  starting install key from wpa_supplicant
5.     -idle-                  =>ieee80211_key_replace()
6.     -idle-                  =>ieee80211_pairwise_rekey() and set
                                 currently key->flags |= KEY_FLAG_TAINTED
7.     -idle-                  =>ieee80211_key_enable_hw_accel()
8.     -idle-                  =>drv_set_key() and waiting key install
                                 complete from lower layer device driver
9.   wake_queue                     -waiting state-
10.  re-sending M4                  -waiting state-
11.  =>ieee80211_tx_h_select_key()  -waiting state-
12.  drop M4 by KEY_FLAG_TAINTED    -waiting state-
13.    -idle-                   install key complete with success/fail
                                  success: clear flag KEY_FLAG_TAINTED
                                  fail: start disconnect

Hence add check in step 11 above to allow the EAPOL send out in the
interval. If lower layer device driver use the old key/cipher to encrypt
the M4, then AP received/decrypt M4 correctly, after M4 send out, lower
layer device driver install the new key/cipher to hardware and return
success.

If lower layer device driver use new key/cipher to send the M4, then AP
will/should drop the M4, then it is same result with this issue, AP will/
should kick out station as well as this issue.

issue log:
kworker/u16:4-5238  [000]  6456.108926: stop_queue:           phy1 queue:0, reason:0
wpa_supplicant-961  [003]  6456.119737: rdev_tx_control_port: wiphy_name=phy1 name=wlan0 ifindex=6 dest=ARRAY[9e, 05, 31, 20, 9b, d0] proto=36488 unencrypted=0
wpa_supplicant-961  [003]  6456.119839: rdev_return_int_cookie: phy1, returned 0, cookie: 504
wpa_supplicant-961  [003]  6456.120287: rdev_add_key:         phy1, netdev:wlan0(6), key_index: 0, mode: 0, pairwise: true, mac addr: 9e:05:31:20:9b:d0
wpa_supplicant-961  [003]  6456.120453: drv_set_key:          phy1 vif:wlan0(2) sta:9e:05:31:20:9b:d0 cipher:0xfac04, flags=0x9, keyidx=0, hw_key_idx=0
kworker/u16:9-3829  [001]  6456.168240: wake_queue:           phy1 queue:0, reason:0
kworker/u16:9-3829  [001]  6456.168255: drv_wake_tx_queue:    phy1 vif:wlan0(2) sta:9e:05:31:20:9b:d0 ac:0 tid:7
kworker/u16:9-3829  [001]  6456.168305: cfg80211_control_port_tx_status: wdev(1), cookie: 504, ack: false
wpa_supplicant-961  [003]  6459.167982: drv_return_int:       phy1 - -110

issue call stack:
nl80211_frame_tx_status+0x230/0x340 [cfg80211]
cfg80211_control_port_tx_status+0x1c/0x28 [cfg80211]
ieee80211_report_used_skb+0x374/0x3e8 [mac80211]
ieee80211_free_txskb+0x24/0x40 [mac80211]
ieee80211_tx_dequeue+0x644/0x954 [mac80211]
ath10k_mac_tx_push_txq+0xac/0x238 [ath10k_core]
ath10k_mac_op_wake_tx_queue+0xac/0xe0 [ath10k_core]
drv_wake_tx_queue+0x80/0x168 [mac80211]
__ieee80211_wake_txqs+0xe8/0x1c8 [mac80211]
_ieee80211_wake_txqs+0xb4/0x120 [mac80211]
ieee80211_wake_txqs+0x48/0x80 [mac80211]
tasklet_action_common+0xa8/0x254
tasklet_action+0x2c/0x38
__do_softirq+0xdc/0x384

Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
Link: https://lore.kernel.org/r/20230801064751.25803-1-quic_wgong@quicinc.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/tx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index bbbcc678c655..788b6a3c1419 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -656,7 +656,8 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 		}
 
 		if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
-			     !ieee80211_is_deauth(hdr->frame_control)))
+			     !ieee80211_is_deauth(hdr->frame_control)) &&
+			     tx->skb->protocol != tx->sdata->control_port_protocol)
 			return TX_DROP;
 
 		if (!skip_hw && tx->key &&

From 4613414129603fca2a8cb1324eae7101865d03e8 Mon Sep 17 00:00:00 2001
From: Benjamin Berg <benjamin.berg@intel.com>
Date: Mon, 25 Sep 2023 17:18:56 +0200
Subject: [PATCH 0163/1043] wifi: cfg80211: avoid leaking stack data into trace

[ Upstream commit 334bf33eec5701a1e4e967bcb7cc8611a998334b ]

If the structure is not initialized then boolean types might be copied
into the tracing data without being initialised. This causes data from
the stack to leak into the trace and also triggers a UBSAN failure which
can easily be avoided here.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Link: https://lore.kernel.org/r/20230925171855.a9271ef53b05.I8180bae663984c91a3e036b87f36a640ba409817@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/nl80211.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ea36d8c47b31..0ac829c8f188 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7467,7 +7467,7 @@ static int nl80211_update_mesh_config(struct sk_buff *skb,
 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 	struct net_device *dev = info->user_ptr[1];
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
-	struct mesh_config cfg;
+	struct mesh_config cfg = {};
 	u32 mask;
 	int err;
 

From f06c3a50ef2bb25a194ca711006004f3ae524af4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
Date: Tue, 19 Sep 2023 00:50:27 +0200
Subject: [PATCH 0164/1043] regulator/core: Revert "fix kobject release warning
 and memory leak in regulator_register()"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6e800968f6a715c0661716d2ec5e1f56ed9f9c08 ]

This reverts commit 5f4b204b6b8153923d5be8002c5f7082985d153f.

Since rdev->dev now has a release() callback, the proper way of freeing
the initialized device can be restored.

Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://lore.kernel.org/r/d7f469f3f7b1f0e1d52f9a7ede3f3c5703382090.1695077303.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/core.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 52b75779dbb7..51c4f604d3b2 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5483,15 +5483,11 @@ regulator_register(const struct regulator_desc *regulator_desc,
 	mutex_lock(&regulator_list_mutex);
 	regulator_ena_gpio_free(rdev);
 	mutex_unlock(&regulator_list_mutex);
-	put_device(&rdev->dev);
-	rdev = NULL;
 clean:
 	if (dangling_of_gpiod)
 		gpiod_put(config->ena_gpiod);
-	if (rdev && rdev->dev.of_node)
-		of_node_put(rdev->dev.of_node);
-	kfree(rdev);
 	kfree(config);
+	put_device(&rdev->dev);
 rinse:
 	if (dangling_cfg_gpiod)
 		gpiod_put(cfg->ena_gpiod);

From 21f85b026dfec532b27012e65ee4ba5645b88708 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Fri, 22 Sep 2023 09:50:39 -0700
Subject: [PATCH 0165/1043] sky2: Make sure there is at least one frag_addr
 available

[ Upstream commit 6a70e5cbedaf8ad10528ac9ac114f3ec20f422df ]

In the pathological case of building sky2 with 16k PAGE_SIZE, the
frag_addr[] array would never be used, so the original code was correct
that size should be 0. But the compiler now gets upset with 0 size arrays
in places where it hasn't eliminated the code that might access such an
array (it can't figure out that in this case an rx skb with fragments
would never be created). To keep the compiler happy, make sure there is
at least 1 frag_addr in struct rx_ring_info:

   In file included from include/linux/skbuff.h:28,
                    from include/net/net_namespace.h:43,
                    from include/linux/netdevice.h:38,
                    from drivers/net/ethernet/marvell/sky2.c:18:
   drivers/net/ethernet/marvell/sky2.c: In function 'sky2_rx_unmap_skb':
   include/linux/dma-mapping.h:416:36: warning: array subscript i is outside array bounds of 'dma_addr_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=]
     416 | #define dma_unmap_page(d, a, s, r) dma_unmap_page_attrs(d, a, s, r, 0)
         |                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/net/ethernet/marvell/sky2.c:1257:17: note: in expansion of macro 'dma_unmap_page'
    1257 |                 dma_unmap_page(&pdev->dev, re->frag_addr[i],
         |                 ^~~~~~~~~~~~~~
   In file included from drivers/net/ethernet/marvell/sky2.c:41:
   drivers/net/ethernet/marvell/sky2.h:2198:25: note: while referencing 'frag_addr'
    2198 |         dma_addr_t      frag_addr[ETH_JUMBO_MTU >> PAGE_SHIFT];
         |                         ^~~~~~~~~

With CONFIG_PAGE_SIZE_16KB=y, PAGE_SHIFT == 14, so:

  #define ETH_JUMBO_MTU   9000

causes "ETH_JUMBO_MTU >> PAGE_SHIFT" to be 0. Use "?: 1" to solve this build warning.

Cc: Mirko Lindner <mlindner@marvell.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202309191958.UBw1cjXk-lkp@intel.com/
Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/sky2.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
index b2dddd8a246c..2bd0a7971ae6 100644
--- a/drivers/net/ethernet/marvell/sky2.h
+++ b/drivers/net/ethernet/marvell/sky2.h
@@ -2195,7 +2195,7 @@ struct rx_ring_info {
 	struct sk_buff	*skb;
 	dma_addr_t	data_addr;
 	DEFINE_DMA_UNMAP_LEN(data_size);
-	dma_addr_t	frag_addr[ETH_JUMBO_MTU >> PAGE_SHIFT];
+	dma_addr_t	frag_addr[ETH_JUMBO_MTU >> PAGE_SHIFT ?: 1];
 };
 
 enum flow_control {

From 5b7cae7c35dda1399e16a22a95d49b8f1e5969cb Mon Sep 17 00:00:00 2001
From: Hangbin Liu <liuhangbin@gmail.com>
Date: Fri, 22 Sep 2023 15:55:08 +0800
Subject: [PATCH 0166/1043] ipv4/fib: send notify when delete source address
 routes

[ Upstream commit 4b2b606075e50cdae62ab2356b0a1e206947c354 ]

After deleting an interface address in fib_del_ifaddr(), the function
scans the fib_info list for stray entries and calls fib_flush() and
fib_table_flush(). Then the stray entries will be deleted silently and no
RTM_DELROUTE notification will be sent.

This lack of notification can make routing daemons, or monitor like
`ip monitor route` miss the routing changes. e.g.

+ ip link add dummy1 type dummy
+ ip link add dummy2 type dummy
+ ip link set dummy1 up
+ ip link set dummy2 up
+ ip addr add 192.168.5.5/24 dev dummy1
+ ip route add 7.7.7.0/24 dev dummy2 src 192.168.5.5
+ ip -4 route
7.7.7.0/24 dev dummy2 scope link src 192.168.5.5
192.168.5.0/24 dev dummy1 proto kernel scope link src 192.168.5.5
+ ip monitor route
+ ip addr del 192.168.5.5/24 dev dummy1
Deleted 192.168.5.0/24 dev dummy1 proto kernel scope link src 192.168.5.5
Deleted broadcast 192.168.5.255 dev dummy1 table local proto kernel scope link src 192.168.5.5
Deleted local 192.168.5.5 dev dummy1 table local proto kernel scope host src 192.168.5.5

As Ido reminded, fib_table_flush() isn't only called when an address is
deleted, but also when an interface is deleted or put down. The lack of
notification in these cases is deliberate. And commit 7c6bb7d2faaf
("net/ipv6: Add knob to skip DELROUTE message on device down") introduced
a sysctl to make IPv6 behave like IPv4 in this regard. So we can't send
the route delete notify blindly in fib_table_flush().

To fix this issue, let's add a new flag in "struct fib_info" to track the
deleted prefer source address routes, and only send notify for them.

After update:
+ ip monitor route
+ ip addr del 192.168.5.5/24 dev dummy1
Deleted 192.168.5.0/24 dev dummy1 proto kernel scope link src 192.168.5.5
Deleted broadcast 192.168.5.255 dev dummy1 table local proto kernel scope link src 192.168.5.5
Deleted local 192.168.5.5 dev dummy1 table local proto kernel scope host src 192.168.5.5
Deleted 7.7.7.0/24 dev dummy2 scope link src 192.168.5.5

Suggested-by: Thomas Haller <thaller@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20230922075508.848925-1-liuhangbin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/ip_fib.h     | 1 +
 net/ipv4/fib_semantics.c | 1 +
 net/ipv4/fib_trie.c      | 4 ++++
 3 files changed, 6 insertions(+)

diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 088f257cd6fb..0d3cb34c7abc 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -151,6 +151,7 @@ struct fib_info {
 	int			fib_nhs;
 	bool			fib_nh_is_v6;
 	bool			nh_updated;
+	bool			pfsrc_removed;
 	struct nexthop		*nh;
 	struct rcu_head		rcu;
 	struct fib_nh		fib_nh[];
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 5f786cff2e41..bb5255178d75 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1908,6 +1908,7 @@ int fib_sync_down_addr(struct net_device *dev, __be32 local)
 			continue;
 		if (fi->fib_prefsrc == local) {
 			fi->fib_flags |= RTNH_F_DEAD;
+			fi->pfsrc_removed = true;
 			ret++;
 		}
 	}
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 456240d2adc1..3f4f6458d40e 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1977,6 +1977,7 @@ void fib_table_flush_external(struct fib_table *tb)
 int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all)
 {
 	struct trie *t = (struct trie *)tb->tb_data;
+	struct nl_info info = { .nl_net = net };
 	struct key_vector *pn = t->kv;
 	unsigned long cindex = 1;
 	struct hlist_node *tmp;
@@ -2039,6 +2040,9 @@ int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all)
 
 			fib_notify_alias_delete(net, n->key, &n->leaf, fa,
 						NULL);
+			if (fi->pfsrc_removed)
+				rtmsg_fib(RTM_DELROUTE, htonl(n->key), fa,
+					  KEYLENGTH - fa->fa_slen, tb->tb_id, &info, 0);
 			hlist_del_rcu(&fa->fa_list);
 			fib_release_info(fa->fa_info);
 			alias_free_mem_rcu(fa);

From 661b4ce3b54abe8683285ef4533909c8a7e3abf4 Mon Sep 17 00:00:00 2001
From: Kai Uwe Broulik <foss-linux@broulik.de>
Date: Sun, 1 Oct 2023 13:47:10 +0200
Subject: [PATCH 0167/1043] drm: panel-orientation-quirks: Add quirk for One
 Mix 2S

[ Upstream commit cbb7eb2dbd9472816e42a1b0fdb51af49abbf812 ]

The One Mix 2S is a mini laptop with a 1200x1920 portrait screen
mounted in a landscape oriented clamshell case. Because of the too
generic DMI strings this entry is also doing bios-date matching.

Signed-off-by: Kai Uwe Broulik <foss-linux@broulik.de>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231001114710.336172-1-foss-linux@broulik.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index 6106fa7c4302..43de9dfcba19 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -44,6 +44,14 @@ static const struct drm_dmi_panel_orientation_data gpd_micropc = {
 	.orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
 };
 
+static const struct drm_dmi_panel_orientation_data gpd_onemix2s = {
+	.width = 1200,
+	.height = 1920,
+	.bios_dates = (const char * const []){ "05/21/2018", "10/26/2018",
+		"03/04/2019", NULL },
+	.orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+};
+
 static const struct drm_dmi_panel_orientation_data gpd_pocket = {
 	.width = 1200,
 	.height = 1920,
@@ -329,6 +337,14 @@ static const struct dmi_system_id orientation_data[] = {
 		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "LTH17"),
 		},
 		.driver_data = (void *)&lcd800x1280_rightside_up,
+	}, {	/* One Mix 2S (generic strings, also match on bios date) */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
+		  DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
+		  DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
+		},
+		.driver_data = (void *)&gpd_onemix2s,
 	},
 	{}
 };

From 4e71ae53f1217e541d2c5a400019abf203ae858b Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Tue, 26 Sep 2023 15:47:27 -0400
Subject: [PATCH 0168/1043] btrfs: fix some -Wmaybe-uninitialized warnings in
 ioctl.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9147b9ded499d9853bdf0e9804b7eaa99c4429ed ]

Jens reported the following warnings from -Wmaybe-uninitialized recent
Linus' branch.

  In file included from ./include/asm-generic/rwonce.h:26,
		   from ./arch/arm64/include/asm/rwonce.h:71,
		   from ./include/linux/compiler.h:246,
		   from ./include/linux/export.h:5,
		   from ./include/linux/linkage.h:7,
		   from ./include/linux/kernel.h:17,
		   from fs/btrfs/ioctl.c:6:
  In function ‘instrument_copy_from_user_before’,
      inlined from ‘_copy_from_user’ at ./include/linux/uaccess.h:148:3,
      inlined from ‘copy_from_user’ at ./include/linux/uaccess.h:183:7,
      inlined from ‘btrfs_ioctl_space_info’ at fs/btrfs/ioctl.c:2999:6,
      inlined from ‘btrfs_ioctl’ at fs/btrfs/ioctl.c:4616:10:
  ./include/linux/kasan-checks.h:38:27: warning: ‘space_args’ may be used
  uninitialized [-Wmaybe-uninitialized]
     38 | #define kasan_check_write __kasan_check_write
  ./include/linux/instrumented.h:129:9: note: in expansion of macro
  ‘kasan_check_write’
    129 |         kasan_check_write(to, n);
	|         ^~~~~~~~~~~~~~~~~
  ./include/linux/kasan-checks.h: In function ‘btrfs_ioctl’:
  ./include/linux/kasan-checks.h:20:6: note: by argument 1 of type ‘const
  volatile void *’ to ‘__kasan_check_write’ declared here
     20 | bool __kasan_check_write(const volatile void *p, unsigned int
	size);
	|      ^~~~~~~~~~~~~~~~~~~
  fs/btrfs/ioctl.c:2981:39: note: ‘space_args’ declared here
   2981 |         struct btrfs_ioctl_space_args space_args;
	|                                       ^~~~~~~~~~
  In function ‘instrument_copy_from_user_before’,
      inlined from ‘_copy_from_user’ at ./include/linux/uaccess.h:148:3,
      inlined from ‘copy_from_user’ at ./include/linux/uaccess.h:183:7,
      inlined from ‘_btrfs_ioctl_send’ at fs/btrfs/ioctl.c:4343:9,
      inlined from ‘btrfs_ioctl’ at fs/btrfs/ioctl.c:4658:10:
  ./include/linux/kasan-checks.h:38:27: warning: ‘args32’ may be used
  uninitialized [-Wmaybe-uninitialized]
     38 | #define kasan_check_write __kasan_check_write
  ./include/linux/instrumented.h:129:9: note: in expansion of macro
  ‘kasan_check_write’
    129 |         kasan_check_write(to, n);
	|         ^~~~~~~~~~~~~~~~~
  ./include/linux/kasan-checks.h: In function ‘btrfs_ioctl’:
  ./include/linux/kasan-checks.h:20:6: note: by argument 1 of type ‘const
  volatile void *’ to ‘__kasan_check_write’ declared here
     20 | bool __kasan_check_write(const volatile void *p, unsigned int
	size);
	|      ^~~~~~~~~~~~~~~~~~~
  fs/btrfs/ioctl.c:4341:49: note: ‘args32’ declared here
   4341 |                 struct btrfs_ioctl_send_args_32 args32;
	|                                                 ^~~~~~

This was due to his config options and having KASAN turned on,
which adds some extra checks around copy_from_user(), which then
triggered the -Wmaybe-uninitialized checker for these cases.

Fix the warnings by initializing the different structs we're copying
into.

Reported-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/ioctl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 930126b094ad..cffd149faf63 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3518,7 +3518,7 @@ static void get_block_group_info(struct list_head *groups_list,
 static long btrfs_ioctl_space_info(struct btrfs_fs_info *fs_info,
 				   void __user *arg)
 {
-	struct btrfs_ioctl_space_args space_args;
+	struct btrfs_ioctl_space_args space_args = { 0 };
 	struct btrfs_ioctl_space_info space;
 	struct btrfs_ioctl_space_info *dest;
 	struct btrfs_ioctl_space_info *dest_orig;
@@ -4858,7 +4858,7 @@ static int _btrfs_ioctl_send(struct file *file, void __user *argp, bool compat)
 
 	if (compat) {
 #if defined(CONFIG_64BIT) && defined(CONFIG_COMPAT)
-		struct btrfs_ioctl_send_args_32 args32;
+		struct btrfs_ioctl_send_args_32 args32 = { 0 };
 
 		ret = copy_from_user(&args32, argp, sizeof(args32));
 		if (ret)

From fd127163276921a45edff9b28d91178985893dc6 Mon Sep 17 00:00:00 2001
From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
Date: Sun, 17 Sep 2023 16:18:43 +0000
Subject: [PATCH 0169/1043] HID: multitouch: Add required quirk for Synaptics
 0xcd7e device

[ Upstream commit 1437e4547edf41689d7135faaca4222ef0081bc1 ]

Register the Synaptics device as a special multitouch device with certain
quirks that may improve usability of the touchpad device.

Reported-by: Rain <rain@sunshowers.io>
Closes: https://lore.kernel.org/linux-input/2bbb8e1d-1793-4df1-810f-cb0137341ff4@app.fastmail.com/
Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-multitouch.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index dc7c33f6b2c4..84b12599eaf6 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -2058,6 +2058,10 @@ static const struct hid_device_id mt_devices[] = {
 			USB_DEVICE_ID_MTP_STM)},
 
 	/* Synaptics devices */
+	{ .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT,
+		HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+			USB_VENDOR_ID_SYNAPTICS, 0xcd7e) },
+
 	{ .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT,
 		HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
 			USB_VENDOR_ID_SYNAPTICS, 0xce08) },

From ead8131372af5d3948eaccfb82a6a2030b9e2aae Mon Sep 17 00:00:00 2001
From: Renan Guilherme Lebre Ramos <japareaggae@gmail.com>
Date: Wed, 4 Oct 2023 19:59:00 -0400
Subject: [PATCH 0170/1043] platform/x86: touchscreen_dmi: Add info for the
 Positivo C4128B

[ Upstream commit aa7dcba3bae6869122828b144a3cfd231718089d ]

Add information for the Positivo C4128B, a notebook/tablet convertible.

Link: https://github.com/onitake/gsl-firmware/pull/217
Signed-off-by: Renan Guilherme Lebre Ramos <japareaggae@gmail.com>
Link: https://lore.kernel.org/r/20231004235900.426240-1-japareaggae@gmail.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/touchscreen_dmi.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
index 55a18cd0c298..eedff2ae2851 100644
--- a/drivers/platform/x86/touchscreen_dmi.c
+++ b/drivers/platform/x86/touchscreen_dmi.c
@@ -726,6 +726,21 @@ static const struct ts_dmi_data pipo_w11_data = {
 	.properties	= pipo_w11_props,
 };
 
+static const struct property_entry positivo_c4128b_props[] = {
+	PROPERTY_ENTRY_U32("touchscreen-min-x", 4),
+	PROPERTY_ENTRY_U32("touchscreen-min-y", 13),
+	PROPERTY_ENTRY_U32("touchscreen-size-x", 1915),
+	PROPERTY_ENTRY_U32("touchscreen-size-y", 1269),
+	PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-positivo-c4128b.fw"),
+	PROPERTY_ENTRY_U32("silead,max-fingers", 10),
+	{ }
+};
+
+static const struct ts_dmi_data positivo_c4128b_data = {
+	.acpi_name	= "MSSL1680:00",
+	.properties	= positivo_c4128b_props,
+};
+
 static const struct property_entry pov_mobii_wintab_p800w_v20_props[] = {
 	PROPERTY_ENTRY_U32("touchscreen-min-x", 32),
 	PROPERTY_ENTRY_U32("touchscreen-min-y", 16),
@@ -1389,6 +1404,14 @@ const struct dmi_system_id touchscreen_dmi_table[] = {
 			DMI_MATCH(DMI_BIOS_VERSION, "MOMO.G.WI71C.MABMRBA02"),
 		},
 	},
+	{
+		/* Positivo C4128B */
+		.driver_data = (void *)&positivo_c4128b_data,
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "C4128B-1"),
+		},
+	},
 	{
 		/* Point of View mobii wintab p800w (v2.0) */
 		.driver_data = (void *)&pov_mobii_wintab_p800w_v20_data,

From 3b6aa631df0cada8f1c85f920bf9374f64e4e0b3 Mon Sep 17 00:00:00 2001
From: Maher Sanalla <msanalla@nvidia.com>
Date: Wed, 6 Sep 2023 21:48:30 +0300
Subject: [PATCH 0171/1043] net/mlx5: Handle fw tracer change ownership event
 based on MTRC

[ Upstream commit 92fd39634541eb0a11bf1bafbc8ba92d6ddb8dba ]

Currently, whenever fw issues a change ownership event, the PF that owns
the fw tracer drops its ownership directly and the other PFs try to pick
up the ownership via what MTRC register suggests.

In some cases, driver releases the ownership of the tracer and reacquires
it later on. Whenever the driver releases ownership of the tracer, fw
issues a change ownership event. This event can be delayed and come after
driver has reacquired ownership of the tracer. Thus the late event will
trigger the tracer owner PF to release the ownership again and lead to a
scenario where no PF is owning the tracer.

To prevent the scenario described above, when handling a change
ownership event, do not drop ownership of the tracer directly, instead
read the fw MTRC register to retrieve the up-to-date owner of the tracer
and set it accordingly in driver level.

Fixes: f53aaa31cce7 ("net/mlx5: FW tracer, implement tracer logic")
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
index 5273644fb2bf..86088ccab23a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
@@ -821,7 +821,7 @@ static void mlx5_fw_tracer_ownership_change(struct work_struct *work)
 
 	mlx5_core_dbg(tracer->dev, "FWTracer: ownership changed, current=(%d)\n", tracer->owner);
 	if (tracer->owner) {
-		tracer->owner = false;
+		mlx5_fw_tracer_ownership_acquire(tracer);
 		return;
 	}
 

From f707bc0a55b7d01419cd3ca6506bd574e272f815 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Thu, 5 Oct 2023 13:59:59 -0700
Subject: [PATCH 0172/1043] Bluetooth: hci_event: Fix using memcmp when
 comparing keys

[ Upstream commit b541260615f601ae1b5d6d0cc54e790de706303b ]

memcmp is not consider safe to use with cryptographic secrets:

 'Do  not  use memcmp() to compare security critical data, such as
 cryptographic secrets, because the required CPU time depends on the
 number of equal bytes.'

While usage of memcmp for ZERO_KEY may not be considered a security
critical data, it can lead to more usage of memcmp with pairing keys
which could introduce more security problems.

Fixes: 455c2ff0a558 ("Bluetooth: Fix BR/EDR out-of-band pairing with only initiator data")
Fixes: 33155c4aae52 ("Bluetooth: hci_event: Ignore NULL link key")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index c0a210324141..ad5294de9759 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -25,6 +25,8 @@
 /* Bluetooth HCI event handling. */
 
 #include <asm/unaligned.h>
+#include <linux/crypto.h>
+#include <crypto/algapi.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -4076,7 +4078,7 @@ static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
 		goto unlock;
 
 	/* Ignore NULL link key against CVE-2020-26555 */
-	if (!memcmp(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
+	if (!crypto_memneq(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
 		bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
 			   &ev->bdaddr);
 		hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
@@ -4588,8 +4590,8 @@ static u8 bredr_oob_data_present(struct hci_conn *conn)
 		 * available, then do not declare that OOB data is
 		 * present.
 		 */
-		if (!memcmp(data->rand256, ZERO_KEY, 16) ||
-		    !memcmp(data->hash256, ZERO_KEY, 16))
+		if (!crypto_memneq(data->rand256, ZERO_KEY, 16) ||
+		    !crypto_memneq(data->hash256, ZERO_KEY, 16))
 			return 0x00;
 
 		return 0x02;
@@ -4599,8 +4601,8 @@ static u8 bredr_oob_data_present(struct hci_conn *conn)
 	 * not supported by the hardware, then check that if
 	 * P-192 data values are present.
 	 */
-	if (!memcmp(data->rand192, ZERO_KEY, 16) ||
-	    !memcmp(data->hash192, ZERO_KEY, 16))
+	if (!crypto_memneq(data->rand192, ZERO_KEY, 16) ||
+	    !crypto_memneq(data->hash192, ZERO_KEY, 16))
 		return 0x00;
 
 	return 0x01;

From 6224890ad0b4e85a909349bdc8606dab50d0daf5 Mon Sep 17 00:00:00 2001
From: Bibek Kumar Patro <quic_bibekkum@quicinc.com>
Date: Wed, 13 Sep 2023 12:37:02 +0530
Subject: [PATCH 0173/1043] mtd: rawnand: qcom: Unmap the right resource upon
 probe failure

commit 5279f4a9eed3ee7d222b76511ea7a22c89e7eefd upstream.

We currently provide the physical address of the DMA region
rather than the output of dma_map_resource() which is obviously wrong.

Fixes: 7330fc505af4 ("mtd: rawnand: qcom: stop using phys_to_dma()")
Cc: stable@vger.kernel.org
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bibek Kumar Patro <quic_bibekkum@quicinc.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230913070702.12707-1-quic_bibekkum@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/qcom_nandc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
index bb181e18c7c5..be7190f0499b 100644
--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -2996,7 +2996,7 @@ static int qcom_nandc_probe(struct platform_device *pdev)
 err_aon_clk:
 	clk_disable_unprepare(nandc->core_clk);
 err_core_clk:
-	dma_unmap_resource(dev, res->start, resource_size(res),
+	dma_unmap_resource(dev, nandc->base_dma, resource_size(res),
 			   DMA_BIDIRECTIONAL, 0);
 	return ret;
 }

From 875d17e4524b1017d4440cb497af7ddc8e394626 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Mon, 17 Jul 2023 21:42:19 +0200
Subject: [PATCH 0174/1043] mtd: rawnand: marvell: Ensure program page
 operations are successful

commit 3e01d5254698ea3d18e09d96b974c762328352cd upstream.

The NAND core complies with the ONFI specification, which itself
mentions that after any program or erase operation, a status check
should be performed to see whether the operation was finished *and*
successful.

The NAND core offers helpers to finish a page write (sending the
"PAGE PROG" command, waiting for the NAND chip to be ready again, and
checking the operation status). But in some cases, advanced controller
drivers might want to optimize this and craft their own page write
helper to leverage additional hardware capabilities, thus not always
using the core facilities.

Some drivers, like this one, do not use the core helper to finish a page
write because the final cycles are automatically managed by the
hardware. In this case, the additional care must be taken to manually
perform the final status check.

Let's read the NAND chip status at the end of the page write helper and
return -EIO upon error.

Cc: stable@vger.kernel.org
Fixes: 02f26ecf8c77 ("mtd: nand: add reworked Marvell NAND controller driver")
Reported-by: Aviram Dali <aviramd@marvell.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Tested-by: Ravi Chandra Minnikanti <rminnikanti@marvell.com>
Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-1-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/marvell_nand.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 2ef1a5adfcfc..9ed3ff7f4cf9 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -1148,6 +1148,7 @@ static int marvell_nfc_hw_ecc_hmg_do_write_page(struct nand_chip *chip,
 		.ndcb[2] = NDCB2_ADDR5_PAGE(page),
 	};
 	unsigned int oob_bytes = lt->spare_bytes + (raw ? lt->ecc_bytes : 0);
+	u8 status;
 	int ret;
 
 	/* NFCv2 needs more information about the operation being executed */
@@ -1181,7 +1182,18 @@ static int marvell_nfc_hw_ecc_hmg_do_write_page(struct nand_chip *chip,
 
 	ret = marvell_nfc_wait_op(chip,
 				  PSEC_TO_MSEC(sdr->tPROG_max));
-	return ret;
+	if (ret)
+		return ret;
+
+	/* Check write status on the chip side */
+	ret = nand_status_op(chip, &status);
+	if (ret)
+		return ret;
+
+	if (status & NAND_STATUS_FAIL)
+		return -EIO;
+
+	return 0;
 }
 
 static int marvell_nfc_hw_ecc_hmg_write_page_raw(struct nand_chip *chip,
@@ -1610,6 +1622,7 @@ static int marvell_nfc_hw_ecc_bch_write_page(struct nand_chip *chip,
 	int data_len = lt->data_bytes;
 	int spare_len = lt->spare_bytes;
 	int chunk, ret;
+	u8 status;
 
 	marvell_nfc_select_target(chip, chip->cur_cs);
 
@@ -1646,6 +1659,14 @@ static int marvell_nfc_hw_ecc_bch_write_page(struct nand_chip *chip,
 	if (ret)
 		return ret;
 
+	/* Check write status on the chip side */
+	ret = nand_status_op(chip, &status);
+	if (ret)
+		return ret;
+
+	if (status & NAND_STATUS_FAIL)
+		return -EIO;
+
 	return 0;
 }
 

From 7682dae0a6076a1c3374dea2cef93f85793ed2df Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Mon, 17 Jul 2023 21:42:20 +0200
Subject: [PATCH 0175/1043] mtd: rawnand: arasan: Ensure program page
 operations are successful

commit 3a4a893dbb19e229db3b753f0462520b561dee98 upstream.

The NAND core complies with the ONFI specification, which itself
mentions that after any program or erase operation, a status check
should be performed to see whether the operation was finished *and*
successful.

The NAND core offers helpers to finish a page write (sending the
"PAGE PROG" command, waiting for the NAND chip to be ready again, and
checking the operation status). But in some cases, advanced controller
drivers might want to optimize this and craft their own page write
helper to leverage additional hardware capabilities, thus not always
using the core facilities.

Some drivers, like this one, do not use the core helper to finish a page
write because the final cycles are automatically managed by the
hardware. In this case, the additional care must be taken to manually
perform the final status check.

Let's read the NAND chip status at the end of the page write helper and
return -EIO upon error.

Cc: Michal Simek <michal.simek@amd.com>
Cc: stable@vger.kernel.org
Fixes: 88ffef1b65cf ("mtd: rawnand: arasan: Support the hardware BCH ECC engine")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Acked-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-2-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/arasan-nand-controller.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/nand/raw/arasan-nand-controller.c b/drivers/mtd/nand/raw/arasan-nand-controller.c
index 6a0d48c42cfa..ef062b5ea9cd 100644
--- a/drivers/mtd/nand/raw/arasan-nand-controller.c
+++ b/drivers/mtd/nand/raw/arasan-nand-controller.c
@@ -451,6 +451,7 @@ static int anfc_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf,
 	struct mtd_info *mtd = nand_to_mtd(chip);
 	unsigned int len = mtd->writesize + (oob_required ? mtd->oobsize : 0);
 	dma_addr_t dma_addr;
+	u8 status;
 	int ret;
 	struct anfc_op nfc_op = {
 		.pkt_reg =
@@ -497,10 +498,21 @@ static int anfc_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf,
 	}
 
 	/* Spare data is not protected */
-	if (oob_required)
+	if (oob_required) {
 		ret = nand_write_oob_std(chip, page);
+		if (ret)
+			return ret;
+	}
 
-	return ret;
+	/* Check write status on the chip side */
+	ret = nand_status_op(chip, &status);
+	if (ret)
+		return ret;
+
+	if (status & NAND_STATUS_FAIL)
+		return -EIO;
+
+	return 0;
 }
 
 static int anfc_sel_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf,

From 3a141424f8fe989d8c0e7890cafd3b035d7ac55d Mon Sep 17 00:00:00 2001
From: Martin Kurbanov <mmkurbanov@sberdevices.ru>
Date: Tue, 5 Sep 2023 17:56:37 +0300
Subject: [PATCH 0176/1043] mtd: spinand: micron: correct bitmask for ecc
 status

commit 9836a987860e33943945d4b257729a4f94eae576 upstream.

Valid bitmask is 0x70 in the status register.

Fixes: a508e8875e13 ("mtd: spinand: Add initial support for Micron MT29F2G01ABAGD")
Signed-off-by: Martin Kurbanov <mmkurbanov@sberdevices.ru>
Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230905145637.139068-1-mmkurbanov@sberdevices.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/spi/micron.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/spi/micron.c b/drivers/mtd/nand/spi/micron.c
index 5d370cfcdaaa..89e2b46bdc46 100644
--- a/drivers/mtd/nand/spi/micron.c
+++ b/drivers/mtd/nand/spi/micron.c
@@ -12,7 +12,7 @@
 
 #define SPINAND_MFR_MICRON		0x2c
 
-#define MICRON_STATUS_ECC_MASK		GENMASK(7, 4)
+#define MICRON_STATUS_ECC_MASK		GENMASK(6, 4)
 #define MICRON_STATUS_ECC_NO_BITFLIPS	(0 << 4)
 #define MICRON_STATUS_ECC_1TO3_BITFLIPS	(1 << 4)
 #define MICRON_STATUS_ECC_4TO6_BITFLIPS	(3 << 4)

From 2312fb7f3b20fe58768f0020eb8c094d15f85c2c Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Wed, 30 Aug 2023 17:00:34 +0200
Subject: [PATCH 0177/1043] mtd: physmap-core: Restore map_rom fallback

commit 6792b7fce610bcd1cf3e07af3607fe7e2c38c1d8 upstream.

When the exact mapping type driver was not available, the old
physmap_of_core driver fell back to mapping the region as ROM.
Unfortunately this feature was lost when the DT and pdata cases were
merged.  Revive this useful feature.

Fixes: 642b1e8dbed7bbbf ("mtd: maps: Merge physmap_of.c into physmap-core.c")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/550e8c8c1da4c4baeb3d71ff79b14a18d4194f9e.1693407371.git.geert+renesas@glider.be
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/maps/physmap-core.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/mtd/maps/physmap-core.c b/drivers/mtd/maps/physmap-core.c
index 4f63b8430c71..9ab795f03c54 100644
--- a/drivers/mtd/maps/physmap-core.c
+++ b/drivers/mtd/maps/physmap-core.c
@@ -556,6 +556,17 @@ static int physmap_flash_probe(struct platform_device *dev)
 		if (info->probe_type) {
 			info->mtds[i] = do_map_probe(info->probe_type,
 						     &info->maps[i]);
+
+			/* Fall back to mapping region as ROM */
+			if (!info->mtds[i] && IS_ENABLED(CONFIG_MTD_ROM) &&
+			    strcmp(info->probe_type, "map_rom")) {
+				dev_warn(&dev->dev,
+					 "map_probe() failed for type %s\n",
+					 info->probe_type);
+
+				info->mtds[i] = do_map_probe("map_rom",
+							     &info->maps[i]);
+			}
 		} else {
 			int j;
 

From f4771efb068359f0437cf57838ec4d5fdb404aba Mon Sep 17 00:00:00 2001
From: Haibo Chen <haibo.chen@nxp.com>
Date: Wed, 30 Aug 2023 17:39:22 +0800
Subject: [PATCH 0178/1043] mmc: core: sdio: hold retuning if sdio in 1-bit
 mode

commit 32a9cdb8869dc111a0c96cf8e1762be9684af15b upstream.

tuning only support in 4-bit mode or 8 bit mode, so in 1-bit mode,
need to hold retuning.

Find this issue when use manual tuning method on imx93. When system
resume back, SDIO WIFI try to switch back to 4 bit mode, first will
trigger retuning, and all tuning command failed.

Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Fixes: dfa13ebbe334 ("mmc: host: Add facility to support re-tuning")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230830093922.3095850-1-haibo.chen@nxp.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/sdio.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index 99a4ce68d82f..85c2947ed45e 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -1075,8 +1075,14 @@ static int mmc_sdio_resume(struct mmc_host *host)
 		}
 		err = mmc_sdio_reinit_card(host);
 	} else if (mmc_card_wake_sdio_irq(host)) {
-		/* We may have switched to 1-bit mode during suspend */
+		/*
+		 * We may have switched to 1-bit mode during suspend,
+		 * need to hold retuning, because tuning only supprt
+		 * 4-bit mode or 8 bit mode.
+		 */
+		mmc_retune_hold_now(host);
 		err = sdio_enable_4bit_bus(host->card);
+		mmc_retune_release(host);
 	}
 
 	if (err)

From b26b0b8757c6a058bd7fa97504d3ae4eb054d4df Mon Sep 17 00:00:00 2001
From: Avri Altman <avri.altman@wdc.com>
Date: Wed, 27 Sep 2023 10:15:00 +0300
Subject: [PATCH 0179/1043] mmc: core: Capture correct oemid-bits for eMMC
 cards

commit 84ee19bffc9306128cd0f1c650e89767079efeff upstream.

The OEMID is an 8-bit binary number rather than 16-bit as the current code
parses for. The OEMID occupies bits [111:104] in the CID register, see the
eMMC spec JESD84-B51 paragraph 7.2.3. It seems that the 16-bit comes from
the legacy MMC specs (v3.31 and before).

Let's fix the parsing by simply move to use 8-bit instead of 16-bit. This
means we ignore the impact on some of those old MMC cards that may be out
there, but on the other hand this shouldn't be a problem as the OEMID seems
not be an important feature for these cards.

Signed-off-by: Avri Altman <avri.altman@wdc.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230927071500.1791882-1-avri.altman@wdc.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/mmc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 87807ef010a9..91c929bd69c0 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -95,7 +95,7 @@ static int mmc_decode_cid(struct mmc_card *card)
 	case 3: /* MMC v3.1 - v3.3 */
 	case 4: /* MMC v4 */
 		card->cid.manfid	= UNSTUFF_BITS(resp, 120, 8);
-		card->cid.oemid		= UNSTUFF_BITS(resp, 104, 16);
+		card->cid.oemid		= UNSTUFF_BITS(resp, 104, 8);
 		card->cid.prod_name[0]	= UNSTUFF_BITS(resp, 96, 8);
 		card->cid.prod_name[1]	= UNSTUFF_BITS(resp, 88, 8);
 		card->cid.prod_name[2]	= UNSTUFF_BITS(resp, 80, 8);

From c44e09a89ad20aa09249b83fd2937626550377dc Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Tue, 17 Oct 2023 17:18:06 +0300
Subject: [PATCH 0180/1043] Revert "pinctrl: avoid unsafe code pattern in
 find_pinctrl()"

commit 62140a1e4dec4594d5d1e1d353747bf2ef434e8b upstream.

The commit breaks MMC enumeration on the Intel Merrifield
plaform.

Before:
[   36.439057] mmc0: SDHCI controller on PCI [0000:00:01.0] using ADMA
[   36.450924] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA
[   36.459355] mmc1: SDHCI controller on PCI [0000:00:01.2] using ADMA
[   36.706399] mmc0: new DDR MMC card at address 0001
[   37.058972] mmc2: new ultra high speed DDR50 SDIO card at address 0001
[   37.278977] mmcblk0: mmc0:0001 H4G1d 3.64 GiB
[   37.297300]  mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10

After:
[   36.436704] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA
[   36.436720] mmc1: SDHCI controller on PCI [0000:00:01.0] using ADMA
[   36.463685] mmc0: SDHCI controller on PCI [0000:00:01.2] using ADMA
[   36.720627] mmc1: new DDR MMC card at address 0001
[   37.068181] mmc2: new ultra high speed DDR50 SDIO card at address 0001
[   37.279998] mmcblk1: mmc1:0001 H4G1d 3.64 GiB
[   37.302670]  mmcblk1: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10

This reverts commit c153a4edff6ab01370fcac8e46f9c89cca1060c2.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20231017141806.535191-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/core.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 6acb2a56910e..840000870d5a 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1007,20 +1007,17 @@ static int add_setting(struct pinctrl *p, struct pinctrl_dev *pctldev,
 
 static struct pinctrl *find_pinctrl(struct device *dev)
 {
-	struct pinctrl *entry, *p = NULL;
+	struct pinctrl *p;
 
 	mutex_lock(&pinctrl_list_mutex);
-
-	list_for_each_entry(entry, &pinctrl_list, node) {
-		if (entry->dev == dev) {
-			p = entry;
-			kref_get(&p->users);
-			break;
+	list_for_each_entry(p, &pinctrl_list, node)
+		if (p->dev == dev) {
+			mutex_unlock(&pinctrl_list_mutex);
+			return p;
 		}
-	}
 
 	mutex_unlock(&pinctrl_list_mutex);
-	return p;
+	return NULL;
 }
 
 static void pinctrl_free(struct pinctrl *p, bool inlist);
@@ -1129,6 +1126,7 @@ struct pinctrl *pinctrl_get(struct device *dev)
 	p = find_pinctrl(dev);
 	if (p) {
 		dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n");
+		kref_get(&p->users);
 		return p;
 	}
 

From 9df654268aecd616998aa1526bd072d27b58a7f1 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Sun, 8 Oct 2023 14:20:19 -0400
Subject: [PATCH 0181/1043] pNFS: Fix a hang in nfs4_evict_inode()

commit f63955721a8020e979b99cc417dcb6da3106aa24 upstream.

We are not allowed to call pnfs_mark_matching_lsegs_return() without
also holding a reference to the layout header, since doing so could lead
to the reference count going to zero when we call
pnfs_layout_remove_lseg(). This again can lead to a hang when we get to
nfs4_evict_inode() and are unable to clear the layout pointer.

pnfs_layout_return_unused_byserver() is guilty of this behaviour, and
has been seen to trigger the refcount warning prior to a hang.

Fixes: b6d49ecd1081 ("NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode")
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/pnfs.c | 33 +++++++++++++++++++++++----------
 1 file changed, 23 insertions(+), 10 deletions(-)

diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 21436721745b..ed6a3ed83755 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2633,31 +2633,44 @@ pnfs_should_return_unused_layout(struct pnfs_layout_hdr *lo,
 	return mode == 0;
 }
 
-static int
-pnfs_layout_return_unused_byserver(struct nfs_server *server, void *data)
+static int pnfs_layout_return_unused_byserver(struct nfs_server *server,
+					      void *data)
 {
 	const struct pnfs_layout_range *range = data;
+	const struct cred *cred;
 	struct pnfs_layout_hdr *lo;
 	struct inode *inode;
+	nfs4_stateid stateid;
+	enum pnfs_iomode iomode;
+
 restart:
 	rcu_read_lock();
 	list_for_each_entry_rcu(lo, &server->layouts, plh_layouts) {
-		if (!pnfs_layout_can_be_returned(lo) ||
+		inode = lo->plh_inode;
+		if (!inode || !pnfs_layout_can_be_returned(lo) ||
 		    test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags))
 			continue;
-		inode = lo->plh_inode;
 		spin_lock(&inode->i_lock);
-		if (!pnfs_should_return_unused_layout(lo, range)) {
+		if (!lo->plh_inode ||
+		    !pnfs_should_return_unused_layout(lo, range)) {
 			spin_unlock(&inode->i_lock);
 			continue;
 		}
+		pnfs_get_layout_hdr(lo);
+		pnfs_set_plh_return_info(lo, range->iomode, 0);
+		if (pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs,
+						    range, 0) != 0 ||
+		    !pnfs_prepare_layoutreturn(lo, &stateid, &cred, &iomode)) {
+			spin_unlock(&inode->i_lock);
+			rcu_read_unlock();
+			pnfs_put_layout_hdr(lo);
+			cond_resched();
+			goto restart;
+		}
 		spin_unlock(&inode->i_lock);
-		inode = pnfs_grab_inode_layout_hdr(lo);
-		if (!inode)
-			continue;
 		rcu_read_unlock();
-		pnfs_mark_layout_for_return(inode, range);
-		iput(inode);
+		pnfs_send_layoutreturn(lo, &stateid, &cred, iomode, false);
+		pnfs_put_layout_hdr(lo);
 		cond_resched();
 		goto restart;
 	}

From 9efa38fdca2cfee4a11ec7d55a80e693bf8db4f5 Mon Sep 17 00:00:00 2001
From: Sunil V L <sunilvl@ventanamicro.com>
Date: Mon, 16 Oct 2023 22:39:39 +0530
Subject: [PATCH 0182/1043] ACPI: irq: Fix incorrect return value in
 acpi_register_gsi()

commit 0c21a18d5d6c6a73d098fb9b4701572370942df9 upstream.

acpi_register_gsi() should return a negative value in case of failure.

Currently, it returns the return value from irq_create_fwspec_mapping().
However, irq_create_fwspec_mapping() returns 0 for failure. Fix the
issue by returning -EINVAL if irq_create_fwspec_mapping() returns zero.

Fixes: d44fa3d46079 ("ACPI: Add support for ResourceSource/IRQ domain mapping")
Cc: 4.11+ <stable@vger.kernel.org> # 4.11+
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
[ rjw: Rename a new local variable ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/irq.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/irq.c b/drivers/acpi/irq.c
index e209081d644b..6a9490ad78ce 100644
--- a/drivers/acpi/irq.c
+++ b/drivers/acpi/irq.c
@@ -52,6 +52,7 @@ int acpi_register_gsi(struct device *dev, u32 gsi, int trigger,
 		      int polarity)
 {
 	struct irq_fwspec fwspec;
+	unsigned int irq;
 
 	if (WARN_ON(!acpi_gsi_domain_id)) {
 		pr_warn("GSI: No registered irqchip, giving up\n");
@@ -63,7 +64,11 @@ int acpi_register_gsi(struct device *dev, u32 gsi, int trigger,
 	fwspec.param[1] = acpi_dev_get_irq_type(trigger, polarity);
 	fwspec.param_count = 2;
 
-	return irq_create_fwspec_mapping(&fwspec);
+	irq = irq_create_fwspec_mapping(&fwspec);
+	if (!irq)
+		return -EINVAL;
+
+	return irq;
 }
 EXPORT_SYMBOL_GPL(acpi_register_gsi);
 

From 6238faecf88a68fc26b2a79584d802a00c4ca1ad Mon Sep 17 00:00:00 2001
From: Keith Busch <kbusch@kernel.org>
Date: Thu, 12 Oct 2023 11:13:51 -0700
Subject: [PATCH 0183/1043] nvme-pci: add BOGUS_NID for Intel 0a54 device

commit 5c3f4066462a5f6cac04d3dd81c9f551fabbc6c7 upstream.

These ones claim cmic and nmic capable, so need special consideration to ignore
their duplicate identifiers.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=217981
Reported-by: welsh@cassens.com
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/host/pci.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 9c67ebd4eac3..970a1b374a66 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3181,7 +3181,8 @@ static const struct pci_device_id nvme_id_table[] = {
 	{ PCI_VDEVICE(INTEL, 0x0a54),	/* Intel P4500/P4600 */
 		.driver_data = NVME_QUIRK_STRIPE_SIZE |
 				NVME_QUIRK_DEALLOCATE_ZEROES |
-				NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+				NVME_QUIRK_IGNORE_DEV_SUBNQN |
+				NVME_QUIRK_BOGUS_NID, },
 	{ PCI_VDEVICE(INTEL, 0x0a55),	/* Dell Express Flash P4600 */
 		.driver_data = NVME_QUIRK_STRIPE_SIZE |
 				NVME_QUIRK_DEALLOCATE_ZEROES, },

From d78d3e0d8462d486217264a78fa46e1190bb86f4 Mon Sep 17 00:00:00 2001
From: Maurizio Lombardi <mlombard@redhat.com>
Date: Mon, 31 Jul 2023 12:37:58 +0200
Subject: [PATCH 0184/1043] nvme-rdma: do not try to stop unallocated queues

commit 3820c4fdc247b6f0a4162733bdb8ddf8f2e8a1e4 upstream.

Trying to stop a queue which hasn't been allocated will result
in a warning due to calling mutex_lock() against an uninitialized mutex.

 DEBUG_LOCKS_WARN_ON(lock->magic != lock)
 WARNING: CPU: 4 PID: 104150 at kernel/locking/mutex.c:579

 Call trace:
  RIP: 0010:__mutex_lock+0x1173/0x14a0
  nvme_rdma_stop_queue+0x1b/0xa0 [nvme_rdma]
  nvme_rdma_teardown_io_queues.part.0+0xb0/0x1d0 [nvme_rdma]
  nvme_rdma_delete_ctrl+0x50/0x100 [nvme_rdma]
  nvme_do_delete_ctrl+0x149/0x158 [nvme_core]

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/host/rdma.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 825c961c6fd5..ecc3f822df24 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -644,6 +644,9 @@ static void __nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)
 
 static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)
 {
+	if (!test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
+		return;
+
 	mutex_lock(&queue->queue_lock);
 	if (test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags))
 		__nvme_rdma_stop_queue(queue);

From 3fb223086de9b51cf94e22fea9b2dfec3cbade51 Mon Sep 17 00:00:00 2001
From: Fabio Porcedda <fabio.porcedda@gmail.com>
Date: Tue, 5 Sep 2023 09:37:24 +0200
Subject: [PATCH 0185/1043] USB: serial: option: add Telit LE910C4-WWX 0x1035
 composition

commit 6a7be48e9bd18d309ba25c223a27790ad1bf0fa3 upstream.

Add support for the following Telit LE910C4-WWX composition:

0x1035: TTY, TTY, ECM

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  5 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=1035 Rev=00.00
S:  Manufacturer=Telit
S:  Product=LE910C4-WWX
S:  SerialNumber=e1b117c7
C:  #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
I:  If#= 3 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 83567e6e32e0..a4595259cafb 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1290,6 +1290,7 @@ static const struct usb_device_id option_ids[] = {
 	 .driver_info = NCTRL(0) | RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1033, 0xff),	/* Telit LE910C1-EUX (ECM) */
 	 .driver_info = NCTRL(0) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1035, 0xff) }, /* Telit LE910C4-WWX (ECM) */
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),
 	  .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1),

From a39ea926ff6da9c026f6a051a98f1cbb830a2b67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Beno=C3=AEt=20Monin?= <benoit.monin@gmx.fr>
Date: Mon, 2 Oct 2023 17:51:40 +0200
Subject: [PATCH 0186/1043] USB: serial: option: add entry for Sierra EM9191
 with new firmware
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 064f6e2ba9eb59b2c87b866e1e968e79ccedf9dd upstream.

Following a firmware update of the modem, the interface for the AT
command port changed, so add it back.

T:  Bus=08 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#=  2 Spd=5000 MxCh= 0
D:  Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
P:  Vendor=1199 ProdID=90d3 Rev=00.06
S:  Manufacturer=Sierra Wireless, Incorporated
S:  Product=Sierra Wireless EM9191
S:  SerialNumber=xxxxxxxxxxxxxxxx
C:  #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=896mA
I:  If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I:  If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:  If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=(none)
I:  If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option

Signed-off-by: Benoît Monin <benoit.monin@gmx.fr>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index a4595259cafb..f54913b229fc 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2263,6 +2263,7 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */
 	{ USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
 	{ } /* Terminating entry */

From 550c70f72a1b00190111c7247319eb94dc5d3dab Mon Sep 17 00:00:00 2001
From: Puliang Lu <puliang.lu@fibocom.com>
Date: Mon, 16 Oct 2023 15:36:16 +0800
Subject: [PATCH 0187/1043] USB: serial: option: add Fibocom to DELL custom
 modem FM101R-GL

commit 52480e1f1a259c93d749ba3961af0bffedfe7a7a upstream.

Update the USB serial option driver support for the Fibocom
FM101R-GL LTE modules as there are actually several different variants.

- VID:PID 413C:8213, FM101R-GL are laptop M.2 cards (with
  MBIM interfaces for Linux)

- VID:PID 413C:8215, FM101R-GL ESIM are laptop M.2 cards (with
  MBIM interface for Linux)

0x8213: mbim, tty
0x8215: mbim, tty

T:  Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#=  2 Spd=5000 MxCh= 0
D:  Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
P:  Vendor=413c ProdID=8213 Rev= 5.04
S:  Manufacturer=Fibocom Wireless Inc.
S:  Product=Fibocom FM101-GL Module
S:  SerialNumber=a3b7cbf0
C:* #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA
A:  FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none)
E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms

T:  Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#=  3 Spd=5000 MxCh= 0
D:  Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs=  1
P:  Vendor=413c ProdID=8215 Rev= 5.04
S:  Manufacturer=Fibocom Wireless Inc.
S:  Product=Fibocom FM101-GL Module
S:  SerialNumber=a3b7cbf0
C:* #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA
A:  FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=81(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none)
E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms

Signed-off-by: Puliang Lu <puliang.lu@fibocom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index f54913b229fc..3e0579d6ec82 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -203,6 +203,9 @@ static void option_instat_callback(struct urb *urb);
 #define DELL_PRODUCT_5829E_ESIM			0x81e4
 #define DELL_PRODUCT_5829E			0x81e6
 
+#define DELL_PRODUCT_FM101R			0x8213
+#define DELL_PRODUCT_FM101R_ESIM		0x8215
+
 #define KYOCERA_VENDOR_ID			0x0c88
 #define KYOCERA_PRODUCT_KPC650			0x17da
 #define KYOCERA_PRODUCT_KPC680			0x180a
@@ -1108,6 +1111,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(0) | RSVD(6) },
 	{ USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E_ESIM),
 	  .driver_info = RSVD(0) | RSVD(6) },
+	{ USB_DEVICE_INTERFACE_CLASS(DELL_VENDOR_ID, DELL_PRODUCT_FM101R, 0xff) },
+	{ USB_DEVICE_INTERFACE_CLASS(DELL_VENDOR_ID, DELL_PRODUCT_FM101R_ESIM, 0xff) },
 	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },	/* ADU-E100, ADU-310 */
 	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
 	{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },

From 487a8e24643a0effb2ba19cad3227fc75dc3c4b7 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Wed, 18 Oct 2023 13:56:54 +0200
Subject: [PATCH 0188/1043] perf: Disallow mis-matched inherited group reads

commit 32671e3799ca2e4590773fd0e63aaa4229e50c06 upstream.

Because group consistency is non-atomic between parent (filedesc) and children
(inherited) events, it is possible for PERF_FORMAT_GROUP read() to try and sum
non-matching counter groups -- with non-sensical results.

Add group_generation to distinguish the case where a parent group removes and
adds an event and thus has the same number, but a different configuration of
events as inherited groups.

This became a problem when commit fa8c269353d5 ("perf/core: Invert
perf_read_group() loops") flipped the order of child_list and sibling_list.
Previously it would iterate the group (sibling_list) first, and for each
sibling traverse the child_list. In this order, only the group composition of
the parent is relevant. By flipping the order the group composition of the
child (inherited) events becomes an issue and the mis-match in group
composition becomes evident.

That said; even prior to this commit, while reading of a group that is not
equally inherited was not broken, it still made no sense.

(Ab)use ECHILD as error return to indicate issues with child process group
composition.

Fixes: fa8c269353d5 ("perf/core: Invert perf_read_group() loops")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20231018115654.GK33217@noisy.programming.kicks-ass.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/perf_event.h |  1 +
 kernel/events/core.c       | 39 ++++++++++++++++++++++++++++++++------
 2 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 93dffe2f3fff..50557d903a05 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -659,6 +659,7 @@ struct perf_event {
 	/* The cumulative AND of all event_caps for events in this group. */
 	int				group_caps;
 
+	unsigned int			group_generation;
 	struct perf_event		*group_leader;
 	struct pmu			*pmu;
 	void				*pmu_private;
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 8c5400fd227b..b23961475692 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2053,6 +2053,7 @@ static void perf_group_attach(struct perf_event *event)
 
 	list_add_tail(&event->sibling_list, &group_leader->sibling_list);
 	group_leader->nr_siblings++;
+	group_leader->group_generation++;
 
 	perf_event__header_size(group_leader);
 
@@ -2245,6 +2246,7 @@ static void perf_group_detach(struct perf_event *event)
 	if (leader != event) {
 		list_del_init(&event->sibling_list);
 		event->group_leader->nr_siblings--;
+		event->group_leader->group_generation++;
 		goto out;
 	}
 
@@ -5222,7 +5224,7 @@ static int __perf_read_group_add(struct perf_event *leader,
 					u64 read_format, u64 *values)
 {
 	struct perf_event_context *ctx = leader->ctx;
-	struct perf_event *sub;
+	struct perf_event *sub, *parent;
 	unsigned long flags;
 	int n = 1; /* skip @nr */
 	int ret;
@@ -5232,6 +5234,33 @@ static int __perf_read_group_add(struct perf_event *leader,
 		return ret;
 
 	raw_spin_lock_irqsave(&ctx->lock, flags);
+	/*
+	 * Verify the grouping between the parent and child (inherited)
+	 * events is still in tact.
+	 *
+	 * Specifically:
+	 *  - leader->ctx->lock pins leader->sibling_list
+	 *  - parent->child_mutex pins parent->child_list
+	 *  - parent->ctx->mutex pins parent->sibling_list
+	 *
+	 * Because parent->ctx != leader->ctx (and child_list nests inside
+	 * ctx->mutex), group destruction is not atomic between children, also
+	 * see perf_event_release_kernel(). Additionally, parent can grow the
+	 * group.
+	 *
+	 * Therefore it is possible to have parent and child groups in a
+	 * different configuration and summing over such a beast makes no sense
+	 * what so ever.
+	 *
+	 * Reject this.
+	 */
+	parent = leader->parent;
+	if (parent &&
+	    (parent->group_generation != leader->group_generation ||
+	     parent->nr_siblings != leader->nr_siblings)) {
+		ret = -ECHILD;
+		goto unlock;
+	}
 
 	/*
 	 * Since we co-schedule groups, {enabled,running} times of siblings
@@ -5261,8 +5290,9 @@ static int __perf_read_group_add(struct perf_event *leader,
 			values[n++] = primary_event_id(sub);
 	}
 
+unlock:
 	raw_spin_unlock_irqrestore(&ctx->lock, flags);
-	return 0;
+	return ret;
 }
 
 static int perf_read_group(struct perf_event *event,
@@ -5281,10 +5311,6 @@ static int perf_read_group(struct perf_event *event,
 
 	values[0] = 1 + leader->nr_siblings;
 
-	/*
-	 * By locking the child_mutex of the leader we effectively
-	 * lock the child list of all siblings.. XXX explain how.
-	 */
 	mutex_lock(&leader->child_mutex);
 
 	ret = __perf_read_group_add(leader, read_format, values);
@@ -12820,6 +12846,7 @@ static int inherit_group(struct perf_event *parent_event,
 		    !perf_get_aux_event(child_ctr, leader))
 			return -EINVAL;
 	}
+	leader->group_generation = parent_event->group_generation;
 	return 0;
 }
 

From 3be044840e8e467de69d8361d7145f0f992b295c Mon Sep 17 00:00:00 2001
From: Niklas Schnelle <schnelle@linux.ibm.com>
Date: Tue, 17 Oct 2023 15:37:29 +0200
Subject: [PATCH 0189/1043] s390/pci: fix iommu bitmap allocation

commit c1ae1c59c8c6e0b66a718308c623e0cb394dab6b upstream.

Since the fixed commits both zdev->iommu_bitmap and zdev->lazy_bitmap
are allocated as vzalloc(zdev->iommu_pages / 8). The problem is that
zdev->iommu_bitmap is a pointer to unsigned long but the above only
yields an allocation that is a multiple of sizeof(unsigned long) which
is 8 on s390x if the number of IOMMU pages is a multiple of 64.
This in turn is the case only if the effective IOMMU aperture is
a multiple of 64 * 4K = 256K. This is usually the case and so didn't
cause visible issues since both the virt_to_phys(high_memory) reduced
limit and hardware limits use nice numbers.

Under KVM, and in particular with QEMU limiting the IOMMU aperture to
the vfio DMA limit (default 65535), it is possible for the reported
aperture not to be a multiple of 256K however. In this case we end up
with an iommu_bitmap whose allocation is not a multiple of
8 causing bitmap operations to access it out of bounds.

Sadly we can't just fix this in the obvious way and use bitmap_zalloc()
because for large RAM systems (tested on 8 TiB) the zdev->iommu_bitmap
grows too large for kmalloc(). So add our own bitmap_vzalloc() wrapper.
This might be a candidate for common code, but this area of code will
be replaced by the upcoming conversion to use the common code DMA API on
s390 so just add a local routine.

Fixes: 224593215525 ("s390/pci: use virtual memory for iommu bitmap")
Fixes: 13954fd6913a ("s390/pci_dma: improve lazy flush for unmap")
Cc: stable@vger.kernel.org
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/pci/pci_dma.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
index ebc9a49523aa..f6690a7003c6 100644
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -541,6 +541,17 @@ static void s390_dma_unmap_sg(struct device *dev, struct scatterlist *sg,
 		s->dma_length = 0;
 	}
 }
+
+static unsigned long *bitmap_vzalloc(size_t bits, gfp_t flags)
+{
+	size_t n = BITS_TO_LONGS(bits);
+	size_t bytes;
+
+	if (unlikely(check_mul_overflow(n, sizeof(unsigned long), &bytes)))
+		return NULL;
+
+	return vzalloc(bytes);
+}
 	
 int zpci_dma_init_device(struct zpci_dev *zdev)
 {
@@ -577,13 +588,13 @@ int zpci_dma_init_device(struct zpci_dev *zdev)
 				zdev->end_dma - zdev->start_dma + 1);
 	zdev->end_dma = zdev->start_dma + zdev->iommu_size - 1;
 	zdev->iommu_pages = zdev->iommu_size >> PAGE_SHIFT;
-	zdev->iommu_bitmap = vzalloc(zdev->iommu_pages / 8);
+	zdev->iommu_bitmap = bitmap_vzalloc(zdev->iommu_pages, GFP_KERNEL);
 	if (!zdev->iommu_bitmap) {
 		rc = -ENOMEM;
 		goto free_dma_table;
 	}
 	if (!s390_iommu_strict) {
-		zdev->lazy_bitmap = vzalloc(zdev->iommu_pages / 8);
+		zdev->lazy_bitmap = bitmap_vzalloc(zdev->iommu_pages, GFP_KERNEL);
 		if (!zdev->lazy_bitmap) {
 			rc = -ENOMEM;
 			goto free_bitmap;

From 8fece0081b64bbbdac90c495c4d7e5a2c385fb66 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 17 Oct 2023 11:07:23 +0200
Subject: [PATCH 0190/1043] platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN
 code from 0x20 to 0x2e

commit f37cc2fc277b371fc491890afb7d8a26e36bb3a1 upstream.

Older Asus laptops change the backlight level themselves and then send
WMI events with different codes for different backlight levels.

The asus-wmi.c code maps the entire range of codes reported on
brightness down keypresses to an internal ASUS_WMI_BRN_DOWN code:

define NOTIFY_BRNUP_MIN                0x11
define NOTIFY_BRNUP_MAX                0x1f
define NOTIFY_BRNDOWN_MIN              0x20
define NOTIFY_BRNDOWN_MAX              0x2e

        if (code >= NOTIFY_BRNUP_MIN && code <= NOTIFY_BRNUP_MAX)
                code = ASUS_WMI_BRN_UP;
        else if (code >= NOTIFY_BRNDOWN_MIN && code <= NOTIFY_BRNDOWN_MAX)
                code = ASUS_WMI_BRN_DOWN;

Before this commit all the NOTIFY_BRNDOWN_MIN - NOTIFY_BRNDOWN_MAX
aka 0x20 - 0x2e events were mapped to 0x20.

This mapping is causing issues on new laptop models which actually
send 0x2b events for printscreen presses and 0x2c events for
capslock presses, which get translated into spurious brightness-down
presses.

The plan is disable the 0x11-0x2e special mapping on laptops
where asus-wmi does not register a backlight-device to avoid
the spurious brightness-down keypresses. New laptops always send
0x2e for brightness-down presses, change the special internal
ASUS_WMI_BRN_DOWN value from 0x20 to 0x2e to match this in
preparation for fixing the spurious brightness-down presses.

This change does not have any functional impact since all
of 0x20 - 0x2e is mapped to ASUS_WMI_BRN_DOWN first and only
then checked against the keymap code and the new 0x2e
value is still in the 0x20 - 0x2e range.

Reported-by: James John <me@donjajo.com>
Closes: https://lore.kernel.org/platform-driver-x86/a2c441fe-457e-44cf-a146-0ecd86b037cf@donjajo.com/
Closes: https://bbs.archlinux.org/viewtopic.php?pid=2123716
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231017090725.38163-2-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/x86/asus-wmi.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
index 1a95c172f94b..1d0b592e2651 100644
--- a/drivers/platform/x86/asus-wmi.h
+++ b/drivers/platform/x86/asus-wmi.h
@@ -18,7 +18,7 @@
 #include <linux/i8042.h>
 
 #define ASUS_WMI_KEY_IGNORE (-1)
-#define ASUS_WMI_BRN_DOWN	0x20
+#define ASUS_WMI_BRN_DOWN	0x2e
 #define ASUS_WMI_BRN_UP		0x2f
 
 struct module;

From 6c3a72d4ae243a63f0208a5e669e63d60af55614 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 17 Oct 2023 11:07:25 +0200
Subject: [PATCH 0191/1043] platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b
 and 0x2c events

commit 235985d1763f7aba92c1c64e5f5aaec26c2c9b18 upstream.

Newer Asus laptops send the following new WMI event codes when some
of the F1 - F12 "media" hotkeys are pressed:

0x2a Screen Capture
0x2b PrintScreen
0x2c CapsLock

Map 0x2a to KEY_SELECTIVE_SCREENSHOT mirroring how similar hotkeys
are mapped on other laptops.

PrintScreem and CapsLock are also reported as normal PS/2 keyboard events,
map these event codes to KE_IGNORE to avoid "Unknown key code 0x%x\n" log
messages.

Reported-by: James John <me@donjajo.com>
Closes: https://lore.kernel.org/platform-driver-x86/a2c441fe-457e-44cf-a146-0ecd86b037cf@donjajo.com/
Closes: https://bbs.archlinux.org/viewtopic.php?pid=2123716
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231017090725.38163-4-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/x86/asus-nb-wmi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index b4a5cbdae904..04503ad6c7fb 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -475,6 +475,9 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver)
 static const struct key_entry asus_nb_wmi_keymap[] = {
 	{ KE_KEY, ASUS_WMI_BRN_DOWN, { KEY_BRIGHTNESSDOWN } },
 	{ KE_KEY, ASUS_WMI_BRN_UP, { KEY_BRIGHTNESSUP } },
+	{ KE_KEY, 0x2a, { KEY_SELECTIVE_SCREENSHOT } },
+	{ KE_IGNORE, 0x2b, }, /* PrintScreen (also send via PS/2) on newer models */
+	{ KE_IGNORE, 0x2c, }, /* CapsLock (also send via PS/2) on newer models */
 	{ KE_KEY, 0x30, { KEY_VOLUMEUP } },
 	{ KE_KEY, 0x31, { KEY_VOLUMEDOWN } },
 	{ KE_KEY, 0x32, { KEY_MUTE } },

From 7e29dadf265d28dfc7a0ae3a1069678b642ee2e6 Mon Sep 17 00:00:00 2001
From: Haibo Chen <haibo.chen@nxp.com>
Date: Wed, 18 Oct 2023 11:00:17 +0200
Subject: [PATCH 0192/1043] gpio: vf610: set value before the direction to
 avoid a glitch

commit fc363413ef8ea842ae7a99e3caf5465dafdd3a49 upstream.

We found a glitch when configuring the pad as output high. To avoid this
glitch, move the data value setting before direction config in the
function vf610_gpio_direction_output().

Fixes: 659d8a62311f ("gpio: vf610: add imx7ulp support")
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
[Bartosz: tweak the commit message]
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpio/gpio-vf610.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index 396a687e020f..c2c38f13801f 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -127,14 +127,14 @@ static int vf610_gpio_direction_output(struct gpio_chip *chip, unsigned gpio,
 	unsigned long mask = BIT(gpio);
 	u32 val;
 
+	vf610_gpio_set(chip, gpio, value);
+
 	if (port->sdata && port->sdata->have_paddr) {
 		val = vf610_gpio_readl(port->gpio_base + GPIO_PDDR);
 		val |= mask;
 		vf610_gpio_writel(val, port->gpio_base + GPIO_PDDR);
 	}
 
-	vf610_gpio_set(chip, gpio, value);
-
 	return pinctrl_gpio_direction_output(chip->base + gpio);
 }
 

From 05e06fb6a6423f1ab59210c1616abb8272e13e53 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Thu, 5 Oct 2023 17:00:24 +0300
Subject: [PATCH 0193/1043] ASoC: pxa: fix a memory leak in probe()

[ Upstream commit aa6464edbd51af4a2f8db43df866a7642b244b5f ]

Free the "priv" pointer before returning the error code.

Fixes: 90eb6b59d311 ("ASoC: pxa-ssp: add support for an external clock in devicetree")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/84ac2313-1420-471a-b2cb-3269a2e12a7c@moroto.mountain
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/pxa/pxa-ssp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/pxa/pxa-ssp.c b/sound/soc/pxa/pxa-ssp.c
index c4e7307a4437..d847263a18b9 100644
--- a/sound/soc/pxa/pxa-ssp.c
+++ b/sound/soc/pxa/pxa-ssp.c
@@ -797,7 +797,7 @@ static int pxa_ssp_probe(struct snd_soc_dai *dai)
 		if (IS_ERR(priv->extclk)) {
 			ret = PTR_ERR(priv->extclk);
 			if (ret == -EPROBE_DEFER)
-				return ret;
+				goto err_priv;
 
 			priv->extclk = NULL;
 		}

From f42634685ee5fac1387b74d0b9f0a200ed5441a1 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Wed, 13 Sep 2023 09:04:27 +0300
Subject: [PATCH 0194/1043] phy: mapphone-mdm6600: Fix runtime disable on probe

[ Upstream commit 719606154c7033c068a5d4c1dc5f9163b814b3c8 ]

Commit d644e0d79829 ("phy: mapphone-mdm6600: Fix PM error handling in
phy_mdm6600_probe") caused a regression where we now unconditionally
disable runtime PM at the end of the probe while it is only needed on
errors.

Cc: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Miaoqian Lin <linmq006@gmail.com>
Cc: Pavel Machek <pavel@ucw.cz>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Fixes: d644e0d79829 ("phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20230913060433.48373-1-tony@atomide.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/motorola/phy-mapphone-mdm6600.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c
index 3cd4d51c247c..436b5ab6dc6d 100644
--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
+++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
@@ -627,10 +627,12 @@ static int phy_mdm6600_probe(struct platform_device *pdev)
 	pm_runtime_put_autosuspend(ddata->dev);
 
 cleanup:
-	if (error < 0)
+	if (error < 0) {
 		phy_mdm6600_device_power_off(ddata);
-	pm_runtime_disable(ddata->dev);
-	pm_runtime_dont_use_autosuspend(ddata->dev);
+		pm_runtime_disable(ddata->dev);
+		pm_runtime_dont_use_autosuspend(ddata->dev);
+	}
+
 	return error;
 }
 

From e9c20d3078ccf2399fe80291fcf1e39d0b665538 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Wed, 13 Sep 2023 09:04:28 +0300
Subject: [PATCH 0195/1043] phy: mapphone-mdm6600: Fix runtime PM for remove

[ Upstream commit b99e0ba9633af51638e5ee1668da2e33620c134f ]

Otherwise we will get an underflow on remove.

Cc: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Sebastian Reichel <sre@kernel.org>
Fixes: f7f50b2a7b05 ("phy: mapphone-mdm6600: Add runtime PM support for n_gsm on USB suspend")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://lore.kernel.org/r/20230913060433.48373-2-tony@atomide.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/motorola/phy-mapphone-mdm6600.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c
index 436b5ab6dc6d..c3e2ab6a2a71 100644
--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
+++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
@@ -641,6 +641,7 @@ static int phy_mdm6600_remove(struct platform_device *pdev)
 	struct phy_mdm6600 *ddata = platform_get_drvdata(pdev);
 	struct gpio_desc *reset_gpio = ddata->ctrl_gpios[PHY_MDM6600_RESET];
 
+	pm_runtime_get_noresume(ddata->dev);
 	pm_runtime_dont_use_autosuspend(ddata->dev);
 	pm_runtime_put_sync(ddata->dev);
 	pm_runtime_disable(ddata->dev);

From 653c808023cd2af518eba4f39207dde12ee8af07 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Wed, 13 Sep 2023 09:04:29 +0300
Subject: [PATCH 0196/1043] phy: mapphone-mdm6600: Fix pinctrl_pm handling for
 sleep pins

[ Upstream commit 3b384cc74b00b5ac21d18e4c1efc3c1da5300971 ]

Looks like the driver sleep pins configuration is unusable. Adding the
sleep pins causes the usb phy to not respond. We need to use the default
pins in probe, and only set sleep pins at phy_mdm6600_device_power_off().

As the modem can also be booted to a serial port mode for firmware
flashing, let's make the pin changes limited to probe and remove. For
probe, we get the default pins automatically. We only need to set the
sleep pins in phy_mdm6600_device_power_off() to prevent the modem from
waking up because the gpio line glitches.

If it turns out that we need a separate state for phy_mdm6600_power_on()
and phy_mdm6600_power_off(), we can use the pinctrl idle state.

Cc: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Sebastian Reichel <sre@kernel.org>
Fixes: 2ad2af081622 ("phy: mapphone-mdm6600: Improve phy related runtime PM calls")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://lore.kernel.org/r/20230913060433.48373-3-tony@atomide.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/motorola/phy-mapphone-mdm6600.c | 29 +++++++++------------
 1 file changed, 12 insertions(+), 17 deletions(-)

diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c
index c3e2ab6a2a71..67802f9e40ba 100644
--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
+++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
@@ -122,16 +122,10 @@ static int phy_mdm6600_power_on(struct phy *x)
 {
 	struct phy_mdm6600 *ddata = phy_get_drvdata(x);
 	struct gpio_desc *enable_gpio = ddata->ctrl_gpios[PHY_MDM6600_ENABLE];
-	int error;
 
 	if (!ddata->enabled)
 		return -ENODEV;
 
-	error = pinctrl_pm_select_default_state(ddata->dev);
-	if (error)
-		dev_warn(ddata->dev, "%s: error with default_state: %i\n",
-			 __func__, error);
-
 	gpiod_set_value_cansleep(enable_gpio, 1);
 
 	/* Allow aggressive PM for USB, it's only needed for n_gsm port */
@@ -160,11 +154,6 @@ static int phy_mdm6600_power_off(struct phy *x)
 
 	gpiod_set_value_cansleep(enable_gpio, 0);
 
-	error = pinctrl_pm_select_sleep_state(ddata->dev);
-	if (error)
-		dev_warn(ddata->dev, "%s: error with sleep_state: %i\n",
-			 __func__, error);
-
 	return 0;
 }
 
@@ -456,6 +445,7 @@ static void phy_mdm6600_device_power_off(struct phy_mdm6600 *ddata)
 {
 	struct gpio_desc *reset_gpio =
 		ddata->ctrl_gpios[PHY_MDM6600_RESET];
+	int error;
 
 	ddata->enabled = false;
 	phy_mdm6600_cmd(ddata, PHY_MDM6600_CMD_BP_SHUTDOWN_REQ);
@@ -471,6 +461,17 @@ static void phy_mdm6600_device_power_off(struct phy_mdm6600 *ddata)
 	} else {
 		dev_err(ddata->dev, "Timed out powering down\n");
 	}
+
+	/*
+	 * Keep reset gpio high with padconf internal pull-up resistor to
+	 * prevent modem from waking up during deeper SoC idle states. The
+	 * gpio bank lines can have glitches if not in the always-on wkup
+	 * domain.
+	 */
+	error = pinctrl_pm_select_sleep_state(ddata->dev);
+	if (error)
+		dev_warn(ddata->dev, "%s: error with sleep_state: %i\n",
+			 __func__, error);
 }
 
 static void phy_mdm6600_deferred_power_on(struct work_struct *work)
@@ -571,12 +572,6 @@ static int phy_mdm6600_probe(struct platform_device *pdev)
 	ddata->dev = &pdev->dev;
 	platform_set_drvdata(pdev, ddata);
 
-	/* Active state selected in phy_mdm6600_power_on() */
-	error = pinctrl_pm_select_sleep_state(ddata->dev);
-	if (error)
-		dev_warn(ddata->dev, "%s: error with sleep_state: %i\n",
-			 __func__, error);
-
 	error = phy_mdm6600_init_lines(ddata);
 	if (error)
 		return error;

From b423509bc99c7c7a7e31d0daa858bca9c45e5f54 Mon Sep 17 00:00:00 2001
From: Edward AD <twuufnxlz@gmail.com>
Date: Tue, 10 Oct 2023 13:36:57 +0800
Subject: [PATCH 0197/1043] Bluetooth: hci_sock: fix slab oob read in
 create_monitor_event

commit 18f547f3fc074500ab5d419cf482240324e73a7e upstream.

When accessing hdev->name, the actual string length should prevail

Reported-by: syzbot+c90849c50ed209d77689@syzkaller.appspotmail.com
Fixes: dcda165706b9 ("Bluetooth: hci_core: Fix build warnings")
Signed-off-by: Edward AD <twuufnxlz@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_sock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index eafb2bebc12c..b5b84b56666b 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -438,7 +438,7 @@ static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
 		ni->type = hdev->dev_type;
 		ni->bus = hdev->bus;
 		bacpy(&ni->bdaddr, &hdev->bdaddr);
-		memcpy(ni->name, hdev->name, 8);
+		memcpy(ni->name, hdev->name, strlen(hdev->name));
 
 		opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
 		break;

From 5d5680755bcef70b484602f16de40fcb324cb784 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Wed, 11 Oct 2023 09:31:44 -0700
Subject: [PATCH 0198/1043] Bluetooth: hci_sock: Correctly bounds check and pad
 HCI_MON_NEW_INDEX name

commit cb3871b1cd135a6662b732fbc6b3db4afcdb4a64 upstream.

The code pattern of memcpy(dst, src, strlen(src)) is almost always
wrong. In this case it is wrong because it leaves memory uninitialized
if it is less than sizeof(ni->name), and overflows ni->name when longer.

Normally strtomem_pad() could be used here, but since ni->name is a
trailing array in struct hci_mon_new_index, compilers that don't support
-fstrict-flex-arrays=3 can't tell how large this array is via
__builtin_object_size(). Instead, open-code the helper and use sizeof()
since it will work correctly.

Additionally mark ni->name as __nonstring since it appears to not be a
%NUL terminated C string.

Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Cc: Edward AD <twuufnxlz@gmail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: linux-bluetooth@vger.kernel.org
Cc: netdev@vger.kernel.org
Fixes: 18f547f3fc07 ("Bluetooth: hci_sock: fix slab oob read in create_monitor_event")
Link: https://lore.kernel.org/lkml/202310110908.F2639D3276@keescook/
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/bluetooth/hci_mon.h | 2 +-
 net/bluetooth/hci_sock.c        | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/net/bluetooth/hci_mon.h b/include/net/bluetooth/hci_mon.h
index 2d5fcda1bcd0..082f89531b88 100644
--- a/include/net/bluetooth/hci_mon.h
+++ b/include/net/bluetooth/hci_mon.h
@@ -56,7 +56,7 @@ struct hci_mon_new_index {
 	__u8		type;
 	__u8		bus;
 	bdaddr_t	bdaddr;
-	char		name[8];
+	char		name[8] __nonstring;
 } __packed;
 #define HCI_MON_NEW_INDEX_SIZE 16
 
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index b5b84b56666b..04db39f67c90 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -438,7 +438,8 @@ static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
 		ni->type = hdev->dev_type;
 		ni->bus = hdev->bus;
 		bacpy(&ni->bdaddr, &hdev->bdaddr);
-		memcpy(ni->name, hdev->name, strlen(hdev->name));
+		memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name,
+			       strnlen(hdev->name, sizeof(ni->name)), '\0');
 
 		opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
 		break;

From 657a3ca8236c45a3b5358985c807991e0697dabf Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Fri, 15 Sep 2023 19:20:41 +0800
Subject: [PATCH 0199/1043] xfrm6: fix inet6_dev refcount underflow problem

[ Upstream commit cc9b364bb1d58d3dae270c7a931a8cc717dc2b3b ]

There are race conditions that may lead to inet6_dev refcount underflow
in xfrm6_dst_destroy() and rt6_uncached_list_flush_dev().

One of the refcount underflow bugs is shown below:
	(cpu 1)                	|	(cpu 2)
xfrm6_dst_destroy()             |
  ...                           |
  in6_dev_put()                 |
				|  rt6_uncached_list_flush_dev()
  ...				|    ...
				|    in6_dev_put()
  rt6_uncached_list_del()       |    ...
  ...                           |

xfrm6_dst_destroy() calls rt6_uncached_list_del() after in6_dev_put(),
so rt6_uncached_list_flush_dev() has a chance to call in6_dev_put()
again for the same inet6_dev.

Fix it by moving in6_dev_put() after rt6_uncached_list_del() in
xfrm6_dst_destroy().

Fixes: 510c321b5571 ("xfrm: reuse uncached_list to track xdsts")
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/xfrm6_policy.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 247296e3294b..4c3aa97f23fa 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -120,11 +120,11 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
 {
 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
 
-	if (likely(xdst->u.rt6.rt6i_idev))
-		in6_dev_put(xdst->u.rt6.rt6i_idev);
 	dst_destroy_metrics_generic(dst);
 	if (xdst->u.rt6.rt6i_uncached_list)
 		rt6_uncached_list_del(&xdst->u.rt6);
+	if (likely(xdst->u.rt6.rt6i_idev))
+		in6_dev_put(xdst->u.rt6.rt6i_idev);
 	xfrm_dst_destroy(xdst);
 }
 

From cb49f0e441ce7db63ef67ccfa9d9562c22f5d6c3 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 25 Oct 2023 11:54:26 +0200
Subject: [PATCH 0200/1043] Linux 5.10.199

Link: https://lore.kernel.org/r/20231023104817.691299567@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Link: https://lore.kernel.org/r/20231024083306.700855687@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Slade Watkins <srw@sladewatkins.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 470e11dcf2a3..5105828bf6da 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 198
+SUBLEVEL = 199
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 597c63c0dca7988966a9577fddd5bb77845943b7 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Thu, 26 Oct 2023 09:37:02 +0000
Subject: [PATCH 0201/1043] ANDROID: GKI: arm64: drop CONFIG_DEBUG_PREEMPT
 forced disable

In commit bf97ea76eac5 ("lib/Kconfig.debug: do not enable DEBUG_PREEMPT
by default"), DEBUG_PREEMPT is not enabled by default, so our explicit
turning it off is no longer needed.  This fixes the arm64 gki builds.

Fixes: bf97ea76eac5 ("lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default")
Change-Id: I4491bceb3735d966731717f13b1e2395c9b7206a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 arch/arm64/configs/gki_defconfig | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/configs/gki_defconfig b/arch/arm64/configs/gki_defconfig
index e238ccdcafe1..28136c6f6435 100644
--- a/arch/arm64/configs/gki_defconfig
+++ b/arch/arm64/configs/gki_defconfig
@@ -694,7 +694,6 @@ CONFIG_PANIC_TIMEOUT=-1
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_WQ_WATCHDOG=y
 CONFIG_SCHEDSTATS=y
-# CONFIG_DEBUG_PREEMPT is not set
 CONFIG_BUG_ON_DATA_CORRUPTION=y
 CONFIG_TRACE_MMIO_ACCESS=y
 CONFIG_TRACEFS_DISABLE_AUTOMOUNT=y

From 9cd7ac5dc5fc930ae1e55f4c371d143ce61df922 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Fri, 27 Oct 2023 15:54:23 +0000
Subject: [PATCH 0202/1043] Revert "xfrm: interface: use DEV_STATS_INC()"

This reverts commit 4ba4eec4f40d4ea82d77258179f76eeb6fce0f7f which is
commit f7c4e3e5d4f6609b4725a97451948ca2e425379a upstream.

It breaks the build as it relies on a reverted patch.  if it is needed
for this branch, it can come back in an abi-safe way.

Change-Id: I18ecdab21ea8a95132d62abac9c189e8589c16b0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 net/xfrm/xfrm_interface_core.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c
index 9eaf0174d998..4eeec3367575 100644
--- a/net/xfrm/xfrm_interface_core.c
+++ b/net/xfrm/xfrm_interface_core.c
@@ -274,8 +274,8 @@ static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
 	skb->dev = dev;
 
 	if (err) {
-		DEV_STATS_INC(dev, rx_errors);
-		DEV_STATS_INC(dev, rx_dropped);
+		dev->stats.rx_errors++;
+		dev->stats.rx_dropped++;
 
 		return 0;
 	}
@@ -309,6 +309,7 @@ static int
 xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 {
 	struct xfrm_if *xi = netdev_priv(dev);
+	struct net_device_stats *stats = &xi->dev->stats;
 	struct dst_entry *dst = skb_dst(skb);
 	unsigned int length = skb->len;
 	struct net_device *tdev;
@@ -334,7 +335,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 	tdev = dst->dev;
 
 	if (tdev == dev) {
-		DEV_STATS_INC(dev, collisions);
+		stats->collisions++;
 		net_warn_ratelimited("%s: Local routing loop detected!\n",
 				     dev->name);
 		goto tx_err_dst_release;
@@ -377,13 +378,13 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 		tstats->tx_packets++;
 		u64_stats_update_end(&tstats->syncp);
 	} else {
-		DEV_STATS_INC(dev, tx_errors);
-		DEV_STATS_INC(dev, tx_aborted_errors);
+		stats->tx_errors++;
+		stats->tx_aborted_errors++;
 	}
 
 	return 0;
 tx_err_link_failure:
-	DEV_STATS_INC(dev, tx_carrier_errors);
+	stats->tx_carrier_errors++;
 	dst_link_failure(skb);
 tx_err_dst_release:
 	dst_release(dst);
@@ -393,6 +394,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct xfrm_if *xi = netdev_priv(dev);
+	struct net_device_stats *stats = &xi->dev->stats;
 	struct dst_entry *dst = skb_dst(skb);
 	struct flowi fl;
 	int ret;
@@ -409,7 +411,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
 			dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
 			if (dst->error) {
 				dst_release(dst);
-				DEV_STATS_INC(dev, tx_carrier_errors);
+				stats->tx_carrier_errors++;
 				goto tx_err;
 			}
 			skb_dst_set(skb, dst);
@@ -425,7 +427,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
 			fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
 			rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
 			if (IS_ERR(rt)) {
-				DEV_STATS_INC(dev, tx_carrier_errors);
+				stats->tx_carrier_errors++;
 				goto tx_err;
 			}
 			skb_dst_set(skb, &rt->dst);
@@ -444,8 +446,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
 	return NETDEV_TX_OK;
 
 tx_err:
-	DEV_STATS_INC(dev, tx_errors);
-	DEV_STATS_INC(dev, tx_dropped);
+	stats->tx_errors++;
+	stats->tx_dropped++;
 	kfree_skb(skb);
 	return NETDEV_TX_OK;
 }

From 5cc7b2b7f4b9a96984778aea6868c00aba1ce9d9 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Thu, 26 Oct 2023 10:15:15 +0000
Subject: [PATCH 0203/1043] Revert "Bluetooth: hci_core: Fix build warnings"

This reverts commit ffb060b136dd75a033ced0fc0aed2882c02e8b56 which is
commit dcda165706b9fbfd685898d46a6749d7d397e0c0 upstream.

It breaks the android ABI and if this is needed in the future, can be
brought back in an abi-safe way.

Bug: 161946584
Change-Id: I4a64dca20bcdfe9cbe33fc23c7d3d1b252f4b873
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/net/bluetooth/hci_core.h | 2 +-
 net/bluetooth/hci_core.c         | 8 +++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 3b0f2a2519e7..46eeb73c1289 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -288,7 +288,7 @@ struct hci_dev {
 	struct list_head list;
 	struct mutex	lock;
 
-	const char	*name;
+	char		name[8];
 	unsigned long	flags;
 	__u16		id;
 	__u8		bus;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 5db4f9530362..8ffcb5669f41 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3731,11 +3731,7 @@ int hci_register_dev(struct hci_dev *hdev)
 	if (id < 0)
 		return id;
 
-	error = dev_set_name(&hdev->dev, "hci%u", id);
-	if (error)
-		return error;
-
-	hdev->name = dev_name(&hdev->dev);
+	snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
 	hdev->id = id;
 
 	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
@@ -3757,6 +3753,8 @@ int hci_register_dev(struct hci_dev *hdev)
 	if (!IS_ERR_OR_NULL(bt_debugfs))
 		hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
 
+	dev_set_name(&hdev->dev, "%s", hdev->name);
+
 	error = device_add(&hdev->dev);
 	if (error < 0)
 		goto err_wqueue;

From b78ecc11eaf11ffd2ad67bab53186e6180ed2dcf Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Thu, 26 Oct 2023 10:28:09 +0000
Subject: [PATCH 0204/1043] Revert "perf: Disallow mis-matched inherited group
 reads"

This reverts commit 487a8e24643a0effb2ba19cad3227fc75dc3c4b7 which is
commit 32671e3799ca2e4590773fd0e63aaa4229e50c06 upstream.

It breaks the android ABI and if this is needed in the future, can be
brought back in an abi-safe way.

Bug: 161946584
Change-Id: Ia00890aeeef6153c7f3462a2a2189149734ac28a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/linux/perf_event.h |  1 -
 kernel/events/core.c       | 39 ++++++--------------------------------
 2 files changed, 6 insertions(+), 34 deletions(-)

diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 6398601eec84..346d24a1469a 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -659,7 +659,6 @@ struct perf_event {
 	/* The cumulative AND of all event_caps for events in this group. */
 	int				group_caps;
 
-	unsigned int			group_generation;
 	struct perf_event		*group_leader;
 	struct pmu			*pmu;
 	void				*pmu_private;
diff --git a/kernel/events/core.c b/kernel/events/core.c
index beb1685ffa36..80ab33aa3a18 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1986,7 +1986,6 @@ static void perf_group_attach(struct perf_event *event)
 
 	list_add_tail(&event->sibling_list, &group_leader->sibling_list);
 	group_leader->nr_siblings++;
-	group_leader->group_generation++;
 
 	perf_event__header_size(group_leader);
 
@@ -2179,7 +2178,6 @@ static void perf_group_detach(struct perf_event *event)
 	if (leader != event) {
 		list_del_init(&event->sibling_list);
 		event->group_leader->nr_siblings--;
-		event->group_leader->group_generation++;
 		goto out;
 	}
 
@@ -5166,7 +5164,7 @@ static int __perf_read_group_add(struct perf_event *leader,
 					u64 read_format, u64 *values)
 {
 	struct perf_event_context *ctx = leader->ctx;
-	struct perf_event *sub, *parent;
+	struct perf_event *sub;
 	unsigned long flags;
 	int n = 1; /* skip @nr */
 	int ret;
@@ -5176,33 +5174,6 @@ static int __perf_read_group_add(struct perf_event *leader,
 		return ret;
 
 	raw_spin_lock_irqsave(&ctx->lock, flags);
-	/*
-	 * Verify the grouping between the parent and child (inherited)
-	 * events is still in tact.
-	 *
-	 * Specifically:
-	 *  - leader->ctx->lock pins leader->sibling_list
-	 *  - parent->child_mutex pins parent->child_list
-	 *  - parent->ctx->mutex pins parent->sibling_list
-	 *
-	 * Because parent->ctx != leader->ctx (and child_list nests inside
-	 * ctx->mutex), group destruction is not atomic between children, also
-	 * see perf_event_release_kernel(). Additionally, parent can grow the
-	 * group.
-	 *
-	 * Therefore it is possible to have parent and child groups in a
-	 * different configuration and summing over such a beast makes no sense
-	 * what so ever.
-	 *
-	 * Reject this.
-	 */
-	parent = leader->parent;
-	if (parent &&
-	    (parent->group_generation != leader->group_generation ||
-	     parent->nr_siblings != leader->nr_siblings)) {
-		ret = -ECHILD;
-		goto unlock;
-	}
 
 	/*
 	 * Since we co-schedule groups, {enabled,running} times of siblings
@@ -5232,9 +5203,8 @@ static int __perf_read_group_add(struct perf_event *leader,
 			values[n++] = primary_event_id(sub);
 	}
 
-unlock:
 	raw_spin_unlock_irqrestore(&ctx->lock, flags);
-	return ret;
+	return 0;
 }
 
 static int perf_read_group(struct perf_event *event,
@@ -5253,6 +5223,10 @@ static int perf_read_group(struct perf_event *event,
 
 	values[0] = 1 + leader->nr_siblings;
 
+	/*
+	 * By locking the child_mutex of the leader we effectively
+	 * lock the child list of all siblings.. XXX explain how.
+	 */
 	mutex_lock(&leader->child_mutex);
 
 	ret = __perf_read_group_add(leader, read_format, values);
@@ -12801,7 +12775,6 @@ static int inherit_group(struct perf_event *parent_event,
 		    !perf_get_aux_event(child_ctr, leader))
 			return -EINVAL;
 	}
-	leader->group_generation = parent_event->group_generation;
 	return 0;
 }
 

From 8af75db0da60af7a68d70d1b56eda3bed1cdbac2 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Thu, 26 Oct 2023 10:16:50 +0000
Subject: [PATCH 0205/1043] Revert "xfrm: fix a data-race in xfrm_gen_index()"

This reverts commit 4d78b9dc79d5a3c44d8106e6b71f2b14ea86804e which is
commit 3e4bc23926b83c3c67e5f61ae8571602754131a6 upstream.

It breaks the android ABI and if this is needed in the future, can be
brought back in an abi-safe way.

Bug: 161946584
Change-Id: I6af8ce540570c756ea9f16526c36f8815971e216
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/net/netns/xfrm.h | 1 -
 net/xfrm/xfrm_policy.c   | 6 ++++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
index 1f925f478eb6..93d74c68d87e 100644
--- a/include/net/netns/xfrm.h
+++ b/include/net/netns/xfrm.h
@@ -50,7 +50,6 @@ struct netns_xfrm {
 	struct list_head	policy_all;
 	struct hlist_head	*policy_byidx;
 	unsigned int		policy_idx_hmask;
-	unsigned int		idx_generator;
 	struct hlist_head	policy_inexact[XFRM_POLICY_MAX];
 	struct xfrm_policy_hash	policy_bydst[XFRM_POLICY_MAX];
 	unsigned int		policy_count[XFRM_POLICY_MAX * 2];
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index aa11fb71ad58..71f6a6defbdd 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1376,6 +1376,8 @@ EXPORT_SYMBOL(xfrm_policy_hash_rebuild);
  * of an absolute inpredictability of ordering of rules. This will not pass. */
 static u32 xfrm_gen_index(struct net *net, int dir, u32 index)
 {
+	static u32 idx_generator;
+
 	for (;;) {
 		struct hlist_head *list;
 		struct xfrm_policy *p;
@@ -1383,8 +1385,8 @@ static u32 xfrm_gen_index(struct net *net, int dir, u32 index)
 		int found;
 
 		if (!index) {
-			idx = (net->xfrm.idx_generator | dir);
-			net->xfrm.idx_generator += 8;
+			idx = (idx_generator | dir);
+			idx_generator += 8;
 		} else {
 			idx = index;
 			index = 0;

From ea0ddd540d92f3180abff1edf58c51b1e70bc2a1 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sat, 28 Oct 2023 07:04:23 +0000
Subject: [PATCH 0206/1043] Revert "net: release reference to inet6_dev
 pointer"

This reverts commit 014cab5329d18524749dacc25923938aab14ff57 which is
commit 5cb249686e67dbef3ffe53887fa725eefc5a7144 upstream.

It breaks the Android ABI, and is already merged in the non-LTS branch
in an abi-safe way.

Bug: 161946584
Change-Id: I563f7eb7ffb01d9681f6a1dbb0252ca32b94f856
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 net/ipv6/addrconf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 84821308fc46..19d865c3d543 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2751,7 +2751,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
 	}
 
 	if (valid_lft != 0 && valid_lft < in6_dev->cnf.accept_ra_min_lft)
-		goto put;
+		return;
 
 	/*
 	 *	Two things going on here:

From 935ac73a69cf8bffc2c168360de66ed464e1e4ca Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sat, 28 Oct 2023 07:04:25 +0000
Subject: [PATCH 0207/1043] Revert "net: change accept_ra_min_rtr_lft to affect
 all RA lifetimes"

This reverts commit d491ac7aa12a09a1a48f9f6cbf628b29080ca9f4 which is
commit 5027d54a9c30bc7ec808360378e2b4753f053f25 upstream.

It breaks the Android ABI, and is already merged in the non-LTS branch
in an abi-safe way.

Bug: 161946584
Change-Id: I9f0f611a3ecbae0ae154ae465ff7472d8e98a1d8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 Documentation/networking/ip-sysctl.rst |  8 ++++----
 include/linux/ipv6.h                   |  2 +-
 include/uapi/linux/ipv6.h              |  2 +-
 net/ipv6/addrconf.c                    | 13 +++++--------
 net/ipv6/ndisc.c                       | 27 +++++++++++++++-----------
 5 files changed, 27 insertions(+), 25 deletions(-)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index dffda1277d88..8e6b2c031f40 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1902,11 +1902,11 @@ accept_ra_min_hop_limit - INTEGER
 
 	Default: 1
 
-accept_ra_min_lft - INTEGER
-	Minimum acceptable lifetime value in Router Advertisement.
+accept_ra_min_rtr_lft - INTEGER
+	Minimum acceptable router lifetime in Router Advertisement.
 
-	RA sections with a lifetime less than this value shall be
-	ignored. Zero lifetimes stay unaffected.
+	RAs with a router lifetime less than this value shall be
+	ignored. RAs with a router lifetime of 0 are unaffected.
 
 	Default: 0
 
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 5a049f604a24..7471874b482f 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -33,7 +33,7 @@ struct ipv6_devconf {
 	__s32		max_addresses;
 	__s32		accept_ra_defrtr;
 	__s32		accept_ra_min_hop_limit;
-	__s32		accept_ra_min_lft;
+	__s32		accept_ra_min_rtr_lft;
 	__s32		accept_ra_pinfo;
 	__s32		ignore_routes_with_linkdown;
 #ifdef CONFIG_IPV6_ROUTER_PREF
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index 456a8c74b28d..6a00ee39803b 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -202,7 +202,7 @@ enum {
 	DEVCONF_IOAM6_ID_WIDE,
 	DEVCONF_NDISC_EVICT_NOCARRIER,
 	DEVCONF_ACCEPT_UNTRACKED_NA,
-	DEVCONF_ACCEPT_RA_MIN_LFT,
+	DEVCONF_ACCEPT_RA_MIN_RTR_LFT,
 	DEVCONF_MAX
 };
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 19d865c3d543..3bbcd1ac9d54 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -209,7 +209,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
-	.accept_ra_min_lft	= 0,
+	.accept_ra_min_rtr_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -266,7 +266,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
-	.accept_ra_min_lft	= 0,
+	.accept_ra_min_rtr_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -2750,9 +2750,6 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
 		return;
 	}
 
-	if (valid_lft != 0 && valid_lft < in6_dev->cnf.accept_ra_min_lft)
-		return;
-
 	/*
 	 *	Two things going on here:
 	 *	1) Add routes for on-link prefixes
@@ -5593,7 +5590,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 	array[DEVCONF_DISABLE_POLICY] = cnf->disable_policy;
 	array[DEVCONF_NDISC_TCLASS] = cnf->ndisc_tclass;
 	array[DEVCONF_RPL_SEG_ENABLED] = cnf->rpl_seg_enabled;
-	array[DEVCONF_ACCEPT_RA_MIN_LFT] = cnf->accept_ra_min_lft;
+	array[DEVCONF_ACCEPT_RA_MIN_RTR_LFT] = cnf->accept_ra_min_rtr_lft;
 }
 
 static inline size_t inet6_ifla6_size(void)
@@ -6752,8 +6749,8 @@ static const struct ctl_table addrconf_sysctl[] = {
 		.proc_handler	= proc_dointvec,
 	},
 	{
-		.procname	= "accept_ra_min_lft",
-		.data		= &ipv6_devconf.accept_ra_min_lft,
+		.procname	= "accept_ra_min_rtr_lft",
+		.data		= &ipv6_devconf.accept_ra_min_rtr_lft,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 14251347c4a5..215ea5dbc5f0 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1222,6 +1222,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		return;
 	}
 
+	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
+
 	if (!ipv6_accept_ra(in6_dev)) {
 		ND_PRINTK(2, info,
 			  "RA: %s, did not accept ra for dev: %s\n",
@@ -1229,6 +1231,13 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_linkparms;
 	}
 
+	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
+		ND_PRINTK(2, info,
+			  "RA: router lifetime (%ds) is too short: %s\n",
+			  lifetime, skb->dev->name);
+		goto skip_linkparms;
+	}
+
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
 	/* skip link-specific parameters from interior routers */
 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
@@ -1269,14 +1278,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_defrtr;
 	}
 
-	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
-	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_lft) {
-		ND_PRINTK(2, info,
-			  "RA: router lifetime (%ds) is too short: %s\n",
-			  lifetime, skb->dev->name);
-		goto skip_defrtr;
-	}
-
 	/* Do not accept RA with source-addr found on local machine unless
 	 * accept_ra_from_local is set to true.
 	 */
@@ -1435,6 +1436,13 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto out;
 	}
 
+	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
+		ND_PRINTK(2, info,
+			  "RA: router lifetime (%ds) is too short: %s\n",
+			  lifetime, skb->dev->name);
+		goto out;
+	}
+
 #ifdef CONFIG_IPV6_ROUTE_INFO
 	if (!in6_dev->cnf.accept_ra_from_local &&
 	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
@@ -1459,9 +1467,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 			if (ri->prefix_len == 0 &&
 			    !in6_dev->cnf.accept_ra_defrtr)
 				continue;
-			if (ri->lifetime != 0 &&
-			    ntohl(ri->lifetime) < in6_dev->cnf.accept_ra_min_lft)
-				continue;
 			if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
 				continue;
 			if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)

From 7957cd8ab1a07ced5c55c6bb09e98b409e01186c Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sat, 28 Oct 2023 07:04:26 +0000
Subject: [PATCH 0208/1043] Revert "net: add sysctl accept_ra_min_rtr_lft"

This reverts commit 354a96770d94ce2cf2c9d4671b19401641877e9f which is
commit 1671bcfd76fdc0b9e65153cf759153083755fe4c upstream.

It breaks the Android ABI, and is already merged in the non-LTS branch
in an abi-safe way.

Bug: 161946584
Change-Id: Ie689c535c1f7c1c4a1e6af6805f400da625104c7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 Documentation/networking/ip-sysctl.rst |  8 --------
 include/linux/ipv6.h                   |  1 -
 include/uapi/linux/ipv6.h              |  7 -------
 net/ipv6/addrconf.c                    | 10 ----------
 net/ipv6/ndisc.c                       | 18 ++----------------
 5 files changed, 2 insertions(+), 42 deletions(-)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index 8e6b2c031f40..eedce7474ad3 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1902,14 +1902,6 @@ accept_ra_min_hop_limit - INTEGER
 
 	Default: 1
 
-accept_ra_min_rtr_lft - INTEGER
-	Minimum acceptable router lifetime in Router Advertisement.
-
-	RAs with a router lifetime less than this value shall be
-	ignored. RAs with a router lifetime of 0 are unaffected.
-
-	Default: 0
-
 accept_ra_pinfo - BOOLEAN
 	Learn Prefix Information in Router Advertisement.
 
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 7471874b482f..9a6832eb8b0c 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -33,7 +33,6 @@ struct ipv6_devconf {
 	__s32		max_addresses;
 	__s32		accept_ra_defrtr;
 	__s32		accept_ra_min_hop_limit;
-	__s32		accept_ra_min_rtr_lft;
 	__s32		accept_ra_pinfo;
 	__s32		ignore_routes_with_linkdown;
 #ifdef CONFIG_IPV6_ROUTER_PREF
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index 6a00ee39803b..2aadbba4e428 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -196,13 +196,6 @@ enum {
 	DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN,
 	DEVCONF_NDISC_TCLASS,
 	DEVCONF_RPL_SEG_ENABLED,
-	DEVCONF_RA_DEFRTR_METRIC,
-	DEVCONF_IOAM6_ENABLED,
-	DEVCONF_IOAM6_ID,
-	DEVCONF_IOAM6_ID_WIDE,
-	DEVCONF_NDISC_EVICT_NOCARRIER,
-	DEVCONF_ACCEPT_UNTRACKED_NA,
-	DEVCONF_ACCEPT_RA_MIN_RTR_LFT,
 	DEVCONF_MAX
 };
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3bbcd1ac9d54..9fd77b219a1d 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -209,7 +209,6 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
-	.accept_ra_min_rtr_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -266,7 +265,6 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
-	.accept_ra_min_rtr_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -5590,7 +5588,6 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 	array[DEVCONF_DISABLE_POLICY] = cnf->disable_policy;
 	array[DEVCONF_NDISC_TCLASS] = cnf->ndisc_tclass;
 	array[DEVCONF_RPL_SEG_ENABLED] = cnf->rpl_seg_enabled;
-	array[DEVCONF_ACCEPT_RA_MIN_RTR_LFT] = cnf->accept_ra_min_rtr_lft;
 }
 
 static inline size_t inet6_ifla6_size(void)
@@ -6748,13 +6745,6 @@ static const struct ctl_table addrconf_sysctl[] = {
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
 	},
-	{
-		.procname	= "accept_ra_min_rtr_lft",
-		.data		= &ipv6_devconf.accept_ra_min_rtr_lft,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
-	},
 	{
 		.procname	= "accept_ra_pinfo",
 		.data		= &ipv6_devconf.accept_ra_pinfo,
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 215ea5dbc5f0..ac1e51087b1d 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1222,8 +1222,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		return;
 	}
 
-	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
-
 	if (!ipv6_accept_ra(in6_dev)) {
 		ND_PRINTK(2, info,
 			  "RA: %s, did not accept ra for dev: %s\n",
@@ -1231,13 +1229,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_linkparms;
 	}
 
-	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
-		ND_PRINTK(2, info,
-			  "RA: router lifetime (%ds) is too short: %s\n",
-			  lifetime, skb->dev->name);
-		goto skip_linkparms;
-	}
-
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
 	/* skip link-specific parameters from interior routers */
 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
@@ -1290,6 +1281,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_defrtr;
 	}
 
+	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
+
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	pref = ra_msg->icmph.icmp6_router_pref;
 	/* 10b is handled as if it were 00b (medium) */
@@ -1436,13 +1429,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto out;
 	}
 
-	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
-		ND_PRINTK(2, info,
-			  "RA: router lifetime (%ds) is too short: %s\n",
-			  lifetime, skb->dev->name);
-		goto out;
-	}
-
 #ifdef CONFIG_IPV6_ROUTE_INFO
 	if (!in6_dev->cnf.accept_ra_from_local &&
 	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,

From f04244ef53ece09717a75292edfdd3d69d37bcfe Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Thu, 26 Oct 2023 18:06:54 +0000
Subject: [PATCH 0209/1043] Revert "ipv4/fib: send notify when delete source
 address routes"

This reverts commit 5b7cae7c35dda1399e16a22a95d49b8f1e5969cb which is
commit 4b2b606075e50cdae62ab2356b0a1e206947c354 upstream.

It breaks the android ABI and if this is needed in the future, can be
brought back in an abi-safe way.

Bug: 161946584
Change-Id: I445b109db38243faa7154021212e3f7ca0ad820f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/net/ip_fib.h     | 1 -
 net/ipv4/fib_semantics.c | 1 -
 net/ipv4/fib_trie.c      | 4 ----
 3 files changed, 6 deletions(-)

diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 0d3cb34c7abc..088f257cd6fb 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -151,7 +151,6 @@ struct fib_info {
 	int			fib_nhs;
 	bool			fib_nh_is_v6;
 	bool			nh_updated;
-	bool			pfsrc_removed;
 	struct nexthop		*nh;
 	struct rcu_head		rcu;
 	struct fib_nh		fib_nh[];
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index bb5255178d75..5f786cff2e41 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1908,7 +1908,6 @@ int fib_sync_down_addr(struct net_device *dev, __be32 local)
 			continue;
 		if (fi->fib_prefsrc == local) {
 			fi->fib_flags |= RTNH_F_DEAD;
-			fi->pfsrc_removed = true;
 			ret++;
 		}
 	}
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 3f4f6458d40e..456240d2adc1 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1977,7 +1977,6 @@ void fib_table_flush_external(struct fib_table *tb)
 int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all)
 {
 	struct trie *t = (struct trie *)tb->tb_data;
-	struct nl_info info = { .nl_net = net };
 	struct key_vector *pn = t->kv;
 	unsigned long cindex = 1;
 	struct hlist_node *tmp;
@@ -2040,9 +2039,6 @@ int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all)
 
 			fib_notify_alias_delete(net, n->key, &n->leaf, fa,
 						NULL);
-			if (fi->pfsrc_removed)
-				rtmsg_fib(RTM_DELROUTE, htonl(n->key), fa,
-					  KEYLENGTH - fa->fa_slen, tb->tb_id, &info, 0);
 			hlist_del_rcu(&fa->fa_list);
 			fib_release_info(fa->fa_info);
 			alias_free_mem_rcu(fa);

From 5653e77e8e149556dd2bd2c0f9fe6fb39fd9a948 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sat, 28 Oct 2023 10:44:08 +0000
Subject: [PATCH 0210/1043] Revert "usb: typec: altmodes/displayport: Signal
 hpd low when exiting mode"

This reverts commit 9ed14f807f4f768ab06de395c1dfea7a31eea55e which is
commit 89434b069e460967624903b049e5cf5c9e6b99b9 upstream.

It breaks the android ABI and if this is needed in the future, can be
brought back in an abi-safe way.

Bug: 161946584
Change-Id: I4b22c70ef3ba8b03807052be2d4cdd5d060f3f76
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/usb/typec/altmodes/displayport.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
index 2ba1ba5e3a8d..19d9965874cb 100644
--- a/drivers/usb/typec/altmodes/displayport.c
+++ b/drivers/usb/typec/altmodes/displayport.c
@@ -294,11 +294,6 @@ static int dp_altmode_vdm(struct typec_altmode *alt,
 		case CMD_EXIT_MODE:
 			dp->data.status = 0;
 			dp->data.conf = 0;
-			if (dp->hpd) {
-				drm_connector_oob_hotplug_event(dp->connector_fwnode);
-				dp->hpd = false;
-				sysfs_notify(&dp->alt->dev.kobj, "displayport", "hpd");
-			}
 			break;
 		case DP_CMD_STATUS_UPDATE:
 			dp->data.status = *vdo;

From 2f382c6d12f6166328061edcc0118af42036ae4a Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sat, 28 Oct 2023 10:44:26 +0000
Subject: [PATCH 0211/1043] Revert "usb: typec: altmodes/displayport: Notify
 drm subsys of hotplug events"

This reverts commit f25a13d318b8eb6fb48673376b585a990e605e93 which is
commit 7f811394878535ed9a6849717de8c2959ae38899 upstream.

It breaks the android ABI and if this is needed in the future, can be
brought back in an abi-safe way.

Bug: 161946584
Change-Id: Ia85b72b88d6a6a5c0258a26c67484f367d724360
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/usb/typec/altmodes/Kconfig       |  1 -
 drivers/usb/typec/altmodes/displayport.c | 23 -----------------------
 2 files changed, 24 deletions(-)

diff --git a/drivers/usb/typec/altmodes/Kconfig b/drivers/usb/typec/altmodes/Kconfig
index 1a6b5e872b0d..60d375e9c3c7 100644
--- a/drivers/usb/typec/altmodes/Kconfig
+++ b/drivers/usb/typec/altmodes/Kconfig
@@ -4,7 +4,6 @@ menu "USB Type-C Alternate Mode drivers"
 
 config TYPEC_DP_ALTMODE
 	tristate "DisplayPort Alternate Mode driver"
-	depends on DRM
 	help
 	  DisplayPort USB Type-C Alternate Mode allows DisplayPort
 	  displays and adapters to be attached to the USB Type-C
diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
index 19d9965874cb..8f0c6da27dd1 100644
--- a/drivers/usb/typec/altmodes/displayport.c
+++ b/drivers/usb/typec/altmodes/displayport.c
@@ -11,10 +11,8 @@
 #include <linux/delay.h>
 #include <linux/mutex.h>
 #include <linux/module.h>
-#include <linux/property.h>
 #include <linux/usb/pd_vdo.h>
 #include <linux/usb/typec_dp.h>
-#include <drm/drm_connector.h>
 #include "displayport.h"
 
 #define DP_HEADER(_dp, ver, cmd)	(VDO((_dp)->alt->svid, 1, ver, cmd)	\
@@ -59,13 +57,11 @@ struct dp_altmode {
 	struct typec_displayport_data data;
 
 	enum dp_state state;
-	bool hpd;
 
 	struct mutex lock; /* device lock */
 	struct work_struct work;
 	struct typec_altmode *alt;
 	const struct typec_altmode *port;
-	struct fwnode_handle *connector_fwnode;
 };
 
 static int dp_altmode_notify(struct dp_altmode *dp)
@@ -126,7 +122,6 @@ static int dp_altmode_configure(struct dp_altmode *dp, u8 con)
 static int dp_altmode_status_update(struct dp_altmode *dp)
 {
 	bool configured = !!DP_CONF_GET_PIN_ASSIGN(dp->data.conf);
-	bool hpd = !!(dp->data.status & DP_STATUS_HPD_STATE);
 	u8 con = DP_STATUS_CONNECTION(dp->data.status);
 	int ret = 0;
 
@@ -139,11 +134,6 @@ static int dp_altmode_status_update(struct dp_altmode *dp)
 		ret = dp_altmode_configure(dp, con);
 		if (!ret)
 			dp->state = DP_STATE_CONFIGURE;
-	} else {
-		if (dp->hpd != hpd) {
-			drm_connector_oob_hotplug_event(dp->connector_fwnode);
-			dp->hpd = hpd;
-		}
 	}
 
 	return ret;
@@ -545,7 +535,6 @@ static const struct attribute_group dp_altmode_group = {
 int dp_altmode_probe(struct typec_altmode *alt)
 {
 	const struct typec_altmode *port = typec_altmode_get_partner(alt);
-	struct fwnode_handle *fwnode;
 	struct dp_altmode *dp;
 	int ret;
 
@@ -574,11 +563,6 @@ int dp_altmode_probe(struct typec_altmode *alt)
 	alt->desc = "DisplayPort";
 	alt->ops = &dp_altmode_ops;
 
-	fwnode = dev_fwnode(alt->dev.parent->parent); /* typec_port fwnode */
-	dp->connector_fwnode = fwnode_find_reference(fwnode, "displayport", 0);
-	if (IS_ERR(dp->connector_fwnode))
-		dp->connector_fwnode = NULL;
-
 	typec_altmode_set_drvdata(alt, dp);
 
 	dp->state = DP_STATE_ENTER;
@@ -594,13 +578,6 @@ void dp_altmode_remove(struct typec_altmode *alt)
 
 	sysfs_remove_group(&alt->dev.kobj, &dp_altmode_group);
 	cancel_work_sync(&dp->work);
-
-	if (dp->connector_fwnode) {
-		if (dp->hpd)
-			drm_connector_oob_hotplug_event(dp->connector_fwnode);
-
-		fwnode_handle_put(dp->connector_fwnode);
-	}
 }
 EXPORT_SYMBOL_GPL(dp_altmode_remove);
 

From 1a01b7e512367be4bf9132ea62b80015016f078d Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sat, 28 Oct 2023 10:44:51 +0000
Subject: [PATCH 0212/1043] Revert "drm/connector: Add support for out-of-band
 hotplug notification (v3)"

This reverts commit 2ea6a14e8a5512755bbeb0db774385e99448ea8f which is
commit 72ad49682dde3d9de5708b8699dc8e0b44962322 upstream.

It breaks the android ABI and if this is needed in the future, can be
brought back in an abi-safe way.

Bug: 161946584
Change-Id: I168048886443f3d5e653a70ceea1affda068894f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/gpu/drm/drm_connector.c | 27 ---------------------------
 include/drm/drm_connector.h     |  9 ---------
 2 files changed, 36 deletions(-)

diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index c4ed4f1b369c..fc06f73acd3c 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -2514,33 +2514,6 @@ struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode)
 	return found;
 }
 
-/**
- * drm_connector_oob_hotplug_event - Report out-of-band hotplug event to connector
- * @connector: connector to report the event on
- *
- * On some hardware a hotplug event notification may come from outside the display
- * driver / device. An example of this is some USB Type-C setups where the hardware
- * muxes the DisplayPort data and aux-lines but does not pass the altmode HPD
- * status bit to the GPU's DP HPD pin.
- *
- * This function can be used to report these out-of-band events after obtaining
- * a drm_connector reference through calling drm_connector_find_by_fwnode().
- */
-void drm_connector_oob_hotplug_event(struct fwnode_handle *connector_fwnode)
-{
-	struct drm_connector *connector;
-
-	connector = drm_connector_find_by_fwnode(connector_fwnode);
-	if (IS_ERR(connector))
-		return;
-
-	if (connector->funcs->oob_hotplug_event)
-		connector->funcs->oob_hotplug_event(connector);
-
-	drm_connector_put(connector);
-}
-EXPORT_SYMBOL(drm_connector_oob_hotplug_event);
-
 
 /**
  * DOC: Tile group
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index 03d39532c708..d6c7554f1d40 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -1030,14 +1030,6 @@ struct drm_connector_funcs {
 	 */
 	void (*atomic_print_state)(struct drm_printer *p,
 				   const struct drm_connector_state *state);
-
-	/**
-	 * @oob_hotplug_event:
-	 *
-	 * This will get called when a hotplug-event for a drm-connector
-	 * has been received from a source outside the display driver / device.
-	 */
-	void (*oob_hotplug_event)(struct drm_connector *connector);
 };
 
 /**
@@ -1620,7 +1612,6 @@ drm_connector_is_unregistered(struct drm_connector *connector)
 		DRM_CONNECTOR_UNREGISTERED;
 }
 
-void drm_connector_oob_hotplug_event(struct fwnode_handle *connector_fwnode);
 const char *drm_get_connector_type_name(unsigned int connector_type);
 const char *drm_get_connector_status_name(enum drm_connector_status status);
 const char *drm_get_subpixel_order_name(enum subpixel_order order);

From 8fd816f563b7e339e54fbc628edc2309579b5a0a Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sat, 28 Oct 2023 10:45:15 +0000
Subject: [PATCH 0213/1043] Revert "drm/connector: Add
 drm_connector_find_by_fwnode() function (v3)"

This reverts commit 6e55f6a8a4986ecd43d235b9b0120e06c400b3d6 which is
commit 3d3f7c1e68691574c1d87cd0f9f2348323bc0199 upstream.

It breaks the android ABI and if this is needed in the future, can be
brought back in an abi-safe way.

Bug: 161946584
Change-Id: Ie2f1199f85aa249f6303b4be83f22b1eb1ebff77
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/gpu/drm/drm_connector.c     | 50 -----------------------------
 drivers/gpu/drm/drm_crtc_internal.h |  2 --
 include/drm/drm_connector.h         |  8 -----
 3 files changed, 60 deletions(-)

diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index fc06f73acd3c..c08501a5620d 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -64,14 +64,6 @@
  * support can instead use e.g. drm_helper_hpd_irq_event().
  */
 
-/*
- * Global connector list for drm_connector_find_by_fwnode().
- * Note drm_connector_[un]register() first take connector->lock and then
- * take the connector_list_lock.
- */
-static DEFINE_MUTEX(connector_list_lock);
-static LIST_HEAD(connector_list);
-
 struct drm_conn_prop_enum_list {
 	int type;
 	const char *name;
@@ -273,7 +265,6 @@ int drm_connector_init(struct drm_device *dev,
 		goto out_put_type_id;
 	}
 
-	INIT_LIST_HEAD(&connector->global_connector_list_entry);
 	INIT_LIST_HEAD(&connector->probed_modes);
 	INIT_LIST_HEAD(&connector->modes);
 	mutex_init(&connector->mutex);
@@ -543,9 +534,6 @@ int drm_connector_register(struct drm_connector *connector)
 	/* Let userspace know we have a new connector */
 	drm_sysfs_hotplug_event(connector->dev);
 
-	mutex_lock(&connector_list_lock);
-	list_add_tail(&connector->global_connector_list_entry, &connector_list);
-	mutex_unlock(&connector_list_lock);
 	goto unlock;
 
 err_debugfs:
@@ -574,10 +562,6 @@ void drm_connector_unregister(struct drm_connector *connector)
 		return;
 	}
 
-	mutex_lock(&connector_list_lock);
-	list_del_init(&connector->global_connector_list_entry);
-	mutex_unlock(&connector_list_lock);
-
 	if (connector->funcs->early_unregister)
 		connector->funcs->early_unregister(connector);
 
@@ -2480,40 +2464,6 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
 	return ret;
 }
 
-/**
- * drm_connector_find_by_fwnode - Find a connector based on the associated fwnode
- * @fwnode: fwnode for which to find the matching drm_connector
- *
- * This functions looks up a drm_connector based on its associated fwnode. When
- * a connector is found a reference to the connector is returned. The caller must
- * call drm_connector_put() to release this reference when it is done with the
- * connector.
- *
- * Returns: A reference to the found connector or an ERR_PTR().
- */
-struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode)
-{
-	struct drm_connector *connector, *found = ERR_PTR(-ENODEV);
-
-	if (!fwnode)
-		return ERR_PTR(-ENODEV);
-
-	mutex_lock(&connector_list_lock);
-
-	list_for_each_entry(connector, &connector_list, global_connector_list_entry) {
-		if (connector->fwnode == fwnode ||
-		    (connector->fwnode && connector->fwnode->secondary == fwnode)) {
-			drm_connector_get(connector);
-			found = connector;
-			break;
-		}
-	}
-
-	mutex_unlock(&connector_list_lock);
-
-	return found;
-}
-
 
 /**
  * DOC: Tile group
diff --git a/drivers/gpu/drm/drm_crtc_internal.h b/drivers/gpu/drm/drm_crtc_internal.h
index c3577eaee416..da96b2f64d7e 100644
--- a/drivers/gpu/drm/drm_crtc_internal.h
+++ b/drivers/gpu/drm/drm_crtc_internal.h
@@ -57,7 +57,6 @@ struct drm_property;
 struct edid;
 struct kref;
 struct work_struct;
-struct fwnode_handle;
 
 /* drm_crtc.c */
 int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
@@ -183,7 +182,6 @@ int drm_connector_set_obj_prop(struct drm_mode_object *obj,
 int drm_connector_create_standard_properties(struct drm_device *dev);
 const char *drm_get_connector_force_name(enum drm_connector_force force);
 void drm_connector_free_work_fn(struct work_struct *work);
-struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode);
 
 /* IOCTL */
 int drm_connector_property_set_ioctl(struct drm_device *dev,
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index d6c7554f1d40..ffad68f775cc 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -1193,14 +1193,6 @@ struct drm_connector {
 	 */
 	struct list_head head;
 
-	/**
-	 * @global_connector_list_entry:
-	 *
-	 * Connector entry in the global connector-list, used by
-	 * drm_connector_find_by_fwnode().
-	 */
-	struct list_head global_connector_list_entry;
-
 	/** @base: base KMS object */
 	struct drm_mode_object base;
 

From 87c1e3677dceb7f6611c2463b04b0dff17ef2428 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sat, 28 Oct 2023 10:45:41 +0000
Subject: [PATCH 0214/1043] Revert "drm/connector: Add a fwnode pointer to
 drm_connector and register with ACPI (v2)"

This reverts commit 89b1868bab4883b2abd4796bc1965db1565ad6ad which is
commit 48c429c6d18db115c277b75000152d8fa4cd35d0 upstream.

It breaks the android ABI and if this is needed in the future, can be
brought back in an abi-safe way.

Bug: 161946584
Change-Id: I1ff8b3d668df6e0c27bab5fbd554097c410fa9a6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/gpu/drm/drm_connector.c |  2 --
 drivers/gpu/drm/drm_sysfs.c     | 37 ---------------------------------
 include/drm/drm_connector.h     |  8 -------
 3 files changed, 47 deletions(-)

diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index c08501a5620d..9c3bbe2c3e6f 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -471,8 +471,6 @@ void drm_connector_cleanup(struct drm_connector *connector)
 	drm_mode_object_unregister(dev, &connector->base);
 	kfree(connector->name);
 	connector->name = NULL;
-	fwnode_handle_put(connector->fwnode);
-	connector->fwnode = NULL;
 	spin_lock_irq(&dev->mode_config.connector_list_lock);
 	list_del(&connector->head);
 	dev->mode_config.num_connector--;
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 71a0d9596efe..a3b71478c590 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -10,7 +10,6 @@
  * Copyright (c) 2003-2004 IBM Corp.
  */
 
-#include <linux/acpi.h>
 #include <linux/device.h>
 #include <linux/err.h>
 #include <linux/export.h>
@@ -57,39 +56,6 @@ static struct device_type drm_sysfs_device_connector = {
 
 struct class *drm_class;
 
-#ifdef CONFIG_ACPI
-static bool drm_connector_acpi_bus_match(struct device *dev)
-{
-	return dev->type == &drm_sysfs_device_connector;
-}
-
-static struct acpi_device *drm_connector_acpi_find_companion(struct device *dev)
-{
-	struct drm_connector *connector = to_drm_connector(dev);
-
-	return to_acpi_device_node(connector->fwnode);
-}
-
-static struct acpi_bus_type drm_connector_acpi_bus = {
-	.name = "drm_connector",
-	.match = drm_connector_acpi_bus_match,
-	.find_companion = drm_connector_acpi_find_companion,
-};
-
-static void drm_sysfs_acpi_register(void)
-{
-	register_acpi_bus_type(&drm_connector_acpi_bus);
-}
-
-static void drm_sysfs_acpi_unregister(void)
-{
-	unregister_acpi_bus_type(&drm_connector_acpi_bus);
-}
-#else
-static void drm_sysfs_acpi_register(void) { }
-static void drm_sysfs_acpi_unregister(void) { }
-#endif
-
 static char *drm_devnode(struct device *dev, umode_t *mode)
 {
 	return kasprintf(GFP_KERNEL, "dri/%s", dev_name(dev));
@@ -123,8 +89,6 @@ int drm_sysfs_init(void)
 	}
 
 	drm_class->devnode = drm_devnode;
-
-	drm_sysfs_acpi_register();
 	return 0;
 }
 
@@ -137,7 +101,6 @@ void drm_sysfs_destroy(void)
 {
 	if (IS_ERR_OR_NULL(drm_class))
 		return;
-	drm_sysfs_acpi_unregister();
 	class_remove_file(drm_class, &class_attr_version.attr);
 	class_destroy(drm_class);
 	drm_class = NULL;
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index ffad68f775cc..928136556174 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -1174,14 +1174,6 @@ struct drm_connector {
 	struct device *kdev;
 	/** @attr: sysfs attributes */
 	struct device_attribute *attr;
-	/**
-	 * @fwnode: associated fwnode supplied by platform firmware
-	 *
-	 * Drivers can set this to associate a fwnode with a connector, drivers
-	 * are expected to get a reference on the fwnode when setting this.
-	 * drm_connector_cleanup() will call fwnode_handle_put() on this.
-	 */
-	struct fwnode_handle *fwnode;
 
 	/**
 	 * @head:

From b4e242de091232f6f5e118f52f0b323cf2b5be11 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 30 Oct 2023 10:16:28 +0000
Subject: [PATCH 0215/1043] Revert "usb: core: Track SuperSpeed Plus GenXxY"

This reverts commit 95b9f1e3927b70a3b5edecf1bcba8c2e363b18b2 which is
commit 0299809be415567366b66f248eed93848b8dc9f3 upstream.

It breaks the Android ABI and isn't needed at all, upstream added it to
reduce some fuzz on some later commits, so it can be safely dropped for
now.

Bug: 161946584
Change-Id: Ie87eebee9b355161465fbae86fc6c35825a46e44
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/usb/core/hcd.c |  6 +---
 drivers/usb/core/hub.c | 78 ------------------------------------------
 include/linux/usb.h    |  2 --
 3 files changed, 1 insertion(+), 85 deletions(-)

diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index b0d17a270f15..1c754aa84357 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2742,7 +2742,6 @@ int usb_add_hcd(struct usb_hcd *hcd,
 
 	rhdev->rx_lanes = 1;
 	rhdev->tx_lanes = 1;
-	rhdev->ssp_rate = USB_SSP_GEN_UNKNOWN;
 
 	switch (hcd->speed) {
 	case HCD_USB11:
@@ -2760,11 +2759,8 @@ int usb_add_hcd(struct usb_hcd *hcd,
 	case HCD_USB32:
 		rhdev->rx_lanes = 2;
 		rhdev->tx_lanes = 2;
-		rhdev->ssp_rate = USB_SSP_GEN_2x2;
-		rhdev->speed = USB_SPEED_SUPER_PLUS;
-		break;
+		fallthrough;
 	case HCD_USB31:
-		rhdev->ssp_rate = USB_SSP_GEN_2x1;
 		rhdev->speed = USB_SPEED_SUPER_PLUS;
 		break;
 	default:
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 2bcc6e3ba02b..f5b4f538a167 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -31,7 +31,6 @@
 #include <linux/pm_qos.h>
 #include <linux/kobject.h>
 
-#include <linux/bitfield.h>
 #include <linux/uaccess.h>
 #include <asm/byteorder.h>
 
@@ -2692,81 +2691,6 @@ int usb_authorize_device(struct usb_device *usb_dev)
 	return result;
 }
 
-/**
- * get_port_ssp_rate - Match the extended port status to SSP rate
- * @hdev: The hub device
- * @ext_portstatus: extended port status
- *
- * Match the extended port status speed id to the SuperSpeed Plus sublink speed
- * capability attributes. Base on the number of connected lanes and speed,
- * return the corresponding enum usb_ssp_rate.
- */
-static enum usb_ssp_rate get_port_ssp_rate(struct usb_device *hdev,
-					   u32 ext_portstatus)
-{
-	struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap;
-	u32 attr;
-	u8 speed_id;
-	u8 ssac;
-	u8 lanes;
-	int i;
-
-	if (!ssp_cap)
-		goto out;
-
-	speed_id = ext_portstatus & USB_EXT_PORT_STAT_RX_SPEED_ID;
-	lanes = USB_EXT_PORT_RX_LANES(ext_portstatus) + 1;
-
-	ssac = le32_to_cpu(ssp_cap->bmAttributes) &
-		USB_SSP_SUBLINK_SPEED_ATTRIBS;
-
-	for (i = 0; i <= ssac; i++) {
-		u8 ssid;
-
-		attr = le32_to_cpu(ssp_cap->bmSublinkSpeedAttr[i]);
-		ssid = FIELD_GET(USB_SSP_SUBLINK_SPEED_SSID, attr);
-		if (speed_id == ssid) {
-			u16 mantissa;
-			u8 lse;
-			u8 type;
-
-			/*
-			 * Note: currently asymmetric lane types are only
-			 * applicable for SSIC operate in SuperSpeed protocol
-			 */
-			type = FIELD_GET(USB_SSP_SUBLINK_SPEED_ST, attr);
-			if (type == USB_SSP_SUBLINK_SPEED_ST_ASYM_RX ||
-			    type == USB_SSP_SUBLINK_SPEED_ST_ASYM_TX)
-				goto out;
-
-			if (FIELD_GET(USB_SSP_SUBLINK_SPEED_LP, attr) !=
-			    USB_SSP_SUBLINK_SPEED_LP_SSP)
-				goto out;
-
-			lse = FIELD_GET(USB_SSP_SUBLINK_SPEED_LSE, attr);
-			mantissa = FIELD_GET(USB_SSP_SUBLINK_SPEED_LSM, attr);
-
-			/* Convert to Gbps */
-			for (; lse < USB_SSP_SUBLINK_SPEED_LSE_GBPS; lse++)
-				mantissa /= 1000;
-
-			if (mantissa >= 10 && lanes == 1)
-				return USB_SSP_GEN_2x1;
-
-			if (mantissa >= 10 && lanes == 2)
-				return USB_SSP_GEN_2x2;
-
-			if (mantissa >= 5 && lanes == 2)
-				return USB_SSP_GEN_1x2;
-
-			goto out;
-		}
-	}
-
-out:
-	return USB_SSP_GEN_UNKNOWN;
-}
-
 /*
  * Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the
  * capability couldn't be checked.
@@ -2954,11 +2878,9 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
 		/* extended portstatus Rx and Tx lane count are zero based */
 		udev->rx_lanes = USB_EXT_PORT_RX_LANES(ext_portstatus) + 1;
 		udev->tx_lanes = USB_EXT_PORT_TX_LANES(ext_portstatus) + 1;
-		udev->ssp_rate = get_port_ssp_rate(hub->hdev, ext_portstatus);
 	} else {
 		udev->rx_lanes = 1;
 		udev->tx_lanes = 1;
-		udev->ssp_rate = USB_SSP_GEN_UNKNOWN;
 	}
 	if (hub_is_wusb(hub))
 		udev->speed = USB_SPEED_WIRELESS;
diff --git a/include/linux/usb.h b/include/linux/usb.h
index edbcfdbd2a9b..57c1a53b0b75 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -581,7 +581,6 @@ struct usb3_lpm_parameters {
  * @speed: device speed: high/full/low (or error)
  * @rx_lanes: number of rx lanes in use, USB 3.2 adds dual-lane support
  * @tx_lanes: number of tx lanes in use, USB 3.2 adds dual-lane support
- * @ssp_rate: SuperSpeed Plus phy signaling rate and lane count
  * @tt: Transaction Translator info; used with low/full speed dev, highspeed hub
  * @ttport: device port on that tt hub
  * @toggle: one bit for each endpoint, with ([0] = IN, [1] = OUT) endpoints
@@ -658,7 +657,6 @@ struct usb_device {
 	enum usb_device_speed	speed;
 	unsigned int		rx_lanes;
 	unsigned int		tx_lanes;
-	enum usb_ssp_rate	ssp_rate;
 
 	struct usb_tt	*tt;
 	int		ttport;

From 09bcf925483854feabdc3c8913df1934a65b2901 Mon Sep 17 00:00:00 2001
From: Francis Laniel <flaniel@linux.microsoft.com>
Date: Fri, 20 Oct 2023 13:42:50 +0300
Subject: [PATCH 0216/1043] selftests/ftrace: Add new test case which checks
 non unique symbol

[ Upstream commit 03b80ff8023adae6780e491f66e932df8165e3a0 ]

If name_show() is non unique, this test will try to install a kprobe on this
function which should fail returning EADDRNOTAVAIL.
On kernel where name_show() is not unique, this test is skipped.

Link: https://lore.kernel.org/all/20231020104250.9537-3-flaniel@linux.microsoft.com/

Cc: stable@vger.kernel.org
Signed-off-by: Francis Laniel <flaniel@linux.microsoft.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc  | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 tools/testing/selftests/ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc

diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc
new file mode 100644
index 000000000000..bc9514428dba
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_non_uniq_symbol.tc
@@ -0,0 +1,13 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+# description: Test failure of registering kprobe on non unique symbol
+# requires: kprobe_events
+
+SYMBOL='name_show'
+
+# We skip this test on kernel where SYMBOL is unique or does not exist.
+if [ "$(grep -c -E "[[:alnum:]]+ t ${SYMBOL}" /proc/kallsyms)" -le '1' ]; then
+	exit_unsupported
+fi
+
+! echo "p:test_non_unique ${SYMBOL}" > kprobe_events

From 6976459c6439465918b20819f115b4ba27b52a49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rodr=C3=ADguez=20Barbarin=2C=20Jos=C3=A9=20Javier?=
 <JoseJavier.Rodriguez@duagon.com>
Date: Tue, 11 Apr 2023 10:33:27 +0200
Subject: [PATCH 0217/1043] mcb: Return actual parsed size when reading
 chameleon table

[ Upstream commit a889c276d33d333ae96697510f33533f6e9d9591 ]

The function chameleon_parse_cells() returns the number of cells
parsed which has an undetermined size. This return value is only
used for error checking but the number of cells is never used.

Change return value to be number of bytes parsed to allow for
memory management improvements.

Co-developed-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
Signed-off-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
Signed-off-by: Javier Rodriguez <josejavier.rodriguez@duagon.com>
Signed-off-by: Johannes Thumshirn <jth@kernel.org>
Link: https://lore.kernel.org/r/20230411083329.4506-2-jth@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mcb/mcb-parse.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
index c41cbacc75a2..656b6b71c768 100644
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -128,7 +128,7 @@ static void chameleon_parse_bar(void __iomem *base,
 	}
 }
 
-static int chameleon_get_bar(char __iomem **base, phys_addr_t mapbase,
+static int chameleon_get_bar(void __iomem **base, phys_addr_t mapbase,
 			     struct chameleon_bar **cb)
 {
 	struct chameleon_bar *c;
@@ -177,12 +177,13 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
 {
 	struct chameleon_fpga_header *header;
 	struct chameleon_bar *cb;
-	char __iomem *p = base;
+	void __iomem *p = base;
 	int num_cells = 0;
 	uint32_t dtype;
 	int bar_count;
 	int ret;
 	u32 hsize;
+	u32 table_size;
 
 	hsize = sizeof(struct chameleon_fpga_header);
 
@@ -237,12 +238,16 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
 		num_cells++;
 	}
 
-	if (num_cells == 0)
-		num_cells = -EINVAL;
+	if (num_cells == 0) {
+		ret = -EINVAL;
+		goto free_bar;
+	}
 
+	table_size = p - base;
+	pr_debug("%d cell(s) found. Chameleon table size: 0x%04x bytes\n", num_cells, table_size);
 	kfree(cb);
 	kfree(header);
-	return num_cells;
+	return table_size;
 
 free_bar:
 	kfree(cb);

From c88dd2aebf0c85b78918fc4e6c21b29f0f839a71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rodr=C3=ADguez=20Barbarin=2C=20Jos=C3=A9=20Javier?=
 <JoseJavier.Rodriguez@duagon.com>
Date: Tue, 11 Apr 2023 10:33:29 +0200
Subject: [PATCH 0218/1043] mcb-lpc: Reallocate memory region to avoid memory
 overlapping

[ Upstream commit 2025b2ca8004c04861903d076c67a73a0ec6dfca ]

mcb-lpc requests a fixed-size memory region to parse the chameleon
table, however, if the chameleon table is smaller that the allocated
region, it could overlap with the IP Cores' memory regions.

After parsing the chameleon table, drop/reallocate the memory region
with the actual chameleon table size.

Co-developed-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
Signed-off-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
Signed-off-by: Javier Rodriguez <josejavier.rodriguez@duagon.com>
Signed-off-by: Johannes Thumshirn <jth@kernel.org>
Link: https://lore.kernel.org/r/20230411083329.4506-4-jth@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mcb/mcb-lpc.c | 35 +++++++++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/drivers/mcb/mcb-lpc.c b/drivers/mcb/mcb-lpc.c
index 506676754538..d513d61f4ba8 100644
--- a/drivers/mcb/mcb-lpc.c
+++ b/drivers/mcb/mcb-lpc.c
@@ -23,7 +23,7 @@ static int mcb_lpc_probe(struct platform_device *pdev)
 {
 	struct resource *res;
 	struct priv *priv;
-	int ret = 0;
+	int ret = 0, table_size;
 
 	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
@@ -58,16 +58,43 @@ static int mcb_lpc_probe(struct platform_device *pdev)
 
 	ret = chameleon_parse_cells(priv->bus, priv->mem->start, priv->base);
 	if (ret < 0) {
-		mcb_release_bus(priv->bus);
-		return ret;
+		goto out_mcb_bus;
 	}
 
-	dev_dbg(&pdev->dev, "Found %d cells\n", ret);
+	table_size = ret;
+
+	if (table_size < CHAM_HEADER_SIZE) {
+		/* Release the previous resources */
+		devm_iounmap(&pdev->dev, priv->base);
+		devm_release_mem_region(&pdev->dev, priv->mem->start, resource_size(priv->mem));
+
+		/* Then, allocate it again with the actual chameleon table size */
+		res = devm_request_mem_region(&pdev->dev, priv->mem->start,
+					      table_size,
+					      KBUILD_MODNAME);
+		if (!res) {
+			dev_err(&pdev->dev, "Failed to request PCI memory\n");
+			ret = -EBUSY;
+			goto out_mcb_bus;
+		}
+
+		priv->base = devm_ioremap(&pdev->dev, priv->mem->start, table_size);
+		if (!priv->base) {
+			dev_err(&pdev->dev, "Cannot ioremap\n");
+			ret = -ENOMEM;
+			goto out_mcb_bus;
+		}
+
+		platform_set_drvdata(pdev, priv);
+	}
 
 	mcb_bus_add_devices(priv->bus);
 
 	return 0;
 
+out_mcb_bus:
+	mcb_release_bus(priv->bus);
+	return ret;
 }
 
 static int mcb_lpc_remove(struct platform_device *pdev)

From 8b857a93d6be0d9bbbbab6038edfd442e3ed81d4 Mon Sep 17 00:00:00 2001
From: Gavin Shan <gshan@redhat.com>
Date: Thu, 31 Aug 2023 11:10:07 +1000
Subject: [PATCH 0219/1043] virtio_balloon: Fix endless deflation and inflation
 on arm64

commit 07622bd415639e9709579f400afd19e7e9866e5e upstream.

The deflation request to the target, which isn't unaligned to the
guest page size causes endless deflation and inflation actions. For
example, we receive the flooding QMP events for the changes on memory
balloon's size after a deflation request to the unaligned target is
sent for the ARM64 guest, where we have 64KB base page size.

  /home/gavin/sandbox/qemu.main/build/qemu-system-aarch64      \
  -accel kvm -machine virt,gic-version=host -cpu host          \
  -smp maxcpus=8,cpus=8,sockets=2,clusters=2,cores=2,threads=1 \
  -m 1024M,slots=16,maxmem=64G                                 \
  -object memory-backend-ram,id=mem0,size=512M                 \
  -object memory-backend-ram,id=mem1,size=512M                 \
  -numa node,nodeid=0,memdev=mem0,cpus=0-3                     \
  -numa node,nodeid=1,memdev=mem1,cpus=4-7                     \
    :                                                          \
  -device virtio-balloon-pci,id=balloon0,bus=pcie.10

  { "execute" : "balloon", "arguments": { "value" : 1073672192 } }
  {"return": {}}
  {"timestamp": {"seconds": 1693272173, "microseconds": 88667},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073610752}}
  {"timestamp": {"seconds": 1693272174, "microseconds": 89704},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073610752}}
  {"timestamp": {"seconds": 1693272175, "microseconds": 90819},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073610752}}
  {"timestamp": {"seconds": 1693272176, "microseconds": 91961},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073610752}}
  {"timestamp": {"seconds": 1693272177, "microseconds": 93040},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073676288}}
  {"timestamp": {"seconds": 1693272178, "microseconds": 94117},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073676288}}
  {"timestamp": {"seconds": 1693272179, "microseconds": 95337},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073610752}}
  {"timestamp": {"seconds": 1693272180, "microseconds": 96615},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073676288}}
  {"timestamp": {"seconds": 1693272181, "microseconds": 97626},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073610752}}
  {"timestamp": {"seconds": 1693272182, "microseconds": 98693},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073676288}}
  {"timestamp": {"seconds": 1693272183, "microseconds": 99698},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073610752}}
  {"timestamp": {"seconds": 1693272184, "microseconds": 100727},  \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073610752}}
  {"timestamp": {"seconds": 1693272185, "microseconds": 90430},   \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073610752}}
  {"timestamp": {"seconds": 1693272186, "microseconds": 102999},  \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073676288}}
     :
  <The similar QMP events repeat>

Fix it by aligning the target up to the guest page size, 64KB in this
specific case. With this applied, no flooding QMP events are observed
and the memory balloon's size can be stablizied to 0x3ffe0000 soon
after the deflation request is sent.

  { "execute" : "balloon", "arguments": { "value" : 1073672192 } }
  {"return": {}}
  {"timestamp": {"seconds": 1693273328, "microseconds": 793075},  \
   "event": "BALLOON_CHANGE", "data": {"actual": 1073610752}}
  { "execute" : "query-balloon" }
  {"return": {"actual": 1073610752}}

Cc: stable@vger.kernel.org
Signed-off-by: Gavin Shan <gshan@redhat.com>
Tested-by: Zhenyu Zhang <zhenyzha@redhat.com>
Message-Id: <20230831011007.1032822-1-gshan@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/virtio/virtio_balloon.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 481611c09dae..935ea2f3dac7 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -402,7 +402,11 @@ static inline s64 towards_target(struct virtio_balloon *vb)
 	virtio_cread_le(vb->vdev, struct virtio_balloon_config, num_pages,
 			&num_pages);
 
-	target = num_pages;
+	/*
+	 * Aligned up to guest page size to avoid inflating and deflating
+	 * balloon endlessly.
+	 */
+	target = ALIGN(num_pages, VIRTIO_BALLOON_PAGES_PER_PAGE);
 	return target - vb->num_pages;
 }
 

From f2c0b571a5fc511daf23c060e7a9c1c502069a06 Mon Sep 17 00:00:00 2001
From: Maximilian Heyne <mheyne@amazon.de>
Date: Mon, 11 Sep 2023 09:03:29 +0000
Subject: [PATCH 0220/1043] virtio-mmio: fix memory leak of vm_dev

commit fab7f259227b8f70aa6d54e1de1a1f5f4729041c upstream.

With the recent removal of vm_dev from devres its memory is only freed
via the callback virtio_mmio_release_dev. However, this only takes
effect after device_add is called by register_virtio_device. Until then
it's an unmanaged resource and must be explicitly freed on error exit.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.

Cc: stable@vger.kernel.org
Fixes: 55c91fedd03d ("virtio-mmio: don't break lifecycle of vm_dev")
Signed-off-by: Maximilian Heyne <mheyne@amazon.de>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Tested-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Message-Id: <20230911090328.40538-1-mheyne@amazon.de>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
---
 drivers/virtio/virtio_mmio.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index 136f90dbad83..7fcc307fac72 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -596,14 +596,17 @@ static int virtio_mmio_probe(struct platform_device *pdev)
 	spin_lock_init(&vm_dev->lock);
 
 	vm_dev->base = devm_platform_ioremap_resource(pdev, 0);
-	if (IS_ERR(vm_dev->base))
-		return PTR_ERR(vm_dev->base);
+	if (IS_ERR(vm_dev->base)) {
+		rc = PTR_ERR(vm_dev->base);
+		goto free_vm_dev;
+	}
 
 	/* Check magic value */
 	magic = readl(vm_dev->base + VIRTIO_MMIO_MAGIC_VALUE);
 	if (magic != ('v' | 'i' << 8 | 'r' << 16 | 't' << 24)) {
 		dev_warn(&pdev->dev, "Wrong magic value 0x%08lx!\n", magic);
-		return -ENODEV;
+		rc = -ENODEV;
+		goto free_vm_dev;
 	}
 
 	/* Check device version */
@@ -611,7 +614,8 @@ static int virtio_mmio_probe(struct platform_device *pdev)
 	if (vm_dev->version < 1 || vm_dev->version > 2) {
 		dev_err(&pdev->dev, "Version %ld not supported!\n",
 				vm_dev->version);
-		return -ENXIO;
+		rc = -ENXIO;
+		goto free_vm_dev;
 	}
 
 	vm_dev->vdev.id.device = readl(vm_dev->base + VIRTIO_MMIO_DEVICE_ID);
@@ -620,7 +624,8 @@ static int virtio_mmio_probe(struct platform_device *pdev)
 		 * virtio-mmio device with an ID 0 is a (dummy) placeholder
 		 * with no function. End probing now with no error reported.
 		 */
-		return -ENODEV;
+		rc = -ENODEV;
+		goto free_vm_dev;
 	}
 	vm_dev->vdev.id.vendor = readl(vm_dev->base + VIRTIO_MMIO_VENDOR_ID);
 
@@ -650,6 +655,10 @@ static int virtio_mmio_probe(struct platform_device *pdev)
 		put_device(&vm_dev->vdev.dev);
 
 	return rc;
+
+free_vm_dev:
+	kfree(vm_dev);
+	return rc;
 }
 
 static int virtio_mmio_remove(struct platform_device *pdev)

From 3ab81820bf9228924f3ca71cc37a90bae1ca0220 Mon Sep 17 00:00:00 2001
From: Kemeng Shi <shikemeng@huaweicloud.com>
Date: Wed, 27 Sep 2023 17:44:01 +0800
Subject: [PATCH 0221/1043] mm/page_alloc: correct start page when guard page
 debug is enabled

commit 61e21cf2d2c3cc5e60e8d0a62a77e250fccda62c upstream.

When guard page debug is enabled and set_page_guard returns success, we
miss to forward page to point to start of next split range and we will do
split unexpectedly in page range without target page.  Move start page
update before set_page_guard to fix this.

As we split to wrong target page, then splited pages are not able to merge
back to original order when target page is put back and splited pages
except target page is not usable.  To be specific:

Consider target page is the third page in buddy page with order 2.
| buddy-2 | Page | Target | Page |

After break down to target page, we will only set first page to Guard
because of bug.
| Guard   | Page | Target | Page |

When we try put_page_back_buddy with target page, the buddy page of target
if neither guard nor buddy, Then it's not able to construct original page
with order 2
| Guard | Page | buddy-0 | Page |

All pages except target page is not in free list and is not usable.

Link: https://lkml.kernel.org/r/20230927094401.68205-1-shikemeng@huaweicloud.com
Fixes: 06be6ff3d2ec ("mm,hwpoison: rework soft offline for free pages")
Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Acked-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/page_alloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d85435db35f3..124ab9324610 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -8932,6 +8932,7 @@ static void break_down_buddy_pages(struct zone *zone, struct page *page,
 			next_page = page;
 			current_buddy = page + size;
 		}
+		page = next_page;
 
 		if (set_page_guard(zone, current_buddy, high, migratetype))
 			continue;
@@ -8939,7 +8940,6 @@ static void break_down_buddy_pages(struct zone *zone, struct page *page,
 		if (current_buddy != target) {
 			add_to_free_list(current_buddy, zone, high, migratetype);
 			set_buddy_order(current_buddy, high);
-			page = next_page;
 		}
 	}
 }

From 957ec0823a5ae39a96bf8a3d00460dfbcdae1c60 Mon Sep 17 00:00:00 2001
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
Date: Thu, 4 Mar 2021 10:29:03 +0100
Subject: [PATCH 0222/1043] mmc: renesas_sdhi: use custom mask for
 TMIO_MASK_ALL

commit 9f12cac1bb88e3296990e760d867a98308d6b0ac upstream.

Populate the new member for custom mask values to make sure this value
is applied whenever needed. Also, rename the define holding the value
because this is not only about initialization anymore.

Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20210304092903.8534-1-wsa+renesas@sang-engineering.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
[geert: Backport to v5.10.199]
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/renesas_sdhi_core.c | 3 ++-
 drivers/mmc/host/tmio_mmc.h          | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
index be4c2a848b52..24e524a1b927 100644
--- a/drivers/mmc/host/renesas_sdhi_core.c
+++ b/drivers/mmc/host/renesas_sdhi_core.c
@@ -571,7 +571,7 @@ static void renesas_sdhi_reset(struct tmio_mmc_host *host)
 
 	if (host->pdata->flags & TMIO_MMC_MIN_RCAR2)
 		sd_ctrl_write32_as_16_and_16(host, CTL_IRQ_MASK,
-					     TMIO_MASK_INIT_RCAR2);
+					     TMIO_MASK_ALL_RCAR2);
 }
 
 #define SH_MOBILE_SDHI_MIN_TAP_ROW 3
@@ -1012,6 +1012,7 @@ int renesas_sdhi_probe(struct platform_device *pdev,
 		host->ops.start_signal_voltage_switch =
 			renesas_sdhi_start_signal_voltage_switch;
 		host->sdcard_irq_setbit_mask = TMIO_STAT_ALWAYS_SET_27;
+		host->sdcard_irq_mask_all = TMIO_MASK_ALL_RCAR2;
 		host->reset = renesas_sdhi_reset;
 	} else {
 		host->sdcard_irq_mask_all = TMIO_MASK_ALL;
diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h
index d6ed5e1f8386..330a17267f7e 100644
--- a/drivers/mmc/host/tmio_mmc.h
+++ b/drivers/mmc/host/tmio_mmc.h
@@ -97,8 +97,8 @@
 
 /* Define some IRQ masks */
 /* This is the mask used at reset by the chip */
-#define TMIO_MASK_INIT_RCAR2	0x8b7f031d /* Initial value for R-Car Gen2+ */
 #define TMIO_MASK_ALL           0x837f031d
+#define TMIO_MASK_ALL_RCAR2	0x8b7f031d
 #define TMIO_MASK_READOP  (TMIO_STAT_RXRDY | TMIO_STAT_DATAEND)
 #define TMIO_MASK_WRITEOP (TMIO_STAT_TXRQ | TMIO_STAT_DATAEND)
 #define TMIO_MASK_CMD     (TMIO_STAT_CMDRESPEND | TMIO_STAT_CMDTIMEOUT | \

From 31c31a78dccfc6ad15af1f6e55ce8cfbb3d31fa5 Mon Sep 17 00:00:00 2001
From: Lukasz Majczak <lma@semihalf.com>
Date: Fri, 22 Sep 2023 08:34:10 +0200
Subject: [PATCH 0223/1043] drm/dp_mst: Fix NULL deref in
 get_mst_branch_device_by_guid_helper()

[ Upstream commit 3d887d512494d678b17c57b835c32f4e48d34f26 ]

As drm_dp_get_mst_branch_device_by_guid() is called from
drm_dp_get_mst_branch_device_by_guid(), mstb parameter has to be checked,
otherwise NULL dereference may occur in the call to
the memcpy() and cause following:

[12579.365869] BUG: kernel NULL pointer dereference, address: 0000000000000049
[12579.365878] #PF: supervisor read access in kernel mode
[12579.365880] #PF: error_code(0x0000) - not-present page
[12579.365882] PGD 0 P4D 0
[12579.365887] Oops: 0000 [#1] PREEMPT SMP NOPTI
...
[12579.365895] Workqueue: events_long drm_dp_mst_up_req_work
[12579.365899] RIP: 0010:memcmp+0xb/0x29
[12579.365921] Call Trace:
[12579.365927] get_mst_branch_device_by_guid_helper+0x22/0x64
[12579.365930] drm_dp_mst_up_req_work+0x137/0x416
[12579.365933] process_one_work+0x1d0/0x419
[12579.365935] worker_thread+0x11a/0x289
[12579.365938] kthread+0x13e/0x14f
[12579.365941] ? process_one_work+0x419/0x419
[12579.365943] ? kthread_blkcg+0x31/0x31
[12579.365946] ret_from_fork+0x1f/0x30

As get_mst_branch_device_by_guid_helper() is recursive, moving condition
to the first line allow to remove a similar one for step over of NULL elements
inside a loop.

Fixes: 5e93b8208d3c ("drm/dp/mst: move GUID storage from mgr, port to only mst branch")
Cc: <stable@vger.kernel.org> # 4.14+
Signed-off-by: Lukasz Majczak <lma@semihalf.com>
Reviewed-by: Radoslaw Biernacki <rad@chromium.org>
Signed-off-by: Manasi Navare <navaremanasi@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230922063410.23626-1-lma@semihalf.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index b5e15933cb5f..27305f339881 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2612,14 +2612,14 @@ static struct drm_dp_mst_branch *get_mst_branch_device_by_guid_helper(
 	struct drm_dp_mst_branch *found_mstb;
 	struct drm_dp_mst_port *port;
 
+	if (!mstb)
+		return NULL;
+
 	if (memcmp(mstb->guid, guid, 16) == 0)
 		return mstb;
 
 
 	list_for_each_entry(port, &mstb->ports, next) {
-		if (!port->mstb)
-			continue;
-
 		found_mstb = get_mst_branch_device_by_guid_helper(port->mstb, guid);
 
 		if (found_mstb)

From 13d357d9f22604b44c975080806c1bc6f3e2f51c Mon Sep 17 00:00:00 2001
From: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Date: Wed, 18 Oct 2023 21:34:36 +0200
Subject: [PATCH 0224/1043] r8169: fix the KCSAN reported data-race in rtl_tx
 while reading TxDescArray[entry].opts1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit dcf75a0f6bc136de94e88178ae5f51b7f879abc9 ]

KCSAN reported the following data-race:

==================================================================
BUG: KCSAN: data-race in rtl8169_poll (drivers/net/ethernet/realtek/r8169_main.c:4368 drivers/net/ethernet/realtek/r8169_main.c:4581) r8169

race at unknown origin, with read to 0xffff888140d37570 of 4 bytes by interrupt on cpu 21:
rtl8169_poll (drivers/net/ethernet/realtek/r8169_main.c:4368 drivers/net/ethernet/realtek/r8169_main.c:4581) r8169
__napi_poll (net/core/dev.c:6527)
net_rx_action (net/core/dev.c:6596 net/core/dev.c:6727)
__do_softirq (kernel/softirq.c:553)
__irq_exit_rcu (kernel/softirq.c:427 kernel/softirq.c:632)
irq_exit_rcu (kernel/softirq.c:647)
sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1074 (discriminator 14))
asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:645)
cpuidle_enter_state (drivers/cpuidle/cpuidle.c:291)
cpuidle_enter (drivers/cpuidle/cpuidle.c:390)
call_cpuidle (kernel/sched/idle.c:135)
do_idle (kernel/sched/idle.c:219 kernel/sched/idle.c:282)
cpu_startup_entry (kernel/sched/idle.c:378 (discriminator 1))
start_secondary (arch/x86/kernel/smpboot.c:210 arch/x86/kernel/smpboot.c:294)
secondary_startup_64_no_verify (arch/x86/kernel/head_64.S:433)

value changed: 0xb0000042 -> 0x00000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 21 PID: 0 Comm: swapper/21 Tainted: G             L     6.6.0-rc2-kcsan-00143-gb5cbe7c00aa0 #41
Hardware name: ASRock X670E PG Lightning/X670E PG Lightning, BIOS 1.21 04/26/2023
==================================================================

The read side is in

drivers/net/ethernet/realtek/r8169_main.c
=========================================
   4355 static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp,
   4356                    int budget)
   4357 {
   4358         unsigned int dirty_tx, bytes_compl = 0, pkts_compl = 0;
   4359         struct sk_buff *skb;
   4360
   4361         dirty_tx = tp->dirty_tx;
   4362
   4363         while (READ_ONCE(tp->cur_tx) != dirty_tx) {
   4364                 unsigned int entry = dirty_tx % NUM_TX_DESC;
   4365                 u32 status;
   4366
 → 4367                 status = le32_to_cpu(tp->TxDescArray[entry].opts1);
   4368                 if (status & DescOwn)
   4369                         break;
   4370
   4371                 skb = tp->tx_skb[entry].skb;
   4372                 rtl8169_unmap_tx_skb(tp, entry);
   4373
   4374                 if (skb) {
   4375                         pkts_compl++;
   4376                         bytes_compl += skb->len;
   4377                         napi_consume_skb(skb, budget);
   4378                 }
   4379                 dirty_tx++;
   4380         }
   4381
   4382         if (tp->dirty_tx != dirty_tx) {
   4383                 dev_sw_netstats_tx_add(dev, pkts_compl, bytes_compl);
   4384                 WRITE_ONCE(tp->dirty_tx, dirty_tx);
   4385
   4386                 netif_subqueue_completed_wake(dev, 0, pkts_compl, bytes_compl,
   4387                                               rtl_tx_slots_avail(tp),
   4388                                               R8169_TX_START_THRS);
   4389                 /*
   4390                  * 8168 hack: TxPoll requests are lost when the Tx packets are
   4391                  * too close. Let's kick an extra TxPoll request when a burst
   4392                  * of start_xmit activity is detected (if it is not detected,
   4393                  * it is slow enough). -- FR
   4394                  * If skb is NULL then we come here again once a tx irq is
   4395                  * triggered after the last fragment is marked transmitted.
   4396                  */
   4397                 if (READ_ONCE(tp->cur_tx) != dirty_tx && skb)
   4398                         rtl8169_doorbell(tp);
   4399         }
   4400 }

tp->TxDescArray[entry].opts1 is reported to have a data-race and READ_ONCE() fixes
this KCSAN warning.

   4366
 → 4367                 status = le32_to_cpu(READ_ONCE(tp->TxDescArray[entry].opts1));
   4368                 if (status & DescOwn)
   4369                         break;
   4370

Cc: Heiner Kallweit <hkallweit1@gmail.com>
Cc: nic_swsd@realtek.com
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Marco Elver <elver@google.com>
Cc: netdev@vger.kernel.org
Link: https://lore.kernel.org/lkml/dc7fc8fa-4ea4-e9a9-30a6-7c83e6b53188@alu.unizg.hr/
Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Acked-by: Marco Elver <elver@google.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index c025dadcce28..d47adc7725ad 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -4470,7 +4470,7 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp,
 		struct sk_buff *skb = tp->tx_skb[entry].skb;
 		u32 status;
 
-		status = le32_to_cpu(tp->TxDescArray[entry].opts1);
+		status = le32_to_cpu(READ_ONCE(tp->TxDescArray[entry].opts1));
 		if (status & DescOwn)
 			break;
 

From 5eab293b1cbfea1e5df41e81862c950d7c9509c6 Mon Sep 17 00:00:00 2001
From: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Date: Wed, 18 Oct 2023 21:34:38 +0200
Subject: [PATCH 0225/1043] r8169: fix the KCSAN reported data race in rtl_rx
 while reading desc->opts1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f97eee484e71890131f9c563c5cc6d5a69e4308d ]

KCSAN reported the following data-race bug:

==================================================================
BUG: KCSAN: data-race in rtl8169_poll (drivers/net/ethernet/realtek/r8169_main.c:4430 drivers/net/ethernet/realtek/r8169_main.c:4583) r8169

race at unknown origin, with read to 0xffff888117e43510 of 4 bytes by interrupt on cpu 21:
rtl8169_poll (drivers/net/ethernet/realtek/r8169_main.c:4430 drivers/net/ethernet/realtek/r8169_main.c:4583) r8169
__napi_poll (net/core/dev.c:6527)
net_rx_action (net/core/dev.c:6596 net/core/dev.c:6727)
__do_softirq (kernel/softirq.c:553)
__irq_exit_rcu (kernel/softirq.c:427 kernel/softirq.c:632)
irq_exit_rcu (kernel/softirq.c:647)
sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1074 (discriminator 14))
asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:645)
cpuidle_enter_state (drivers/cpuidle/cpuidle.c:291)
cpuidle_enter (drivers/cpuidle/cpuidle.c:390)
call_cpuidle (kernel/sched/idle.c:135)
do_idle (kernel/sched/idle.c:219 kernel/sched/idle.c:282)
cpu_startup_entry (kernel/sched/idle.c:378 (discriminator 1))
start_secondary (arch/x86/kernel/smpboot.c:210 arch/x86/kernel/smpboot.c:294)
secondary_startup_64_no_verify (arch/x86/kernel/head_64.S:433)

value changed: 0x80003fff -> 0x3402805f

Reported by Kernel Concurrency Sanitizer on:
CPU: 21 PID: 0 Comm: swapper/21 Tainted: G             L     6.6.0-rc2-kcsan-00143-gb5cbe7c00aa0 #41
Hardware name: ASRock X670E PG Lightning/X670E PG Lightning, BIOS 1.21 04/26/2023
==================================================================

drivers/net/ethernet/realtek/r8169_main.c:
==========================================
   4429
 → 4430                 status = le32_to_cpu(desc->opts1);
   4431                 if (status & DescOwn)
   4432                         break;
   4433
   4434                 /* This barrier is needed to keep us from reading
   4435                  * any other fields out of the Rx descriptor until
   4436                  * we know the status of DescOwn
   4437                  */
   4438                 dma_rmb();
   4439
   4440                 if (unlikely(status & RxRES)) {
   4441                         if (net_ratelimit())
   4442                                 netdev_warn(dev, "Rx ERROR. status = %08x\n",

Marco Elver explained that dma_rmb() doesn't prevent the compiler to tear up the access to
desc->opts1 which can be written to concurrently. READ_ONCE() should prevent that from
happening:

   4429
 → 4430                 status = le32_to_cpu(READ_ONCE(desc->opts1));
   4431                 if (status & DescOwn)
   4432                         break;
   4433

As the consequence of this fix, this KCSAN warning was eliminated.

Fixes: 6202806e7c03a ("r8169: drop member opts1_mask from struct rtl8169_private")
Suggested-by: Marco Elver <elver@google.com>
Cc: Heiner Kallweit <hkallweit1@gmail.com>
Cc: nic_swsd@realtek.com
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org
Link: https://lore.kernel.org/lkml/dc7fc8fa-4ea4-e9a9-30a6-7c83e6b53188@alu.unizg.hr/
Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Acked-by: Marco Elver <elver@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index d47adc7725ad..37e34d8f7946 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -4544,7 +4544,7 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
 		dma_addr_t addr;
 		u32 status;
 
-		status = le32_to_cpu(desc->opts1);
+		status = le32_to_cpu(READ_ONCE(desc->opts1));
 		if (status & DescOwn)
 			break;
 

From 1ac4f8e5553cc0d6a92b56016fe1d6b64d2b9daf Mon Sep 17 00:00:00 2001
From: Kunwu Chan <chentao@kylinos.cn>
Date: Fri, 20 Oct 2023 17:31:56 +0800
Subject: [PATCH 0226/1043] treewide: Spelling fix in comment

[ Upstream commit fb71ba0ed8be9534493c80ba00142a64d9972a72 ]

reques -> request

Fixes: 09dde54c6a69 ("PS3: gelic: Add wireless support for PS3")
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/toshiba/ps3_gelic_wireless.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
index dc14a66583ff..44488c153ea2 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
@@ -1217,7 +1217,7 @@ static int gelic_wl_set_encodeext(struct net_device *netdev,
 		key_index = wl->current_key;
 
 	if (!enc->length && (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)) {
-		/* reques to change default key index */
+		/* request to change default key index */
 		pr_debug("%s: request to change default key to %d\n",
 			 __func__, key_index);
 		wl->current_key = key_index;

From 77c4f14f952e50ece062fcc98df546ff4c8f732c Mon Sep 17 00:00:00 2001
From: Mateusz Palczewski <mateusz.palczewski@intel.com>
Date: Thu, 19 Oct 2023 13:40:35 -0700
Subject: [PATCH 0227/1043] igb: Fix potential memory leak in
 igb_add_ethtool_nfc_entry

[ Upstream commit 8c0b48e01daba5ca58f939a8425855d3f4f2ed14 ]

Add check for return of igb_update_ethtool_nfc_entry so that in case
of any potential errors the memory alocated for input will be freed.

Fixes: 0e71def25281 ("igb: add support of RX network flow classification")
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel)
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/igb/igb_ethtool.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index d9de3b811543..2d1d9090f2cb 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -2987,11 +2987,15 @@ static int igb_add_ethtool_nfc_entry(struct igb_adapter *adapter,
 	if (err)
 		goto err_out_w_lock;
 
-	igb_update_ethtool_nfc_entry(adapter, input, input->sw_idx);
+	err = igb_update_ethtool_nfc_entry(adapter, input, input->sw_idx);
+	if (err)
+		goto err_out_input_filter;
 
 	spin_unlock(&adapter->nfc_lock);
 	return 0;
 
+err_out_input_filter:
+	igb_erase_filter(adapter, input);
 err_out_w_lock:
 	spin_unlock(&adapter->nfc_lock);
 err_out:

From 1e628189a21b1cde5c0ac7c1984d0356543963fb Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 19 Oct 2023 12:21:04 +0000
Subject: [PATCH 0228/1043] neighbour: fix various data-races

[ Upstream commit a9beb7e81bcb876615e1fbb3c07f3f9dba69831f ]

1) tbl->gc_thresh1, tbl->gc_thresh2, tbl->gc_thresh3 and tbl->gc_interval
   can be written from sysfs.

2) tbl->last_flush is read locklessly from neigh_alloc()

3) tbl->proxy_queue.qlen is read locklessly from neightbl_fill_info()

4) neightbl_fill_info() reads cpu stats that can be changed concurrently.

Fixes: c7fb64db001f ("[NETLINK]: Neighbour table configuration and statistics via rtnetlink")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20231019122104.1448310-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/neighbour.c | 67 +++++++++++++++++++++++---------------------
 1 file changed, 35 insertions(+), 32 deletions(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 15267428c4f8..4c43183a8d93 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -224,7 +224,8 @@ bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
 
 static int neigh_forced_gc(struct neigh_table *tbl)
 {
-	int max_clean = atomic_read(&tbl->gc_entries) - tbl->gc_thresh2;
+	int max_clean = atomic_read(&tbl->gc_entries) -
+			READ_ONCE(tbl->gc_thresh2);
 	unsigned long tref = jiffies - 5 * HZ;
 	struct neighbour *n, *tmp;
 	int shrunk = 0;
@@ -253,7 +254,7 @@ static int neigh_forced_gc(struct neigh_table *tbl)
 		}
 	}
 
-	tbl->last_flush = jiffies;
+	WRITE_ONCE(tbl->last_flush, jiffies);
 
 	write_unlock_bh(&tbl->lock);
 
@@ -409,17 +410,17 @@ static struct neighbour *neigh_alloc(struct neigh_table *tbl,
 {
 	struct neighbour *n = NULL;
 	unsigned long now = jiffies;
-	int entries;
+	int entries, gc_thresh3;
 
 	if (exempt_from_gc)
 		goto do_alloc;
 
 	entries = atomic_inc_return(&tbl->gc_entries) - 1;
-	if (entries >= tbl->gc_thresh3 ||
-	    (entries >= tbl->gc_thresh2 &&
-	     time_after(now, tbl->last_flush + 5 * HZ))) {
-		if (!neigh_forced_gc(tbl) &&
-		    entries >= tbl->gc_thresh3) {
+	gc_thresh3 = READ_ONCE(tbl->gc_thresh3);
+	if (entries >= gc_thresh3 ||
+	    (entries >= READ_ONCE(tbl->gc_thresh2) &&
+	     time_after(now, READ_ONCE(tbl->last_flush) + 5 * HZ))) {
+		if (!neigh_forced_gc(tbl) && entries >= gc_thresh3) {
 			net_info_ratelimited("%s: neighbor table overflow!\n",
 					     tbl->id);
 			NEIGH_CACHE_STAT_INC(tbl, table_fulls);
@@ -902,13 +903,14 @@ static void neigh_periodic_work(struct work_struct *work)
 
 	if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 		struct neigh_parms *p;
-		tbl->last_rand = jiffies;
+
+		WRITE_ONCE(tbl->last_rand, jiffies);
 		list_for_each_entry(p, &tbl->parms_list, list)
 			p->reachable_time =
 				neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 	}
 
-	if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
+	if (atomic_read(&tbl->entries) < READ_ONCE(tbl->gc_thresh1))
 		goto out;
 
 	for (i = 0 ; i < (1 << nht->hash_shift); i++) {
@@ -2055,15 +2057,16 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
 	ndtmsg->ndtm_pad2   = 0;
 
 	if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
-	    nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
-	    nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
-	    nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
-	    nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
+	    nla_put_msecs(skb, NDTA_GC_INTERVAL, READ_ONCE(tbl->gc_interval),
+			  NDTA_PAD) ||
+	    nla_put_u32(skb, NDTA_THRESH1, READ_ONCE(tbl->gc_thresh1)) ||
+	    nla_put_u32(skb, NDTA_THRESH2, READ_ONCE(tbl->gc_thresh2)) ||
+	    nla_put_u32(skb, NDTA_THRESH3, READ_ONCE(tbl->gc_thresh3)))
 		goto nla_put_failure;
 	{
 		unsigned long now = jiffies;
-		long flush_delta = now - tbl->last_flush;
-		long rand_delta = now - tbl->last_rand;
+		long flush_delta = now - READ_ONCE(tbl->last_flush);
+		long rand_delta = now - READ_ONCE(tbl->last_rand);
 		struct neigh_hash_table *nht;
 		struct ndt_config ndc = {
 			.ndtc_key_len		= tbl->key_len,
@@ -2071,7 +2074,7 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
 			.ndtc_entries		= atomic_read(&tbl->entries),
 			.ndtc_last_flush	= jiffies_to_msecs(flush_delta),
 			.ndtc_last_rand		= jiffies_to_msecs(rand_delta),
-			.ndtc_proxy_qlen	= tbl->proxy_queue.qlen,
+			.ndtc_proxy_qlen	= READ_ONCE(tbl->proxy_queue.qlen),
 		};
 
 		rcu_read_lock_bh();
@@ -2094,17 +2097,17 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
 			struct neigh_statistics	*st;
 
 			st = per_cpu_ptr(tbl->stats, cpu);
-			ndst.ndts_allocs		+= st->allocs;
-			ndst.ndts_destroys		+= st->destroys;
-			ndst.ndts_hash_grows		+= st->hash_grows;
-			ndst.ndts_res_failed		+= st->res_failed;
-			ndst.ndts_lookups		+= st->lookups;
-			ndst.ndts_hits			+= st->hits;
-			ndst.ndts_rcv_probes_mcast	+= st->rcv_probes_mcast;
-			ndst.ndts_rcv_probes_ucast	+= st->rcv_probes_ucast;
-			ndst.ndts_periodic_gc_runs	+= st->periodic_gc_runs;
-			ndst.ndts_forced_gc_runs	+= st->forced_gc_runs;
-			ndst.ndts_table_fulls		+= st->table_fulls;
+			ndst.ndts_allocs		+= READ_ONCE(st->allocs);
+			ndst.ndts_destroys		+= READ_ONCE(st->destroys);
+			ndst.ndts_hash_grows		+= READ_ONCE(st->hash_grows);
+			ndst.ndts_res_failed		+= READ_ONCE(st->res_failed);
+			ndst.ndts_lookups		+= READ_ONCE(st->lookups);
+			ndst.ndts_hits			+= READ_ONCE(st->hits);
+			ndst.ndts_rcv_probes_mcast	+= READ_ONCE(st->rcv_probes_mcast);
+			ndst.ndts_rcv_probes_ucast	+= READ_ONCE(st->rcv_probes_ucast);
+			ndst.ndts_periodic_gc_runs	+= READ_ONCE(st->periodic_gc_runs);
+			ndst.ndts_forced_gc_runs	+= READ_ONCE(st->forced_gc_runs);
+			ndst.ndts_table_fulls		+= READ_ONCE(st->table_fulls);
 		}
 
 		if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
@@ -2328,16 +2331,16 @@ static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh,
 		goto errout_tbl_lock;
 
 	if (tb[NDTA_THRESH1])
-		tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
+		WRITE_ONCE(tbl->gc_thresh1, nla_get_u32(tb[NDTA_THRESH1]));
 
 	if (tb[NDTA_THRESH2])
-		tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
+		WRITE_ONCE(tbl->gc_thresh2, nla_get_u32(tb[NDTA_THRESH2]));
 
 	if (tb[NDTA_THRESH3])
-		tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
+		WRITE_ONCE(tbl->gc_thresh3, nla_get_u32(tb[NDTA_THRESH3]));
 
 	if (tb[NDTA_GC_INTERVAL])
-		tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
+		WRITE_ONCE(tbl->gc_interval, nla_get_msecs(tb[NDTA_GC_INTERVAL]));
 
 	err = 0;
 

From 634c72adc864124245305b602ac4a4ff0302b044 Mon Sep 17 00:00:00 2001
From: Sasha Neftin <sasha.neftin@intel.com>
Date: Thu, 19 Oct 2023 13:36:41 -0700
Subject: [PATCH 0229/1043] igc: Fix ambiguity in the ethtool advertising

[ Upstream commit e7684d29efdf37304c62bb337ea55b3428ca118e ]

The 'ethtool_convert_link_mode_to_legacy_u32' method does not allow us to
advertise 2500M speed support and TP (twisted pair) properly. Convert to
'ethtool_link_ksettings_test_link_mode' to advertise supported speed and
eliminate ambiguity.

Fixes: 8c5ad0dae93c ("igc: Add ethtool support")
Suggested-by: Dima Ruinskiy <dima.ruinskiy@intel.com>
Suggested-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
Tested-by: Naama Meir <naamax.meir@linux.intel.com>
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://lore.kernel.org/r/20231019203641.3661960-1-jacob.e.keller@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/igc/igc_ethtool.c | 35 ++++++++++++++------
 1 file changed, 25 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c
index d28ac3a025ab..9b01912c6e17 100644
--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c
+++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c
@@ -1775,7 +1775,7 @@ igc_ethtool_set_link_ksettings(struct net_device *netdev,
 	struct igc_adapter *adapter = netdev_priv(netdev);
 	struct net_device *dev = adapter->netdev;
 	struct igc_hw *hw = &adapter->hw;
-	u32 advertising;
+	u16 advertised = 0;
 
 	/* When adapter in resetting mode, autoneg/speed/duplex
 	 * cannot be changed
@@ -1800,18 +1800,33 @@ igc_ethtool_set_link_ksettings(struct net_device *netdev,
 	while (test_and_set_bit(__IGC_RESETTING, &adapter->state))
 		usleep_range(1000, 2000);
 
-	ethtool_convert_link_mode_to_legacy_u32(&advertising,
-						cmd->link_modes.advertising);
-	/* Converting to legacy u32 drops ETHTOOL_LINK_MODE_2500baseT_Full_BIT.
-	 * We have to check this and convert it to ADVERTISE_2500_FULL
-	 * (aka ETHTOOL_LINK_MODE_2500baseX_Full_BIT) explicitly.
-	 */
-	if (ethtool_link_ksettings_test_link_mode(cmd, advertising, 2500baseT_Full))
-		advertising |= ADVERTISE_2500_FULL;
+	if (ethtool_link_ksettings_test_link_mode(cmd, advertising,
+						  2500baseT_Full))
+		advertised |= ADVERTISE_2500_FULL;
+
+	if (ethtool_link_ksettings_test_link_mode(cmd, advertising,
+						  1000baseT_Full))
+		advertised |= ADVERTISE_1000_FULL;
+
+	if (ethtool_link_ksettings_test_link_mode(cmd, advertising,
+						  100baseT_Full))
+		advertised |= ADVERTISE_100_FULL;
+
+	if (ethtool_link_ksettings_test_link_mode(cmd, advertising,
+						  100baseT_Half))
+		advertised |= ADVERTISE_100_HALF;
+
+	if (ethtool_link_ksettings_test_link_mode(cmd, advertising,
+						  10baseT_Full))
+		advertised |= ADVERTISE_10_FULL;
+
+	if (ethtool_link_ksettings_test_link_mode(cmd, advertising,
+						  10baseT_Half))
+		advertised |= ADVERTISE_10_HALF;
 
 	if (cmd->base.autoneg == AUTONEG_ENABLE) {
 		hw->mac.autoneg = 1;
-		hw->phy.autoneg_advertised = advertising;
+		hw->phy.autoneg_advertised = advertised;
 		if (adapter->fc_autoneg)
 			hw->fc.requested_mode = igc_fc_default;
 	} else {

From d9864e589f0e0b86d6eb2d713e8187b88d818c8c Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 21 Oct 2023 20:03:53 +0200
Subject: [PATCH 0230/1043] net: ieee802154: adf7242: Fix some potential buffer
 overflow in adf7242_stats_show()

[ Upstream commit ca082f019d8fbb983f03080487946da714154bae ]

strncat() usage in adf7242_debugfs_init() is wrong.
The size given to strncat() is the maximum number of bytes that can be
written, excluding the trailing NULL.

Here, the size that is passed, DNAME_INLINE_LEN, does not take into account
the size of "adf7242-" that is already in the array.

In order to fix it, use snprintf() instead.

Fixes: 7302b9d90117 ("ieee802154/adf7242: Driver for ADF7242 MAC IEEE802154")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ieee802154/adf7242.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
index 07adbeec1978..14cf8b0dfad9 100644
--- a/drivers/net/ieee802154/adf7242.c
+++ b/drivers/net/ieee802154/adf7242.c
@@ -1162,9 +1162,10 @@ static int adf7242_stats_show(struct seq_file *file, void *offset)
 
 static void adf7242_debugfs_init(struct adf7242_local *lp)
 {
-	char debugfs_dir_name[DNAME_INLINE_LEN + 1] = "adf7242-";
+	char debugfs_dir_name[DNAME_INLINE_LEN + 1];
 
-	strncat(debugfs_dir_name, dev_name(&lp->spi->dev), DNAME_INLINE_LEN);
+	snprintf(debugfs_dir_name, sizeof(debugfs_dir_name),
+		 "adf7242-%s", dev_name(&lp->spi->dev));
 
 	lp->debugfs_root = debugfs_create_dir(debugfs_dir_name, NULL);
 

From 79e2610efc940a0e62d37a38926a46313cc7a338 Mon Sep 17 00:00:00 2001
From: Shigeru Yoshida <syoshida@redhat.com>
Date: Sat, 21 Oct 2023 02:03:44 +0900
Subject: [PATCH 0231/1043] net: usb: smsc95xx: Fix uninit-value access in
 smsc95xx_read_reg

[ Upstream commit 51a32e828109b4a209efde44505baa356b37a4ce ]

syzbot reported the following uninit-value access issue [1]:

smsc95xx 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32
smsc95xx 1-1:0.0 (unnamed net_device) (uninitialized): Error reading E2P_CMD
=====================================================
BUG: KMSAN: uninit-value in smsc95xx_reset+0x409/0x25f0 drivers/net/usb/smsc95xx.c:896
 smsc95xx_reset+0x409/0x25f0 drivers/net/usb/smsc95xx.c:896
 smsc95xx_bind+0x9bc/0x22e0 drivers/net/usb/smsc95xx.c:1131
 usbnet_probe+0x100b/0x4060 drivers/net/usb/usbnet.c:1750
 usb_probe_interface+0xc75/0x1210 drivers/usb/core/driver.c:396
 really_probe+0x506/0xf40 drivers/base/dd.c:658
 __driver_probe_device+0x2a7/0x5d0 drivers/base/dd.c:800
 driver_probe_device+0x72/0x7b0 drivers/base/dd.c:830
 __device_attach_driver+0x55a/0x8f0 drivers/base/dd.c:958
 bus_for_each_drv+0x3ff/0x620 drivers/base/bus.c:457
 __device_attach+0x3bd/0x640 drivers/base/dd.c:1030
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1079
 bus_probe_device+0x3d8/0x5a0 drivers/base/bus.c:532
 device_add+0x16ae/0x1f20 drivers/base/core.c:3622
 usb_set_configuration+0x31c9/0x38c0 drivers/usb/core/message.c:2207
 usb_generic_driver_probe+0x109/0x2a0 drivers/usb/core/generic.c:238
 usb_probe_device+0x290/0x4a0 drivers/usb/core/driver.c:293
 really_probe+0x506/0xf40 drivers/base/dd.c:658
 __driver_probe_device+0x2a7/0x5d0 drivers/base/dd.c:800
 driver_probe_device+0x72/0x7b0 drivers/base/dd.c:830
 __device_attach_driver+0x55a/0x8f0 drivers/base/dd.c:958
 bus_for_each_drv+0x3ff/0x620 drivers/base/bus.c:457
 __device_attach+0x3bd/0x640 drivers/base/dd.c:1030
 device_initial_probe+0x32/0x40 drivers/base/dd.c:1079
 bus_probe_device+0x3d8/0x5a0 drivers/base/bus.c:532
 device_add+0x16ae/0x1f20 drivers/base/core.c:3622
 usb_new_device+0x15f6/0x22f0 drivers/usb/core/hub.c:2589
 hub_port_connect drivers/usb/core/hub.c:5440 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5580 [inline]
 port_event drivers/usb/core/hub.c:5740 [inline]
 hub_event+0x53bc/0x7290 drivers/usb/core/hub.c:5822
 process_one_work kernel/workqueue.c:2630 [inline]
 process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2703
 worker_thread+0xf45/0x1490 kernel/workqueue.c:2784
 kthread+0x3e8/0x540 kernel/kthread.c:388
 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

Local variable buf.i225 created at:
 smsc95xx_read_reg drivers/net/usb/smsc95xx.c:90 [inline]
 smsc95xx_reset+0x203/0x25f0 drivers/net/usb/smsc95xx.c:892
 smsc95xx_bind+0x9bc/0x22e0 drivers/net/usb/smsc95xx.c:1131

CPU: 1 PID: 773 Comm: kworker/1:2 Not tainted 6.6.0-rc1-syzkaller-00125-ge42bebf6db29 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
Workqueue: usb_hub_wq hub_event
=====================================================

Similar to e9c65989920f ("net: usb: smsc75xx: Fix uninit-value access in
__smsc75xx_read_reg"), this issue is caused because usbnet_read_cmd() reads
less bytes than requested (zero byte in the reproducer). In this case,
'buf' is not properly filled.

This patch fixes the issue by returning -ENODATA if usbnet_read_cmd() reads
less bytes than requested.

sysbot reported similar uninit-value access issue [2]. The root cause is
the same as mentioned above, and this patch addresses it as well.

Fixes: 2f7ca802bdae ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver")
Reported-and-tested-by: syzbot+c74c24b43c9ae534f0e0@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+2c97a98a5ba9ea9c23bd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c74c24b43c9ae534f0e0 [1]
Closes: https://syzkaller.appspot.com/bug?extid=2c97a98a5ba9ea9c23bd [2]
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/smsc95xx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 9297f2078fd2..569be01700aa 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -86,7 +86,9 @@ static int __must_check __smsc95xx_read_reg(struct usbnet *dev, u32 index,
 	ret = fn(dev, USB_VENDOR_REQUEST_READ_REGISTER, USB_DIR_IN
 		 | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 		 0, index, &buf, 4);
-	if (ret < 0) {
+	if (ret < 4) {
+		ret = ret < 0 ? ret : -ENODATA;
+
 		if (ret != -ENODEV)
 			netdev_warn(dev->net, "Failed to read reg index 0x%08x: %d\n",
 				    index, ret);

From 704c25fc6abd7a5a4d27f0ef53e5e0fda66c37b7 Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Fri, 20 Oct 2023 14:06:52 -0700
Subject: [PATCH 0232/1043] r8152: Increase USB control msg timeout to 5000ms
 as per spec

[ Upstream commit a5feba71ec9c14a54c3babdc732c5b6866d8ee43 ]

According to the comment next to USB_CTRL_GET_TIMEOUT and
USB_CTRL_SET_TIMEOUT, although sending/receiving control messages is
usually quite fast, the spec allows them to take up to 5 seconds.
Let's increase the timeout in the Realtek driver from 500ms to 5000ms
(using the #defines) to account for this.

This is not just a theoretical change. The need for the longer timeout
was seen in testing. Specifically, if you drop a sc7180-trogdor based
Chromebook into the kdb debugger and then "go" again after sitting in
the debugger for a while, the next USB control message takes a long
time. Out of ~40 tests the slowest USB control message was 4.5
seconds.

While dropping into kdb is not exactly an end-user scenario, the above
is similar to what could happen due to an temporary interrupt storm,
what could happen if there was a host controller (HW or SW) issue, or
what could happen if the Realtek device got into a confused state and
needed time to recover.

This change is fairly critical since the r8152 driver in Linux doesn't
expect register reads/writes (which are backed by USB control
messages) to fail.

Fixes: ac718b69301c ("net/usb: new driver for RTL8152")
Suggested-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/r8152.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index cc7c86debfa2..d0ab761dad18 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1042,7 +1042,7 @@ int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
 
 	ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0),
 			      RTL8152_REQ_GET_REGS, RTL8152_REQT_READ,
-			      value, index, tmp, size, 500);
+			      value, index, tmp, size, USB_CTRL_GET_TIMEOUT);
 	if (ret < 0)
 		memset(data, 0xff, size);
 	else
@@ -1065,7 +1065,7 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
 
 	ret = usb_control_msg(tp->udev, usb_sndctrlpipe(tp->udev, 0),
 			      RTL8152_REQ_SET_REGS, RTL8152_REQT_WRITE,
-			      value, index, tmp, size, 500);
+			      value, index, tmp, size, USB_CTRL_SET_TIMEOUT);
 
 	kfree(tmp);
 
@@ -6615,7 +6615,8 @@ static u8 rtl_get_version(struct usb_interface *intf)
 
 	ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 			      RTL8152_REQ_GET_REGS, RTL8152_REQT_READ,
-			      PLA_TCR0, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
+			      PLA_TCR0, MCU_TYPE_PLA, tmp, sizeof(*tmp),
+			      USB_CTRL_GET_TIMEOUT);
 	if (ret > 0)
 		ocp_data = (__le32_to_cpu(*tmp) >> 16) & VERSION_MASK;
 

From 7dc907d855df3bf22c63dd1425973632540716a4 Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Fri, 20 Oct 2023 14:06:53 -0700
Subject: [PATCH 0233/1043] r8152: Run the unload routine if we have errors
 during probe

[ Upstream commit 5dd17689526971c5ae12bc8398f34bd68cd0499e ]

The rtl8152_probe() function lacks a call to the chip-specific
unload() routine when it sees an error in probe. Add it in to match
the cleanup code in rtl8152_disconnect().

Fixes: ac718b69301c ("net/usb: new driver for RTL8152")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/r8152.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index d0ab761dad18..517334aab278 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -6825,6 +6825,8 @@ static int rtl8152_probe(struct usb_interface *intf,
 
 out1:
 	tasklet_kill(&tp->tx_tl);
+	if (tp->rtl_ops.unload)
+		tp->rtl_ops.unload(tp);
 	usb_set_intfdata(intf, NULL);
 out:
 	free_netdev(netdev);

From 17b455747bc6d0b4a3b2fbb2781e7e8b67a259f9 Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Fri, 20 Oct 2023 14:06:54 -0700
Subject: [PATCH 0234/1043] r8152: Cancel hw_phy_work if we have an error in
 probe

[ Upstream commit bb8adff9123e492598162ac1baad01a53891aef6 ]

The error handling in rtl8152_probe() is missing a call to cancel the
hw_phy_work. Add it in to match what's in the cleanup code in
rtl8152_disconnect().

Fixes: a028a9e003f2 ("r8152: move the settings of PHY to a work queue")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/r8152.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 517334aab278..beb1fb6f7273 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -6825,6 +6825,7 @@ static int rtl8152_probe(struct usb_interface *intf,
 
 out1:
 	tasklet_kill(&tp->tx_tl);
+	cancel_delayed_work_sync(&tp->hw_phy_work);
 	if (tp->rtl_ops.unload)
 		tp->rtl_ops.unload(tp);
 	usb_set_intfdata(intf, NULL);

From e0308c793943b8ef7d790fc202914501820e9e4b Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Fri, 20 Oct 2023 14:06:55 -0700
Subject: [PATCH 0235/1043] r8152: Release firmware if we have an error in
 probe

[ Upstream commit b8d35024d4059ca550cba11ac9ab23a6c238d929 ]

The error handling in rtl8152_probe() is missing a call to release
firmware. Add it in to match what's in the cleanup code in
rtl8152_disconnect().

Fixes: 9370f2d05a2a ("r8152: support request_firmware for RTL8153")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/r8152.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index beb1fb6f7273..0d6f10c9bb13 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -6828,6 +6828,7 @@ static int rtl8152_probe(struct usb_interface *intf,
 	cancel_delayed_work_sync(&tp->hw_phy_work);
 	if (tp->rtl_ops.unload)
 		tp->rtl_ops.unload(tp);
+	rtl8152_release_firmware(tp);
 	usb_set_intfdata(intf, NULL);
 out:
 	free_netdev(netdev);

From 4d0d5e54b59063c6493f1e3cfb9349638f05f3a9 Mon Sep 17 00:00:00 2001
From: Fred Chen <fred.chenchen03@gmail.com>
Date: Sat, 21 Oct 2023 08:19:47 +0800
Subject: [PATCH 0236/1043] tcp: fix wrong RTO timeout when received SACK
 reneging

[ Upstream commit d2a0fc372aca561556e765d0a9ec365c7c12f0ad ]

This commit fix wrong RTO timeout when received SACK reneging.

When an ACK arrived pointing to a SACK reneging, tcp_check_sack_reneging()
will rearm the RTO timer for min(1/2*srtt, 10ms) into to the future.

But since the commit 62d9f1a6945b ("tcp: fix TLP timer not set when
CA_STATE changes from DISORDER to OPEN") merged, the tcp_set_xmit_timer()
is moved after tcp_fastretrans_alert()(which do the SACK reneging check),
so the RTO timeout will be overwrited by tcp_set_xmit_timer() with
icsk_rto instead of 1/2*srtt.

Here is a packetdrill script to check this bug:
0     socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0    bind(3, ..., ...) = 0
+0    listen(3, 1) = 0

// simulate srtt to 100ms
+0    < S 0:0(0) win 32792 <mss 1000, sackOK,nop,nop,nop,wscale 7>
+0    > S. 0:0(0) ack 1 <mss 1460,nop,nop,sackOK,nop,wscale 7>
+.1    < . 1:1(0) ack 1 win 1024

+0    accept(3, ..., ...) = 4

+0    write(4, ..., 10000) = 10000
+0    > P. 1:10001(10000) ack 1

// inject sack
+.1    < . 1:1(0) ack 1 win 257 <sack 1001:10001,nop,nop>
+0    > . 1:1001(1000) ack 1

// inject sack reneging
+.1    < . 1:1(0) ack 1001 win 257 <sack 9001:10001,nop,nop>

// we expect rto fired in 1/2*srtt (50ms)
+.05    > . 1001:2001(1000) ack 1

This fix remove the FLAG_SET_XMIT_TIMER from ack_flag when
tcp_check_sack_reneging() set RTO timer with 1/2*srtt to avoid
being overwrited later.

Fixes: 62d9f1a6945b ("tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN")
Signed-off-by: Fred Chen <fred.chenchen03@gmail.com>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Tested-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_input.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3f2b6a3adf6a..0c935904ced8 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2185,16 +2185,17 @@ void tcp_enter_loss(struct sock *sk)
  * restore sanity to the SACK scoreboard. If the apparent reneging
  * persists until this RTO then we'll clear the SACK scoreboard.
  */
-static bool tcp_check_sack_reneging(struct sock *sk, int flag)
+static bool tcp_check_sack_reneging(struct sock *sk, int *ack_flag)
 {
-	if (flag & FLAG_SACK_RENEGING &&
-	    flag & FLAG_SND_UNA_ADVANCED) {
+	if (*ack_flag & FLAG_SACK_RENEGING &&
+	    *ack_flag & FLAG_SND_UNA_ADVANCED) {
 		struct tcp_sock *tp = tcp_sk(sk);
 		unsigned long delay = max(usecs_to_jiffies(tp->srtt_us >> 4),
 					  msecs_to_jiffies(10));
 
 		inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
 					  delay, TCP_RTO_MAX);
+		*ack_flag &= ~FLAG_SET_XMIT_TIMER;
 		return true;
 	}
 	return false;
@@ -2950,7 +2951,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,
 		tp->prior_ssthresh = 0;
 
 	/* B. In all the states check for reneging SACKs. */
-	if (tcp_check_sack_reneging(sk, flag))
+	if (tcp_check_sack_reneging(sk, ack_flag))
 		return;
 
 	/* C. Check consistency of the current state. */

From 3ae8b75fce05f51643e3d90effdc76d6c6a41b75 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sun, 22 Oct 2023 22:25:17 +0200
Subject: [PATCH 0237/1043] gtp: uapi: fix GTPA_MAX

[ Upstream commit adc8df12d91a2b8350b0cd4c7fec3e8546c9d1f8 ]

Subtract one to __GTPA_MAX, otherwise GTPA_MAX is off by 2.

Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/uapi/linux/gtp.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/uapi/linux/gtp.h b/include/uapi/linux/gtp.h
index 79f9191bbb24..82d0e58ec3ce 100644
--- a/include/uapi/linux/gtp.h
+++ b/include/uapi/linux/gtp.h
@@ -32,6 +32,6 @@ enum gtp_attrs {
 	GTPA_PAD,
 	__GTPA_MAX,
 };
-#define GTPA_MAX (__GTPA_MAX + 1)
+#define GTPA_MAX (__GTPA_MAX - 1)
 
 #endif /* _UAPI_LINUX_GTP_H_ */

From fe65fc90e9f2f7e7766ba7534e32aa4a469a3101 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sun, 22 Oct 2023 22:25:18 +0200
Subject: [PATCH 0238/1043] gtp: fix fragmentation needed check with gso

[ Upstream commit 4530e5b8e2dad63dcad2206232dd86e4b1489b6c ]

Call skb_gso_validate_network_len() to check if packet is over PMTU.

Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/gtp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 05ea3a18552b..ed247cba2291 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -538,8 +538,9 @@ static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev,
 
 	rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu, false);
 
-	if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) &&
-	    mtu < ntohs(iph->tot_len)) {
+	if (iph->frag_off & htons(IP_DF) &&
+	    ((!skb_is_gso(skb) && skb->len > mtu) ||
+	     (skb_is_gso(skb) && !skb_gso_validate_network_len(skb, mtu)))) {
 		netdev_dbg(dev, "packet too big, fragmentation needed\n");
 		icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
 			      htonl(mtu));

From be9e6f51ba7b47fbe5869b8eb83eed100d33adf7 Mon Sep 17 00:00:00 2001
From: Ivan Vecera <ivecera@redhat.com>
Date: Mon, 23 Oct 2023 14:27:14 -0700
Subject: [PATCH 0239/1043] i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR

[ Upstream commit 77a8c982ff0d4c3a14022c6fe9e3dbfb327552ec ]

The I40E_TXR_FLAGS_WB_ON_ITR is i40e_ring flag and not i40e_pf one.

Fixes: 8e0764b4d6be42 ("i40e/i40evf: Add support for writeback on ITR feature for X722")
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://lore.kernel.org/r/20231023212714.178032-1-jacob.e.keller@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 43be33d87e39..88d8f17cefd8 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -2663,7 +2663,7 @@ int i40e_napi_poll(struct napi_struct *napi, int budget)
 		return budget;
 	}
 
-	if (vsi->back->flags & I40E_TXR_FLAGS_WB_ON_ITR)
+	if (q_vector->tx.ring[0].flags & I40E_TXR_FLAGS_WB_ON_ITR)
 		q_vector->arm_wb_state = false;
 
 	/* Exit the polling mode, but don't re-enable interrupts if stack might

From 632c2199e52d0e957dd47d4c931d60b82cd5ff29 Mon Sep 17 00:00:00 2001
From: Haibo Li <haibo.li@mediatek.com>
Date: Mon, 9 Oct 2023 15:37:48 +0800
Subject: [PATCH 0240/1043] kasan: print the original fault addr when access
 invalid shadow

commit babddbfb7d7d70ae7f10fedd75a45d8ad75fdddf upstream.

when the checked address is illegal,the corresponding shadow address from
kasan_mem_to_shadow may have no mapping in mmu table.  Access such shadow
address causes kernel oops.  Here is a sample about oops on arm64(VA
39bit) with KASAN_SW_TAGS and KASAN_OUTLINE on:

[ffffffb80aaaaaaa] pgd=000000005d3ce003, p4d=000000005d3ce003,
    pud=000000005d3ce003, pmd=0000000000000000
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 3 PID: 100 Comm: sh Not tainted 6.6.0-rc1-dirty #43
Hardware name: linux,dummy-virt (DT)
pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __hwasan_load8_noabort+0x5c/0x90
lr : do_ib_ob+0xf4/0x110
ffffffb80aaaaaaa is the shadow address for efffff80aaaaaaaa.
The problem is reading invalid shadow in kasan_check_range.

The generic kasan also has similar oops.

It only reports the shadow address which causes oops but not
the original address.

Commit 2f004eea0fc8("x86/kasan: Print original address on #GP")
introduce to kasan_non_canonical_hook but limit it to KASAN_INLINE.

This patch extends it to KASAN_OUTLINE mode.

Link: https://lkml.kernel.org/r/20231009073748.159228-1-haibo.li@mediatek.com
Fixes: 2f004eea0fc8("x86/kasan: Print original address on #GP")
Signed-off-by: Haibo Li <haibo.li@mediatek.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Haibo Li <haibo.li@mediatek.com>
Cc: Matthias Brugger <matthias.bgg@gmail.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/kasan.h | 6 +++---
 mm/kasan/report.c     | 4 +---
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 30d343b4a40a..c0b976dd138b 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -234,10 +234,10 @@ static inline void kasan_release_vmalloc(unsigned long start,
 					 unsigned long free_region_end) {}
 #endif
 
-#ifdef CONFIG_KASAN_INLINE
+#ifdef CONFIG_KASAN
 void kasan_non_canonical_hook(unsigned long addr);
-#else /* CONFIG_KASAN_INLINE */
+#else /* CONFIG_KASAN */
 static inline void kasan_non_canonical_hook(unsigned long addr) { }
-#endif /* CONFIG_KASAN_INLINE */
+#endif /* CONFIG_KASAN */
 
 #endif /* LINUX_KASAN_H */
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index 2f5e96ac4d00..98b08807c9c2 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -560,9 +560,8 @@ bool kasan_report(unsigned long addr, size_t size, bool is_write,
 	return ret;
 }
 
-#ifdef CONFIG_KASAN_INLINE
 /*
- * With CONFIG_KASAN_INLINE, accesses to bogus pointers (outside the high
+ * With CONFIG_KASAN, accesses to bogus pointers (outside the high
  * canonical half of the address space) cause out-of-bounds shadow memory reads
  * before the actual access. For addresses in the low canonical half of the
  * address space, as well as most non-canonical addresses, that out-of-bounds
@@ -598,4 +597,3 @@ void kasan_non_canonical_hook(unsigned long addr)
 	pr_alert("KASAN: %s in range [0x%016lx-0x%016lx]\n", bug_type,
 		 orig_addr, orig_addr + KASAN_SHADOW_MASK);
 }
-#endif

From 0c8587fec9d533346a3695ce36330a2441d9c13b Mon Sep 17 00:00:00 2001
From: Marek Szyprowski <m.szyprowski@samsung.com>
Date: Mon, 9 Oct 2023 12:14:12 +0200
Subject: [PATCH 0241/1043] iio: exynos-adc: request second interupt only when
 touchscreen mode is used

commit 865b080e3229102f160889328ce2e8e97aa65ea0 upstream.

Second interrupt is needed only when touchscreen mode is used, so don't
request it unconditionally. This removes the following annoying warning
during boot:

exynos-adc 14d10000.adc: error -ENXIO: IRQ index 1 not found

Fixes: 2bb8ad9b44c5 ("iio: exynos-adc: add experimental touchscreen support")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20231009101412.916922-1-m.szyprowski@samsung.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/exynos_adc.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/drivers/iio/adc/exynos_adc.c b/drivers/iio/adc/exynos_adc.c
index 99f4404e9fd1..b6f09e5acb91 100644
--- a/drivers/iio/adc/exynos_adc.c
+++ b/drivers/iio/adc/exynos_adc.c
@@ -821,16 +821,26 @@ static int exynos_adc_probe(struct platform_device *pdev)
 		}
 	}
 
+	/* leave out any TS related code if unreachable */
+	if (IS_REACHABLE(CONFIG_INPUT)) {
+		has_ts = of_property_read_bool(pdev->dev.of_node,
+					       "has-touchscreen") || pdata;
+	}
+
 	irq = platform_get_irq(pdev, 0);
 	if (irq < 0)
 		return irq;
 	info->irq = irq;
 
-	irq = platform_get_irq(pdev, 1);
-	if (irq == -EPROBE_DEFER)
-		return irq;
+	if (has_ts) {
+		irq = platform_get_irq(pdev, 1);
+		if (irq == -EPROBE_DEFER)
+			return irq;
 
-	info->tsirq = irq;
+		info->tsirq = irq;
+	} else {
+		info->tsirq = -1;
+	}
 
 	info->dev = &pdev->dev;
 
@@ -895,12 +905,6 @@ static int exynos_adc_probe(struct platform_device *pdev)
 	if (info->data->init_hw)
 		info->data->init_hw(info);
 
-	/* leave out any TS related code if unreachable */
-	if (IS_REACHABLE(CONFIG_INPUT)) {
-		has_ts = of_property_read_bool(pdev->dev.of_node,
-					       "has-touchscreen") || pdata;
-	}
-
 	if (pdata)
 		info->delay = pdata->delay;
 	else

From 3cb69f1dbc86d12c61f09450da2f9f7fa49716de Mon Sep 17 00:00:00 2001
From: Herve Codina <herve.codina@bootlin.com>
Date: Fri, 20 Oct 2023 17:30:11 +0200
Subject: [PATCH 0242/1043] i2c: muxes: i2c-mux-pinctrl: Use
 of_get_i2c_adapter_by_node()

commit 3171d37b58a76e1febbf3f4af2d06234a98cf88b upstream.

i2c-mux-pinctrl uses the pair of_find_i2c_adapter_by_node() /
i2c_put_adapter(). These pair alone is not correct to properly lock the
I2C parent adapter.

Indeed, i2c_put_adapter() decrements the module refcount while
of_find_i2c_adapter_by_node() does not increment it. This leads to an
underflow of the parent module refcount.

Use the dedicated function, of_get_i2c_adapter_by_node(), to handle
correctly the module refcount.

Fixes: c4aee3e1b0de ("i2c: mux: pinctrl: remove platform_data")
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Cc: stable@vger.kernel.org
Acked-by: Peter Rosin <peda@axentia.se>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/muxes/i2c-mux-pinctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/muxes/i2c-mux-pinctrl.c b/drivers/i2c/muxes/i2c-mux-pinctrl.c
index f1bb00a11ad6..fc991cf002af 100644
--- a/drivers/i2c/muxes/i2c-mux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c
@@ -62,7 +62,7 @@ static struct i2c_adapter *i2c_mux_pinctrl_parent_adapter(struct device *dev)
 		dev_err(dev, "Cannot parse i2c-parent\n");
 		return ERR_PTR(-ENODEV);
 	}
-	parent = of_find_i2c_adapter_by_node(parent_np);
+	parent = of_get_i2c_adapter_by_node(parent_np);
 	of_node_put(parent_np);
 	if (!parent)
 		return ERR_PTR(-EPROBE_DEFER);

From 9a9ead53e72fb75157de646555f536091e424c47 Mon Sep 17 00:00:00 2001
From: Herve Codina <herve.codina@bootlin.com>
Date: Fri, 20 Oct 2023 17:30:13 +0200
Subject: [PATCH 0243/1043] i2c: muxes: i2c-mux-gpmux: Use
 of_get_i2c_adapter_by_node()

commit 3dc0ec46f6e7511fc4fdf6b6cda439382bc957f1 upstream.

i2c-mux-gpmux uses the pair of_find_i2c_adapter_by_node() /
i2c_put_adapter(). These pair alone is not correct to properly lock the
I2C parent adapter.

Indeed, i2c_put_adapter() decrements the module refcount while
of_find_i2c_adapter_by_node() does not increment it. This leads to an
underflow of the parent module refcount.

Use the dedicated function, of_get_i2c_adapter_by_node(), to handle
correctly the module refcount.

Fixes: ac8498f0ce53 ("i2c: i2c-mux-gpmux: new driver")
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Cc: stable@vger.kernel.org
Acked-by: Peter Rosin <peda@axentia.se>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/muxes/i2c-mux-gpmux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/muxes/i2c-mux-gpmux.c b/drivers/i2c/muxes/i2c-mux-gpmux.c
index 33024acaac02..0ebc12575081 100644
--- a/drivers/i2c/muxes/i2c-mux-gpmux.c
+++ b/drivers/i2c/muxes/i2c-mux-gpmux.c
@@ -52,7 +52,7 @@ static struct i2c_adapter *mux_parent_adapter(struct device *dev)
 		dev_err(dev, "Cannot parse i2c-parent\n");
 		return ERR_PTR(-ENODEV);
 	}
-	parent = of_find_i2c_adapter_by_node(parent_np);
+	parent = of_get_i2c_adapter_by_node(parent_np);
 	of_node_put(parent_np);
 	if (!parent)
 		return ERR_PTR(-EPROBE_DEFER);

From 80416f6ba0025753649dfae2d1ab18ddc3cbbc2e Mon Sep 17 00:00:00 2001
From: Herve Codina <herve.codina@bootlin.com>
Date: Fri, 20 Oct 2023 17:30:12 +0200
Subject: [PATCH 0244/1043] i2c: muxes: i2c-demux-pinctrl: Use
 of_get_i2c_adapter_by_node()

commit 0fb118de5003028ad092a4e66fc6d07b86c3bc94 upstream.

i2c-demux-pinctrl uses the pair of_find_i2c_adapter_by_node() /
i2c_put_adapter(). These pair alone is not correct to properly lock the
I2C parent adapter.

Indeed, i2c_put_adapter() decrements the module refcount while
of_find_i2c_adapter_by_node() does not increment it. This leads to an
underflow of the parent module refcount.

Use the	dedicated function, of_get_i2c_adapter_by_node(), to handle
correctly the module refcount.

Fixes: 50a5ba876908 ("i2c: mux: demux-pinctrl: add driver")
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Cc: stable@vger.kernel.org
Acked-by: Peter Rosin <peda@axentia.se>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/muxes/i2c-demux-pinctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
index 8e8688e8de0f..45a3f7e7b3f6 100644
--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
@@ -61,7 +61,7 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
 	if (ret)
 		goto err;
 
-	adap = of_find_i2c_adapter_by_node(priv->chan[new_chan].parent_np);
+	adap = of_get_i2c_adapter_by_node(priv->chan[new_chan].parent_np);
 	if (!adap) {
 		ret = -ENODEV;
 		goto err_with_revert;

From 18c5167d046038337c6dbf97e83cb4c0b89356ed Mon Sep 17 00:00:00 2001
From: Alain Volmat <alain.volmat@foss.st.com>
Date: Tue, 10 Oct 2023 10:44:54 +0200
Subject: [PATCH 0245/1043] i2c: stm32f7: Fix PEC handling in case of SMBUS
 transfers

commit c896ff2dd8f30a6b0a922c83a96f6d43f05f0e92 upstream.

In case of SMBUS byte read with PEC enabled, the whole transfer
is split into two commands.  A first write command, followed by
a read command.  The write command does not have any PEC byte
and a PEC byte is appended at the end of the read command.
(cf Read byte protocol with PEC in SMBUS specification)

Within the STM32 I2C controller, handling (either sending
or receiving) of the PEC byte is done via the PECBYTE bit in
register CR2.

Currently, the PECBYTE is set at the beginning of a transfer,
which lead to sending a PEC byte at the end of the write command
(hence losing the real last byte), and also does not check the
PEC byte received during the read command.

This patch corrects the function stm32f7_i2c_smbus_xfer_msg
in order to only set the PECBYTE during the read command.

Fixes: 9e48155f6bfe ("i2c: i2c-stm32f7: Add initial SMBus protocols support")
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
Acked-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/busses/i2c-stm32f7.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index 0f4c0282028b..7b9272f9cc21 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -1042,9 +1042,10 @@ static int stm32f7_i2c_smbus_xfer_msg(struct stm32f7_i2c_dev *i2c_dev,
 	/* Configure PEC */
 	if ((flags & I2C_CLIENT_PEC) && f7_msg->size != I2C_SMBUS_QUICK) {
 		cr1 |= STM32F7_I2C_CR1_PECEN;
-		cr2 |= STM32F7_I2C_CR2_PECBYTE;
-		if (!f7_msg->read_write)
+		if (!f7_msg->read_write) {
+			cr2 |= STM32F7_I2C_CR2_PECBYTE;
 			f7_msg->count++;
+		}
 	} else {
 		cr1 &= ~STM32F7_I2C_CR1_PECEN;
 		cr2 &= ~STM32F7_I2C_CR2_PECBYTE;
@@ -1132,8 +1133,10 @@ static void stm32f7_i2c_smbus_rep_start(struct stm32f7_i2c_dev *i2c_dev)
 	f7_msg->stop = true;
 
 	/* Add one byte for PEC if needed */
-	if (cr1 & STM32F7_I2C_CR1_PECEN)
+	if (cr1 & STM32F7_I2C_CR1_PECEN) {
+		cr2 |= STM32F7_I2C_CR2_PECBYTE;
 		f7_msg->count++;
+	}
 
 	/* Set number of bytes to be transferred */
 	cr2 &= ~(STM32F7_I2C_CR2_NBYTES_MASK);

From ca764116b5c1d05913cf287cb486c23fd972c405 Mon Sep 17 00:00:00 2001
From: Jian Zhang <zhangjian.3032@bytedance.com>
Date: Fri, 6 Oct 2023 10:22:33 +0800
Subject: [PATCH 0246/1043] i2c: aspeed: Fix i2c bus hang in slave read

commit 54f1840ddee9bbdc8dd89fbbfdfa632401244146 upstream.

When the `CONFIG_I2C_SLAVE` option is enabled and the device operates
as a slave, a situation arises where the master sends a START signal
without the accompanying STOP signal. This action results in a
persistent I2C bus timeout. The core issue stems from the fact that
the i2c controller remains in a slave read state without a timeout
mechanism. As a consequence, the bus perpetually experiences timeouts.

In this case, the i2c bus will be reset, but the slave_state reset is
missing.

Fixes: fee465150b45 ("i2c: aspeed: Reset the i2c controller when timeout occurs")
Signed-off-by: Jian Zhang <zhangjian.3032@bytedance.com>
Acked-by: Andi Shyti <andi.shyti@kernel.org>
Tested-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/busses/i2c-aspeed.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c
index dac46bc2fafc..a1bc8a2c3ead 100644
--- a/drivers/i2c/busses/i2c-aspeed.c
+++ b/drivers/i2c/busses/i2c-aspeed.c
@@ -740,6 +740,8 @@ static void __aspeed_i2c_reg_slave(struct aspeed_i2c_bus *bus, u16 slave_addr)
 	func_ctrl_reg_val = readl(bus->base + ASPEED_I2C_FUN_CTRL_REG);
 	func_ctrl_reg_val |= ASPEED_I2CD_SLAVE_EN;
 	writel(func_ctrl_reg_val, bus->base + ASPEED_I2C_FUN_CTRL_REG);
+
+	bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE;
 }
 
 static int aspeed_i2c_reg_slave(struct i2c_client *client)
@@ -756,7 +758,6 @@ static int aspeed_i2c_reg_slave(struct i2c_client *client)
 	__aspeed_i2c_reg_slave(bus, client->addr);
 
 	bus->slave = client;
-	bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE;
 	spin_unlock_irqrestore(&bus->lock, flags);
 
 	return 0;

From 866838eb8ee9a93fe5d26da8dacbb39897146002 Mon Sep 17 00:00:00 2001
From: Yujie Liu <yujie.liu@intel.com>
Date: Fri, 27 Oct 2023 12:13:14 +0800
Subject: [PATCH 0247/1043] tracing/kprobes: Fix the description of variable
 length arguments

commit e0f831836cead677fb07d54bd6bf499df35640c2 upstream.

Fix the following kernel-doc warnings:

kernel/trace/trace_kprobe.c:1029: warning: Excess function parameter 'args' description in '__kprobe_event_gen_cmd_start'
kernel/trace/trace_kprobe.c:1097: warning: Excess function parameter 'args' description in '__kprobe_event_add_fields'

Refer to the usage of variable length arguments elsewhere in the kernel
code, "@..." is the proper way to express it in the description.

Link: https://lore.kernel.org/all/20231027041315.2613166-1-yujie.liu@intel.com/

Fixes: 2a588dd1d5d6 ("tracing: Add kprobe event command generation functions")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310190437.paI6LYJF-lkp@intel.com/
Signed-off-by: Yujie Liu <yujie.liu@intel.com>
Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace_kprobe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index b882c6519b03..37e1ec1d3ee5 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -952,7 +952,7 @@ EXPORT_SYMBOL_GPL(kprobe_event_cmd_init);
  * @name: The name of the kprobe event
  * @loc: The location of the kprobe event
  * @kretprobe: Is this a return probe?
- * @args: Variable number of arg (pairs), one pair for each field
+ * @...: Variable number of arg (pairs), one pair for each field
  *
  * NOTE: Users normally won't want to call this function directly, but
  * rather use the kprobe_event_gen_cmd_start() wrapper, which automatically
@@ -1025,7 +1025,7 @@ EXPORT_SYMBOL_GPL(__kprobe_event_gen_cmd_start);
 /**
  * __kprobe_event_add_fields - Add probe fields to a kprobe command from arg list
  * @cmd: A pointer to the dynevent_cmd struct representing the new event
- * @args: Variable number of arg (pairs), one pair for each field
+ * @...: Variable number of arg (pairs), one pair for each field
  *
  * NOTE: Users normally won't want to call this function directly, but
  * rather use the kprobe_event_add_fields() wrapper, which

From d44166341f4bc838b30be139bdbcd289c87458d0 Mon Sep 17 00:00:00 2001
From: Ekansh Gupta <quic_ekangupt@quicinc.com>
Date: Fri, 13 Oct 2023 13:20:06 +0100
Subject: [PATCH 0248/1043] misc: fastrpc: Clean buffers on remote invocation
 failures

commit 1c8093591d1e372d700fe65423e7315a8ecf721b upstream.

With current design, buffers and dma handles are not freed in case
of remote invocation failures returned from DSP. This could result
in buffer leakings and dma handle pointing to wrong memory in the
fastrpc kernel. Adding changes to clean buffers and dma handles
even when remote invocation to DSP returns failures.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable <stable@kernel.org>
Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20231013122007.174464-4-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/fastrpc.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index eed047e971e7..9822efdc6cc2 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -990,11 +990,6 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl,  u32 kernel,
 		err = wait_for_completion_interruptible(&ctx->work);
 	}
 
-	if (err)
-		goto bail;
-
-	/* Check the response from remote dsp */
-	err = ctx->retval;
 	if (err)
 		goto bail;
 
@@ -1007,6 +1002,11 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl,  u32 kernel,
 			goto bail;
 	}
 
+	/* Check the response from remote dsp */
+	err = ctx->retval;
+	if (err)
+		goto bail;
+
 bail:
 	if (err != -ERESTARTSYS && err != -ETIMEDOUT) {
 		/* We are done with this compute context */

From 7a1c29e93c25dbf7868d942c1bd94dcef3364f07 Mon Sep 17 00:00:00 2001
From: Peng Fan <peng.fan@nxp.com>
Date: Fri, 13 Oct 2023 13:49:04 +0100
Subject: [PATCH 0249/1043] nvmem: imx: correct nregs for i.MX6ULL

commit 2382c1b044231fd49eaf9aa82bc7113fc55487b8 upstream.

The nregs for i.MX6ULL should be 80 per fuse map, correct it.

Fixes: ffbc34bf0e9c ("nvmem: imx-ocotp: Implement i.MX6ULL/ULZ support")
Cc: Stable@vger.kernel.org
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20231013124904.175782-4-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvmem/imx-ocotp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
index 7a1ebd6fd08b..d36ac604e147 100644
--- a/drivers/nvmem/imx-ocotp.c
+++ b/drivers/nvmem/imx-ocotp.c
@@ -488,7 +488,7 @@ static const struct ocotp_params imx6ul_params = {
 };
 
 static const struct ocotp_params imx6ull_params = {
-	.nregs = 64,
+	.nregs = 80,
 	.bank_address_words = 0,
 	.set_timing = imx_ocotp_set_imx6_timing,
 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,

From 37ccf15ebeec7c685e88c4fae4024f152c832f67 Mon Sep 17 00:00:00 2001
From: Peng Fan <peng.fan@nxp.com>
Date: Fri, 13 Oct 2023 13:49:02 +0100
Subject: [PATCH 0250/1043] nvmem: imx: correct nregs for i.MX6SLL

commit 414a98abbefd82d591f4e2d1efd2917bcd3b6f6d upstream.

The nregs for i.MX6SLL should be 80 per fuse map, correct it.

Fixes: 6da27821a6f5 ("nvmem: imx-ocotp: add support for imx6sll")
Cc: Stable@vger.kernel.org
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20231013124904.175782-2-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvmem/imx-ocotp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
index d36ac604e147..91dc76ba1fab 100644
--- a/drivers/nvmem/imx-ocotp.c
+++ b/drivers/nvmem/imx-ocotp.c
@@ -467,7 +467,7 @@ static const struct ocotp_params imx6sl_params = {
 };
 
 static const struct ocotp_params imx6sll_params = {
-	.nregs = 128,
+	.nregs = 80,
 	.bank_address_words = 0,
 	.set_timing = imx_ocotp_set_imx6_timing,
 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,

From 4e3c606afa2595da31a41dde591f9520361e5436 Mon Sep 17 00:00:00 2001
From: Peng Fan <peng.fan@nxp.com>
Date: Fri, 13 Oct 2023 13:49:03 +0100
Subject: [PATCH 0251/1043] nvmem: imx: correct nregs for i.MX6UL

commit 7d6e10f5d254681983b53d979422c8de3fadbefb upstream.

The nregs for i.MX6UL should be 144 per fuse map, correct it.

Fixes: 4aa2b4802046 ("nvmem: octop: Add support for imx6ul")
Cc: Stable@vger.kernel.org
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20231013124904.175782-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvmem/imx-ocotp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
index 91dc76ba1fab..fddb5459e427 100644
--- a/drivers/nvmem/imx-ocotp.c
+++ b/drivers/nvmem/imx-ocotp.c
@@ -481,7 +481,7 @@ static const struct ocotp_params imx6sx_params = {
 };
 
 static const struct ocotp_params imx6ul_params = {
-	.nregs = 128,
+	.nregs = 144,
 	.bank_address_words = 0,
 	.set_timing = imx_ocotp_set_imx6_timing,
 	.ctrl = IMX_OCOTP_BM_CTRL_DEFAULT,

From 0258ca32b0eaf9d6dcc07b98587f51463dbffcf7 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Tue, 24 Oct 2023 11:42:21 +0200
Subject: [PATCH 0252/1043] perf/core: Fix potential NULL deref

commit a71ef31485bb51b846e8db8b3a35e432cc15afb5 upstream.

Smatch is awesome.

Fixes: 32671e3799ca ("perf: Disallow mis-matched inherited group reads")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/events/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index b23961475692..5072635f0b0c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -12846,7 +12846,8 @@ static int inherit_group(struct perf_event *parent_event,
 		    !perf_get_aux_event(child_ctr, leader))
 			return -EINVAL;
 	}
-	leader->group_generation = parent_event->group_generation;
+	if (leader)
+		leader->group_generation = parent_event->group_generation;
 	return 0;
 }
 

From 09ce0d85cc00fe1911e1e072e3ad7ed9adab2c41 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sun, 22 Oct 2023 19:34:28 -0400
Subject: [PATCH 0253/1043] sparc32: fix a braino in fault handling in
 csum_and_copy_..._user()

commit 1f36cd05e0081f2c75769a551d584c4ffb2a5660 upstream.

Fault handler used to make non-trivial calls, so it needed
to set a stack frame up.  Used to be
	save ... - grab a stack frame, old %o... become %i...
	....
	ret	- go back to address originally in %o7, currently %i7
	 restore - switch to previous stack frame, in delay slot
Non-trivial calls had been gone since ab5e8b331244 and that code should
have become
	retl	- go back to address in %o7
	 clr %o0 - have return value set to 0
What it had become instead was
	ret	- go back to address in %i7 - return address of *caller*
	 clr %o0 - have return value set to 0
which is not good, to put it mildly - we forcibly return 0 from
csum_and_copy_{from,to}_iter() (which is what the call of that
thing had been inlined into) and do that without dropping the
stack frame of said csum_and_copy_..._iter().  Confuses the
hell out of the caller of csum_and_copy_..._iter(), obviously...

Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Fixes: ab5e8b331244 "sparc32: propagate the calling conventions change down to __csum_partial_copy_sparc_generic()"
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/sparc/lib/checksum_32.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/lib/checksum_32.S b/arch/sparc/lib/checksum_32.S
index 7488d130faf7..f5a8851e0e55 100644
--- a/arch/sparc/lib/checksum_32.S
+++ b/arch/sparc/lib/checksum_32.S
@@ -463,5 +463,5 @@ ccslow:	cmp	%g1, 0
  * we only bother with faults on loads... */
 
 cc_fault:
-	ret
+	retl
 	 clr	%o0

From d8928befffe589dcac95efc6f30db59a8bad6b9f Mon Sep 17 00:00:00 2001
From: Alessandro Carminati <alessandro.carminati@gmail.com>
Date: Thu, 21 Sep 2023 07:32:17 +0000
Subject: [PATCH 0254/1043] clk: Sanitize possible_parent_show to Handle Return
 Value of of_clk_get_parent_name

commit ceb87a361d0b079ecbc7d2831618c19087f304a9 upstream.

In the possible_parent_show function, ensure proper handling of the return
value from of_clk_get_parent_name to prevent potential issues arising from
a NULL return.
The current implementation invokes seq_puts directly on the result of
of_clk_get_parent_name without verifying the return value, which can lead
to kernel panic if the function returns NULL.

This patch addresses the concern by introducing a check on the return
value of of_clk_get_parent_name. If the return value is not NULL, the
function proceeds to call seq_puts, providing the returned value as
argument.
However, if of_clk_get_parent_name returns NULL, the function provides a
static string as argument, avoiding the panic.

Fixes: 1ccc0ddf046a ("clk: Use seq_puts() in possible_parent_show()")
Reported-by: Philip Daly <pdaly@redhat.com>
Signed-off-by: Alessandro Carminati (Red Hat) <alessandro.carminati@gmail.com>
Link: https://lore.kernel.org/r/20230921073217.572151-1-alessandro.carminati@gmail.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/clk.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 3575afe16a57..62572d59e7e3 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -3167,6 +3167,7 @@ static void possible_parent_show(struct seq_file *s, struct clk_core *core,
 				 unsigned int i, char terminator)
 {
 	struct clk_core *parent;
+	const char *name = NULL;
 
 	/*
 	 * Go through the following options to fetch a parent's name.
@@ -3181,18 +3182,20 @@ static void possible_parent_show(struct seq_file *s, struct clk_core *core,
 	 * registered (yet).
 	 */
 	parent = clk_core_get_parent_by_index(core, i);
-	if (parent)
+	if (parent) {
 		seq_puts(s, parent->name);
-	else if (core->parents[i].name)
+	} else if (core->parents[i].name) {
 		seq_puts(s, core->parents[i].name);
-	else if (core->parents[i].fw_name)
+	} else if (core->parents[i].fw_name) {
 		seq_printf(s, "<%s>(fw)", core->parents[i].fw_name);
-	else if (core->parents[i].index >= 0)
-		seq_puts(s,
-			 of_clk_get_parent_name(core->of_node,
-						core->parents[i].index));
-	else
-		seq_puts(s, "(missing)");
+	} else {
+		if (core->parents[i].index >= 0)
+			name = of_clk_get_parent_name(core->of_node, core->parents[i].index);
+		if (!name)
+			name = "(missing)";
+
+		seq_puts(s, name);
+	}
 
 	seq_putc(s, terminator);
 }

From c4b496c9f7724f205570107aaf678876428f8f79 Mon Sep 17 00:00:00 2001
From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Date: Mon, 30 Nov 2020 15:27:57 +0100
Subject: [PATCH 0255/1043] iio: adc: xilinx: use helper variable for
 &pdev->dev

[ Upstream commit 9d8fd2a06a2bcce8eada1bad26cbe0fbfc27cdf4 ]

It's more elegant to use a helper local variable to store the address
of the underlying struct device than to dereference pdev everywhere.

Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Tested-by: Anand Ashok Dumbre <anandash@xilinx.com>
Reviewed-by: Anand Ashok Dumbre <anandash@xilinx.com>
Link: https://lore.kernel.org/r/20201130142759.28216-2-brgl@bgdev.pl
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: 8d6b3ea4d9ea ("iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/xilinx-xadc-core.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index f93c34fe5873..8494eb424b33 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -1186,6 +1186,7 @@ static int xadc_parse_dt(struct iio_dev *indio_dev, struct device_node *np,
 
 static int xadc_probe(struct platform_device *pdev)
 {
+	struct device *dev = &pdev->dev;
 	const struct of_device_id *id;
 	struct iio_dev *indio_dev;
 	unsigned int bipolar_mask;
@@ -1195,10 +1196,10 @@ static int xadc_probe(struct platform_device *pdev)
 	int irq;
 	int i;
 
-	if (!pdev->dev.of_node)
+	if (!dev->of_node)
 		return -ENODEV;
 
-	id = of_match_node(xadc_of_match_table, pdev->dev.of_node);
+	id = of_match_node(xadc_of_match_table, dev->of_node);
 	if (!id)
 		return -EINVAL;
 
@@ -1206,7 +1207,7 @@ static int xadc_probe(struct platform_device *pdev)
 	if (irq <= 0)
 		return -ENXIO;
 
-	indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*xadc));
+	indio_dev = devm_iio_device_alloc(dev, sizeof(*xadc));
 	if (!indio_dev)
 		return -ENOMEM;
 
@@ -1226,7 +1227,7 @@ static int xadc_probe(struct platform_device *pdev)
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->info = &xadc_info;
 
-	ret = xadc_parse_dt(indio_dev, pdev->dev.of_node, &conf0);
+	ret = xadc_parse_dt(indio_dev, dev->of_node, &conf0);
 	if (ret)
 		return ret;
 
@@ -1250,7 +1251,7 @@ static int xadc_probe(struct platform_device *pdev)
 		}
 	}
 
-	xadc->clk = devm_clk_get(&pdev->dev, NULL);
+	xadc->clk = devm_clk_get(dev, NULL);
 	if (IS_ERR(xadc->clk)) {
 		ret = PTR_ERR(xadc->clk);
 		goto err_free_samplerate_trigger;
@@ -1276,7 +1277,7 @@ static int xadc_probe(struct platform_device *pdev)
 	}
 
 	ret = request_irq(xadc->irq, xadc->ops->interrupt_handler, 0,
-			dev_name(&pdev->dev), indio_dev);
+			  dev_name(dev), indio_dev);
 	if (ret)
 		goto err_clk_disable_unprepare;
 

From 0eb1198fe4d6f163afc11eeba3a303a986d78915 Mon Sep 17 00:00:00 2001
From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Date: Mon, 30 Nov 2020 15:27:58 +0100
Subject: [PATCH 0256/1043] iio: adc: xilinx: use devm_krealloc() instead of
 kfree() + kcalloc()

[ Upstream commit eab64715709ed440d54cac42f239e2d49df26c1f ]

We now have devm_krealloc() in the kernel Use it indstead of calling
kfree() and kcalloc() separately.

Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Tested-by: Anand Ashok Dumbre <anandash@xilinx.com>
Reviewed-by: Anand Ashok Dumbre <anandash@xilinx.com>
Link: https://lore.kernel.org/r/20201130142759.28216-3-brgl@bgdev.pl
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: 8d6b3ea4d9ea ("iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/xilinx-xadc-core.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index 8494eb424b33..6f89a97bb127 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/of.h>
+#include <linux/overflow.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/sysfs.h>
@@ -585,15 +586,22 @@ static int xadc_update_scan_mode(struct iio_dev *indio_dev,
 	const unsigned long *mask)
 {
 	struct xadc *xadc = iio_priv(indio_dev);
-	unsigned int n;
+	size_t new_size, n;
+	void *data;
 
 	n = bitmap_weight(mask, indio_dev->masklength);
 
-	kfree(xadc->data);
-	xadc->data = kcalloc(n, sizeof(*xadc->data), GFP_KERNEL);
-	if (!xadc->data)
+	if (check_mul_overflow(n, sizeof(*xadc->data), &new_size))
 		return -ENOMEM;
 
+	data = devm_krealloc(indio_dev->dev.parent, xadc->data,
+			     new_size, GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	memset(data, 0, new_size);
+	xadc->data = data;
+
 	return 0;
 }
 
@@ -1372,7 +1380,6 @@ static int xadc_remove(struct platform_device *pdev)
 	free_irq(xadc->irq, indio_dev);
 	cancel_delayed_work_sync(&xadc->zynq_unmask_work);
 	clk_disable_unprepare(xadc->clk);
-	kfree(xadc->data);
 
 	return 0;
 }

From e96eb8853f334f96312968e4f01c5a452db54c00 Mon Sep 17 00:00:00 2001
From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Date: Mon, 30 Nov 2020 15:27:59 +0100
Subject: [PATCH 0257/1043] iio: adc: xilinx: use more devres helpers and
 remove remove()

[ Upstream commit 2a9685d1a3b7644ca08d8355fc238b43faef7c3e ]

In order to simplify resource management and error paths in probe() and
entirely drop the remove() callback - use devres helpers wherever
possible. Define devm actions for cancelling the delayed work and
disabling the clock.

Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Tested-by: Anand Ashok Dumbre <anandash@xilinx.com>
Reviewed-by: Anand Ashok Dumbre <anandash@xilinx.com>
Link: https://lore.kernel.org/r/20201130142759.28216-4-brgl@bgdev.pl
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: 8d6b3ea4d9ea ("iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/xilinx-xadc-core.c | 133 ++++++++++++-----------------
 1 file changed, 55 insertions(+), 78 deletions(-)

diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index 6f89a97bb127..fec266682e91 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -713,11 +713,12 @@ static const struct iio_trigger_ops xadc_trigger_ops = {
 static struct iio_trigger *xadc_alloc_trigger(struct iio_dev *indio_dev,
 	const char *name)
 {
+	struct device *dev = indio_dev->dev.parent;
 	struct iio_trigger *trig;
 	int ret;
 
-	trig = iio_trigger_alloc("%s%d-%s", indio_dev->name,
-				indio_dev->id, name);
+	trig = devm_iio_trigger_alloc(dev, "%s%d-%s", indio_dev->name,
+				      indio_dev->id, name);
 	if (trig == NULL)
 		return ERR_PTR(-ENOMEM);
 
@@ -725,15 +726,11 @@ static struct iio_trigger *xadc_alloc_trigger(struct iio_dev *indio_dev,
 	trig->ops = &xadc_trigger_ops;
 	iio_trigger_set_drvdata(trig, iio_priv(indio_dev));
 
-	ret = iio_trigger_register(trig);
+	ret = devm_iio_trigger_register(dev, trig);
 	if (ret)
-		goto error_free_trig;
+		return ERR_PTR(ret);
 
 	return trig;
-
-error_free_trig:
-	iio_trigger_free(trig);
-	return ERR_PTR(ret);
 }
 
 static int xadc_power_adc_b(struct xadc *xadc, unsigned int seq_mode)
@@ -1192,6 +1189,20 @@ static int xadc_parse_dt(struct iio_dev *indio_dev, struct device_node *np,
 	return 0;
 }
 
+static void xadc_clk_disable_unprepare(void *data)
+{
+	struct clk *clk = data;
+
+	clk_disable_unprepare(clk);
+}
+
+static void xadc_cancel_delayed_work(void *data)
+{
+	struct delayed_work *work = data;
+
+	cancel_delayed_work_sync(work);
+}
+
 static int xadc_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -1240,34 +1251,35 @@ static int xadc_probe(struct platform_device *pdev)
 		return ret;
 
 	if (xadc->ops->flags & XADC_FLAGS_BUFFERED) {
-		ret = iio_triggered_buffer_setup(indio_dev,
-			&iio_pollfunc_store_time, &xadc_trigger_handler,
-			&xadc_buffer_ops);
+		ret = devm_iio_triggered_buffer_setup(dev, indio_dev,
+						      &iio_pollfunc_store_time,
+						      &xadc_trigger_handler,
+						      &xadc_buffer_ops);
 		if (ret)
 			return ret;
 
 		xadc->convst_trigger = xadc_alloc_trigger(indio_dev, "convst");
-		if (IS_ERR(xadc->convst_trigger)) {
-			ret = PTR_ERR(xadc->convst_trigger);
-			goto err_triggered_buffer_cleanup;
-		}
+		if (IS_ERR(xadc->convst_trigger))
+			return PTR_ERR(xadc->convst_trigger);
+
 		xadc->samplerate_trigger = xadc_alloc_trigger(indio_dev,
 			"samplerate");
-		if (IS_ERR(xadc->samplerate_trigger)) {
-			ret = PTR_ERR(xadc->samplerate_trigger);
-			goto err_free_convst_trigger;
-		}
+		if (IS_ERR(xadc->samplerate_trigger))
+			return PTR_ERR(xadc->samplerate_trigger);
 	}
 
 	xadc->clk = devm_clk_get(dev, NULL);
-	if (IS_ERR(xadc->clk)) {
-		ret = PTR_ERR(xadc->clk);
-		goto err_free_samplerate_trigger;
-	}
+	if (IS_ERR(xadc->clk))
+		return PTR_ERR(xadc->clk);
 
 	ret = clk_prepare_enable(xadc->clk);
 	if (ret)
-		goto err_free_samplerate_trigger;
+		return ret;
+
+	ret = devm_add_action_or_reset(dev,
+				       xadc_clk_disable_unprepare, xadc->clk);
+	if (ret)
+		return ret;
 
 	/*
 	 * Make sure not to exceed the maximum samplerate since otherwise the
@@ -1276,22 +1288,28 @@ static int xadc_probe(struct platform_device *pdev)
 	if (xadc->ops->flags & XADC_FLAGS_BUFFERED) {
 		ret = xadc_read_samplerate(xadc);
 		if (ret < 0)
-			goto err_free_samplerate_trigger;
+			return ret;
+
 		if (ret > XADC_MAX_SAMPLERATE) {
 			ret = xadc_write_samplerate(xadc, XADC_MAX_SAMPLERATE);
 			if (ret < 0)
-				goto err_free_samplerate_trigger;
+				return ret;
 		}
 	}
 
-	ret = request_irq(xadc->irq, xadc->ops->interrupt_handler, 0,
-			  dev_name(dev), indio_dev);
+	ret = devm_request_irq(dev, xadc->irq, xadc->ops->interrupt_handler, 0,
+			       dev_name(dev), indio_dev);
 	if (ret)
-		goto err_clk_disable_unprepare;
+		return ret;
+
+	ret = devm_add_action_or_reset(dev, xadc_cancel_delayed_work,
+				       &xadc->zynq_unmask_work);
+	if (ret)
+		return ret;
 
 	ret = xadc->ops->setup(pdev, indio_dev, xadc->irq);
 	if (ret)
-		goto err_free_irq;
+		return ret;
 
 	for (i = 0; i < 16; i++)
 		xadc_read_adc_reg(xadc, XADC_REG_THRESHOLD(i),
@@ -1299,7 +1317,7 @@ static int xadc_probe(struct platform_device *pdev)
 
 	ret = xadc_write_adc_reg(xadc, XADC_REG_CONF0, conf0);
 	if (ret)
-		goto err_free_irq;
+		return ret;
 
 	bipolar_mask = 0;
 	for (i = 0; i < indio_dev->num_channels; i++) {
@@ -1309,17 +1327,18 @@ static int xadc_probe(struct platform_device *pdev)
 
 	ret = xadc_write_adc_reg(xadc, XADC_REG_INPUT_MODE(0), bipolar_mask);
 	if (ret)
-		goto err_free_irq;
+		return ret;
+
 	ret = xadc_write_adc_reg(xadc, XADC_REG_INPUT_MODE(1),
 		bipolar_mask >> 16);
 	if (ret)
-		goto err_free_irq;
+		return ret;
 
 	/* Disable all alarms */
 	ret = xadc_update_adc_reg(xadc, XADC_REG_CONF1, XADC_CONF1_ALARM_MASK,
 				  XADC_CONF1_ALARM_MASK);
 	if (ret)
-		goto err_free_irq;
+		return ret;
 
 	/* Set thresholds to min/max */
 	for (i = 0; i < 16; i++) {
@@ -1334,59 +1353,17 @@ static int xadc_probe(struct platform_device *pdev)
 		ret = xadc_write_adc_reg(xadc, XADC_REG_THRESHOLD(i),
 			xadc->threshold[i]);
 		if (ret)
-			goto err_free_irq;
+			return ret;
 	}
 
 	/* Go to non-buffered mode */
 	xadc_postdisable(indio_dev);
 
-	ret = iio_device_register(indio_dev);
-	if (ret)
-		goto err_free_irq;
-
-	platform_set_drvdata(pdev, indio_dev);
-
-	return 0;
-
-err_free_irq:
-	free_irq(xadc->irq, indio_dev);
-	cancel_delayed_work_sync(&xadc->zynq_unmask_work);
-err_clk_disable_unprepare:
-	clk_disable_unprepare(xadc->clk);
-err_free_samplerate_trigger:
-	if (xadc->ops->flags & XADC_FLAGS_BUFFERED)
-		iio_trigger_free(xadc->samplerate_trigger);
-err_free_convst_trigger:
-	if (xadc->ops->flags & XADC_FLAGS_BUFFERED)
-		iio_trigger_free(xadc->convst_trigger);
-err_triggered_buffer_cleanup:
-	if (xadc->ops->flags & XADC_FLAGS_BUFFERED)
-		iio_triggered_buffer_cleanup(indio_dev);
-
-	return ret;
-}
-
-static int xadc_remove(struct platform_device *pdev)
-{
-	struct iio_dev *indio_dev = platform_get_drvdata(pdev);
-	struct xadc *xadc = iio_priv(indio_dev);
-
-	iio_device_unregister(indio_dev);
-	if (xadc->ops->flags & XADC_FLAGS_BUFFERED) {
-		iio_trigger_free(xadc->samplerate_trigger);
-		iio_trigger_free(xadc->convst_trigger);
-		iio_triggered_buffer_cleanup(indio_dev);
-	}
-	free_irq(xadc->irq, indio_dev);
-	cancel_delayed_work_sync(&xadc->zynq_unmask_work);
-	clk_disable_unprepare(xadc->clk);
-
-	return 0;
+	return devm_iio_device_register(dev, indio_dev);
 }
 
 static struct platform_driver xadc_driver = {
 	.probe = xadc_probe,
-	.remove = xadc_remove,
 	.driver = {
 		.name = "xadc",
 		.of_match_table = xadc_of_match_table,

From 62184eb778213a807744d563b0df286dbdb98448 Mon Sep 17 00:00:00 2001
From: Robert Hancock <robert.hancock@calian.com>
Date: Thu, 14 Sep 2023 18:10:18 -0600
Subject: [PATCH 0258/1043] iio: adc: xilinx-xadc: Don't clobber preset
 voltage/temperature thresholds

[ Upstream commit 8d6b3ea4d9eaca80982442b68a292ce50ce0a135 ]

In the probe function, the driver was reading out the thresholds already
set in the core, which can be configured by the user in the Vivado tools
when the FPGA image is built. However, it later clobbered those values
with zero or maximum values. In particular, the overtemperature shutdown
threshold register was overwritten with the max value, which effectively
prevents the FPGA from shutting down when the desired threshold was
eached, potentially risking hardware damage in that case.

Remove this code to leave the preconfigured default threshold values
intact.

The code was also disabling all alarms regardless of what enable state
they were left in by the FPGA image, including the overtemperature
shutdown feature. Leave these bits in their original state so they are
not unconditionally disabled.

Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver")
Signed-off-by: Robert Hancock <robert.hancock@calian.com>
Acked-by: O'Griofa, Conall <conall.ogriofa@amd.com>
Tested-by: O'Griofa, Conall <conall.ogriofa@amd.com>
Link: https://lore.kernel.org/r/20230915001019.2862964-2-robert.hancock@calian.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/xilinx-xadc-core.c | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index fec266682e91..30b5a17ce41a 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -1334,28 +1334,6 @@ static int xadc_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
-	/* Disable all alarms */
-	ret = xadc_update_adc_reg(xadc, XADC_REG_CONF1, XADC_CONF1_ALARM_MASK,
-				  XADC_CONF1_ALARM_MASK);
-	if (ret)
-		return ret;
-
-	/* Set thresholds to min/max */
-	for (i = 0; i < 16; i++) {
-		/*
-		 * Set max voltage threshold and both temperature thresholds to
-		 * 0xffff, min voltage threshold to 0.
-		 */
-		if (i % 8 < 4 || i == 7)
-			xadc->threshold[i] = 0xffff;
-		else
-			xadc->threshold[i] = 0;
-		ret = xadc_write_adc_reg(xadc, XADC_REG_THRESHOLD(i),
-			xadc->threshold[i]);
-		if (ret)
-			return ret;
-	}
-
 	/* Go to non-buffered mode */
 	xadc_postdisable(indio_dev);
 

From b9b197f659043bf29e86effa1d24bab96d1ee5c3 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 25 Oct 2023 23:04:15 +0200
Subject: [PATCH 0259/1043] x86/i8259: Skip probing when ACPI/MADT advertises
 PCAT compatibility

commit 128b0c9781c9f2651bea163cb85e52a6c7be0f9e upstream.

David and a few others reported that on certain newer systems some legacy
interrupts fail to work correctly.

Debugging revealed that the BIOS of these systems leaves the legacy PIC in
uninitialized state which makes the PIC detection fail and the kernel
switches to a dummy implementation.

Unfortunately this fallback causes quite some code to fail as it depends on
checks for the number of legacy PIC interrupts or the availability of the
real PIC.

In theory there is no reason to use the PIC on any modern system when
IO/APIC is available, but the dependencies on the related checks cannot be
resolved trivially and on short notice. This needs lots of analysis and
rework.

The PIC detection has been added to avoid quirky checks and force selection
of the dummy implementation all over the place, especially in VM guest
scenarios. So it's not an option to revert the relevant commit as that
would break a lot of other scenarios.

One solution would be to try to initialize the PIC on detection fail and
retry the detection, but that puts the burden on everything which does not
have a PIC.

Fortunately the ACPI/MADT table header has a flag field, which advertises
in bit 0 that the system is PCAT compatible, which means it has a legacy
8259 PIC.

Evaluate that bit and if set avoid the detection routine and keep the real
PIC installed, which then gets initialized (for nothing) and makes the rest
of the code with all the dependencies work again.

Fixes: e179f6914152 ("x86, irq, pic: Probe for legacy PIC and set legacy_pic appropriately")
Reported-by: David Lazar <dlazar@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: David Lazar <dlazar@gmail.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Cc: stable@vger.kernel.org
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218003
Link: https://lore.kernel.org/r/875y2u5s8g.ffs@tglx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/i8259.h |  2 ++
 arch/x86/kernel/acpi/boot.c  |  3 +++
 arch/x86/kernel/i8259.c      | 38 ++++++++++++++++++++++++++++--------
 3 files changed, 35 insertions(+), 8 deletions(-)

diff --git a/arch/x86/include/asm/i8259.h b/arch/x86/include/asm/i8259.h
index 89789e8c80f6..e16574c16e93 100644
--- a/arch/x86/include/asm/i8259.h
+++ b/arch/x86/include/asm/i8259.h
@@ -67,6 +67,8 @@ struct legacy_pic {
 	void (*make_irq)(unsigned int irq);
 };
 
+void legacy_pic_pcat_compat(void);
+
 extern struct legacy_pic *legacy_pic;
 extern struct legacy_pic null_legacy_pic;
 
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 55562a9b7f92..c91851573e5f 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -141,6 +141,9 @@ static int __init acpi_parse_madt(struct acpi_table_header *table)
 		       madt->address);
 	}
 
+	if (madt->flags & ACPI_MADT_PCAT_COMPAT)
+		legacy_pic_pcat_compat();
+
 	default_acpi_madt_oem_check(madt->header.oem_id,
 				    madt->header.oem_table_id);
 
diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
index f325389d0351..4c9f559e1388 100644
--- a/arch/x86/kernel/i8259.c
+++ b/arch/x86/kernel/i8259.c
@@ -32,6 +32,7 @@
  */
 static void init_8259A(int auto_eoi);
 
+static bool pcat_compat __ro_after_init;
 static int i8259A_auto_eoi;
 DEFINE_RAW_SPINLOCK(i8259A_lock);
 
@@ -301,15 +302,32 @@ static void unmask_8259A(void)
 
 static int probe_8259A(void)
 {
+	unsigned char new_val, probe_val = ~(1 << PIC_CASCADE_IR);
 	unsigned long flags;
-	unsigned char probe_val = ~(1 << PIC_CASCADE_IR);
-	unsigned char new_val;
+
 	/*
-	 * Check to see if we have a PIC.
-	 * Mask all except the cascade and read
-	 * back the value we just wrote. If we don't
-	 * have a PIC, we will read 0xff as opposed to the
-	 * value we wrote.
+	 * If MADT has the PCAT_COMPAT flag set, then do not bother probing
+	 * for the PIC. Some BIOSes leave the PIC uninitialized and probing
+	 * fails.
+	 *
+	 * Right now this causes problems as quite some code depends on
+	 * nr_legacy_irqs() > 0 or has_legacy_pic() == true. This is silly
+	 * when the system has an IO/APIC because then PIC is not required
+	 * at all, except for really old machines where the timer interrupt
+	 * must be routed through the PIC. So just pretend that the PIC is
+	 * there and let legacy_pic->init() initialize it for nothing.
+	 *
+	 * Alternatively this could just try to initialize the PIC and
+	 * repeat the probe, but for cases where there is no PIC that's
+	 * just pointless.
+	 */
+	if (pcat_compat)
+		return nr_legacy_irqs();
+
+	/*
+	 * Check to see if we have a PIC.  Mask all except the cascade and
+	 * read back the value we just wrote. If we don't have a PIC, we
+	 * will read 0xff as opposed to the value we wrote.
 	 */
 	raw_spin_lock_irqsave(&i8259A_lock, flags);
 
@@ -431,5 +449,9 @@ static int __init i8259A_init_ops(void)
 
 	return 0;
 }
-
 device_initcall(i8259A_init_ops);
+
+void __init legacy_pic_pcat_compat(void)
+{
+	pcat_compat = true;
+}

From b2e62728b106fe54f8618c21a252df7d4a4cc775 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Tue, 20 Dec 2022 09:21:43 +0800
Subject: [PATCH 0260/1043] kobject: Fix slab-out-of-bounds in fill_kobj_path()

commit 3bb2a01caa813d3a1845d378bbe4169ef280d394 upstream.

In kobject_get_path(), if kobj->name is changed between calls
get_kobj_path_length() and fill_kobj_path() and the length becomes
longer, then fill_kobj_path() will have an out-of-bounds bug.

The actual current problem occurs when the ixgbe probe.

In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name
length becomes longer, out-of-bounds will occur.

cpu0                                         cpu1
ixgbe_probe
 register_netdev(netdev)
  netdev_register_kobject
   device_add
    kobject_uevent // Sending ADD events
                                             systemd-udevd // rename netdev
                                              dev_change_name
                                               device_rename
                                                kobject_rename
 ixgbe_mii_bus_init                             |
  mdiobus_register                              |
   __mdiobus_register                           |
    device_register                             |
     device_add                                 |
      kobject_uevent                            |
       kobject_get_path                         |
        len = get_kobj_path_length // old name  |
        path = kzalloc(len, gfp_mask);          |
                                                kobj->name = name;
                                                /* name length becomes
                                                 * longer
                                                 */
        fill_kobj_path /* kobj path length is
                        * longer than path,
                        * resulting in out of
                        * bounds when filling path
                        */

This is the kasan report:

==================================================================
BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0
Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673

 Workqueue: events work_for_cpu_fn
 Call Trace:
 <TASK>
 dump_stack_lvl+0x34/0x48
 print_address_description.constprop.0+0x86/0x1e7
 print_report+0x36/0x4f
 kasan_report+0xad/0x130
 kasan_check_range+0x35/0x1c0
 memcpy+0x39/0x60
 fill_kobj_path+0x50/0xc0
 kobject_get_path+0x5a/0xc0
 kobject_uevent_env+0x140/0x460
 device_add+0x5c7/0x910
 __mdiobus_register+0x14e/0x490
 ixgbe_probe.cold+0x441/0x574 [ixgbe]
 local_pci_probe+0x78/0xc0
 work_for_cpu_fn+0x26/0x40
 process_one_work+0x3b6/0x6a0
 worker_thread+0x368/0x520
 kthread+0x165/0x1a0
 ret_from_fork+0x1f/0x30

This reproducer triggers that bug:

while:
do
    rmmod ixgbe
    sleep 0.5
    modprobe ixgbe
    sleep 0.5

When calling fill_kobj_path() to fill path, if the name length of
kobj becomes longer, return failure and retry. This fixes the problem.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com
Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/kobject.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/kobject.c b/lib/kobject.c
index cd3e1a98eff9..73047e847e91 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -144,7 +144,7 @@ static int get_kobj_path_length(struct kobject *kobj)
 	return length;
 }
 
-static void fill_kobj_path(struct kobject *kobj, char *path, int length)
+static int fill_kobj_path(struct kobject *kobj, char *path, int length)
 {
 	struct kobject *parent;
 
@@ -153,12 +153,16 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length)
 		int cur = strlen(kobject_name(parent));
 		/* back up enough to print this name with '/' */
 		length -= cur;
+		if (length <= 0)
+			return -EINVAL;
 		memcpy(path + length, kobject_name(parent), cur);
 		*(path + --length) = '/';
 	}
 
 	pr_debug("kobject: '%s' (%p): %s: path = '%s'\n", kobject_name(kobj),
 		 kobj, __func__, path);
+
+	return 0;
 }
 
 /**
@@ -173,13 +177,17 @@ char *kobject_get_path(struct kobject *kobj, gfp_t gfp_mask)
 	char *path;
 	int len;
 
+retry:
 	len = get_kobj_path_length(kobj);
 	if (len == 0)
 		return NULL;
 	path = kzalloc(len, gfp_mask);
 	if (!path)
 		return NULL;
-	fill_kobj_path(kobj, path, len);
+	if (fill_kobj_path(kobj, path, len)) {
+		kfree(path);
+		goto retry;
+	}
 
 	return path;
 }

From d1c37e849f3754f5837ae25ec41498685906e207 Mon Sep 17 00:00:00 2001
From: Steve French <stfrench@microsoft.com>
Date: Mon, 21 Jun 2021 16:25:20 -0500
Subject: [PATCH 0261/1043] smbdirect: missing rc checks while waiting for rdma
 events

commit 0555b221528e9cb11f5766dcdee19c809187e42e upstream.

There were two places where we weren't checking for error
(e.g. ERESTARTSYS) while waiting for rdma resolution.

Addresses-Coverity: 1462165 ("Unchecked return value")
Reviewed-by: Tom Talpey <tom@talpey.com>
Reviewed-by: Long Li <longli@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/smbdirect.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
index bcc611069308..7d18b9268817 100644
--- a/fs/cifs/smbdirect.c
+++ b/fs/cifs/smbdirect.c
@@ -571,8 +571,13 @@ static struct rdma_cm_id *smbd_create_id(
 		log_rdma_event(ERR, "rdma_resolve_addr() failed %i\n", rc);
 		goto out;
 	}
-	wait_for_completion_interruptible_timeout(
+	rc = wait_for_completion_interruptible_timeout(
 		&info->ri_done, msecs_to_jiffies(RDMA_RESOLVE_TIMEOUT));
+	/* e.g. if interrupted returns -ERESTARTSYS */
+	if (rc < 0) {
+		log_rdma_event(ERR, "rdma_resolve_addr timeout rc: %i\n", rc);
+		goto out;
+	}
 	rc = info->ri_rc;
 	if (rc) {
 		log_rdma_event(ERR, "rdma_resolve_addr() completed %i\n", rc);
@@ -585,8 +590,13 @@ static struct rdma_cm_id *smbd_create_id(
 		log_rdma_event(ERR, "rdma_resolve_route() failed %i\n", rc);
 		goto out;
 	}
-	wait_for_completion_interruptible_timeout(
+	rc = wait_for_completion_interruptible_timeout(
 		&info->ri_done, msecs_to_jiffies(RDMA_RESOLVE_TIMEOUT));
+	/* e.g. if interrupted returns -ERESTARTSYS */
+	if (rc < 0)  {
+		log_rdma_event(ERR, "rdma_resolve_addr timeout rc: %i\n", rc);
+		goto out;
+	}
 	rc = info->ri_rc;
 	if (rc) {
 		log_rdma_event(ERR, "rdma_resolve_route() completed %i\n", rc);

From 571ce7d944cdd204da163cb5d5cc75bb38090246 Mon Sep 17 00:00:00 2001
From: Chao Yu <chao@kernel.org>
Date: Mon, 6 Dec 2021 22:44:19 +0800
Subject: [PATCH 0262/1043] f2fs: fix to do sanity check on inode type during
 garbage collection

commit 9056d6489f5a41cfbb67f719d2c0ce61ead72d9f upstream.

As report by Wenqing Liu in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=215231

- Overview
kernel NULL pointer dereference triggered  in folio_mark_dirty() when mount and operate on a crafted f2fs image

- Reproduce
tested on kernel 5.16-rc3, 5.15.X under root

1. mkdir mnt
2. mount -t f2fs tmp1.img mnt
3. touch tmp
4. cp tmp mnt

F2FS-fs (loop0): sanity_check_inode: inode (ino=49) extent info [5942, 4294180864, 4] is incorrect, run fsck to fix
F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=31340049, run fsck to fix.
BUG: kernel NULL pointer dereference, address: 0000000000000000
 folio_mark_dirty+0x33/0x50
 move_data_page+0x2dd/0x460 [f2fs]
 do_garbage_collect+0xc18/0x16a0 [f2fs]
 f2fs_gc+0x1d3/0xd90 [f2fs]
 f2fs_balance_fs+0x13a/0x570 [f2fs]
 f2fs_create+0x285/0x840 [f2fs]
 path_openat+0xe6d/0x1040
 do_filp_open+0xc5/0x140
 do_sys_openat2+0x23a/0x310
 do_sys_open+0x57/0x80

The root cause is for special file: e.g. character, block, fifo or socket file,
f2fs doesn't assign address space operations pointer array for mapping->a_ops field,
so, in a fuzzed image, SSA table indicates a data block belong to special file, when
f2fs tries to migrate that block, it causes NULL pointer access once move_data_page()
calls a_ops->set_dirty_page().

Cc: stable@vger.kernel.org
Reported-by: Wenqing Liu <wenqingliu0120@gmail.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Kazunori Kobayashi <kazunori.kobayashi@miraclelinux.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/gc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index 8e4daee0171f..dfa99cd195b8 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1451,7 +1451,8 @@ static int gc_data_segment(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
 
 		if (phase == 3) {
 			inode = f2fs_iget(sb, dni.ino);
-			if (IS_ERR(inode) || is_bad_inode(inode)) {
+			if (IS_ERR(inode) || is_bad_inode(inode) ||
+					special_file(inode->i_mode)) {
 				set_sbi_flag(sbi, SBI_NEED_FSCK);
 				continue;
 			}

From 01a5e17e3ef30ff45dc3f27631d4645f035b3e6c Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 6 May 2022 14:14:32 +0200
Subject: [PATCH 0263/1043] x86/mm: Simplify RESERVE_BRK()

commit a1e2c031ec3949b8c039b739c0b5bf9c30007b00 upstream.

RESERVE_BRK() reserves data in the .brk_reservation section.  The data
is initialized to zero, like BSS, so the macro specifies 'nobits' to
prevent the data from taking up space in the vmlinux binary.  The only
way to get the compiler to do that (without putting the variable in .bss
proper) is to use inline asm.

The macro also has a hack which encloses the inline asm in a discarded
function, which allows the size to be passed (global inline asm doesn't
allow inputs).

Remove the need for the discarded function hack by just stringifying the
size rather than supplying it as an input to the inline asm.

Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Borislav Petkov <bp@suse.de>
Link: https://lore.kernel.org/r/20220506121631.133110232@infradead.org
[nathan: Resolve conflict due to lack of 2b6ff7dea670]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/setup.h | 30 +++++++++++-------------------
 1 file changed, 11 insertions(+), 19 deletions(-)

diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
index 389d851a02c4..f0aa958bccbe 100644
--- a/arch/x86/include/asm/setup.h
+++ b/arch/x86/include/asm/setup.h
@@ -108,27 +108,19 @@ extern unsigned long _brk_end;
 void *extend_brk(size_t size, size_t align);
 
 /*
- * Reserve space in the brk section.  The name must be unique within
- * the file, and somewhat descriptive.  The size is in bytes.  Must be
- * used at file scope.
+ * Reserve space in the brk section.  The name must be unique within the file,
+ * and somewhat descriptive.  The size is in bytes.
  *
- * (This uses a temp function to wrap the asm so we can pass it the
- * size parameter; otherwise we wouldn't be able to.  We can't use a
- * "section" attribute on a normal variable because it always ends up
- * being @progbits, which ends up allocating space in the vmlinux
- * executable.)
+ * The allocation is done using inline asm (rather than using a section
+ * attribute on a normal variable) in order to allow the use of @nobits, so
+ * that it doesn't take up any space in the vmlinux file.
  */
-#define RESERVE_BRK(name,sz)						\
-	static void __section(".discard.text") __used notrace		\
-	__brk_reservation_fn_##name##__(void) {				\
-		asm volatile (						\
-			".pushsection .brk_reservation,\"aw\",@nobits;" \
-			".brk." #name ":"				\
-			" 1:.skip %c0;"					\
-			" .size .brk." #name ", . - 1b;"		\
-			" .popsection"					\
-			: : "i" (sz));					\
-	}
+#define RESERVE_BRK(name, size)						\
+	asm(".pushsection .brk_reservation,\"aw\",@nobits\n\t"		\
+	    ".brk." #name ":\n\t"					\
+	    ".skip " __stringify(size) "\n\t"				\
+	    ".size .brk." #name ", " __stringify(size) "\n\t"		\
+	    ".popsection\n\t")
 
 /* Helper for reserving space for arrays of things */
 #define RESERVE_BRK_ARRAY(type, name, entries)		\

From c761d34a7ec06f12faa776c2c6c53c18535e3557 Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@kernel.org>
Date: Thu, 9 Jun 2022 00:17:32 -0700
Subject: [PATCH 0264/1043] x86/mm: Fix RESERVE_BRK() for older binutils

commit e32683c6f7d22ba624e0bfc58b02cf3348bdca63 upstream.

With binutils 2.26, RESERVE_BRK() causes a build failure:

  /tmp/ccnGOKZ5.s: Assembler messages:
  /tmp/ccnGOKZ5.s:98: Error: missing ')'
  /tmp/ccnGOKZ5.s:98: Error: missing ')'
  /tmp/ccnGOKZ5.s:98: Error: missing ')'
  /tmp/ccnGOKZ5.s:98: Error: junk at end of line, first unrecognized
  character is `U'

The problem is this line:

  RESERVE_BRK(early_pgt_alloc, INIT_PGT_BUF_SIZE)

Specifically, the INIT_PGT_BUF_SIZE macro which (via PAGE_SIZE's use
_AC()) has a "1UL", which makes older versions of the assembler unhappy.
Unfortunately the _AC() macro doesn't work for inline asm.

Inline asm was only needed here to convince the toolchain to add the
STT_NOBITS flag.  However, if a C variable is placed in a section whose
name is prefixed with ".bss", GCC and Clang automatically set
STT_NOBITS.  In fact, ".bss..page_aligned" already relies on this trick.

So fix the build failure (and simplify the macro) by allocating the
variable in C.

Also, add NOLOAD to the ".brk" output section clause in the linker
script.  This is a failsafe in case the ".bss" prefix magic trick ever
stops working somehow.  If there's a section type mismatch, the GNU
linker will force the ".brk" output section to be STT_NOBITS.  The LLVM
linker will fail with a "section type mismatch" error.

Note this also changes the name of the variable from .brk.##name to
__brk_##name.  The variable names aren't actually used anywhere, so it's
harmless.

Fixes: a1e2c031ec39 ("x86/mm: Simplify RESERVE_BRK()")
Reported-by: Joe Damato <jdamato@fastly.com>
Reported-by: Byungchul Park <byungchul.park@lge.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Joe Damato <jdamato@fastly.com>
Link: https://lore.kernel.org/r/22d07a44c80d8e8e1e82b9a806ddc8c6bbb2606e.1654759036.git.jpoimboe@kernel.org
[nathan: Fix trivial conflict due to lack of 81519f778830]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/setup.h  | 38 +++++++++++++++++++----------------
 arch/x86/kernel/setup.c       |  5 -----
 arch/x86/kernel/vmlinux.lds.S |  4 ++--
 3 files changed, 23 insertions(+), 24 deletions(-)

diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
index f0aa958bccbe..4e1757bf66a8 100644
--- a/arch/x86/include/asm/setup.h
+++ b/arch/x86/include/asm/setup.h
@@ -108,19 +108,16 @@ extern unsigned long _brk_end;
 void *extend_brk(size_t size, size_t align);
 
 /*
- * Reserve space in the brk section.  The name must be unique within the file,
- * and somewhat descriptive.  The size is in bytes.
+ * Reserve space in the .brk section, which is a block of memory from which the
+ * caller is allowed to allocate very early (before even memblock is available)
+ * by calling extend_brk().  All allocated memory will be eventually converted
+ * to memblock.  Any leftover unallocated memory will be freed.
  *
- * The allocation is done using inline asm (rather than using a section
- * attribute on a normal variable) in order to allow the use of @nobits, so
- * that it doesn't take up any space in the vmlinux file.
+ * The size is in bytes.
  */
-#define RESERVE_BRK(name, size)						\
-	asm(".pushsection .brk_reservation,\"aw\",@nobits\n\t"		\
-	    ".brk." #name ":\n\t"					\
-	    ".skip " __stringify(size) "\n\t"				\
-	    ".size .brk." #name ", " __stringify(size) "\n\t"		\
-	    ".popsection\n\t")
+#define RESERVE_BRK(name, size)					\
+	__section(".bss..brk") __aligned(1) __used	\
+	static char __brk_##name[size]
 
 /* Helper for reserving space for arrays of things */
 #define RESERVE_BRK_ARRAY(type, name, entries)		\
@@ -138,12 +135,19 @@ asmlinkage void __init x86_64_start_reservations(char *real_mode_data);
 
 #endif /* __i386__ */
 #endif /* _SETUP */
-#else
-#define RESERVE_BRK(name,sz)				\
-	.pushsection .brk_reservation,"aw",@nobits;	\
-.brk.name:						\
-1:	.skip sz;					\
-	.size .brk.name,.-1b;				\
+
+#else  /* __ASSEMBLY */
+
+.macro __RESERVE_BRK name, size
+	.pushsection .bss..brk, "aw"
+SYM_DATA_START(__brk_\name)
+	.skip \size
+SYM_DATA_END(__brk_\name)
 	.popsection
+.endm
+
+#define RESERVE_BRK(name, size) __RESERVE_BRK name, size
+
 #endif /* __ASSEMBLY__ */
+
 #endif /* _ASM_X86_SETUP_H */
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 065152d9265e..e9b483c6f413 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -64,11 +64,6 @@ RESERVE_BRK(dmi_alloc, 65536);
 #endif
 
 
-/*
- * Range of the BSS area. The size of the BSS area is determined
- * at link time, with RESERVE_BRK*() facility reserving additional
- * chunks.
- */
 unsigned long _brk_start = (unsigned long)__brk_base;
 unsigned long _brk_end   = (unsigned long)__brk_base;
 
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index f0d4500ae77a..d685369fd30a 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -411,10 +411,10 @@ SECTIONS
 	__end_of_kernel_reserve = .;
 
 	. = ALIGN(PAGE_SIZE);
-	.brk : AT(ADDR(.brk) - LOAD_OFFSET) {
+	.brk (NOLOAD) : AT(ADDR(.brk) - LOAD_OFFSET) {
 		__brk_base = .;
 		. += 64 * 1024;		/* 64k alignment slop space */
-		*(.brk_reservation)	/* areas brk users have reserved */
+		*(.bss..brk)		/* areas brk users have reserved */
 		__brk_limit = .;
 	}
 

From c0db17e55ff6105f04f8fddc3a0a8d381315e929 Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Sat, 28 Oct 2023 14:40:07 +0800
Subject: [PATCH 0265/1043] ext4: add two helper functions extent_logical_end()
 and pa_logical_end()

commit 43bbddc067883d94de7a43d5756a295439fbe37d upstream.

When we use lstart + len to calculate the end of free extent or prealloc
space, it may exceed the maximum value of 4294967295(0xffffffff) supported
by ext4_lblk_t and cause overflow, which may lead to various problems.

Therefore, we add two helper functions, extent_logical_end() and
pa_logical_end(), to limit the type of end to loff_t, and also convert
lstart to loff_t for calculation to avoid overflow.

Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Link: https://lore.kernel.org/r/20230724121059.11834-2-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/mballoc.c |  7 +++----
 fs/ext4/mballoc.h | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index b35d59d41c89..b994561f3f28 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3545,7 +3545,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
 
 	/* first, let's learn actual file size
 	 * given current request is allocated */
-	size = ac->ac_o_ex.fe_logical + EXT4_C2B(sbi, ac->ac_o_ex.fe_len);
+	size = extent_logical_end(sbi, &ac->ac_o_ex);
 	size = size << bsbits;
 	if (size < i_size_read(ac->ac_inode))
 		size = i_size_read(ac->ac_inode);
@@ -3885,8 +3885,7 @@ ext4_mb_use_preallocated(struct ext4_allocation_context *ac)
 		/* all fields in this condition don't change,
 		 * so we can skip locking for them */
 		if (ac->ac_o_ex.fe_logical < pa->pa_lstart ||
-		    ac->ac_o_ex.fe_logical >= (pa->pa_lstart +
-					       EXT4_C2B(sbi, pa->pa_len)))
+		    ac->ac_o_ex.fe_logical >= pa_logical_end(sbi, pa))
 			continue;
 
 		/* non-extent files can't have physical blocks past 2^32 */
@@ -4704,7 +4703,7 @@ static void ext4_mb_group_or_file(struct ext4_allocation_context *ac)
 	if (unlikely(ac->ac_flags & EXT4_MB_HINT_GOAL_ONLY))
 		return;
 
-	size = ac->ac_o_ex.fe_logical + EXT4_C2B(sbi, ac->ac_o_ex.fe_len);
+	size = extent_logical_end(sbi, &ac->ac_o_ex);
 	isize = (i_size_read(ac->ac_inode) + ac->ac_sb->s_blocksize - 1)
 		>> bsbits;
 
diff --git a/fs/ext4/mballoc.h b/fs/ext4/mballoc.h
index 7be6288e48ec..1e9c402189cb 100644
--- a/fs/ext4/mballoc.h
+++ b/fs/ext4/mballoc.h
@@ -199,6 +199,20 @@ static inline ext4_fsblk_t ext4_grp_offs_to_block(struct super_block *sb,
 		(fex->fe_start << EXT4_SB(sb)->s_cluster_bits);
 }
 
+static inline loff_t extent_logical_end(struct ext4_sb_info *sbi,
+					struct ext4_free_extent *fex)
+{
+	/* Use loff_t to avoid end exceeding ext4_lblk_t max. */
+	return (loff_t)fex->fe_logical + EXT4_C2B(sbi, fex->fe_len);
+}
+
+static inline loff_t pa_logical_end(struct ext4_sb_info *sbi,
+				    struct ext4_prealloc_space *pa)
+{
+	/* Use loff_t to avoid end exceeding ext4_lblk_t max. */
+	return (loff_t)pa->pa_lstart + EXT4_C2B(sbi, pa->pa_len);
+}
+
 typedef int (*ext4_mballoc_query_range_fn)(
 	struct super_block		*sb,
 	ext4_group_t			agno,

From 58fe961c606c446f5612f6897827b1cac42c2e89 Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Sat, 28 Oct 2023 14:40:08 +0800
Subject: [PATCH 0266/1043] ext4: fix BUG in ext4_mb_new_inode_pa() due to
 overflow

commit bc056e7163ac7db945366de219745cf94f32a3e6 upstream.

When we calculate the end position of ext4_free_extent, this position may
be exactly where ext4_lblk_t (i.e. uint) overflows. For example, if
ac_g_ex.fe_logical is 4294965248 and ac_orig_goal_len is 2048, then the
computed end is 0x100000000, which is 0. If ac->ac_o_ex.fe_logical is not
the first case of adjusting the best extent, that is, new_bex_end > 0, the
following BUG_ON will be triggered:

=========================================================
kernel BUG at fs/ext4/mballoc.c:5116!
invalid opcode: 0000 [#1] PREEMPT SMP PTI
CPU: 3 PID: 673 Comm: xfs_io Tainted: G E 6.5.0-rc1+ #279
RIP: 0010:ext4_mb_new_inode_pa+0xc5/0x430
Call Trace:
 <TASK>
 ext4_mb_use_best_found+0x203/0x2f0
 ext4_mb_try_best_found+0x163/0x240
 ext4_mb_regular_allocator+0x158/0x1550
 ext4_mb_new_blocks+0x86a/0xe10
 ext4_ext_map_blocks+0xb0c/0x13a0
 ext4_map_blocks+0x2cd/0x8f0
 ext4_iomap_begin+0x27b/0x400
 iomap_iter+0x222/0x3d0
 __iomap_dio_rw+0x243/0xcb0
 iomap_dio_rw+0x16/0x80
=========================================================

A simple reproducer demonstrating the problem:

	mkfs.ext4 -F /dev/sda -b 4096 100M
	mount /dev/sda /tmp/test
	fallocate -l1M /tmp/test/tmp
	fallocate -l10M /tmp/test/file
	fallocate -i -o 1M -l16777203M /tmp/test/file
	fsstress -d /tmp/test -l 0 -n 100000 -p 8 &
	sleep 10 && killall -9 fsstress
	rm -f /tmp/test/tmp
	xfs_io -c "open -ad /tmp/test/file" -c "pwrite -S 0xff 0 8192"

We simply refactor the logic for adjusting the best extent by adding
a temporary ext4_free_extent ex and use extent_logical_end() to avoid
overflow, which also simplifies the code.

Cc: stable@kernel.org # 6.4
Fixes: 93cdf49f6eca ("ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()")
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Link: https://lore.kernel.org/r/20230724121059.11834-3-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/mballoc.c | 31 ++++++++++++++-----------------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index b994561f3f28..552781a94b4a 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4130,8 +4130,11 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
 	pa = ac->ac_pa;
 
 	if (ac->ac_b_ex.fe_len < ac->ac_g_ex.fe_len) {
-		int new_bex_start;
-		int new_bex_end;
+		struct ext4_free_extent ex = {
+			.fe_logical = ac->ac_g_ex.fe_logical,
+			.fe_len = ac->ac_g_ex.fe_len,
+		};
+		loff_t orig_goal_end = extent_logical_end(sbi, &ex);
 
 		/* we can't allocate as much as normalizer wants.
 		 * so, found space must get proper lstart
@@ -4150,29 +4153,23 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
 		 *    still cover original start
 		 * 3. Else, keep the best ex at start of original request.
 		 */
-		new_bex_end = ac->ac_g_ex.fe_logical +
-			EXT4_C2B(sbi, ac->ac_g_ex.fe_len);
-		new_bex_start = new_bex_end - EXT4_C2B(sbi, ac->ac_b_ex.fe_len);
-		if (ac->ac_o_ex.fe_logical >= new_bex_start)
+		ex.fe_len = ac->ac_b_ex.fe_len;
+
+		ex.fe_logical = orig_goal_end - EXT4_C2B(sbi, ex.fe_len);
+		if (ac->ac_o_ex.fe_logical >= ex.fe_logical)
 			goto adjust_bex;
 
-		new_bex_start = ac->ac_g_ex.fe_logical;
-		new_bex_end =
-			new_bex_start + EXT4_C2B(sbi, ac->ac_b_ex.fe_len);
-		if (ac->ac_o_ex.fe_logical < new_bex_end)
+		ex.fe_logical = ac->ac_g_ex.fe_logical;
+		if (ac->ac_o_ex.fe_logical < extent_logical_end(sbi, &ex))
 			goto adjust_bex;
 
-		new_bex_start = ac->ac_o_ex.fe_logical;
-		new_bex_end =
-			new_bex_start + EXT4_C2B(sbi, ac->ac_b_ex.fe_len);
-
+		ex.fe_logical = ac->ac_o_ex.fe_logical;
 adjust_bex:
-		ac->ac_b_ex.fe_logical = new_bex_start;
+		ac->ac_b_ex.fe_logical = ex.fe_logical;
 
 		BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical);
 		BUG_ON(ac->ac_o_ex.fe_len > ac->ac_b_ex.fe_len);
-		BUG_ON(new_bex_end > (ac->ac_g_ex.fe_logical +
-				      EXT4_C2B(sbi, ac->ac_g_ex.fe_len)));
+		BUG_ON(extent_logical_end(sbi, &ex) > orig_goal_end);
 	}
 
 	/* preallocation can change ac_b_ex, thus we store actually

From 6b977a7323f7d932b5aa72952758056cf3a4b80f Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Sat, 28 Oct 2023 14:40:09 +0800
Subject: [PATCH 0267/1043] ext4: avoid overlapping preallocations due to
 overflow

commit bedc5d34632c21b5adb8ca7143d4c1f794507e4c upstream.

Let's say we want to allocate 2 blocks starting from 4294966386, after
predicting the file size, start is aligned to 4294965248, len is changed
to 2048, then end = start + size = 0x100000000. Since end is of
type ext4_lblk_t, i.e. uint, end is truncated to 0.

This causes (pa->pa_lstart >= end) to always hold when checking if the
current extent to be allocated crosses already preallocated blocks, so the
resulting ac_g_ex may cross already preallocated blocks. Hence we convert
the end type to loff_t and use pa_logical_end() to avoid overflow.

Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Link: https://lore.kernel.org/r/20230724121059.11834-4-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/mballoc.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 552781a94b4a..c9ac43f40746 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3515,8 +3515,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
 	struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
 	struct ext4_super_block *es = sbi->s_es;
 	int bsbits, max;
-	ext4_lblk_t end;
-	loff_t size, start_off;
+	loff_t size, start_off, end;
 	loff_t orig_size __maybe_unused;
 	ext4_lblk_t start;
 	struct ext4_inode_info *ei = EXT4_I(ac->ac_inode);
@@ -3624,7 +3623,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
 	/* check we don't cross already preallocated blocks */
 	rcu_read_lock();
 	list_for_each_entry_rcu(pa, &ei->i_prealloc_list, pa_inode_list) {
-		ext4_lblk_t pa_end;
+		loff_t pa_end;
 
 		if (pa->pa_deleted)
 			continue;
@@ -3634,8 +3633,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
 			continue;
 		}
 
-		pa_end = pa->pa_lstart + EXT4_C2B(EXT4_SB(ac->ac_sb),
-						  pa->pa_len);
+		pa_end = pa_logical_end(EXT4_SB(ac->ac_sb), pa);
 
 		/* PA must not overlap original request */
 		BUG_ON(!(ac->ac_o_ex.fe_logical >= pa_end ||
@@ -3664,12 +3662,11 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
 	/* XXX: extra loop to check we really don't overlap preallocations */
 	rcu_read_lock();
 	list_for_each_entry_rcu(pa, &ei->i_prealloc_list, pa_inode_list) {
-		ext4_lblk_t pa_end;
+		loff_t pa_end;
 
 		spin_lock(&pa->pa_lock);
 		if (pa->pa_deleted == 0) {
-			pa_end = pa->pa_lstart + EXT4_C2B(EXT4_SB(ac->ac_sb),
-							  pa->pa_len);
+			pa_end = pa_logical_end(EXT4_SB(ac->ac_sb), pa);
 			BUG_ON(!(start >= pa_end || end <= pa->pa_lstart));
 		}
 		spin_unlock(&pa->pa_lock);

From 4a20f5ea62db9dc5dc1ff5b8e44f32baf36d701e Mon Sep 17 00:00:00 2001
From: John Sperbeck <jsperbeck@google.com>
Date: Sat, 28 Oct 2023 18:41:31 +0000
Subject: [PATCH 0268/1043] objtool/x86: add missing embedded_insn check

When dbf460087755 ("objtool/x86: Fixup frame-pointer vs rethunk")
was backported to some stable branches, the check for dest->embedded_insn
in is_special_call() was missed.  The result is that the warning it
was intended to suppress still appears.  For example on 6.1 (on kernels
before 6.1, the '-s' argument would instead be 'check'):

$ tools/objtool/objtool -s arch/x86/lib/retpoline.o
arch/x86/lib/retpoline.o: warning: objtool: srso_untrain_ret+0xd:
    call without frame pointer save/setup

With this patch, the warning is correctly suppressed, and the
kernel still passes the normal Google kernel developer tests.

Signed-off-by: John Sperbeck <jsperbeck@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/objtool/check.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index bd24951faa09..059b78d08f7a 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -2107,7 +2107,7 @@ static bool is_special_call(struct instruction *insn)
 		if (!dest)
 			return false;
 
-		if (dest->fentry)
+		if (dest->fentry || dest->embedded_insn)
 			return true;
 	}
 

From da369d3996ccd4ba6efaf73525789e70bd032168 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date: Tue, 31 Oct 2023 11:33:49 +0000
Subject: [PATCH 0269/1043] driver: platform: Add helper for safer setting of
 driver_override

commit 6c2f421174273de8f83cde4286d1c076d43a2d35 upstream.

Several core drivers and buses expect that driver_override is a
dynamically allocated memory thus later they can kfree() it.

However such assumption is not documented, there were in the past and
there are already users setting it to a string literal. This leads to
kfree() of static memory during device release (e.g. in error paths or
during unbind):

    kernel BUG at ../mm/slub.c:3960!
    Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
    ...
    (kfree) from [<c058da50>] (platform_device_release+0x88/0xb4)
    (platform_device_release) from [<c0585be0>] (device_release+0x2c/0x90)
    (device_release) from [<c0a69050>] (kobject_put+0xec/0x20c)
    (kobject_put) from [<c0f2f120>] (exynos5_clk_probe+0x154/0x18c)
    (exynos5_clk_probe) from [<c058de70>] (platform_drv_probe+0x6c/0xa4)
    (platform_drv_probe) from [<c058b7ac>] (really_probe+0x280/0x414)
    (really_probe) from [<c058baf4>] (driver_probe_device+0x78/0x1c4)
    (driver_probe_device) from [<c0589854>] (bus_for_each_drv+0x74/0xb8)
    (bus_for_each_drv) from [<c058b48c>] (__device_attach+0xd4/0x16c)
    (__device_attach) from [<c058a638>] (bus_probe_device+0x88/0x90)
    (bus_probe_device) from [<c05871fc>] (device_add+0x3dc/0x62c)
    (device_add) from [<c075ff10>] (of_platform_device_create_pdata+0x94/0xbc)
    (of_platform_device_create_pdata) from [<c07600ec>] (of_platform_bus_create+0x1a8/0x4fc)
    (of_platform_bus_create) from [<c0760150>] (of_platform_bus_create+0x20c/0x4fc)
    (of_platform_bus_create) from [<c07605f0>] (of_platform_populate+0x84/0x118)
    (of_platform_populate) from [<c0f3c964>] (of_platform_default_populate_init+0xa0/0xb8)
    (of_platform_default_populate_init) from [<c01031f8>] (do_one_initcall+0x8c/0x404)

Provide a helper which clearly documents the usage of driver_override.
This will allow later to reuse the helper and reduce the amount of
duplicated code.

Convert the platform driver to use a new helper and make the
driver_override field const char (it is not modified by the core).

Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20220419113435.246203-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/driver.c           | 69 +++++++++++++++++++++++++++++++++
 drivers/base/platform.c         | 28 ++-----------
 include/linux/device/driver.h   |  2 +
 include/linux/platform_device.h |  6 ++-
 4 files changed, 80 insertions(+), 25 deletions(-)

diff --git a/drivers/base/driver.c b/drivers/base/driver.c
index 8c0d33e182fd..1b9d47b10bd0 100644
--- a/drivers/base/driver.c
+++ b/drivers/base/driver.c
@@ -30,6 +30,75 @@ static struct device *next_device(struct klist_iter *i)
 	return dev;
 }
 
+/**
+ * driver_set_override() - Helper to set or clear driver override.
+ * @dev: Device to change
+ * @override: Address of string to change (e.g. &device->driver_override);
+ *            The contents will be freed and hold newly allocated override.
+ * @s: NUL-terminated string, new driver name to force a match, pass empty
+ *     string to clear it ("" or "\n", where the latter is only for sysfs
+ *     interface).
+ * @len: length of @s
+ *
+ * Helper to set or clear driver override in a device, intended for the cases
+ * when the driver_override field is allocated by driver/bus code.
+ *
+ * Returns: 0 on success or a negative error code on failure.
+ */
+int driver_set_override(struct device *dev, const char **override,
+			const char *s, size_t len)
+{
+	const char *new, *old;
+	char *cp;
+
+	if (!override || !s)
+		return -EINVAL;
+
+	/*
+	 * The stored value will be used in sysfs show callback (sysfs_emit()),
+	 * which has a length limit of PAGE_SIZE and adds a trailing newline.
+	 * Thus we can store one character less to avoid truncation during sysfs
+	 * show.
+	 */
+	if (len >= (PAGE_SIZE - 1))
+		return -EINVAL;
+
+	if (!len) {
+		/* Empty string passed - clear override */
+		device_lock(dev);
+		old = *override;
+		*override = NULL;
+		device_unlock(dev);
+		kfree(old);
+
+		return 0;
+	}
+
+	cp = strnchr(s, len, '\n');
+	if (cp)
+		len = cp - s;
+
+	new = kstrndup(s, len, GFP_KERNEL);
+	if (!new)
+		return -ENOMEM;
+
+	device_lock(dev);
+	old = *override;
+	if (cp != s) {
+		*override = new;
+	} else {
+		/* "\n" passed - clear override */
+		kfree(new);
+		*override = NULL;
+	}
+	device_unlock(dev);
+
+	kfree(old);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(driver_set_override);
+
 /**
  * driver_for_each_device - Iterator for devices bound to a driver.
  * @drv: Driver we're iterating.
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 88aef93eb4dd..647066229fec 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -1046,31 +1046,11 @@ static ssize_t driver_override_store(struct device *dev,
 				     const char *buf, size_t count)
 {
 	struct platform_device *pdev = to_platform_device(dev);
-	char *driver_override, *old, *cp;
+	int ret;
 
-	/* We need to keep extra room for a newline */
-	if (count >= (PAGE_SIZE - 1))
-		return -EINVAL;
-
-	driver_override = kstrndup(buf, count, GFP_KERNEL);
-	if (!driver_override)
-		return -ENOMEM;
-
-	cp = strchr(driver_override, '\n');
-	if (cp)
-		*cp = '\0';
-
-	device_lock(dev);
-	old = pdev->driver_override;
-	if (strlen(driver_override)) {
-		pdev->driver_override = driver_override;
-	} else {
-		kfree(driver_override);
-		pdev->driver_override = NULL;
-	}
-	device_unlock(dev);
-
-	kfree(old);
+	ret = driver_set_override(dev, &pdev->driver_override, buf, count);
+	if (ret)
+		return ret;
 
 	return count;
 }
diff --git a/include/linux/device/driver.h b/include/linux/device/driver.h
index ee7ba5b5417e..a44f5adeaef5 100644
--- a/include/linux/device/driver.h
+++ b/include/linux/device/driver.h
@@ -150,6 +150,8 @@ extern int __must_check driver_create_file(struct device_driver *driver,
 extern void driver_remove_file(struct device_driver *driver,
 			       const struct driver_attribute *attr);
 
+int driver_set_override(struct device *dev, const char **override,
+			const char *s, size_t len);
 extern int __must_check driver_for_each_device(struct device_driver *drv,
 					       struct device *start,
 					       void *data,
diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
index 17f9cd5626c8..e7a83b021807 100644
--- a/include/linux/platform_device.h
+++ b/include/linux/platform_device.h
@@ -30,7 +30,11 @@ struct platform_device {
 	struct resource	*resource;
 
 	const struct platform_device_id	*id_entry;
-	char *driver_override; /* Driver name to force a match */
+	/*
+	 * Driver name to force a match.  Do not set directly, because core
+	 * frees it.  Use driver_set_override() to set or clear it.
+	 */
+	const char *driver_override;
 
 	/* MFD cell pointer */
 	struct mfd_cell *mfd_cell;

From d0208fb38f439a9e05866a52d2394cbe9f58d87a Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date: Tue, 31 Oct 2023 11:33:50 +0000
Subject: [PATCH 0270/1043] rpmsg: Constify local variable in field store macro

commit e5f89131a06142e91073b6959d91cea73861d40e upstream.

Memory pointed by variable 'old' in field store macro is not modified,
so it can be made a pointer to const.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20220419113435.246203-12-krzysztof.kozlowski@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rpmsg/rpmsg_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
index 028ca5961bc2..ef32fd66e8c2 100644
--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -332,7 +332,8 @@ field##_store(struct device *dev, struct device_attribute *attr,	\
 	      const char *buf, size_t sz)				\
 {									\
 	struct rpmsg_device *rpdev = to_rpmsg_device(dev);		\
-	char *new, *old;						\
+	const char *old;						\
+	char *new;							\
 									\
 	new = kstrndup(buf, sz, GFP_KERNEL);				\
 	if (!new)							\

From 5bbd3469a4b60e026b3bf712e4108e646714231f Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date: Tue, 31 Oct 2023 11:33:51 +0000
Subject: [PATCH 0271/1043] rpmsg: Fix kfree() of static memory on setting
 driver_override

commit 42cd402b8fd4672b692400fe5f9eecd55d2794ac upstream.

The driver_override field from platform driver should not be initialized
from static memory (string literal) because the core later kfree() it,
for example when driver_override is set via sysfs.

Use dedicated helper to set driver_override properly.

Fixes: 950a7388f02b ("rpmsg: Turn name service into a stand alone driver")
Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface")
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20220419113435.246203-13-krzysztof.kozlowski@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rpmsg/rpmsg_internal.h | 15 ++++++++++++---
 include/linux/rpmsg.h          |  6 ++++--
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/drivers/rpmsg/rpmsg_internal.h b/drivers/rpmsg/rpmsg_internal.h
index 3fc83cd50e98..9165e3c811be 100644
--- a/drivers/rpmsg/rpmsg_internal.h
+++ b/drivers/rpmsg/rpmsg_internal.h
@@ -84,10 +84,19 @@ struct device *rpmsg_find_device(struct device *parent,
  */
 static inline int rpmsg_chrdev_register_device(struct rpmsg_device *rpdev)
 {
-	strcpy(rpdev->id.name, "rpmsg_chrdev");
-	rpdev->driver_override = "rpmsg_chrdev";
+	int ret;
 
-	return rpmsg_register_device(rpdev);
+	strcpy(rpdev->id.name, "rpmsg_chrdev");
+	ret = driver_set_override(&rpdev->dev, &rpdev->driver_override,
+				  rpdev->id.name, strlen(rpdev->id.name));
+	if (ret)
+		return ret;
+
+	ret = rpmsg_register_device(rpdev);
+	if (ret)
+		kfree(rpdev->driver_override);
+
+	return ret;
 }
 
 #endif
diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h
index a68972b097b7..6e7690e20dc5 100644
--- a/include/linux/rpmsg.h
+++ b/include/linux/rpmsg.h
@@ -41,7 +41,9 @@ struct rpmsg_channel_info {
  * rpmsg_device - device that belong to the rpmsg bus
  * @dev: the device struct
  * @id: device id (used to match between rpmsg drivers and devices)
- * @driver_override: driver name to force a match
+ * @driver_override: driver name to force a match; do not set directly,
+ *                   because core frees it; use driver_set_override() to
+ *                   set or clear it.
  * @src: local address
  * @dst: destination address
  * @ept: the rpmsg endpoint of this channel
@@ -50,7 +52,7 @@ struct rpmsg_channel_info {
 struct rpmsg_device {
 	struct device dev;
 	struct rpmsg_device_id id;
-	char *driver_override;
+	const char *driver_override;
 	u32 src;
 	u32 dst;
 	struct rpmsg_endpoint *ept;

From 5f1bb9f4d4b55c39180329c4e379aa740039eed3 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date: Tue, 31 Oct 2023 11:33:52 +0000
Subject: [PATCH 0272/1043] rpmsg: Fix calling device_lock() on non-initialized
 device

commit bb17d110cbf270d5247a6e261c5ad50e362d1675 upstream.

driver_set_override() helper uses device_lock() so it should not be
called before rpmsg_register_device() (which calls device_register()).
Effect can be seen with CONFIG_DEBUG_MUTEXES:

  DEBUG_LOCKS_WARN_ON(lock->magic != lock)
  WARNING: CPU: 3 PID: 57 at kernel/locking/mutex.c:582 __mutex_lock+0x1ec/0x430
  ...
  Call trace:
   __mutex_lock+0x1ec/0x430
   mutex_lock_nested+0x44/0x50
   driver_set_override+0x124/0x150
   qcom_glink_native_probe+0x30c/0x3b0
   glink_rpm_probe+0x274/0x350
   platform_probe+0x6c/0xe0
   really_probe+0x17c/0x3d0
   __driver_probe_device+0x114/0x190
   driver_probe_device+0x3c/0xf0
   ...

Refactor the rpmsg_register_device() function to use two-step device
registering (initialization + add) and call driver_set_override() in
proper moment.

This moves the code around, so while at it also NULL-ify the
rpdev->driver_override in error path to be sure it won't be kfree()
second time.

Fixes: 42cd402b8fd4 ("rpmsg: Fix kfree() of static memory on setting driver_override")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20220429195946.1061725-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rpmsg/rpmsg_core.c     | 33 ++++++++++++++++++++++++++++++---
 drivers/rpmsg/rpmsg_internal.h | 14 +-------------
 include/linux/rpmsg.h          |  8 ++++++++
 3 files changed, 39 insertions(+), 16 deletions(-)

diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
index ef32fd66e8c2..089eee735acc 100644
--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -526,24 +526,51 @@ static struct bus_type rpmsg_bus = {
 	.remove		= rpmsg_dev_remove,
 };
 
-int rpmsg_register_device(struct rpmsg_device *rpdev)
+/*
+ * A helper for registering rpmsg device with driver override and name.
+ * Drivers should not be using it, but instead rpmsg_register_device().
+ */
+int rpmsg_register_device_override(struct rpmsg_device *rpdev,
+				   const char *driver_override)
 {
 	struct device *dev = &rpdev->dev;
 	int ret;
 
+	if (driver_override)
+		strcpy(rpdev->id.name, driver_override);
+
 	dev_set_name(&rpdev->dev, "%s.%s.%d.%d", dev_name(dev->parent),
 		     rpdev->id.name, rpdev->src, rpdev->dst);
 
 	rpdev->dev.bus = &rpmsg_bus;
 
-	ret = device_register(&rpdev->dev);
+	device_initialize(dev);
+	if (driver_override) {
+		ret = driver_set_override(dev, &rpdev->driver_override,
+					  driver_override,
+					  strlen(driver_override));
+		if (ret) {
+			dev_err(dev, "device_set_override failed: %d\n", ret);
+			return ret;
+		}
+	}
+
+	ret = device_add(dev);
 	if (ret) {
-		dev_err(dev, "device_register failed: %d\n", ret);
+		dev_err(dev, "device_add failed: %d\n", ret);
+		kfree(rpdev->driver_override);
+		rpdev->driver_override = NULL;
 		put_device(&rpdev->dev);
 	}
 
 	return ret;
 }
+EXPORT_SYMBOL(rpmsg_register_device_override);
+
+int rpmsg_register_device(struct rpmsg_device *rpdev)
+{
+	return rpmsg_register_device_override(rpdev, NULL);
+}
 EXPORT_SYMBOL(rpmsg_register_device);
 
 /*
diff --git a/drivers/rpmsg/rpmsg_internal.h b/drivers/rpmsg/rpmsg_internal.h
index 9165e3c811be..f305279e2e24 100644
--- a/drivers/rpmsg/rpmsg_internal.h
+++ b/drivers/rpmsg/rpmsg_internal.h
@@ -84,19 +84,7 @@ struct device *rpmsg_find_device(struct device *parent,
  */
 static inline int rpmsg_chrdev_register_device(struct rpmsg_device *rpdev)
 {
-	int ret;
-
-	strcpy(rpdev->id.name, "rpmsg_chrdev");
-	ret = driver_set_override(&rpdev->dev, &rpdev->driver_override,
-				  rpdev->id.name, strlen(rpdev->id.name));
-	if (ret)
-		return ret;
-
-	ret = rpmsg_register_device(rpdev);
-	if (ret)
-		kfree(rpdev->driver_override);
-
-	return ret;
+	return rpmsg_register_device_override(rpdev, "rpmsg_ctrl");
 }
 
 #endif
diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h
index 6e7690e20dc5..267533fecbdd 100644
--- a/include/linux/rpmsg.h
+++ b/include/linux/rpmsg.h
@@ -115,6 +115,8 @@ struct rpmsg_driver {
 
 #if IS_ENABLED(CONFIG_RPMSG)
 
+int rpmsg_register_device_override(struct rpmsg_device *rpdev,
+				   const char *driver_override);
 int register_rpmsg_device(struct rpmsg_device *dev);
 void unregister_rpmsg_device(struct rpmsg_device *dev);
 int __register_rpmsg_driver(struct rpmsg_driver *drv, struct module *owner);
@@ -139,6 +141,12 @@ __poll_t rpmsg_poll(struct rpmsg_endpoint *ept, struct file *filp,
 
 #else
 
+static inline int rpmsg_register_device_override(struct rpmsg_device *rpdev,
+						 const char *driver_override)
+{
+	return -ENXIO;
+}
+
 static inline int register_rpmsg_device(struct rpmsg_device *dev)
 {
 	return -ENXIO;

From 41c13a571de449a94c92a68eac5b92a8860d5cc6 Mon Sep 17 00:00:00 2001
From: Bjorn Andersson <quic_bjorande@quicinc.com>
Date: Tue, 31 Oct 2023 11:33:53 +0000
Subject: [PATCH 0273/1043] rpmsg: glink: Release driver_override

commit fb80ef67e8ff6a00d3faad4cb348dafdb8eccfd8 upstream.

Upon termination of the rpmsg_device, driver_override needs to be freed
to avoid leaking the potentially assigned string.

Fixes: 42cd402b8fd4 ("rpmsg: Fix kfree() of static memory on setting driver_override")
Fixes: 39e47767ec9b ("rpmsg: Add driver_override device attribute for rpmsg_device")
Reviewed-by: Chris Lew <quic_clew@quicinc.com>
Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230109223931.1706429-1-quic_bjorande@quicinc.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rpmsg/qcom_glink_native.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index e776d1bfc976..28b6ae0e1a2f 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1379,6 +1379,7 @@ static void qcom_glink_rpdev_release(struct device *dev)
 	struct glink_channel *channel = to_glink_channel(rpdev->ept);
 
 	channel->rpdev = NULL;
+	kfree(rpdev->driver_override);
 	kfree(rpdev);
 }
 
@@ -1607,6 +1608,7 @@ static void qcom_glink_device_release(struct device *dev)
 
 	/* Release qcom_glink_alloc_channel() reference */
 	kref_put(&channel->refcount, qcom_glink_channel_release);
+	kfree(rpdev->driver_override);
 	kfree(rpdev);
 }
 

From 3fdd5b2bb09fc2b5bf3504778f51c89bb48c097f Mon Sep 17 00:00:00 2001
From: Hangyu Hua <hbh25y@gmail.com>
Date: Tue, 31 Oct 2023 11:33:54 +0000
Subject: [PATCH 0274/1043] rpmsg: Fix possible refcount leak in
 rpmsg_register_device_override()

commit d7bd416d35121c95fe47330e09a5c04adbc5f928 upstream.

rpmsg_register_device_override need to call put_device to free vch when
driver_set_override fails.

Fix this by adding a put_device() to the error path.

Fixes: bb17d110cbf2 ("rpmsg: Fix calling device_lock() on non-initialized device")
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20220624024120.11576-1-hbh25y@gmail.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rpmsg/rpmsg_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
index 089eee735acc..fd3d7b3fbbd1 100644
--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -551,6 +551,7 @@ int rpmsg_register_device_override(struct rpmsg_device *rpdev,
 					  strlen(driver_override));
 		if (ret) {
 			dev_err(dev, "device_set_override failed: %d\n", ret);
+			put_device(dev);
 			return ret;
 		}
 	}

From 9ade01b2949b7c281d2895bd0ae6cdbd5039cfda Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Thu, 30 Jun 2022 09:14:41 +0200
Subject: [PATCH 0275/1043] x86: Fix .brk attribute in linker script

commit 7e09ac27f43b382f5fe9bb7c7f4c465ece1f8a23 upstream.

Commit in Fixes added the "NOLOAD" attribute to the .brk section as a
"failsafe" measure.

Unfortunately, this leads to the linker no longer covering the .brk
section in a program header, resulting in the kernel loader not knowing
that the memory for the .brk section must be reserved.

This has led to crashes when loading the kernel as PV dom0 under Xen,
but other scenarios could be hit by the same problem (e.g. in case an
uncompressed kernel is used and the initrd is placed directly behind
it).

So drop the "NOLOAD" attribute. This has been verified to correctly
cover the .brk section by a program header of the resulting ELF file.

Fixes: e32683c6f7d2 ("x86/mm: Fix RESERVE_BRK() for older binutils")
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>
Link: https://lore.kernel.org/r/20220630071441.28576-4-jgross@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/vmlinux.lds.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index d685369fd30a..740f87d8aa48 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -411,7 +411,7 @@ SECTIONS
 	__end_of_kernel_reserve = .;
 
 	. = ALIGN(PAGE_SIZE);
-	.brk (NOLOAD) : AT(ADDR(.brk) - LOAD_OFFSET) {
+	.brk : AT(ADDR(.brk) - LOAD_OFFSET) {
 		__brk_base = .;
 		. += 64 * 1024;		/* 64k alignment slop space */
 		*(.bss..brk)		/* areas brk users have reserved */

From d151fb8019573a47d564a8b17e62b6fe14c87af9 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Wed, 4 Oct 2023 15:19:37 +0200
Subject: [PATCH 0276/1043] net: sched: cls_u32: Fix allocation size in
 u32_init()

[ Upstream commit c4d49196ceec80e30e8d981410d73331b49b7850 ]

commit d61491a51f7e ("net/sched: cls_u32: Replace one-element array
with flexible-array member") incorrecly replaced an instance of
`sizeof(*tp_c)` with `struct_size(tp_c, hlist->ht, 1)`. This results
in a an over-allocation of 8 bytes.

This change is wrong because `hlist` in `struct tc_u_common` is a
pointer:

net/sched/cls_u32.c:
struct tc_u_common {
        struct tc_u_hnode __rcu *hlist;
        void                    *ptr;
        int                     refcnt;
        struct idr              handle_idr;
        struct hlist_node       hnode;
        long                    knodes;
};

So, the use of `struct_size()` makes no sense: we don't need to allocate
any extra space for a flexible-array member. `sizeof(*tp_c)` is just fine.

So, `struct_size(tp_c, hlist->ht, 1)` translates to:

sizeof(*tp_c) + sizeof(tp_c->hlist->ht) ==
sizeof(struct tc_u_common) + sizeof(struct tc_u_knode *) ==
						144 + 8  == 0x98 (byes)
						     ^^^
						      |
						unnecessary extra
						allocation size

$ pahole -C tc_u_common net/sched/cls_u32.o
struct tc_u_common {
	struct tc_u_hnode *        hlist;                /*     0     8 */
	void *                     ptr;                  /*     8     8 */
	int                        refcnt;               /*    16     4 */

	/* XXX 4 bytes hole, try to pack */

	struct idr                 handle_idr;           /*    24    96 */
	/* --- cacheline 1 boundary (64 bytes) was 56 bytes ago --- */
	struct hlist_node          hnode;                /*   120    16 */
	/* --- cacheline 2 boundary (128 bytes) was 8 bytes ago --- */
	long int                   knodes;               /*   136     8 */

	/* size: 144, cachelines: 3, members: 6 */
	/* sum members: 140, holes: 1, sum holes: 4 */
	/* last cacheline: 16 bytes */
};

And with `sizeof(*tp_c)`, we have:

	sizeof(*tp_c) == sizeof(struct tc_u_common) == 144 == 0x90 (bytes)

which is the correct and original allocation size.

Fix this issue by replacing `struct_size(tp_c, hlist->ht, 1)` with
`sizeof(*tp_c)`, and avoid allocating 8 too many bytes.

The following difference in binary output is expected and reflects the
desired change:

| net/sched/cls_u32.o
| @@ -6148,7 +6148,7 @@
| include/linux/slab.h:599
|     2cf5:      mov    0x0(%rip),%rdi        # 2cfc <u32_init+0xfc>
|                        2cf8: R_X86_64_PC32     kmalloc_caches+0xc
|-    2cfc:      mov    $0x98,%edx
|+    2cfc:      mov    $0x90,%edx

Reported-by: Alejandro Colomar <alx@kernel.org>
Closes: https://lore.kernel.org/lkml/09b4a2ce-da74-3a19-6961-67883f634d98@kernel.org/
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/cls_u32.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index b2d2ba561eba..f2a0c10682fc 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -364,7 +364,7 @@ static int u32_init(struct tcf_proto *tp)
 	idr_init(&root_ht->handle_idr);
 
 	if (tp_c == NULL) {
-		tp_c = kzalloc(struct_size(tp_c, hlist->ht, 1), GFP_KERNEL);
+		tp_c = kzalloc(sizeof(*tp_c), GFP_KERNEL);
 		if (tp_c == NULL) {
 			kfree(root_ht);
 			return -ENOBUFS;

From e619b38a873fc92239d5f65c417d362c099c0e19 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <ben.wolsieffer@hefring.com>
Date: Tue, 3 Oct 2023 12:20:03 -0400
Subject: [PATCH 0277/1043] irqchip/stm32-exti: add missing DT IRQ flag
 translation

[ Upstream commit 8554cba1d6dbd3c74e0549e28ddbaccbb1d6b30a ]

The STM32F4/7 EXTI driver was missing the xlate callback, so IRQ trigger
flags specified in the device tree were being ignored. This was
preventing the RTC alarm interrupt from working, because it must be set
to trigger on the rising edge to function correctly.

Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20231003162003.1649967-1-ben.wolsieffer@hefring.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-stm32-exti.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
index 8662d7b7b262..cec9080cccad 100644
--- a/drivers/irqchip/irq-stm32-exti.c
+++ b/drivers/irqchip/irq-stm32-exti.c
@@ -403,6 +403,7 @@ static const struct irq_domain_ops irq_exti_domain_ops = {
 	.map	= irq_map_generic_chip,
 	.alloc  = stm32_exti_alloc,
 	.free	= stm32_exti_free,
+	.xlate	= irq_domain_xlate_twocell,
 };
 
 static void stm32_irq_ack(struct irq_data *d)

From fb8f253b953282e6087f9ddd916b8d89061af904 Mon Sep 17 00:00:00 2001
From: Zhang Shurong <zhang_shurong@foxmail.com>
Date: Thu, 5 Oct 2023 22:28:35 +0800
Subject: [PATCH 0278/1043] dmaengine: ste_dma40: Fix PM disable depth
 imbalance in d40_probe

[ Upstream commit 0618c077a8c20e8c81e367988f70f7e32bb5a717 ]

The pm_runtime_enable will increase power disable depth. Thus
a pairing decrement is needed on the error handling path to
keep it balanced according to context.
We fix it by calling pm_runtime_disable when error returns.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/tencent_DD2D371DB5925B4B602B1E1D0A5FA88F1208@qq.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/ste_dma40.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index d99fec821508..4c306dd13e86 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -3698,6 +3698,7 @@ static int __init d40_probe(struct platform_device *pdev)
 		regulator_disable(base->lcpa_regulator);
 		regulator_put(base->lcpa_regulator);
 	}
+	pm_runtime_disable(base->dev);
 
 	kfree(base->lcla_pool.alloc_map);
 	kfree(base->lookup_log_chans);

From ead3c123a7539422aa77b517e94dbd8ffe780c14 Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Fri, 13 Oct 2023 17:29:57 -0700
Subject: [PATCH 0279/1043] Input: synaptics-rmi4 - handle reset delay when
 using SMBus trsnsport

[ Upstream commit 5030b2fe6aab37fe42d14f31842ea38be7c55c57 ]

Touch controllers need some time after receiving reset command for the
firmware to finish re-initializing and be ready to respond to commands
from the host. The driver already had handling for the post-reset delay
for I2C and SPI transports, this change adds the handling to
SMBus-connected devices.

SMBus devices are peculiar because they implement legacy PS/2
compatibility mode, so reset is actually issued by psmouse driver on the
associated serio port, after which the control is passed to the RMI4
driver with SMBus companion device.

Note that originally the delay was added to psmouse driver in
92e24e0e57f7 ("Input: psmouse - add delay when deactivating for SMBus
mode"), but that resulted in an unwanted delay in "fast" reconnect
handler for the serio port, so it was decided to revert the patch and
have the delay being handled in the RMI4 driver, similar to the other
transports.

Tested-by: Jeffery Miller <jefferymiller@google.com>
Link: https://lore.kernel.org/r/ZR1yUFJ8a9Zt606N@penguin
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/mouse/synaptics.c |  1 +
 drivers/input/rmi4/rmi_smbus.c  | 50 ++++++++++++++++++---------------
 2 files changed, 29 insertions(+), 22 deletions(-)

diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index afa5d2623c41..e2c130832c15 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1749,6 +1749,7 @@ static int synaptics_create_intertouch(struct psmouse *psmouse,
 		psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) &&
 		!SYN_CAP_EXT_BUTTONS_STICK(info->ext_cap_10);
 	const struct rmi_device_platform_data pdata = {
+		.reset_delay_ms = 30,
 		.sensor_pdata = {
 			.sensor_type = rmi_sensor_touchpad,
 			.axis_align.flip_y = true,
diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c
index 2407ea43de59..f38bf9a5f599 100644
--- a/drivers/input/rmi4/rmi_smbus.c
+++ b/drivers/input/rmi4/rmi_smbus.c
@@ -235,12 +235,29 @@ static void rmi_smb_clear_state(struct rmi_smb_xport *rmi_smb)
 
 static int rmi_smb_enable_smbus_mode(struct rmi_smb_xport *rmi_smb)
 {
-	int retval;
+	struct i2c_client *client = rmi_smb->client;
+	int smbus_version;
+
+	/*
+	 * psmouse driver resets the controller, we only need to wait
+	 * to give the firmware chance to fully reinitialize.
+	 */
+	if (rmi_smb->xport.pdata.reset_delay_ms)
+		msleep(rmi_smb->xport.pdata.reset_delay_ms);
 
 	/* we need to get the smbus version to activate the touchpad */
-	retval = rmi_smb_get_version(rmi_smb);
-	if (retval < 0)
-		return retval;
+	smbus_version = rmi_smb_get_version(rmi_smb);
+	if (smbus_version < 0)
+		return smbus_version;
+
+	rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d",
+		smbus_version);
+
+	if (smbus_version != 2 && smbus_version != 3) {
+		dev_err(&client->dev, "Unrecognized SMB version %d\n",
+				smbus_version);
+		return -ENODEV;
+	}
 
 	return 0;
 }
@@ -253,11 +270,10 @@ static int rmi_smb_reset(struct rmi_transport_dev *xport, u16 reset_addr)
 	rmi_smb_clear_state(rmi_smb);
 
 	/*
-	 * we do not call the actual reset command, it has to be handled in
-	 * PS/2 or there will be races between PS/2 and SMBus.
-	 * PS/2 should ensure that a psmouse_reset is called before
-	 * intializing the device and after it has been removed to be in a known
-	 * state.
+	 * We do not call the actual reset command, it has to be handled in
+	 * PS/2 or there will be races between PS/2 and SMBus. PS/2 should
+	 * ensure that a psmouse_reset is called before initializing the
+	 * device and after it has been removed to be in a known state.
 	 */
 	return rmi_smb_enable_smbus_mode(rmi_smb);
 }
@@ -273,7 +289,6 @@ static int rmi_smb_probe(struct i2c_client *client,
 {
 	struct rmi_device_platform_data *pdata = dev_get_platdata(&client->dev);
 	struct rmi_smb_xport *rmi_smb;
-	int smbus_version;
 	int error;
 
 	if (!pdata) {
@@ -312,18 +327,9 @@ static int rmi_smb_probe(struct i2c_client *client,
 	rmi_smb->xport.proto_name = "smb";
 	rmi_smb->xport.ops = &rmi_smb_ops;
 
-	smbus_version = rmi_smb_get_version(rmi_smb);
-	if (smbus_version < 0)
-		return smbus_version;
-
-	rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d",
-		smbus_version);
-
-	if (smbus_version != 2 && smbus_version != 3) {
-		dev_err(&client->dev, "Unrecognized SMB version %d\n",
-				smbus_version);
-		return -ENODEV;
-	}
+	error = rmi_smb_enable_smbus_mode(rmi_smb);
+	if (error)
+		return error;
 
 	i2c_set_clientdata(client, rmi_smb);
 

From 6f9093b6f8f76376cac1c262560524d7a0a8bee9 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Thu, 21 Sep 2023 19:04:21 +0800
Subject: [PATCH 0280/1043] fbdev: atyfb: only use ioremap_uc() on i386 and
 ia64

[ Upstream commit c1a8d1d0edb71dec15c9649cb56866c71c1ecd9e ]

ioremap_uc() is only meaningful on old x86-32 systems with the PAT
extension, and on ia64 with its slightly unconventional ioremap()
behavior, everywhere else this is the same as ioremap() anyway.

Change the only driver that still references ioremap_uc() to only do so
on x86-32/ia64 in order to allow removing that interface at some
point in the future for the other architectures.

On some architectures, ioremap_uc() just returns NULL, changing
the driver to call ioremap() means that they now have a chance
of working correctly.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Baoquan He <bhe@redhat.com>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Cc: Helge Deller <deller@gmx.de>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: linux-fbdev@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/aty/atyfb_base.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c
index c8feff0ee8da..eb32ff0910d3 100644
--- a/drivers/video/fbdev/aty/atyfb_base.c
+++ b/drivers/video/fbdev/aty/atyfb_base.c
@@ -3440,11 +3440,15 @@ static int atyfb_setup_generic(struct pci_dev *pdev, struct fb_info *info,
 	}
 
 	info->fix.mmio_start = raddr;
+#if defined(__i386__) || defined(__ia64__)
 	/*
 	 * By using strong UC we force the MTRR to never have an
 	 * effect on the MMIO region on both non-PAT and PAT systems.
 	 */
 	par->ati_regbase = ioremap_uc(info->fix.mmio_start, 0x1000);
+#else
+	par->ati_regbase = ioremap(info->fix.mmio_start, 0x1000);
+#endif
 	if (par->ati_regbase == NULL)
 		return -ENOMEM;
 

From 66cc633fc6e1a8229c3adc3e3939335f9af90b3e Mon Sep 17 00:00:00 2001
From: "William A. Kennington III" <william@wkennington.com>
Date: Fri, 22 Sep 2023 11:28:12 -0700
Subject: [PATCH 0281/1043] spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0

[ Upstream commit 2ec8b010979036c2fe79a64adb6ecc0bd11e91d1 ]

We don't want to use the value of ilog2(0) as dummy.buswidth is 0 when
dummy.nbytes is 0. Since we have no dummy bytes, we don't need to
configure the dummy byte bits per clock register value anyway.

Signed-off-by: "William A. Kennington III" <william@wkennington.com>
Link: https://lore.kernel.org/r/20230922182812.2728066-1-william@wkennington.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-npcm-fiu.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c
index b62471ab6d7f..1edaf22e265b 100644
--- a/drivers/spi/spi-npcm-fiu.c
+++ b/drivers/spi/spi-npcm-fiu.c
@@ -334,8 +334,9 @@ static int npcm_fiu_uma_read(struct spi_mem *mem,
 		uma_cfg |= ilog2(op->cmd.buswidth);
 		uma_cfg |= ilog2(op->addr.buswidth)
 			<< NPCM_FIU_UMA_CFG_ADBPCK_SHIFT;
-		uma_cfg |= ilog2(op->dummy.buswidth)
-			<< NPCM_FIU_UMA_CFG_DBPCK_SHIFT;
+		if (op->dummy.nbytes)
+			uma_cfg |= ilog2(op->dummy.buswidth)
+				<< NPCM_FIU_UMA_CFG_DBPCK_SHIFT;
 		uma_cfg |= ilog2(op->data.buswidth)
 			<< NPCM_FIU_UMA_CFG_RDBPCK_SHIFT;
 		uma_cfg |= op->dummy.nbytes << NPCM_FIU_UMA_CFG_DBSIZ_SHIFT;

From c683d8b6417c2248cf6eedf9a41147447483501b Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Thu, 5 Oct 2023 10:53:08 +0200
Subject: [PATCH 0282/1043] netfilter: nfnetlink_log: silence bogus compiler
 warning

[ Upstream commit 2e1d175410972285333193837a4250a74cd472e6 ]

net/netfilter/nfnetlink_log.c:800:18: warning: variable 'ctinfo' is uninitialized

The warning is bogus, the variable is only used if ct is non-NULL and
always initialised in that case.  Init to 0 too to silence this.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202309100514.ndBFebXN-lkp@intel.com/
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nfnetlink_log.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index f087baa95b07..80c09070ea9f 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -683,8 +683,8 @@ nfulnl_log_packet(struct net *net,
 	unsigned int plen = 0;
 	struct nfnl_log_net *log = nfnl_log_pernet(net);
 	const struct nfnl_ct_hook *nfnl_ct = NULL;
+	enum ip_conntrack_info ctinfo = 0;
 	struct nf_conn *ct = NULL;
-	enum ip_conntrack_info ctinfo;
 
 	if (li_user && li_user->type == NF_LOG_TYPE_ULOG)
 		li = li_user;

From ec45886637ee368772dcb568f76b9285d339ebfb Mon Sep 17 00:00:00 2001
From: Shuming Fan <shumingf@realtek.com>
Date: Fri, 13 Oct 2023 17:45:25 +0800
Subject: [PATCH 0283/1043] ASoC: rt5650: fix the wrong result of key button

[ Upstream commit f88dfbf333b3661faff996bb03af2024d907b76a ]

The RT5650 should enable a power setting for button detection to avoid the wrong result.

Signed-off-by: Shuming Fan <shumingf@realtek.com>
Link: https://lore.kernel.org/r/20231013094525.715518-1-shumingf@realtek.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/rt5645.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index d1533e95a74f..99d91bfb8812 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -3241,6 +3241,8 @@ int rt5645_set_jack_detect(struct snd_soc_component *component,
 				RT5645_GP1_PIN_IRQ, RT5645_GP1_PIN_IRQ);
 		regmap_update_bits(rt5645->regmap, RT5645_GEN_CTRL1,
 				RT5645_DIG_GATE_CTRL, RT5645_DIG_GATE_CTRL);
+		regmap_update_bits(rt5645->regmap, RT5645_DEPOP_M1,
+				RT5645_HP_CB_MASK, RT5645_HP_CB_PU);
 	}
 	rt5645_irq(0, rt5645);
 

From abf9c7811836adda81e07478499e9ece1257b4a2 Mon Sep 17 00:00:00 2001
From: Jorge Maidana <jorgem.linux@gmail.com>
Date: Fri, 6 Oct 2023 17:43:47 -0300
Subject: [PATCH 0284/1043] fbdev: uvesafb: Call cn_del_callback() at the end
 of uvesafb_exit()

[ Upstream commit 1022e7e2f40574c74ed32c3811b03d26b0b81daf ]

Delete the v86d netlink only after all the VBE tasks have been
completed.

Fixes initial state restore on module unload:
uvesafb: VBE state restore call failed (eax=0x4f04, err=-19)

Signed-off-by: Jorge Maidana <jorgem.linux@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/uvesafb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
index 661f12742e4f..d999a7cdb540 100644
--- a/drivers/video/fbdev/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
@@ -1933,10 +1933,10 @@ static void uvesafb_exit(void)
 		}
 	}
 
-	cn_del_callback(&uvesafb_cn_id);
 	driver_remove_file(&uvesafb_driver.driver, &driver_attr_v86d);
 	platform_device_unregister(uvesafb_device);
 	platform_driver_unregister(&uvesafb_driver);
+	cn_del_callback(&uvesafb_cn_id);
 }
 
 module_exit(uvesafb_exit);

From 268ec38b797b7dac36f16e135bd735b8dce80cd3 Mon Sep 17 00:00:00 2001
From: Tomas Henzl <thenzl@redhat.com>
Date: Sun, 15 Oct 2023 13:45:29 +0200
Subject: [PATCH 0285/1043] scsi: mpt3sas: Fix in error path

[ Upstream commit e40c04ade0e2f3916b78211d747317843b11ce10 ]

The driver should be deregistered as misc driver after PCI registration
failure.

Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Link: https://lore.kernel.org/r/20231015114529.10725-1-thenzl@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index c3a5978b0efa..e797f6e3982c 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -11624,8 +11624,10 @@ _mpt3sas_init(void)
 	mpt3sas_ctl_init(hbas_to_enumerate);
 
 	error = pci_register_driver(&mpt3sas_driver);
-	if (error)
+	if (error) {
+		mpt3sas_ctl_exit(hbas_to_enumerate);
 		scsih_exit();
+	}
 
 	return error;
 }

From 955a1105eec28c9aeaf26d1b1d7a589810e80071 Mon Sep 17 00:00:00 2001
From: Liming Sun <limings@nvidia.com>
Date: Thu, 12 Oct 2023 19:02:35 -0400
Subject: [PATCH 0286/1043] platform/mellanox: mlxbf-tmfifo: Fix a warning
 message

[ Upstream commit 99c09c985e5973c8f0ad976ebae069548dd86f12 ]

This commit fixes the smatch static checker warning in function
mlxbf_tmfifo_rxtx_word() which complains data not initialized at
line 634 when IS_VRING_DROP() is TRUE.

Signed-off-by: Liming Sun <limings@nvidia.com>
Link: https://lore.kernel.org/r/20231012230235.219861-1-limings@nvidia.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c
index 194f3205e559..767f4406e55f 100644
--- a/drivers/platform/mellanox/mlxbf-tmfifo.c
+++ b/drivers/platform/mellanox/mlxbf-tmfifo.c
@@ -588,24 +588,25 @@ static void mlxbf_tmfifo_rxtx_word(struct mlxbf_tmfifo_vring *vring,
 
 	if (vring->cur_len + sizeof(u64) <= len) {
 		/* The whole word. */
-		if (!IS_VRING_DROP(vring)) {
-			if (is_rx)
+		if (is_rx) {
+			if (!IS_VRING_DROP(vring))
 				memcpy(addr + vring->cur_len, &data,
 				       sizeof(u64));
-			else
-				memcpy(&data, addr + vring->cur_len,
-				       sizeof(u64));
+		} else {
+			memcpy(&data, addr + vring->cur_len,
+			       sizeof(u64));
 		}
 		vring->cur_len += sizeof(u64);
 	} else {
 		/* Leftover bytes. */
-		if (!IS_VRING_DROP(vring)) {
-			if (is_rx)
+		if (is_rx) {
+			if (!IS_VRING_DROP(vring))
 				memcpy(addr + vring->cur_len, &data,
 				       len - vring->cur_len);
-			else
-				memcpy(&data, addr + vring->cur_len,
-				       len - vring->cur_len);
+		} else {
+			data = 0;
+			memcpy(&data, addr + vring->cur_len,
+			       len - vring->cur_len);
 		}
 		vring->cur_len = len;
 	}

From 1b285a1bfb0de166139683ad18c98fa7a1b96392 Mon Sep 17 00:00:00 2001
From: Su Hui <suhui@nfschina.com>
Date: Fri, 20 Oct 2023 17:27:59 +0800
Subject: [PATCH 0287/1043] net: chelsio: cxgb4: add an error code check in
 t4_load_phy_fw

[ Upstream commit 9f771493da935299c6393ad3563b581255d01a37 ]

t4_set_params_timeout() can return -EINVAL if failed, add check
for this.

Signed-off-by: Su Hui <suhui@nfschina.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 964ea3491b80..7e8a8ea6d8f7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3846,6 +3846,8 @@ int t4_load_phy_fw(struct adapter *adap, int win,
 		 FW_PARAMS_PARAM_Z_V(FW_PARAMS_PARAM_DEV_PHYFW_DOWNLOAD));
 	ret = t4_set_params_timeout(adap, adap->mbox, adap->pf, 0, 1,
 				    &param, &val, 30000);
+	if (ret)
+		return ret;
 
 	/* If we have version number support, then check to see that the new
 	 * firmware got loaded properly.

From b881ce6c7d10071ee9440deec03ac15e581f956c Mon Sep 17 00:00:00 2001
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Mon, 23 Oct 2023 22:25:00 +1100
Subject: [PATCH 0288/1043] powerpc/mm: Fix boot crash with FLATMEM

[ Upstream commit daa9ada2093ed23d52b4c1fe6e13cf78f55cc85f ]

Erhard reported that his G5 was crashing with v6.6-rc kernels:

  mpic: Setting up HT PICs workarounds for U3/U4
  BUG: Unable to handle kernel data access at 0xfeffbb62ffec65fe
  Faulting instruction address: 0xc00000000005dc40
  Oops: Kernel access of bad area, sig: 11 [#1]
  BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 PowerMac
  Modules linked in:
  CPU: 0 PID: 0 Comm: swapper/0 Tainted: G                T  6.6.0-rc3-PMacGS #1
  Hardware name: PowerMac11,2 PPC970MP 0x440101 PowerMac
  NIP:  c00000000005dc40 LR: c000000000066660 CTR: c000000000007730
  REGS: c0000000022bf510 TRAP: 0380   Tainted: G                T (6.6.0-rc3-PMacGS)
  MSR:  9000000000001032 <SF,HV,ME,IR,DR,RI>  CR: 44004242  XER: 00000000
  IRQMASK: 3
  GPR00: 0000000000000000 c0000000022bf7b0 c0000000010c0b00 00000000000001ac
  GPR04: 0000000003c80000 0000000000000300 c0000000f20001ae 0000000000000300
  GPR08: 0000000000000006 feffbb62ffec65ff 0000000000000001 0000000000000000
  GPR12: 9000000000001032 c000000002362000 c000000000f76b80 000000000349ecd8
  GPR16: 0000000002367ba8 0000000002367f08 0000000000000006 0000000000000000
  GPR20: 00000000000001ac c000000000f6f920 c0000000022cd985 000000000000000c
  GPR24: 0000000000000300 00000003b0a3691d c0003e008030000e 0000000000000000
  GPR28: c00000000000000c c0000000f20001ee feffbb62ffec65fe 00000000000001ac
  NIP hash_page_do_lazy_icache+0x50/0x100
  LR  __hash_page_4K+0x420/0x590
  Call Trace:
    hash_page_mm+0x364/0x6f0
    do_hash_fault+0x114/0x2b0
    data_access_common_virt+0x198/0x1f0
  --- interrupt: 300 at mpic_init+0x4bc/0x10c4
  NIP:  c000000002020a5c LR: c000000002020a04 CTR: 0000000000000000
  REGS: c0000000022bf9f0 TRAP: 0300   Tainted: G                T (6.6.0-rc3-PMacGS)
  MSR:  9000000000001032 <SF,HV,ME,IR,DR,RI>  CR: 24004248  XER: 00000000
  DAR: c0003e008030000e DSISR: 40000000 IRQMASK: 1
  ...
  NIP mpic_init+0x4bc/0x10c4
  LR  mpic_init+0x464/0x10c4
  --- interrupt: 300
    pmac_setup_one_mpic+0x258/0x2dc
    pmac_pic_init+0x28c/0x3d8
    init_IRQ+0x90/0x140
    start_kernel+0x57c/0x78c
    start_here_common+0x1c/0x20

A bisect pointed to the breakage beginning with commit 9fee28baa601 ("powerpc:
implement the new page table range API").

Analysis of the oops pointed to a struct page with a corrupted
compound_head being loaded via page_folio() -> _compound_head() in
hash_page_do_lazy_icache().

The access by the mpic code is to an MMIO address, so the expectation
is that the struct page for that address would be initialised by
init_unavailable_range(), as pointed out by Aneesh.

Instrumentation showed that was not the case, which eventually lead to
the realisation that pfn_valid() was returning false for that address,
causing the struct page to not be initialised.

Because the system is using FLATMEM, the version of pfn_valid() in
memory_model.h is used:

static inline int pfn_valid(unsigned long pfn)
{
	...
	return pfn >= pfn_offset && (pfn - pfn_offset) < max_mapnr;
}

Which relies on max_mapnr being initialised. Early in boot max_mapnr is
zero meaning no PFNs are valid.

max_mapnr is initialised in mem_init() called via:

  start_kernel()
    mm_core_init()  # init/main.c:928
      mem_init()

But that is too late for the usage in init_unavailable_range() called via:

  start_kernel()
    setup_arch()    # init/main.c:893
      paging_init()
        free_area_init()
          init_unavailable_range()

Although max_mapnr is currently set in mem_init(), the value is actually
already available much earlier, as soon as mem_topology_setup() has
completed, which is also before paging_init() is called. So move the
initialisation there, which causes paging_init() to correctly initialise
the struct page and fixes the bug.

This bug seems to have been lurking for years, but went unnoticed
because the pre-folio code was inspecting the uninitialised page->flags
but not dereferencing it.

Thanks to Erhard and Aneesh for help debugging.

Reported-by: Erhard Furtner <erhard_f@mailbox.org>
Closes: https://lore.kernel.org/all/20230929132750.3cd98452@yea/
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231023112500.1550208-1-mpe@ellerman.id.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/setup-common.c | 2 ++
 arch/powerpc/mm/mem.c              | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index da8c71f321ad..1e417c3eedfe 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -906,6 +906,8 @@ void __init setup_arch(char **cmdline_p)
 
 	/* Parse memory topology */
 	mem_topology_setup();
+	/* Set max_mapnr before paging_init() */
+	set_max_mapnr(max_pfn);
 
 	/*
 	 * Release secondary cpus out of their spinloops at 0x60 now that
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 1ed276d2305f..08e3422eb792 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -293,7 +293,6 @@ void __init mem_init(void)
 #endif
 
 	high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
-	set_max_mapnr(max_pfn);
 
 	kasan_late_init();
 

From 186ab5645199cac4008645aff711c5d77f7fae5f Mon Sep 17 00:00:00 2001
From: Patrick Menschel <menschel.p@posteo.de>
Date: Tue, 31 Oct 2023 10:29:09 +0100
Subject: [PATCH 0289/1043] can: isotp: change error format from decimal to
 symbolic error names

commit 46d8657a6b284e32b6b3bf1a6c93ee507fdd3cdb upstream

This patch changes the format string for errors from decimal %d to
symbolic error names %pe to achieve more comprehensive log messages.

Link: https://lore.kernel.org/r/20210427052150.2308-2-menschel.p@posteo.de
Signed-off-by: Patrick Menschel <menschel.p@posteo.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index 16ebc187af1c..d34f9ab2eb62 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -228,8 +228,8 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus)
 
 	can_send_ret = can_send(nskb, 1);
 	if (can_send_ret)
-		pr_notice_once("can-isotp: %s: can_send_ret %d\n",
-			       __func__, can_send_ret);
+		pr_notice_once("can-isotp: %s: can_send_ret %pe\n",
+			       __func__, ERR_PTR(can_send_ret));
 
 	dev_put(dev);
 
@@ -814,8 +814,8 @@ static enum hrtimer_restart isotp_tx_timer_handler(struct hrtimer *hrtimer)
 
 		can_send_ret = can_send(skb, 1);
 		if (can_send_ret)
-			pr_notice_once("can-isotp: %s: can_send_ret %d\n",
-				       __func__, can_send_ret);
+			pr_notice_once("can-isotp: %s: can_send_ret %pe\n",
+				       __func__, ERR_PTR(can_send_ret));
 
 		if (so->tx.idx >= so->tx.len) {
 			/* we are done */
@@ -976,8 +976,8 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	err = can_send(skb, 1);
 	dev_put(dev);
 	if (err) {
-		pr_notice_once("can-isotp: %s: can_send_ret %d\n",
-			       __func__, err);
+		pr_notice_once("can-isotp: %s: can_send_ret %pe\n",
+			       __func__, ERR_PTR(err));
 
 		/* no transmission -> no timeout monitoring */
 		if (hrtimer_sec)

From 57798a2cfe1594e7fa0f920811fe69cb093d8954 Mon Sep 17 00:00:00 2001
From: Patrick Menschel <menschel.p@posteo.de>
Date: Tue, 31 Oct 2023 10:29:10 +0100
Subject: [PATCH 0290/1043] can: isotp: add symbolic error message to
 isotp_module_init()

commit 6a5ddae578842652719fb926b22f1d510fe50bee upstream

This patch adds the value of err with format %pe to the already
existing error message.

Link: https://lore.kernel.org/r/20210427052150.2308-3-menschel.p@posteo.de
Signed-off-by: Patrick Menschel <menschel.p@posteo.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index d34f9ab2eb62..009d5216f3ea 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1550,7 +1550,7 @@ static __init int isotp_module_init(void)
 
 	err = can_proto_register(&isotp_can_proto);
 	if (err < 0)
-		pr_err("can: registration of isotp protocol failed\n");
+		pr_err("can: registration of isotp protocol failed %pe\n", ERR_PTR(err));
 	else
 		register_netdevice_notifier(&canisotp_notifier);
 

From 7adbc048d84b54aaa2faf466d888e436fb83f70b Mon Sep 17 00:00:00 2001
From: Patrick Menschel <menschel.p@posteo.de>
Date: Tue, 31 Oct 2023 10:29:11 +0100
Subject: [PATCH 0291/1043] can: isotp: Add error message if txqueuelen is too
 small

commit c69d190f7bb9a03cf5237d45a457993730d01605 upstream

This patch adds an additional error message in case that txqueuelen is
set too small and advices the user to increase txqueuelen.

This is likely to happen even with small transfers if txqueuelen is at
default value 10 frames.

Link: https://lore.kernel.org/r/20210427052150.2308-4-menschel.p@posteo.de
Signed-off-by: Patrick Menschel <menschel.p@posteo.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index 009d5216f3ea..ef72e5344789 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -813,10 +813,12 @@ static enum hrtimer_restart isotp_tx_timer_handler(struct hrtimer *hrtimer)
 		can_skb_set_owner(skb, sk);
 
 		can_send_ret = can_send(skb, 1);
-		if (can_send_ret)
+		if (can_send_ret) {
 			pr_notice_once("can-isotp: %s: can_send_ret %pe\n",
 				       __func__, ERR_PTR(can_send_ret));
-
+			if (can_send_ret == -ENOBUFS)
+				pr_notice_once("can-isotp: tx queue is full, increasing txqueuelen may prevent this error\n");
+		}
 		if (so->tx.idx >= so->tx.len) {
 			/* we are done */
 			so->tx.state = ISOTP_IDLE;

From 93b1e3f3a263e9986e8f46d23f1a932d4e34adf4 Mon Sep 17 00:00:00 2001
From: Oliver Hartkopp <socketcan@hartkopp.net>
Date: Tue, 31 Oct 2023 10:29:12 +0100
Subject: [PATCH 0292/1043] can: isotp: set max PDU size to 64 kByte

commit 9c0c191d82a1de964ac953a1df8b5744ec670b07 upstream

The reason to extend the max PDU size from 4095 Byte (12 bit length value)
to a 32 bit value (up to 4 GByte) was to be able to flash 64 kByte
bootloaders with a single ISO-TP PDU. The max PDU size in the Linux kernel
implementation was set to 8200 Bytes to be able to test the length
information escape sequence.

It turns out that the demand for 64 kByte PDUs is real so the value for
MAX_MSG_LENGTH is set to 66000 to be able to potentially add some checksums
to the 65.536 Byte block.

Link: https://github.com/linux-can/can-utils/issues/347#issuecomment-1056142301
Link: https://lore.kernel.org/all/20220309120416.83514-3-socketcan@hartkopp.net
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index ef72e5344789..fb179a333784 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -87,9 +87,9 @@ MODULE_ALIAS("can-proto-6");
 /* ISO 15765-2:2016 supports more than 4095 byte per ISO PDU as the FF_DL can
  * take full 32 bit values (4 Gbyte). We would need some good concept to handle
  * this between user space and kernel space. For now increase the static buffer
- * to something about 8 kbyte to be able to test this new functionality.
+ * to something about 64 kbyte to be able to test this new functionality.
  */
-#define MAX_MSG_LENGTH 8200
+#define MAX_MSG_LENGTH 66000
 
 /* N_PCI type values in bits 7-4 of N_PCI bytes */
 #define N_PCI_SF 0x00	/* single frame */

From 0386f37047899b3af95b00090b1f4ff4f5990f8d Mon Sep 17 00:00:00 2001
From: Oliver Hartkopp <socketcan@hartkopp.net>
Date: Tue, 31 Oct 2023 10:29:13 +0100
Subject: [PATCH 0293/1043] can: isotp: isotp_bind(): return -EINVAL on
 incorrect CAN ID formatting

commit 2aa39889c463195a0dfe2aff9fad413139c32a4f upstream

Commit 3ea566422cbd ("can: isotp: sanitize CAN ID checks in
isotp_bind()") checks the given CAN ID address information by
sanitizing the input values.

This check (silently) removes obsolete bits by masking the given CAN
IDs.

Derek Will suggested to give a feedback to the application programmer
when the 'sanitizing' was actually needed which means the programmer
provided CAN ID content in a wrong format (e.g. SFF CAN IDs with a CAN
ID > 0x7FF).

Link: https://lore.kernel.org/all/20220515181633.76671-1-socketcan@hartkopp.net
Suggested-by: Derek Will <derekrobertwill@gmail.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index fb179a333784..902cb61b6495 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1142,6 +1142,11 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
 	else
 		rx_id &= CAN_SFF_MASK;
 
+	/* give feedback on wrong CAN-ID values */
+	if (tx_id != addr->can_addr.tp.tx_id ||
+	    rx_id != addr->can_addr.tp.rx_id)
+		return -EINVAL;
+
 	if (!addr->can_ifindex)
 		return -ENODEV;
 

From de3c02383aa678f6799402ac47fdd89cf4bfcaa9 Mon Sep 17 00:00:00 2001
From: Oliver Hartkopp <socketcan@hartkopp.net>
Date: Tue, 31 Oct 2023 10:29:14 +0100
Subject: [PATCH 0294/1043] can: isotp: check CAN address family in
 isotp_bind()

commit c6adf659a8ba85913e16a571d5a9bcd17d3d1234 upstream

Add missing check to block non-AF_CAN binds.

Syzbot created some code which matched the right sockaddr struct size
but used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family
field:

bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10)
                                ^^^^
This has no funtional impact but the userspace should be notified about
the wrong address family field content.

Link: https://syzkaller.appspot.com/text?tag=CrashLog&x=11ff9d8c480000
Reported-by: syzbot+5aed6c3aaba661f5b917@syzkaller.appspotmail.com
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://lore.kernel.org/all/20230104201844.13168-1-socketcan@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index 902cb61b6495..87de9a08cc85 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1129,6 +1129,9 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
 	if (len < ISOTP_MIN_NAMELEN)
 		return -EINVAL;
 
+	if (addr->can_family != AF_CAN)
+		return -EINVAL;
+
 	/* sanitize tx/rx CAN identifiers */
 	tx_id = addr->can_addr.tp.tx_id;
 	if (tx_id & CAN_EFF_FLAG)

From 569c95b7ece0644dbe5d49d058d25bfa2a50d872 Mon Sep 17 00:00:00 2001
From: Oliver Hartkopp <socketcan@hartkopp.net>
Date: Tue, 31 Oct 2023 10:29:15 +0100
Subject: [PATCH 0295/1043] can: isotp: handle wait_event_interruptible()
 return values

commit 823b2e42720f96f277940c37ea438b7c5ead51a4 upstream

When wait_event_interruptible() has been interrupted by a signal the
tx.state value might not be ISOTP_IDLE. Force the state machines
into idle state to inhibit the timer handlers to continue working.

Fixes: 866337865f37 ("can: isotp: fix tx state handling for echo tx processing")
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://lore.kernel.org/all/20230112192347.1944-1-socketcan@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index 87de9a08cc85..42194b0d176c 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1071,6 +1071,10 @@ static int isotp_release(struct socket *sock)
 	/* wait for complete transmission of current pdu */
 	wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
 
+	/* force state machines to be idle also when a signal occurred */
+	so->tx.state = ISOTP_IDLE;
+	so->rx.state = ISOTP_IDLE;
+
 	spin_lock(&isotp_notifier_lock);
 	while (isotp_busy_notifier == so) {
 		spin_unlock(&isotp_notifier_lock);

From e4c4e0e1b29ca5ca539ae3cea8145e0a8154420e Mon Sep 17 00:00:00 2001
From: Oliver Hartkopp <socketcan@hartkopp.net>
Date: Tue, 31 Oct 2023 10:29:16 +0100
Subject: [PATCH 0296/1043] can: isotp: add local echo tx processing and tx
 without FC

commit 4b7fe92c06901f4563af0e36d25223a5ab343782 upstream
commit 9f39d36530e5678d092d53c5c2c60d82b4dcc169 upstream
commit 051737439eaee5bdd03d3c2ef5510d54a478fd05 upstream

Due to the existing patch order applied to isotp.c in the stable kernel the
original order of depending patches the three original patches
4b7fe92c0690 ("can: isotp: add local echo tx processing for consecutive frames")
9f39d36530e5 ("can: isotp: add support for transmission without flow control")
051737439eae ("can: isotp: fix race between isotp_sendsmg() and isotp_release()")
can not be split into different patches that can be applied in working steps
to the stable tree.

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/uapi/linux/can/isotp.h |  25 +-
 net/can/isotp.c                | 410 +++++++++++++++++++++------------
 2 files changed, 273 insertions(+), 162 deletions(-)

diff --git a/include/uapi/linux/can/isotp.h b/include/uapi/linux/can/isotp.h
index 590f8aea2b6d..439c982f7e81 100644
--- a/include/uapi/linux/can/isotp.h
+++ b/include/uapi/linux/can/isotp.h
@@ -124,18 +124,19 @@ struct can_isotp_ll_options {
 
 /* flags for isotp behaviour */
 
-#define CAN_ISOTP_LISTEN_MODE	0x001	/* listen only (do not send FC) */
-#define CAN_ISOTP_EXTEND_ADDR	0x002	/* enable extended addressing */
-#define CAN_ISOTP_TX_PADDING	0x004	/* enable CAN frame padding tx path */
-#define CAN_ISOTP_RX_PADDING	0x008	/* enable CAN frame padding rx path */
-#define CAN_ISOTP_CHK_PAD_LEN	0x010	/* check received CAN frame padding */
-#define CAN_ISOTP_CHK_PAD_DATA	0x020	/* check received CAN frame padding */
-#define CAN_ISOTP_HALF_DUPLEX	0x040	/* half duplex error state handling */
-#define CAN_ISOTP_FORCE_TXSTMIN	0x080	/* ignore stmin from received FC */
-#define CAN_ISOTP_FORCE_RXSTMIN	0x100	/* ignore CFs depending on rx stmin */
-#define CAN_ISOTP_RX_EXT_ADDR	0x200	/* different rx extended addressing */
-#define CAN_ISOTP_WAIT_TX_DONE	0x400	/* wait for tx completion */
-#define CAN_ISOTP_SF_BROADCAST	0x800	/* 1-to-N functional addressing */
+#define CAN_ISOTP_LISTEN_MODE	0x0001	/* listen only (do not send FC) */
+#define CAN_ISOTP_EXTEND_ADDR	0x0002	/* enable extended addressing */
+#define CAN_ISOTP_TX_PADDING	0x0004	/* enable CAN frame padding tx path */
+#define CAN_ISOTP_RX_PADDING	0x0008	/* enable CAN frame padding rx path */
+#define CAN_ISOTP_CHK_PAD_LEN	0x0010	/* check received CAN frame padding */
+#define CAN_ISOTP_CHK_PAD_DATA	0x0020	/* check received CAN frame padding */
+#define CAN_ISOTP_HALF_DUPLEX	0x0040	/* half duplex error state handling */
+#define CAN_ISOTP_FORCE_TXSTMIN	0x0080	/* ignore stmin from received FC */
+#define CAN_ISOTP_FORCE_RXSTMIN	0x0100	/* ignore CFs depending on rx stmin */
+#define CAN_ISOTP_RX_EXT_ADDR	0x0200	/* different rx extended addressing */
+#define CAN_ISOTP_WAIT_TX_DONE	0x0400	/* wait for tx completion */
+#define CAN_ISOTP_SF_BROADCAST	0x0800	/* 1-to-N functional addressing */
+#define CAN_ISOTP_CF_BROADCAST	0x1000	/* 1-to-N transmission w/o FC */
 
 /* protocol machine default values */
 
diff --git a/net/can/isotp.c b/net/can/isotp.c
index 42194b0d176c..f362b50484fc 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -14,7 +14,6 @@
  * - use CAN_ISOTP_WAIT_TX_DONE flag to block the caller until the PDU is sent
  * - as we have static buffers the check whether the PDU fits into the buffer
  *   is done at FF reception time (no support for sending 'wait frames')
- * - take care of the tx-queue-len as traffic shaping is still on the TODO list
  *
  * Copyright (c) 2020 Volkswagen Group Electronic Research
  * All rights reserved.
@@ -105,18 +104,23 @@ MODULE_ALIAS("can-proto-6");
 #define FC_CONTENT_SZ 3	/* flow control content size in byte (FS/BS/STmin) */
 
 #define ISOTP_CHECK_PADDING (CAN_ISOTP_CHK_PAD_LEN | CAN_ISOTP_CHK_PAD_DATA)
+#define ISOTP_ALL_BC_FLAGS (CAN_ISOTP_SF_BROADCAST | CAN_ISOTP_CF_BROADCAST)
 
 /* Flow Status given in FC frame */
 #define ISOTP_FC_CTS 0		/* clear to send */
 #define ISOTP_FC_WT 1		/* wait */
 #define ISOTP_FC_OVFLW 2	/* overflow */
 
+#define ISOTP_FC_TIMEOUT 1	/* 1 sec */
+#define ISOTP_ECHO_TIMEOUT 2	/* 2 secs */
+
 enum {
 	ISOTP_IDLE = 0,
 	ISOTP_WAIT_FIRST_FC,
 	ISOTP_WAIT_FC,
 	ISOTP_WAIT_DATA,
-	ISOTP_SENDING
+	ISOTP_SENDING,
+	ISOTP_SHUTDOWN,
 };
 
 struct tpcon {
@@ -137,13 +141,14 @@ struct isotp_sock {
 	canid_t rxid;
 	ktime_t tx_gap;
 	ktime_t lastrxcf_tstamp;
-	struct hrtimer rxtimer, txtimer;
+	struct hrtimer rxtimer, txtimer, txfrtimer;
 	struct can_isotp_options opt;
 	struct can_isotp_fc_options rxfc, txfc;
 	struct can_isotp_ll_options ll;
 	u32 frame_txtime;
 	u32 force_tx_stmin;
 	u32 force_rx_stmin;
+	u32 cfecho; /* consecutive frame echo tag */
 	struct tpcon rx, tx;
 	struct list_head notifier;
 	wait_queue_head_t wait;
@@ -159,6 +164,17 @@ static inline struct isotp_sock *isotp_sk(const struct sock *sk)
 	return (struct isotp_sock *)sk;
 }
 
+static u32 isotp_bc_flags(struct isotp_sock *so)
+{
+	return so->opt.flags & ISOTP_ALL_BC_FLAGS;
+}
+
+static bool isotp_register_rxid(struct isotp_sock *so)
+{
+	/* no broadcast modes => register rx_id for FC frame reception */
+	return (isotp_bc_flags(so) == 0);
+}
+
 static enum hrtimer_restart isotp_rx_timer_handler(struct hrtimer *hrtimer)
 {
 	struct isotp_sock *so = container_of(hrtimer, struct isotp_sock,
@@ -240,7 +256,8 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus)
 	so->lastrxcf_tstamp = ktime_set(0, 0);
 
 	/* start rx timeout watchdog */
-	hrtimer_start(&so->rxtimer, ktime_set(1, 0), HRTIMER_MODE_REL_SOFT);
+	hrtimer_start(&so->rxtimer, ktime_set(ISOTP_FC_TIMEOUT, 0),
+		      HRTIMER_MODE_REL_SOFT);
 	return 0;
 }
 
@@ -326,6 +343,8 @@ static int check_pad(struct isotp_sock *so, struct canfd_frame *cf,
 	return 0;
 }
 
+static void isotp_send_cframe(struct isotp_sock *so);
+
 static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae)
 {
 	struct sock *sk = &so->sk;
@@ -380,14 +399,15 @@ static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae)
 	case ISOTP_FC_CTS:
 		so->tx.bs = 0;
 		so->tx.state = ISOTP_SENDING;
-		/* start cyclic timer for sending CF frame */
-		hrtimer_start(&so->txtimer, so->tx_gap,
+		/* send CF frame and enable echo timeout handling */
+		hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0),
 			      HRTIMER_MODE_REL_SOFT);
+		isotp_send_cframe(so);
 		break;
 
 	case ISOTP_FC_WT:
 		/* start timer to wait for next FC frame */
-		hrtimer_start(&so->txtimer, ktime_set(1, 0),
+		hrtimer_start(&so->txtimer, ktime_set(ISOTP_FC_TIMEOUT, 0),
 			      HRTIMER_MODE_REL_SOFT);
 		break;
 
@@ -582,7 +602,7 @@ static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae,
 	/* perform blocksize handling, if enabled */
 	if (!so->rxfc.bs || ++so->rx.bs < so->rxfc.bs) {
 		/* start rx timeout watchdog */
-		hrtimer_start(&so->rxtimer, ktime_set(1, 0),
+		hrtimer_start(&so->rxtimer, ktime_set(ISOTP_FC_TIMEOUT, 0),
 			      HRTIMER_MODE_REL_SOFT);
 		return 0;
 	}
@@ -713,6 +733,63 @@ static void isotp_fill_dataframe(struct canfd_frame *cf, struct isotp_sock *so,
 		cf->data[0] = so->opt.ext_address;
 }
 
+static void isotp_send_cframe(struct isotp_sock *so)
+{
+	struct sock *sk = &so->sk;
+	struct sk_buff *skb;
+	struct net_device *dev;
+	struct canfd_frame *cf;
+	int can_send_ret;
+	int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0;
+
+	dev = dev_get_by_index(sock_net(sk), so->ifindex);
+	if (!dev)
+		return;
+
+	skb = alloc_skb(so->ll.mtu + sizeof(struct can_skb_priv), GFP_ATOMIC);
+	if (!skb) {
+		dev_put(dev);
+		return;
+	}
+
+	can_skb_reserve(skb);
+	can_skb_prv(skb)->ifindex = dev->ifindex;
+	can_skb_prv(skb)->skbcnt = 0;
+
+	cf = (struct canfd_frame *)skb->data;
+	skb_put_zero(skb, so->ll.mtu);
+
+	/* create consecutive frame */
+	isotp_fill_dataframe(cf, so, ae, 0);
+
+	/* place consecutive frame N_PCI in appropriate index */
+	cf->data[ae] = N_PCI_CF | so->tx.sn++;
+	so->tx.sn %= 16;
+	so->tx.bs++;
+
+	cf->flags = so->ll.tx_flags;
+
+	skb->dev = dev;
+	can_skb_set_owner(skb, sk);
+
+	/* cfecho should have been zero'ed by init/isotp_rcv_echo() */
+	if (so->cfecho)
+		pr_notice_once("can-isotp: cfecho is %08X != 0\n", so->cfecho);
+
+	/* set consecutive frame echo tag */
+	so->cfecho = *(u32 *)cf->data;
+
+	/* send frame with local echo enabled */
+	can_send_ret = can_send(skb, 1);
+	if (can_send_ret) {
+		pr_notice_once("can-isotp: %s: can_send_ret %pe\n",
+			       __func__, ERR_PTR(can_send_ret));
+		if (can_send_ret == -ENOBUFS)
+			pr_notice_once("can-isotp: tx queue is full\n");
+	}
+	dev_put(dev);
+}
+
 static void isotp_create_fframe(struct canfd_frame *cf, struct isotp_sock *so,
 				int ae)
 {
@@ -746,7 +823,50 @@ static void isotp_create_fframe(struct canfd_frame *cf, struct isotp_sock *so,
 		cf->data[i] = so->tx.buf[so->tx.idx++];
 
 	so->tx.sn = 1;
-	so->tx.state = ISOTP_WAIT_FIRST_FC;
+}
+
+static void isotp_rcv_echo(struct sk_buff *skb, void *data)
+{
+	struct sock *sk = (struct sock *)data;
+	struct isotp_sock *so = isotp_sk(sk);
+	struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+
+	/* only handle my own local echo CF/SF skb's (no FF!) */
+	if (skb->sk != sk || so->cfecho != *(u32 *)cf->data)
+		return;
+
+	/* cancel local echo timeout */
+	hrtimer_cancel(&so->txtimer);
+
+	/* local echo skb with consecutive frame has been consumed */
+	so->cfecho = 0;
+
+	if (so->tx.idx >= so->tx.len) {
+		/* we are done */
+		so->tx.state = ISOTP_IDLE;
+		wake_up_interruptible(&so->wait);
+		return;
+	}
+
+	if (so->txfc.bs && so->tx.bs >= so->txfc.bs) {
+		/* stop and wait for FC with timeout */
+		so->tx.state = ISOTP_WAIT_FC;
+		hrtimer_start(&so->txtimer, ktime_set(ISOTP_FC_TIMEOUT, 0),
+			      HRTIMER_MODE_REL_SOFT);
+		return;
+	}
+
+	/* no gap between data frames needed => use burst mode */
+	if (!so->tx_gap) {
+		/* enable echo timeout handling */
+		hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0),
+			      HRTIMER_MODE_REL_SOFT);
+		isotp_send_cframe(so);
+		return;
+	}
+
+	/* start timer to send next consecutive frame with correct delay */
+	hrtimer_start(&so->txfrtimer, so->tx_gap, HRTIMER_MODE_REL_SOFT);
 }
 
 static enum hrtimer_restart isotp_tx_timer_handler(struct hrtimer *hrtimer)
@@ -754,137 +874,72 @@ static enum hrtimer_restart isotp_tx_timer_handler(struct hrtimer *hrtimer)
 	struct isotp_sock *so = container_of(hrtimer, struct isotp_sock,
 					     txtimer);
 	struct sock *sk = &so->sk;
-	struct sk_buff *skb;
-	struct net_device *dev;
-	struct canfd_frame *cf;
-	enum hrtimer_restart restart = HRTIMER_NORESTART;
-	int can_send_ret;
-	int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0;
 
-	switch (so->tx.state) {
-	case ISOTP_WAIT_FC:
-	case ISOTP_WAIT_FIRST_FC:
+	/* don't handle timeouts in IDLE or SHUTDOWN state */
+	if (so->tx.state == ISOTP_IDLE || so->tx.state == ISOTP_SHUTDOWN)
+		return HRTIMER_NORESTART;
 
-		/* we did not get any flow control frame in time */
+	/* we did not get any flow control or echo frame in time */
 
-		/* report 'communication error on send' */
-		sk->sk_err = ECOMM;
-		if (!sock_flag(sk, SOCK_DEAD))
-			sk->sk_error_report(sk);
+	/* report 'communication error on send' */
+	sk->sk_err = ECOMM;
+	if (!sock_flag(sk, SOCK_DEAD))
+		sk->sk_error_report(sk);
 
-		/* reset tx state */
-		so->tx.state = ISOTP_IDLE;
-		wake_up_interruptible(&so->wait);
-		break;
+	/* reset tx state */
+	so->tx.state = ISOTP_IDLE;
+	wake_up_interruptible(&so->wait);
 
-	case ISOTP_SENDING:
+	return HRTIMER_NORESTART;
+}
 
-		/* push out the next segmented pdu */
-		dev = dev_get_by_index(sock_net(sk), so->ifindex);
-		if (!dev)
-			break;
+static enum hrtimer_restart isotp_txfr_timer_handler(struct hrtimer *hrtimer)
+{
+	struct isotp_sock *so = container_of(hrtimer, struct isotp_sock,
+					     txfrtimer);
 
-isotp_tx_burst:
-		skb = alloc_skb(so->ll.mtu + sizeof(struct can_skb_priv),
-				GFP_ATOMIC);
-		if (!skb) {
-			dev_put(dev);
-			break;
-		}
+	/* start echo timeout handling and cover below protocol error */
+	hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0),
+		      HRTIMER_MODE_REL_SOFT);
 
-		can_skb_reserve(skb);
-		can_skb_prv(skb)->ifindex = dev->ifindex;
-		can_skb_prv(skb)->skbcnt = 0;
+	/* cfecho should be consumed by isotp_rcv_echo() here */
+	if (so->tx.state == ISOTP_SENDING && !so->cfecho)
+		isotp_send_cframe(so);
 
-		cf = (struct canfd_frame *)skb->data;
-		skb_put_zero(skb, so->ll.mtu);
-
-		/* create consecutive frame */
-		isotp_fill_dataframe(cf, so, ae, 0);
-
-		/* place consecutive frame N_PCI in appropriate index */
-		cf->data[ae] = N_PCI_CF | so->tx.sn++;
-		so->tx.sn %= 16;
-		so->tx.bs++;
-
-		cf->flags = so->ll.tx_flags;
-
-		skb->dev = dev;
-		can_skb_set_owner(skb, sk);
-
-		can_send_ret = can_send(skb, 1);
-		if (can_send_ret) {
-			pr_notice_once("can-isotp: %s: can_send_ret %pe\n",
-				       __func__, ERR_PTR(can_send_ret));
-			if (can_send_ret == -ENOBUFS)
-				pr_notice_once("can-isotp: tx queue is full, increasing txqueuelen may prevent this error\n");
-		}
-		if (so->tx.idx >= so->tx.len) {
-			/* we are done */
-			so->tx.state = ISOTP_IDLE;
-			dev_put(dev);
-			wake_up_interruptible(&so->wait);
-			break;
-		}
-
-		if (so->txfc.bs && so->tx.bs >= so->txfc.bs) {
-			/* stop and wait for FC */
-			so->tx.state = ISOTP_WAIT_FC;
-			dev_put(dev);
-			hrtimer_set_expires(&so->txtimer,
-					    ktime_add(ktime_get(),
-						      ktime_set(1, 0)));
-			restart = HRTIMER_RESTART;
-			break;
-		}
-
-		/* no gap between data frames needed => use burst mode */
-		if (!so->tx_gap)
-			goto isotp_tx_burst;
-
-		/* start timer to send next data frame with correct delay */
-		dev_put(dev);
-		hrtimer_set_expires(&so->txtimer,
-				    ktime_add(ktime_get(), so->tx_gap));
-		restart = HRTIMER_RESTART;
-		break;
-
-	default:
-		WARN_ON_ONCE(1);
-	}
-
-	return restart;
+	return HRTIMER_NORESTART;
 }
 
 static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 {
 	struct sock *sk = sock->sk;
 	struct isotp_sock *so = isotp_sk(sk);
-	u32 old_state = so->tx.state;
 	struct sk_buff *skb;
 	struct net_device *dev;
 	struct canfd_frame *cf;
 	int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0;
 	int wait_tx_done = (so->opt.flags & CAN_ISOTP_WAIT_TX_DONE) ? 1 : 0;
-	s64 hrtimer_sec = 0;
+	s64 hrtimer_sec = ISOTP_ECHO_TIMEOUT;
 	int off;
 	int err;
 
-	if (!so->bound)
+	if (!so->bound || so->tx.state == ISOTP_SHUTDOWN)
 		return -EADDRNOTAVAIL;
 
+wait_free_buffer:
 	/* we do not support multiple buffers - for now */
-	if (cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SENDING) != ISOTP_IDLE ||
-	    wq_has_sleeper(&so->wait)) {
-		if (msg->msg_flags & MSG_DONTWAIT) {
-			err = -EAGAIN;
-			goto err_out;
-		}
+	if (wq_has_sleeper(&so->wait) && (msg->msg_flags & MSG_DONTWAIT))
+		return -EAGAIN;
 
-		/* wait for complete transmission of current pdu */
-		err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
-		if (err)
-			goto err_out;
+	/* wait for complete transmission of current pdu */
+	err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
+	if (err)
+		goto err_event_drop;
+
+	if (cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SENDING) != ISOTP_IDLE) {
+		if (so->tx.state == ISOTP_SHUTDOWN)
+			return -EADDRNOTAVAIL;
+
+		goto wait_free_buffer;
 	}
 
 	if (!size || size > MAX_MSG_LENGTH) {
@@ -896,7 +951,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	off = (so->tx.ll_dl > CAN_MAX_DLEN) ? 1 : 0;
 
 	/* does the given data fit into a single frame for SF_BROADCAST? */
-	if ((so->opt.flags & CAN_ISOTP_SF_BROADCAST) &&
+	if ((isotp_bc_flags(so) == CAN_ISOTP_SF_BROADCAST) &&
 	    (size > so->tx.ll_dl - SF_PCI_SZ4 - ae - off)) {
 		err = -EINVAL;
 		goto err_out_drop;
@@ -929,6 +984,10 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	cf = (struct canfd_frame *)skb->data;
 	skb_put_zero(skb, so->ll.mtu);
 
+	/* cfecho should have been zero'ed by init / former isotp_rcv_echo() */
+	if (so->cfecho)
+		pr_notice_once("can-isotp: uninit cfecho %08X\n", so->cfecho);
+
 	/* check for single frame transmission depending on TX_DL */
 	if (size <= so->tx.ll_dl - SF_PCI_SZ4 - ae - off) {
 		/* The message size generally fits into a SingleFrame - good.
@@ -954,22 +1013,40 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 		else
 			cf->data[ae] |= size;
 
-		so->tx.state = ISOTP_IDLE;
-		wake_up_interruptible(&so->wait);
-
-		/* don't enable wait queue for a single frame transmission */
-		wait_tx_done = 0;
+		/* set CF echo tag for isotp_rcv_echo() (SF-mode) */
+		so->cfecho = *(u32 *)cf->data;
 	} else {
-		/* send first frame and wait for FC */
+		/* send first frame */
 
 		isotp_create_fframe(cf, so, ae);
 
-		/* start timeout for FC */
-		hrtimer_sec = 1;
-		hrtimer_start(&so->txtimer, ktime_set(hrtimer_sec, 0),
-			      HRTIMER_MODE_REL_SOFT);
+		if (isotp_bc_flags(so) == CAN_ISOTP_CF_BROADCAST) {
+			/* set timer for FC-less operation (STmin = 0) */
+			if (so->opt.flags & CAN_ISOTP_FORCE_TXSTMIN)
+				so->tx_gap = ktime_set(0, so->force_tx_stmin);
+			else
+				so->tx_gap = ktime_set(0, so->frame_txtime);
+
+			/* disable wait for FCs due to activated block size */
+			so->txfc.bs = 0;
+
+			/* set CF echo tag for isotp_rcv_echo() (CF-mode) */
+			so->cfecho = *(u32 *)cf->data;
+		} else {
+			/* standard flow control check */
+			so->tx.state = ISOTP_WAIT_FIRST_FC;
+
+			/* start timeout for FC */
+			hrtimer_sec = ISOTP_FC_TIMEOUT;
+
+			/* no CF echo tag for isotp_rcv_echo() (FF-mode) */
+			so->cfecho = 0;
+		}
 	}
 
+	hrtimer_start(&so->txtimer, ktime_set(hrtimer_sec, 0),
+		      HRTIMER_MODE_REL_SOFT);
+
 	/* send the first or only CAN frame */
 	cf->flags = so->ll.tx_flags;
 
@@ -982,15 +1059,19 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 			       __func__, ERR_PTR(err));
 
 		/* no transmission -> no timeout monitoring */
-		if (hrtimer_sec)
-			hrtimer_cancel(&so->txtimer);
+		hrtimer_cancel(&so->txtimer);
+
+		/* reset consecutive frame echo tag */
+		so->cfecho = 0;
 
 		goto err_out_drop;
 	}
 
 	if (wait_tx_done) {
 		/* wait for complete transmission of current pdu */
-		wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
+		err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
+		if (err)
+			goto err_event_drop;
 
 		err = sock_error(sk);
 		if (err)
@@ -999,13 +1080,15 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 
 	return size;
 
+err_event_drop:
+	/* got signal: force tx state machine to be idle */
+	so->tx.state = ISOTP_IDLE;
+	hrtimer_cancel(&so->txfrtimer);
+	hrtimer_cancel(&so->txtimer);
 err_out_drop:
 	/* drop this PDU and unlock a potential wait queue */
-	old_state = ISOTP_IDLE;
-err_out:
-	so->tx.state = old_state;
-	if (so->tx.state == ISOTP_IDLE)
-		wake_up_interruptible(&so->wait);
+	so->tx.state = ISOTP_IDLE;
+	wake_up_interruptible(&so->wait);
 
 	return err;
 }
@@ -1069,10 +1152,12 @@ static int isotp_release(struct socket *sock)
 	net = sock_net(sk);
 
 	/* wait for complete transmission of current pdu */
-	wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
+	while (wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE) == 0 &&
+	       cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SHUTDOWN) != ISOTP_IDLE)
+		;
 
 	/* force state machines to be idle also when a signal occurred */
-	so->tx.state = ISOTP_IDLE;
+	so->tx.state = ISOTP_SHUTDOWN;
 	so->rx.state = ISOTP_IDLE;
 
 	spin_lock(&isotp_notifier_lock);
@@ -1087,21 +1172,27 @@ static int isotp_release(struct socket *sock)
 	lock_sock(sk);
 
 	/* remove current filters & unregister */
-	if (so->bound && (!(so->opt.flags & CAN_ISOTP_SF_BROADCAST))) {
+	if (so->bound) {
 		if (so->ifindex) {
 			struct net_device *dev;
 
 			dev = dev_get_by_index(net, so->ifindex);
 			if (dev) {
-				can_rx_unregister(net, dev, so->rxid,
-						  SINGLE_MASK(so->rxid),
-						  isotp_rcv, sk);
+				if (isotp_register_rxid(so))
+					can_rx_unregister(net, dev, so->rxid,
+							  SINGLE_MASK(so->rxid),
+							  isotp_rcv, sk);
+
+				can_rx_unregister(net, dev, so->txid,
+						  SINGLE_MASK(so->txid),
+						  isotp_rcv_echo, sk);
 				dev_put(dev);
 				synchronize_rcu();
 			}
 		}
 	}
 
+	hrtimer_cancel(&so->txfrtimer);
 	hrtimer_cancel(&so->txtimer);
 	hrtimer_cancel(&so->rxtimer);
 
@@ -1128,7 +1219,6 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
 	canid_t tx_id, rx_id;
 	int err = 0;
 	int notify_enetdown = 0;
-	int do_rx_reg = 1;
 
 	if (len < ISOTP_MIN_NAMELEN)
 		return -EINVAL;
@@ -1164,12 +1254,8 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
 		goto out;
 	}
 
-	/* do not register frame reception for functional addressing */
-	if (so->opt.flags & CAN_ISOTP_SF_BROADCAST)
-		do_rx_reg = 0;
-
-	/* do not validate rx address for functional addressing */
-	if (do_rx_reg && rx_id == tx_id) {
+	/* ensure different CAN IDs when the rx_id is to be registered */
+	if (isotp_register_rxid(so) && rx_id == tx_id) {
 		err = -EADDRNOTAVAIL;
 		goto out;
 	}
@@ -1194,10 +1280,17 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
 
 	ifindex = dev->ifindex;
 
-	if (do_rx_reg)
+	if (isotp_register_rxid(so))
 		can_rx_register(net, dev, rx_id, SINGLE_MASK(rx_id),
 				isotp_rcv, sk, "isotp", sk);
 
+	/* no consecutive frame echo skb in flight */
+	so->cfecho = 0;
+
+	/* register for echo skb's */
+	can_rx_register(net, dev, tx_id, SINGLE_MASK(tx_id),
+			isotp_rcv_echo, sk, "isotpe", sk);
+
 	dev_put(dev);
 
 	/* switch to new settings */
@@ -1258,6 +1351,15 @@ static int isotp_setsockopt_locked(struct socket *sock, int level, int optname,
 		if (!(so->opt.flags & CAN_ISOTP_RX_EXT_ADDR))
 			so->opt.rx_ext_address = so->opt.ext_address;
 
+		/* these broadcast flags are not allowed together */
+		if (isotp_bc_flags(so) == ISOTP_ALL_BC_FLAGS) {
+			/* CAN_ISOTP_SF_BROADCAST is prioritized */
+			so->opt.flags &= ~CAN_ISOTP_CF_BROADCAST;
+
+			/* give user feedback on wrong config attempt */
+			ret = -EINVAL;
+		}
+
 		/* check for frame_txtime changes (0 => no changes) */
 		if (so->opt.frame_txtime) {
 			if (so->opt.frame_txtime == CAN_ISOTP_FRAME_TXTIME_ZERO)
@@ -1408,10 +1510,16 @@ static void isotp_notify(struct isotp_sock *so, unsigned long msg,
 	case NETDEV_UNREGISTER:
 		lock_sock(sk);
 		/* remove current filters & unregister */
-		if (so->bound && (!(so->opt.flags & CAN_ISOTP_SF_BROADCAST)))
-			can_rx_unregister(dev_net(dev), dev, so->rxid,
-					  SINGLE_MASK(so->rxid),
-					  isotp_rcv, sk);
+		if (so->bound) {
+			if (isotp_register_rxid(so))
+				can_rx_unregister(dev_net(dev), dev, so->rxid,
+						  SINGLE_MASK(so->rxid),
+						  isotp_rcv, sk);
+
+			can_rx_unregister(dev_net(dev), dev, so->txid,
+					  SINGLE_MASK(so->txid),
+					  isotp_rcv_echo, sk);
+		}
 
 		so->ifindex = 0;
 		so->bound  = 0;
@@ -1484,6 +1592,8 @@ static int isotp_init(struct sock *sk)
 	so->rxtimer.function = isotp_rx_timer_handler;
 	hrtimer_init(&so->txtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT);
 	so->txtimer.function = isotp_tx_timer_handler;
+	hrtimer_init(&so->txfrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT);
+	so->txfrtimer.function = isotp_txfr_timer_handler;
 
 	init_waitqueue_head(&so->wait);
 	spin_lock_init(&so->rx_lock);

From 8716c28f695cc5fe507235d37827fe6ad2816f4c Mon Sep 17 00:00:00 2001
From: Oliver Hartkopp <socketcan@hartkopp.net>
Date: Tue, 31 Oct 2023 10:29:17 +0100
Subject: [PATCH 0297/1043] can: isotp: isotp_bind(): do not validate unused
 address information

commit b76b163f46b661499921a0049982764a6659bfe7 upstream

With commit 2aa39889c463 ("can: isotp: isotp_bind(): return -EINVAL on
incorrect CAN ID formatting") the bind() syscall returns -EINVAL when
the given CAN ID needed to be sanitized. But in the case of an unconfirmed
broadcast mode the rx CAN ID is not needed and may be uninitialized from
the caller - which is ok.

This patch makes sure the result of an inproper CAN ID format is only
provided when the address information is needed.

Link: https://lore.kernel.org/all/20220517145653.2556-1-socketcan@hartkopp.net
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index f362b50484fc..08dfa34d68d5 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1216,7 +1216,8 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
 	struct net *net = sock_net(sk);
 	int ifindex;
 	struct net_device *dev;
-	canid_t tx_id, rx_id;
+	canid_t tx_id = addr->can_addr.tp.tx_id;
+	canid_t rx_id = addr->can_addr.tp.rx_id;
 	int err = 0;
 	int notify_enetdown = 0;
 
@@ -1226,24 +1227,28 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len)
 	if (addr->can_family != AF_CAN)
 		return -EINVAL;
 
-	/* sanitize tx/rx CAN identifiers */
-	tx_id = addr->can_addr.tp.tx_id;
+	/* sanitize tx CAN identifier */
 	if (tx_id & CAN_EFF_FLAG)
 		tx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK);
 	else
 		tx_id &= CAN_SFF_MASK;
 
-	rx_id = addr->can_addr.tp.rx_id;
-	if (rx_id & CAN_EFF_FLAG)
-		rx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK);
-	else
-		rx_id &= CAN_SFF_MASK;
-
-	/* give feedback on wrong CAN-ID values */
-	if (tx_id != addr->can_addr.tp.tx_id ||
-	    rx_id != addr->can_addr.tp.rx_id)
+	/* give feedback on wrong CAN-ID value */
+	if (tx_id != addr->can_addr.tp.tx_id)
 		return -EINVAL;
 
+	/* sanitize rx CAN identifier (if needed) */
+	if (isotp_register_rxid(so)) {
+		if (rx_id & CAN_EFF_FLAG)
+			rx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK);
+		else
+			rx_id &= CAN_SFF_MASK;
+
+		/* give feedback on wrong CAN-ID value */
+		if (rx_id != addr->can_addr.tp.rx_id)
+			return -EINVAL;
+	}
+
 	if (!addr->can_ifindex)
 		return -ENODEV;
 

From deddf60c271f1fc1edba25c4bf66d02854df5c5d Mon Sep 17 00:00:00 2001
From: Lukas Magel <lukas.magel@posteo.net>
Date: Tue, 31 Oct 2023 10:29:18 +0100
Subject: [PATCH 0298/1043] can: isotp: isotp_sendmsg(): fix TX state detection
 and wait behavior

[ Upstream commit d9c2ba65e651467de739324d978b04ed8729f483 ]

With patch [1], isotp_poll was updated to also queue the poller in the
so->wait queue, which is used for send state changes. Since the queue
now also contains polling tasks that are not interested in sending, the
queue fill state can no longer be used as an indication of send
readiness. As a consequence, nonblocking writes can lead to a race and
lock-up of the socket if there is a second task polling the socket in
parallel.

With this patch, isotp_sendmsg does not consult wq_has_sleepers but
instead tries to atomically set so->tx.state and waits on so->wait if it
is unable to do so. This behavior is in alignment with isotp_poll, which
also checks so->tx.state to determine send readiness.

V2:
- Revert direct exit to goto err_event_drop

[1] https://lore.kernel.org/all/20230331125511.372783-1-michal.sojka@cvut.cz

Reported-by: Maxime Jayat <maxime.jayat@mobile-devices.fr>
Closes: https://lore.kernel.org/linux-can/11328958-453f-447f-9af8-3b5824dfb041@munic.io/
Signed-off-by: Lukas Magel <lukas.magel@posteo.net>
Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
Fixes: 79e19fa79cb5 ("can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events")
Link: https://github.com/pylessard/python-udsoncan/issues/178#issuecomment-1743786590
Link: https://lore.kernel.org/all/20230827092205.7908-1-lukas.magel@posteo.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index 08dfa34d68d5..c646fef8f3ba 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -925,21 +925,18 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	if (!so->bound || so->tx.state == ISOTP_SHUTDOWN)
 		return -EADDRNOTAVAIL;
 
-wait_free_buffer:
-	/* we do not support multiple buffers - for now */
-	if (wq_has_sleeper(&so->wait) && (msg->msg_flags & MSG_DONTWAIT))
-		return -EAGAIN;
+	while (cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SENDING) != ISOTP_IDLE) {
+		/* we do not support multiple buffers - for now */
+		if (msg->msg_flags & MSG_DONTWAIT)
+			return -EAGAIN;
 
-	/* wait for complete transmission of current pdu */
-	err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
-	if (err)
-		goto err_event_drop;
-
-	if (cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SENDING) != ISOTP_IDLE) {
 		if (so->tx.state == ISOTP_SHUTDOWN)
 			return -EADDRNOTAVAIL;
 
-		goto wait_free_buffer;
+		/* wait for complete transmission of current pdu */
+		err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
+		if (err)
+			goto err_event_drop;
 	}
 
 	if (!size || size > MAX_MSG_LENGTH) {

From 747b8f877998f6ee1b21c975b2e3c9de22827c26 Mon Sep 17 00:00:00 2001
From: Vicki Pfau <vi@endrift.com>
Date: Wed, 27 Sep 2023 13:22:12 -0700
Subject: [PATCH 0299/1043] PCI: Prevent xHCI driver from claiming AMD VanGogh
 USB3 DRD device

commit 7e6f3b6d2c352b5fde37ce3fed83bdf6172eebd4 upstream.

The AMD VanGogh SoC contains a DesignWare USB3 Dual-Role Device that can be
operated as either a USB Host or a USB Device, similar to on the AMD Nolan
platform.

be6646bfbaec ("PCI: Prevent xHCI driver from claiming AMD Nolan USB3 DRD
device") added a quirk to let the dwc3 driver claim the Nolan device since
it provides more specific support.

Extend that quirk to include the VanGogh SoC USB3 device.

Link: https://lore.kernel.org/r/20230927202212.2388216-1-vi@endrift.com
Signed-off-by: Vicki Pfau <vi@endrift.com>
[bhelgaas: include be6646bfbaec reference, add stable tag]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org	# v3.19+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/quirks.c    | 8 +++++---
 include/linux/pci_ids.h | 1 +
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index c0d113481191..158ff4331a14 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -597,7 +597,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI,	PCI_DEVICE_ID_ATI_RS100,   quirk_ati_
 /*
  * In the AMD NL platform, this device ([1022:7912]) has a class code of
  * PCI_CLASS_SERIAL_USB_XHCI (0x0c0330), which means the xhci driver will
- * claim it.
+ * claim it. The same applies on the VanGogh platform device ([1022:163a]).
  *
  * But the dwc3 driver is a more specific driver for this device, and we'd
  * prefer to use it instead of xhci. To prevent xhci from claiming the
@@ -605,7 +605,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI,	PCI_DEVICE_ID_ATI_RS100,   quirk_ati_
  * defines as "USB device (not host controller)". The dwc3 driver can then
  * claim it based on its Vendor and Device ID.
  */
-static void quirk_amd_nl_class(struct pci_dev *pdev)
+static void quirk_amd_dwc_class(struct pci_dev *pdev)
 {
 	u32 class = pdev->class;
 
@@ -615,7 +615,9 @@ static void quirk_amd_nl_class(struct pci_dev *pdev)
 		 class, pdev->class);
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB,
-		quirk_amd_nl_class);
+		quirk_amd_dwc_class);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_VANGOGH_USB,
+		quirk_amd_dwc_class);
 
 /*
  * Synopsys USB 3.x host HAPS platform has a class code of
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 4b34a5c12599..1a41147b22e8 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -555,6 +555,7 @@
 #define PCI_DEVICE_ID_AMD_17H_M30H_DF_F3 0x1493
 #define PCI_DEVICE_ID_AMD_17H_M60H_DF_F3 0x144b
 #define PCI_DEVICE_ID_AMD_17H_M70H_DF_F3 0x1443
+#define PCI_DEVICE_ID_AMD_VANGOGH_USB	0x163a
 #define PCI_DEVICE_ID_AMD_19H_DF_F3	0x1653
 #define PCI_DEVICE_ID_AMD_CNB17H_F3	0x1703
 #define PCI_DEVICE_ID_AMD_LANCE		0x2000

From 8e0324f2cbb72b4519bf68ae4738ed3ff7c35030 Mon Sep 17 00:00:00 2001
From: LihaSika <lihasika@gmail.com>
Date: Fri, 27 Oct 2023 20:28:04 +0300
Subject: [PATCH 0300/1043] usb: storage: set 1.50 as the lower bcdDevice for
 older "Super Top" compatibility

commit 0e3139e6543b241b3e65956a55c712333bef48ac upstream.

Change lower bcdDevice value for "Super Top USB 2.0  SATA BRIDGE" to match
1.50. I have such an older device with bcdDevice=1.50 and it will not work
otherwise.

Cc: stable@vger.kernel.org
Signed-off-by: Liha Sikanen <lihasika@gmail.com>
Link: https://lore.kernel.org/r/ccf7d12a-8362-4916-b3e0-f4150f54affd@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/unusual_cypress.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h
index 0547daf116a2..5df40759d77a 100644
--- a/drivers/usb/storage/unusual_cypress.h
+++ b/drivers/usb/storage/unusual_cypress.h
@@ -19,7 +19,7 @@ UNUSUAL_DEV(  0x04b4, 0x6831, 0x0000, 0x9999,
 		"Cypress ISD-300LP",
 		USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
 
-UNUSUAL_DEV( 0x14cd, 0x6116, 0x0160, 0x0160,
+UNUSUAL_DEV( 0x14cd, 0x6116, 0x0150, 0x0160,
 		"Super Top",
 		"USB 2.0  SATA BRIDGE",
 		USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),

From e705aee2a65701c462ed2be619ed83be3eb95901 Mon Sep 17 00:00:00 2001
From: Andrey Konovalov <andreyknvl@gmail.com>
Date: Thu, 26 Oct 2023 22:01:12 +0200
Subject: [PATCH 0301/1043] usb: raw-gadget: properly handle interrupted
 requests

commit e8033bde451eddfb9b1bbd6e2d848c1b5c277222 upstream.

Currently, if a USB request that was queued by Raw Gadget is interrupted
(via a signal), wait_for_completion_interruptible returns -ERESTARTSYS.
Raw Gadget then attempts to propagate this value to userspace as a return
value from its ioctls. However, when -ERESTARTSYS is returned by a syscall
handler, the kernel internally restarts the syscall.

This doesn't allow userspace applications to interrupt requests queued by
Raw Gadget (which is required when the emulated device is asked to switch
altsettings). It also violates the implied interface of Raw Gadget that a
single ioctl must only queue a single USB request.

Instead, make Raw Gadget do what GadgetFS does: check whether the request
was interrupted (dequeued with status == -ECONNRESET) and report -EINTR to
userspace.

Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface")
Cc: stable <stable@kernel.org>
Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
Link: https://lore.kernel.org/r/0db45b1d7cc466e3d4d1ab353f61d63c977fbbc5.1698350424.git.andreyknvl@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/legacy/raw_gadget.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index ddb39e672801..72ecce73ab53 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -662,12 +662,12 @@ static int raw_process_ep0_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
 	if (WARN_ON(in && dev->ep0_out_pending)) {
 		ret = -ENODEV;
 		dev->state = STATE_DEV_FAILED;
-		goto out_done;
+		goto out_unlock;
 	}
 	if (WARN_ON(!in && dev->ep0_in_pending)) {
 		ret = -ENODEV;
 		dev->state = STATE_DEV_FAILED;
-		goto out_done;
+		goto out_unlock;
 	}
 
 	dev->req->buf = data;
@@ -682,7 +682,7 @@ static int raw_process_ep0_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
 				"fail, usb_ep_queue returned %d\n", ret);
 		spin_lock_irqsave(&dev->lock, flags);
 		dev->state = STATE_DEV_FAILED;
-		goto out_done;
+		goto out_queue_failed;
 	}
 
 	ret = wait_for_completion_interruptible(&dev->ep0_done);
@@ -691,13 +691,16 @@ static int raw_process_ep0_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
 		usb_ep_dequeue(dev->gadget->ep0, dev->req);
 		wait_for_completion(&dev->ep0_done);
 		spin_lock_irqsave(&dev->lock, flags);
-		goto out_done;
+		if (dev->ep0_status == -ECONNRESET)
+			dev->ep0_status = -EINTR;
+		goto out_interrupted;
 	}
 
 	spin_lock_irqsave(&dev->lock, flags);
-	ret = dev->ep0_status;
 
-out_done:
+out_interrupted:
+	ret = dev->ep0_status;
+out_queue_failed:
 	dev->ep0_urb_queued = false;
 out_unlock:
 	spin_unlock_irqrestore(&dev->lock, flags);
@@ -1059,7 +1062,7 @@ static int raw_process_ep_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
 				"fail, usb_ep_queue returned %d\n", ret);
 		spin_lock_irqsave(&dev->lock, flags);
 		dev->state = STATE_DEV_FAILED;
-		goto out_done;
+		goto out_queue_failed;
 	}
 
 	ret = wait_for_completion_interruptible(&done);
@@ -1068,13 +1071,16 @@ static int raw_process_ep_io(struct raw_dev *dev, struct usb_raw_ep_io *io,
 		usb_ep_dequeue(ep->ep, ep->req);
 		wait_for_completion(&done);
 		spin_lock_irqsave(&dev->lock, flags);
-		goto out_done;
+		if (ep->status == -ECONNRESET)
+			ep->status = -EINTR;
+		goto out_interrupted;
 	}
 
 	spin_lock_irqsave(&dev->lock, flags);
-	ret = ep->status;
 
-out_done:
+out_interrupted:
+	ret = ep->status;
+out_queue_failed:
 	ep->urb_queued = false;
 out_unlock:
 	spin_unlock_irqrestore(&dev->lock, flags);

From a8bf6f62187f02337cf04348e0dc599d38fff001 Mon Sep 17 00:00:00 2001
From: Cameron Williams <cang1@live.co.uk>
Date: Fri, 20 Oct 2023 17:03:08 +0100
Subject: [PATCH 0302/1043] tty: 8250: Remove UC-257 and UC-431

commit 33092fb3af51deb80849e90a17bada44bbcde6b3 upstream.

The UC-257 is a serial + LPT card, so remove it from this driver.
A patch has been submitted to add it to parport_serial instead.

Additionaly, the UC-431 does not use this card ID, only the UC-420
does. The 431 is a 3-port card and there is no generic 3-port configuration
available, so remove reference to it from this driver.

Fixes: 152d1afa834c ("tty: Add support for Brainboxes UC cards.")
Cc: stable@vger.kernel.org
Signed-off-by: Cameron Williams <cang1@live.co.uk>
Link: https://lore.kernel.org/r/DU0PR02MB78995ADF7394C74AD4CF3357C4DBA@DU0PR02MB7899.eurprd02.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_pci.c | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index fd857d434326..8b099d19335c 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -5159,13 +5159,6 @@ static const struct pci_device_id serial_pci_tbl[] = {
 		PCI_ANY_ID, PCI_ANY_ID,
 		0, 0,
 		pbn_b2_1_115200 },
-	/*
-	 * Brainboxes UC-257
-	 */
-	{	PCI_VENDOR_ID_INTASHIELD, 0x0861,
-		PCI_ANY_ID, PCI_ANY_ID,
-		0, 0,
-		pbn_b2_2_115200 },
 	/*
 	 * Brainboxes UC-260/271/701/756
 	 */
@@ -5245,7 +5238,7 @@ static const struct pci_device_id serial_pci_tbl[] = {
 		0, 0,
 		pbn_b2_4_115200 },
 	/*
-	 * Brainboxes UC-420/431
+	 * Brainboxes UC-420
 	 */
 	{       PCI_VENDOR_ID_INTASHIELD, 0x0921,
 		PCI_ANY_ID, PCI_ANY_ID,

From 119f38e8ca163914144642cce94f072d633113cf Mon Sep 17 00:00:00 2001
From: Cameron Williams <cang1@live.co.uk>
Date: Fri, 20 Oct 2023 17:03:09 +0100
Subject: [PATCH 0303/1043] tty: 8250: Add support for additional Brainboxes UC
 cards

commit c563db486db7d245c0e2f319443417ae8e692f7f upstream.

Add device IDs for some more Brainboxes UC cards, namely
UC-235/UC-246, UC-253/UC-734, UC-302, UC-313, UC-346, UC-357,
UC-607 and UC-836.

Cc: stable@vger.kernel.org
Signed-off-by: Cameron Williams <cang1@live.co.uk>
Link: https://lore.kernel.org/r/DU0PR02MB789969998A6C3FAFCD95C85DC4DBA@DU0PR02MB7899.eurprd02.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_pci.c | 57 ++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 8b099d19335c..2d2e4fc65667 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -5159,6 +5159,17 @@ static const struct pci_device_id serial_pci_tbl[] = {
 		PCI_ANY_ID, PCI_ANY_ID,
 		0, 0,
 		pbn_b2_1_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0AA2,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_1_115200 },
+	/*
+	 * Brainboxes UC-253/UC-734
+	 */
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0CA1,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
 	/*
 	 * Brainboxes UC-260/271/701/756
 	 */
@@ -5191,6 +5202,14 @@ static const struct pci_device_id serial_pci_tbl[] = {
 		PCI_ANY_ID, PCI_ANY_ID,
 		0, 0,
 		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x08E2,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x08E3,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
 	/*
 	 * Brainboxes UC-310
 	 */
@@ -5201,6 +5220,14 @@ static const struct pci_device_id serial_pci_tbl[] = {
 	/*
 	 * Brainboxes UC-313
 	 */
+	{       PCI_VENDOR_ID_INTASHIELD, 0x08A1,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{       PCI_VENDOR_ID_INTASHIELD, 0x08A2,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
 	{       PCI_VENDOR_ID_INTASHIELD, 0x08A3,
 		PCI_ANY_ID, PCI_ANY_ID,
 		0, 0,
@@ -5215,6 +5242,10 @@ static const struct pci_device_id serial_pci_tbl[] = {
 	/*
 	 * Brainboxes UC-346
 	 */
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0B01,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_4_115200 },
 	{	PCI_VENDOR_ID_INTASHIELD, 0x0B02,
 		PCI_ANY_ID, PCI_ANY_ID,
 		0, 0,
@@ -5226,6 +5257,10 @@ static const struct pci_device_id serial_pci_tbl[] = {
 		PCI_ANY_ID, PCI_ANY_ID,
 		0, 0,
 		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0A82,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
 	{	PCI_VENDOR_ID_INTASHIELD, 0x0A83,
 		PCI_ANY_ID, PCI_ANY_ID,
 		0, 0,
@@ -5244,6 +5279,28 @@ static const struct pci_device_id serial_pci_tbl[] = {
 		PCI_ANY_ID, PCI_ANY_ID,
 		0, 0,
 		pbn_b2_4_115200 },
+	/*
+	 * Brainboxes UC-607
+	 */
+	{	PCI_VENDOR_ID_INTASHIELD, 0x09A1,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x09A2,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x09A3,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	/*
+	 * Brainboxes UC-836
+	 */
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0D41,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_4_115200 },
 	/*
 	 * Perle PCI-RAS cards
 	 */

From 73bcb4d44988393255ab033dfd2f0bdfdb8f8e78 Mon Sep 17 00:00:00 2001
From: Cameron Williams <cang1@live.co.uk>
Date: Fri, 20 Oct 2023 17:03:10 +0100
Subject: [PATCH 0304/1043] tty: 8250: Add support for Brainboxes UP cards

commit 2c6fec1e1532f15350be7e14ba6b88a39d289fe4 upstream.

Add support for the Brainboxes UP (powered PCI) range of
cards, namely UP-189, UP-200, UP-869 and UP-880.

Cc: stable@vger.kernel.org
Signed-off-by: Cameron Williams <cang1@live.co.uk>
Link: https://lore.kernel.org/r/DU0PR02MB7899B5B59FF3D8587E88C117C4DBA@DU0PR02MB7899.eurprd02.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_pci.c | 60 ++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 2d2e4fc65667..0511ebc5b179 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -5181,6 +5181,66 @@ static const struct pci_device_id serial_pci_tbl[] = {
 		PCI_ANY_ID, PCI_ANY_ID,
 		PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
 		pbn_b2_4_115200 },
+	/*
+	 * Brainboxes UP-189
+	 */
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0AC1,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0AC2,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0AC3,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	/*
+	 * Brainboxes UP-200
+	 */
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0B21,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0B22,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0B23,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	/*
+	 * Brainboxes UP-869
+	 */
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0C01,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0C02,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0C03,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	/*
+	 * Brainboxes UP-880
+	 */
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0C21,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0C22,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0C23,
+		PCI_ANY_ID, PCI_ANY_ID,
+		0, 0,
+		pbn_b2_2_115200 },
 	/*
 	 * Brainboxes UC-268
 	 */

From 9109649559f9815ecff167af38d7d621fa631bb7 Mon Sep 17 00:00:00 2001
From: Cameron Williams <cang1@live.co.uk>
Date: Fri, 20 Oct 2023 17:03:11 +0100
Subject: [PATCH 0305/1043] tty: 8250: Add support for Intashield IS-100

commit 4d994e3cf1b541ff32dfb03fbbc60eea68f9645b upstream.

Add support for the Intashield IS-100 1 port serial card.

Cc: stable@vger.kernel.org
Signed-off-by: Cameron Williams <cang1@live.co.uk>
Link: https://lore.kernel.org/r/DU0PR02MB7899A0E0CDAA505AF5A874CDC4DBA@DU0PR02MB7899.eurprd02.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_pci.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 0511ebc5b179..89b14f5541fa 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -5132,6 +5132,12 @@ static const struct pci_device_id serial_pci_tbl[] = {
 		0, 0,
 		pbn_b1_bt_1_115200 },
 
+	/*
+	 * IntaShield IS-100
+	 */
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0D60,
+		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+		pbn_b2_1_115200 },
 	/*
 	 * IntaShield IS-200
 	 */

From a5feaf765935cfd43a089738c20a8486cd192f51 Mon Sep 17 00:00:00 2001
From: Mark Hasemeyer <markhas@chromium.org>
Date: Wed, 18 Oct 2023 17:59:31 -0600
Subject: [PATCH 0306/1043] ALSA: hda: intel-dsp-config: Fix JSL Chromebook
 quirk detection

commit 7c05b44e1a50d9cbfc4f731dddc436a24ddc129a upstream.

Some Jasperlake Chromebooks overwrite the system vendor DMI value to the
name of the OEM that manufactured the device. This breaks Chromebook
quirk detection as it expects the system vendor to be "Google".

Add another quirk detection entry that looks for "Google" in the BIOS
version.

Cc: stable@vger.kernel.org
Signed-off-by: Mark Hasemeyer <markhas@chromium.org>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20231018235944.1860717-1-markhas@chromium.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/hda/intel-dsp-config.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sound/hda/intel-dsp-config.c b/sound/hda/intel-dsp-config.c
index 801c89a3a1b6..48c78388c1d2 100644
--- a/sound/hda/intel-dsp-config.c
+++ b/sound/hda/intel-dsp-config.c
@@ -329,6 +329,12 @@ static const struct config_entry config_table[] = {
 					DMI_MATCH(DMI_SYS_VENDOR, "Google"),
 				}
 			},
+			{
+				.ident = "Google firmware",
+				.matches = {
+					DMI_MATCH(DMI_BIOS_VERSION, "Google"),
+				}
+			},
 			{}
 		}
 	},

From 3e55583405ac3f8651966dcd23590adb3db1d8c2 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 8 Nov 2023 17:30:52 +0100
Subject: [PATCH 0307/1043] Linux 5.10.200

Link: https://lore.kernel.org/r/20231106130304.678610325@linuxfoundation.org
Tested-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20231107202447.670990820@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 5105828bf6da..da4a3de444cf 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 199
+SUBLEVEL = 200
 EXTRAVERSION =
 NAME = Dare mighty things
 

From bdb7de7ed5baffabf11987f4d95273b8fc0958d7 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Mon, 25 Sep 2023 13:02:59 +0100
Subject: [PATCH 0308/1043] iov_iter, x86: Be consistent about the __user tag
 on copy_mc_to_user()

[ Upstream commit 066baf92bed934c9fb4bcee97a193f47aa63431c ]

copy_mc_to_user() has the destination marked __user on powerpc, but not on
x86; the latter results in a sparse warning in lib/iov_iter.c.

Fix this by applying the tag on x86 too.

Fixes: ec6347bb4339 ("x86, powerpc: Rename memcpy_mcsafe() to copy_mc_to_{user, kernel}()")
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/20230925120309.1731676-3-dhowells@redhat.com
cc: Dan Williams <dan.j.williams@intel.com>
cc: Thomas Gleixner <tglx@linutronix.de>
cc: Ingo Molnar <mingo@redhat.com>
cc: Borislav Petkov <bp@alien8.de>
cc: Dave Hansen <dave.hansen@linux.intel.com>
cc: "H. Peter Anvin" <hpa@zytor.com>
cc: Alexander Viro <viro@zeniv.linux.org.uk>
cc: Jens Axboe <axboe@kernel.dk>
cc: Christoph Hellwig <hch@lst.de>
cc: Christian Brauner <christian@brauner.io>
cc: Matthew Wilcox <willy@infradead.org>
cc: Linus Torvalds <torvalds@linux-foundation.org>
cc: David Laight <David.Laight@ACULAB.COM>
cc: x86@kernel.org
cc: linux-block@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
cc: linux-mm@kvack.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/uaccess.h | 2 +-
 arch/x86/lib/copy_mc.c         | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index bb1430283c72..bf2561a5eb58 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -446,7 +446,7 @@ copy_mc_to_kernel(void *to, const void *from, unsigned len);
 #define copy_mc_to_kernel copy_mc_to_kernel
 
 unsigned long __must_check
-copy_mc_to_user(void *to, const void *from, unsigned len);
+copy_mc_to_user(void __user *to, const void *from, unsigned len);
 #endif
 
 /*
diff --git a/arch/x86/lib/copy_mc.c b/arch/x86/lib/copy_mc.c
index c13e8c9ee926..e058ef2d454d 100644
--- a/arch/x86/lib/copy_mc.c
+++ b/arch/x86/lib/copy_mc.c
@@ -74,23 +74,23 @@ unsigned long __must_check copy_mc_to_kernel(void *dst, const void *src, unsigne
 }
 EXPORT_SYMBOL_GPL(copy_mc_to_kernel);
 
-unsigned long __must_check copy_mc_to_user(void *dst, const void *src, unsigned len)
+unsigned long __must_check copy_mc_to_user(void __user *dst, const void *src, unsigned len)
 {
 	unsigned long ret;
 
 	if (copy_mc_fragile_enabled) {
 		__uaccess_begin();
-		ret = copy_mc_fragile(dst, src, len);
+		ret = copy_mc_fragile((__force void *)dst, src, len);
 		__uaccess_end();
 		return ret;
 	}
 
 	if (static_cpu_has(X86_FEATURE_ERMS)) {
 		__uaccess_begin();
-		ret = copy_mc_enhanced_fast_string(dst, src, len);
+		ret = copy_mc_enhanced_fast_string((__force void *)dst, src, len);
 		__uaccess_end();
 		return ret;
 	}
 
-	return copy_user_generic(dst, src, len);
+	return copy_user_generic((__force void *)dst, src, len);
 }

From 9fe0f6b5720e2b2ed4fdd44c98ec721e27282016 Mon Sep 17 00:00:00 2001
From: Qais Yousef <qyousef@layalina.io>
Date: Sun, 17 Sep 2023 00:29:54 +0100
Subject: [PATCH 0309/1043] sched/uclamp: Ignore (util == 0) optimization in
 feec() when p_util_max = 0

[ Upstream commit 23c9519def98ee0fa97ea5871535e9b136f522fc ]

find_energy_efficient_cpu() bails out early if effective util of the
task is 0 as the delta at this point will be zero and there's nothing
for EAS to do. When uclamp is being used, this could lead to wrong
decisions when uclamp_max is set to 0. In this case the task is capped
to performance point 0, but it is actually running and consuming energy
and we can benefit from EAS energy calculations.

Rework the condition so that it bails out when both util and uclamp_min
are 0.

We can do that without needing to use uclamp_task_util(); remove it.

Fixes: d81304bc6193 ("sched/uclamp: Cater for uclamp in find_energy_efficient_cpu()'s early exit condition")
Signed-off-by: Qais Yousef (Google) <qyousef@layalina.io>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20230916232955.2099394-3-qyousef@layalina.io
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/fair.c | 18 +-----------------
 1 file changed, 1 insertion(+), 17 deletions(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index d53f57ac7609..73a89fbd81be 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3927,22 +3927,6 @@ static inline unsigned long task_util_est(struct task_struct *p)
 	return max(task_util(p), _task_util_est(p));
 }
 
-#ifdef CONFIG_UCLAMP_TASK
-static inline unsigned long uclamp_task_util(struct task_struct *p,
-					     unsigned long uclamp_min,
-					     unsigned long uclamp_max)
-{
-	return clamp(task_util_est(p), uclamp_min, uclamp_max);
-}
-#else
-static inline unsigned long uclamp_task_util(struct task_struct *p,
-					     unsigned long uclamp_min,
-					     unsigned long uclamp_max)
-{
-	return task_util_est(p);
-}
-#endif
-
 static inline void util_est_enqueue(struct cfs_rq *cfs_rq,
 				    struct task_struct *p)
 {
@@ -6842,7 +6826,7 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu)
 		goto fail;
 
 	sync_entity_load_avg(&p->se);
-	if (!uclamp_task_util(p, p_util_min, p_util_max))
+	if (!task_util_est(p) && p_util_min == 0)
 		goto unlock;
 
 	for (; pd; pd = pd->next) {

From f49926b8d2a530975c9abb1f44f8893350dc54d6 Mon Sep 17 00:00:00 2001
From: Reuben Hawkins <reubenhwk@gmail.com>
Date: Mon, 2 Oct 2023 20:57:04 -0500
Subject: [PATCH 0310/1043] vfs: fix readahead(2) on block devices

[ Upstream commit 7116c0af4b8414b2f19fdb366eea213cbd9d91c2 ]

Readahead was factored to call generic_fadvise.  That refactor added an
S_ISREG restriction which broke readahead on block devices.

In addition to S_ISREG, this change checks S_ISBLK to fix block device
readahead.  There is no change in behavior with any file type besides block
devices in this change.

Fixes: 3d8f7615319b ("vfs: implement readahead(2) using POSIX_FADV_WILLNEED")
Signed-off-by: Reuben Hawkins <reubenhwk@gmail.com>
Link: https://lore.kernel.org/r/20231003015704.2415-1-reubenhwk@gmail.com
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/readahead.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/readahead.c b/mm/readahead.c
index c5b0457415be..d30bcf4bc63b 100644
--- a/mm/readahead.c
+++ b/mm/readahead.c
@@ -625,7 +625,8 @@ ssize_t ksys_readahead(int fd, loff_t offset, size_t count)
 	 */
 	ret = -EINVAL;
 	if (!f.file->f_mapping || !f.file->f_mapping->a_ops ||
-	    !S_ISREG(file_inode(f.file)->i_mode))
+	    (!S_ISREG(file_inode(f.file)->i_mode) &&
+	    !S_ISBLK(file_inode(f.file)->i_mode)))
 		goto out;
 
 	ret = vfs_fadvise(f.file, offset, count, POSIX_FADV_WILLNEED);

From f52587051637af5799323413307f57988bdfedbb Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@kernel.org>
Date: Mon, 4 Sep 2023 22:04:49 -0700
Subject: [PATCH 0311/1043] x86/srso: Fix SBPB enablement for (possible) future
 fixed HW

[ Upstream commit 1d1142ac51307145dbb256ac3535a1d43a1c9800 ]

Make the SBPB check more robust against the (possible) case where future
HW has SRSO fixed but doesn't have the SRSO_NO bit set.

Fixes: 1b5277c0ea0b ("x86/srso: Add SRSO_NO support")
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/cee5050db750b391c9f35f5334f8ff40e66c01b9.1693889988.git.jpoimboe@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/cpu/bugs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index ec3ddb9a456b..d9fda0b6eb19 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -2407,7 +2407,7 @@ static void __init srso_select_mitigation(void)
 	pr_info("%s%s\n", srso_strings[srso_mitigation], (has_microcode ? "" : ", no microcode"));
 
 pred_cmd:
-	if ((boot_cpu_has(X86_FEATURE_SRSO_NO) || srso_cmd == SRSO_CMD_OFF) &&
+	if ((!boot_cpu_has_bug(X86_BUG_SRSO) || srso_cmd == SRSO_CMD_OFF) &&
 	     boot_cpu_has(X86_FEATURE_SBPB))
 		x86_pred_cmd = PRED_CMD_SBPB;
 }

From ffa4cc86e959f52600f6f77a56b632af4a582594 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <ben.wolsieffer@hefring.com>
Date: Thu, 19 Oct 2023 16:45:49 -0400
Subject: [PATCH 0312/1043] futex: Don't include process MM in futex key on
 no-MMU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c73801ae4f22b390228ebf471d55668e824198b6 ]

On no-MMU, all futexes are treated as private because there is no need
to map a virtual address to physical to match the futex across
processes. This doesn't quite work though, because private futexes
include the current process's mm_struct as part of their key. This makes
it impossible for one process to wake up a shared futex being waited on
in another process.

Fix this bug by excluding the mm_struct from the key. With
a single address space, the futex address is already a unique key.

Fixes: 784bdf3bb694 ("futex: Assume all mappings are private on !MMU systems")
Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Darren Hart <dvhart@infradead.org>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: André Almeida <andrealmeid@igalia.com>
Link: https://lore.kernel.org/r/20231019204548.1236437-2-ben.wolsieffer@hefring.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/futex/core.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index 8dd0bc50ac36..cde0ca876b93 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -514,7 +514,17 @@ static int get_futex_key(u32 __user *uaddr, bool fshared, union futex_key *key,
 	 *        but access_ok() should be faster than find_vma()
 	 */
 	if (!fshared) {
-		key->private.mm = mm;
+		/*
+		 * On no-MMU, shared futexes are treated as private, therefore
+		 * we must not include the current process in the key. Since
+		 * there is only one address space, the address is a unique key
+		 * on its own.
+		 */
+		if (IS_ENABLED(CONFIG_MMU))
+			key->private.mm = mm;
+		else
+			key->private.mm = NULL;
+
 		key->private.address = address;
 		return 0;
 	}

From 66f9969141c0c5961e657fded8379699417106a5 Mon Sep 17 00:00:00 2001
From: Yuntao Wang <ytcoode@gmail.com>
Date: Mon, 7 Aug 2023 16:45:47 +0800
Subject: [PATCH 0313/1043] x86/boot: Fix incorrect startup_gdt_descr.size

[ Upstream commit 001470fed5959d01faecbd57fcf2f60294da0de1 ]

Since the size value is added to the base address to yield the last valid
byte address of the GDT, the current size value of startup_gdt_descr is
incorrect (too large by one), fix it.

[ mingo: This probably never mattered, because startup_gdt[] is only used
         in a very controlled fashion - but make it consistent nevertheless. ]

Fixes: 866b556efa12 ("x86/head/64: Install startup GDT")
Signed-off-by: Yuntao Wang <ytcoode@gmail.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Link: https://lore.kernel.org/r/20230807084547.217390-1-ytcoode@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/head64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index efe13ab366f4..8596b4dca945 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -80,7 +80,7 @@ static struct desc_struct startup_gdt[GDT_ENTRIES] = {
  * while the kernel still uses a direct mapping.
  */
 static struct desc_ptr startup_gdt_descr = {
-	.size = sizeof(startup_gdt),
+	.size = sizeof(startup_gdt)-1,
 	.address = 0,
 };
 

From bb166bdae1a7d7db30e9be7e6ccaba606debc05f Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Date: Fri, 23 Jun 2023 10:27:06 +0800
Subject: [PATCH 0314/1043] pstore/platform: Add check for kstrdup

[ Upstream commit a19d48f7c5d57c0f0405a7d4334d1d38fe9d3c1c ]

Add check for the return value of kstrdup() and return the error
if it fails in order to avoid NULL pointer dereference.

Fixes: 563ca40ddf40 ("pstore/platform: Switch pstore_info::name to const")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20230623022706.32125-1-jiasheng@iscas.ac.cn
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/pstore/platform.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index ce03c3dbb5c3..d59f13b1fb96 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -558,6 +558,8 @@ static int pstore_write_user_compat(struct pstore_record *record,
  */
 int pstore_register(struct pstore_info *psi)
 {
+	char *new_backend;
+
 	if (backend && strcmp(backend, psi->name)) {
 		pr_warn("ignoring unexpected backend '%s'\n", psi->name);
 		return -EPERM;
@@ -577,11 +579,16 @@ int pstore_register(struct pstore_info *psi)
 		return -EINVAL;
 	}
 
+	new_backend = kstrdup(psi->name, GFP_KERNEL);
+	if (!new_backend)
+		return -ENOMEM;
+
 	mutex_lock(&psinfo_lock);
 	if (psinfo) {
 		pr_warn("backend '%s' already loaded: ignoring '%s'\n",
 			psinfo->name, psi->name);
 		mutex_unlock(&psinfo_lock);
+		kfree(new_backend);
 		return -EBUSY;
 	}
 
@@ -614,7 +621,7 @@ int pstore_register(struct pstore_info *psi)
 	 * Update the module parameter backend, so it is visible
 	 * through /sys/module/pstore/parameters/backend
 	 */
-	backend = kstrdup(psi->name, GFP_KERNEL);
+	backend = new_backend;
 
 	pr_info("Registered %s as persistent store backend\n", psi->name);
 

From 47479ed7fcf750b08f3143f64804fae908e14078 Mon Sep 17 00:00:00 2001
From: Chen Yu <yu.c.chen@intel.com>
Date: Fri, 20 Oct 2023 15:25:22 +0800
Subject: [PATCH 0315/1043] genirq/matrix: Exclude managed interrupts in
 irq_matrix_allocated()

[ Upstream commit a0b0bad10587ae2948a7c36ca4ffc206007fbcf3 ]

When a CPU is about to be offlined, x86 validates that all active
interrupts which are targeted to this CPU can be migrated to the remaining
online CPUs. If not, the offline operation is aborted.

The validation uses irq_matrix_allocated() to retrieve the number of
vectors which are allocated on the outgoing CPU. The returned number of
allocated vectors includes also vectors which are associated to managed
interrupts.

That's overaccounting because managed interrupts are:

  - not migrated when the affinity mask of the interrupt targets only
    the outgoing CPU

  - migrated to another CPU, but in that case the vector is already
    pre-allocated on the potential target CPUs and must not be taken into
    account.

As a consequence the check whether the remaining online CPUs have enough
capacity for migrating the allocated vectors from the outgoing CPU might
fail incorrectly.

Let irq_matrix_allocated() return only the number of allocated non-managed
interrupts to make this validation check correct.

[ tglx: Amend changelog and fixup kernel-doc comment ]

Fixes: 2f75d9e1c905 ("genirq: Implement bitmap matrix allocator")
Reported-by: Wendy Wang <wendy.wang@intel.com>
Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20231020072522.557846-1-yu.c.chen@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/irq/matrix.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
index 8e586858bcf4..d25edbb87119 100644
--- a/kernel/irq/matrix.c
+++ b/kernel/irq/matrix.c
@@ -466,16 +466,16 @@ unsigned int irq_matrix_reserved(struct irq_matrix *m)
 }
 
 /**
- * irq_matrix_allocated - Get the number of allocated irqs on the local cpu
+ * irq_matrix_allocated - Get the number of allocated non-managed irqs on the local CPU
  * @m:		Pointer to the matrix to search
  *
- * This returns number of allocated irqs
+ * This returns number of allocated non-managed interrupts.
  */
 unsigned int irq_matrix_allocated(struct irq_matrix *m)
 {
 	struct cpumap *cm = this_cpu_ptr(m->maps);
 
-	return cm->allocated;
+	return cm->allocated - cm->managed_allocated;
 }
 
 #ifdef CONFIG_GENERIC_IRQ_DEBUGFS

From 61e7961ff33d18a27e539e713397e9069d4b332d Mon Sep 17 00:00:00 2001
From: Andrii Staikov <andrii.staikov@intel.com>
Date: Fri, 8 Sep 2023 14:42:01 +0200
Subject: [PATCH 0316/1043] i40e: fix potential memory leaks in i40e_remove()

[ Upstream commit 5ca636d927a106780451d957734f02589b972e2b ]

Instead of freeing memory of a single VSI, make sure
the memory for all VSIs is cleared before releasing VSIs.
Add releasing of their resources in a loop with the iteration
number equal to the number of allocated VSIs.

Fixes: 41c445ff0f48 ("i40e: main driver core")
Signed-off-by: Andrii Staikov <andrii.staikov@intel.com>
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_main.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index d23a467d0d20..64e1f6f407b4 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -15601,11 +15601,15 @@ static void i40e_remove(struct pci_dev *pdev)
 			i40e_switch_branch_release(pf->veb[i]);
 	}
 
-	/* Now we can shutdown the PF's VSI, just before we kill
+	/* Now we can shutdown the PF's VSIs, just before we kill
 	 * adminq and hmc.
 	 */
-	if (pf->vsi[pf->lan_vsi])
-		i40e_vsi_release(pf->vsi[pf->lan_vsi]);
+	for (i = pf->num_alloc_vsi; i--;)
+		if (pf->vsi[i]) {
+			i40e_vsi_close(pf->vsi[i]);
+			i40e_vsi_release(pf->vsi[i]);
+			pf->vsi[i] = NULL;
+		}
 
 	i40e_cloud_filter_exit(pf);
 

From 0ca9fc8200d41fde03e6664261bb526846a1d0ca Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Tue, 12 Sep 2023 09:17:25 +0000
Subject: [PATCH 0317/1043] udp: add missing WRITE_ONCE() around up->encap_rcv

[ Upstream commit 6d5a12eb91224d707f8691dccb40a5719fe5466d ]

UDP_ENCAP_ESPINUDP_NON_IKE setsockopt() writes over up->encap_rcv
while other cpus read it.

Fixes: 067b207b281d ("[UDP]: Cleanup UDP encapsulation code")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/udp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 913966e7703f..476f79f1563a 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2645,10 +2645,12 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
 		case UDP_ENCAP_ESPINUDP_NON_IKE:
 #if IS_ENABLED(CONFIG_IPV6)
 			if (sk->sk_family == AF_INET6)
-				up->encap_rcv = ipv6_stub->xfrm6_udp_encap_rcv;
+				WRITE_ONCE(up->encap_rcv,
+					   ipv6_stub->xfrm6_udp_encap_rcv);
 			else
 #endif
-				up->encap_rcv = xfrm4_udp_encap_rcv;
+				WRITE_ONCE(up->encap_rcv,
+					   xfrm4_udp_encap_rcv);
 #endif
 			fallthrough;
 		case UDP_ENCAP_L2TPINUDP:

From 2f4b4eb58fc03dca486a741b8c9c0bd88816c10c Mon Sep 17 00:00:00 2001
From: Aananth V <aananthv@google.com>
Date: Thu, 14 Sep 2023 14:36:20 +0000
Subject: [PATCH 0318/1043] tcp: call tcp_try_undo_recovery when an RTOd TFO
 SYNACK is ACKed

[ Upstream commit e326578a21414738de45f77badd332fb00bd0f58 ]

For passive TCP Fast Open sockets that had SYN/ACK timeout and did not
send more data in SYN_RECV, upon receiving the final ACK in 3WHS, the
congestion state may awkwardly stay in CA_Loss mode unless the CA state
was undone due to TCP timestamp checks. However, if
tcp_rcv_synrecv_state_fastopen() decides not to undo, then we should
enter CA_Open, because at that point we have received an ACK covering
the retransmitted SYNACKs. Currently, the icsk_ca_state is only set to
CA_Open after we receive an ACK for a data-packet. This is because
tcp_ack does not call tcp_fastretrans_alert (and tcp_process_loss) if
!prior_packets

Note that tcp_process_loss() calls tcp_try_undo_recovery(), so having
tcp_rcv_synrecv_state_fastopen() decide that if we're in CA_Loss we
should call tcp_try_undo_recovery() is consistent with that, and
low risk.

Fixes: dad8cea7add9 ("tcp: fix TFO SYNACK undo to avoid double-timestamp-undo")
Signed-off-by: Aananth V <aananthv@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_input.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0c935904ced8..a8948c76d19b 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6349,22 +6349,23 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
 
 static void tcp_rcv_synrecv_state_fastopen(struct sock *sk)
 {
+	struct tcp_sock *tp = tcp_sk(sk);
 	struct request_sock *req;
 
 	/* If we are still handling the SYNACK RTO, see if timestamp ECR allows
 	 * undo. If peer SACKs triggered fast recovery, we can't undo here.
 	 */
-	if (inet_csk(sk)->icsk_ca_state == TCP_CA_Loss)
-		tcp_try_undo_loss(sk, false);
+	if (inet_csk(sk)->icsk_ca_state == TCP_CA_Loss && !tp->packets_out)
+		tcp_try_undo_recovery(sk);
 
 	/* Reset rtx states to prevent spurious retransmits_timed_out() */
-	tcp_sk(sk)->retrans_stamp = 0;
+	tp->retrans_stamp = 0;
 	inet_csk(sk)->icsk_retransmits = 0;
 
 	/* Once we leave TCP_SYN_RECV or TCP_FIN_WAIT_1,
 	 * we no longer need req so release it.
 	 */
-	req = rcu_dereference_protected(tcp_sk(sk)->fastopen_rsk,
+	req = rcu_dereference_protected(tp->fastopen_rsk,
 					lockdep_sock_is_held(sk));
 	reqsk_fastopen_remove(sk, req, false);
 

From 2b46db3bb73df8add8a958848b7df3907ffc00b0 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Sat, 18 Sep 2021 15:17:53 -0700
Subject: [PATCH 0319/1043] overflow: Implement size_t saturating arithmetic
 helpers

[ Upstream commit e1be43d9b5d0d1310dbd90185a8e5c7145dde40f ]

In order to perform more open-coded replacements of common allocation
size arithmetic, the kernel needs saturating (SIZE_MAX) helpers for
multiplication, addition, and subtraction. For example, it is common in
allocators, especially on realloc, to add to an existing size:

    p = krealloc(map->patch,
                 sizeof(struct reg_sequence) * (map->patch_regs + num_regs),
                 GFP_KERNEL);

There is no existing saturating replacement for this calculation, and
just leaving the addition open coded inside array_size() could
potentially overflow as well. For example, an overflow in an expression
for a size_t argument might wrap to zero:

    array_size(anything, something_at_size_max + 1) == 0

Introduce size_mul(), size_add(), and size_sub() helpers that
implicitly promote arguments to size_t and saturated calculations for
use in allocations. With these helpers it is also possible to redefine
array_size(), array3_size(), flex_array_size(), and struct_size() in
terms of the new helpers.

As with the check_*_overflow() helpers, the new helpers use __must_check,
though what is really desired is a way to make sure that assignment is
only to a size_t lvalue. Without this, it's still possible to introduce
overflow/underflow via type conversion (i.e. from size_t to int).
Enforcing this will currently need to be left to static analysis or
future use of -Wconversion.

Additionally update the overflow unit tests to force runtime evaluation
for the pathological cases.

Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Keith Busch <kbusch@kernel.org>
Cc: Len Baker <len.baker@gmx.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Stable-dep-of: d692873cbe86 ("gve: Use size_add() in call to struct_size()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/process/deprecated.rst |  20 +++-
 include/linux/overflow.h             | 136 ++++++++++++++++-----------
 lib/test_overflow.c                  |  98 +++++++++++++++++++
 3 files changed, 197 insertions(+), 57 deletions(-)

diff --git a/Documentation/process/deprecated.rst b/Documentation/process/deprecated.rst
index 9d83b8db8874..86ea327b7e3a 100644
--- a/Documentation/process/deprecated.rst
+++ b/Documentation/process/deprecated.rst
@@ -70,6 +70,9 @@ Instead, the 2-factor form of the allocator should be used::
 
 	foo = kmalloc_array(count, size, GFP_KERNEL);
 
+Specifically, kmalloc() can be replaced with kmalloc_array(), and
+kzalloc() can be replaced with kcalloc().
+
 If no 2-factor form is available, the saturate-on-overflow helpers should
 be used::
 
@@ -90,9 +93,20 @@ Instead, use the helper::
         array usage and switch to a `flexible array member
         <#zero-length-and-one-element-arrays>`_ instead.
 
-See array_size(), array3_size(), and struct_size(),
-for more details as well as the related check_add_overflow() and
-check_mul_overflow() family of functions.
+For other calculations, please compose the use of the size_mul(),
+size_add(), and size_sub() helpers. For example, in the case of::
+
+	foo = krealloc(current_size + chunk_size * (count - 3), GFP_KERNEL);
+
+Instead, use the helpers::
+
+	foo = krealloc(size_add(current_size,
+				size_mul(chunk_size,
+					 size_sub(count, 3))), GFP_KERNEL);
+
+For more details, also see array3_size() and flex_array_size(),
+as well as the related check_mul_overflow(), check_add_overflow(),
+check_sub_overflow(), and check_shl_overflow() family of functions.
 
 simple_strtol(), simple_strtoll(), simple_strtoul(), simple_strtoull()
 ----------------------------------------------------------------------
diff --git a/include/linux/overflow.h b/include/linux/overflow.h
index ef74051d5cfe..35af574d006f 100644
--- a/include/linux/overflow.h
+++ b/include/linux/overflow.h
@@ -249,6 +249,69 @@ static inline bool __must_check __must_check_overflow(bool overflow)
 	(*_d >> _to_shift) != _a);					\
 }))
 
+/**
+ * size_mul() - Calculate size_t multiplication with saturation at SIZE_MAX
+ *
+ * @factor1: first factor
+ * @factor2: second factor
+ *
+ * Returns: calculate @factor1 * @factor2, both promoted to size_t,
+ * with any overflow causing the return value to be SIZE_MAX. The
+ * lvalue must be size_t to avoid implicit type conversion.
+ */
+static inline size_t __must_check size_mul(size_t factor1, size_t factor2)
+{
+	size_t bytes;
+
+	if (check_mul_overflow(factor1, factor2, &bytes))
+		return SIZE_MAX;
+
+	return bytes;
+}
+
+/**
+ * size_add() - Calculate size_t addition with saturation at SIZE_MAX
+ *
+ * @addend1: first addend
+ * @addend2: second addend
+ *
+ * Returns: calculate @addend1 + @addend2, both promoted to size_t,
+ * with any overflow causing the return value to be SIZE_MAX. The
+ * lvalue must be size_t to avoid implicit type conversion.
+ */
+static inline size_t __must_check size_add(size_t addend1, size_t addend2)
+{
+	size_t bytes;
+
+	if (check_add_overflow(addend1, addend2, &bytes))
+		return SIZE_MAX;
+
+	return bytes;
+}
+
+/**
+ * size_sub() - Calculate size_t subtraction with saturation at SIZE_MAX
+ *
+ * @minuend: value to subtract from
+ * @subtrahend: value to subtract from @minuend
+ *
+ * Returns: calculate @minuend - @subtrahend, both promoted to size_t,
+ * with any overflow causing the return value to be SIZE_MAX. For
+ * composition with the size_add() and size_mul() helpers, neither
+ * argument may be SIZE_MAX (or the result with be forced to SIZE_MAX).
+ * The lvalue must be size_t to avoid implicit type conversion.
+ */
+static inline size_t __must_check size_sub(size_t minuend, size_t subtrahend)
+{
+	size_t bytes;
+
+	if (minuend == SIZE_MAX || subtrahend == SIZE_MAX ||
+	    check_sub_overflow(minuend, subtrahend, &bytes))
+		return SIZE_MAX;
+
+	return bytes;
+}
+
 /**
  * array_size() - Calculate size of 2-dimensional array.
  *
@@ -260,15 +323,7 @@ static inline bool __must_check __must_check_overflow(bool overflow)
  * Returns: number of bytes needed to represent the array or SIZE_MAX on
  * overflow.
  */
-static inline __must_check size_t array_size(size_t a, size_t b)
-{
-	size_t bytes;
-
-	if (check_mul_overflow(a, b, &bytes))
-		return SIZE_MAX;
-
-	return bytes;
-}
+#define array_size(a, b)	size_mul(a, b)
 
 /**
  * array3_size() - Calculate size of 3-dimensional array.
@@ -282,49 +337,7 @@ static inline __must_check size_t array_size(size_t a, size_t b)
  * Returns: number of bytes needed to represent the array or SIZE_MAX on
  * overflow.
  */
-static inline __must_check size_t array3_size(size_t a, size_t b, size_t c)
-{
-	size_t bytes;
-
-	if (check_mul_overflow(a, b, &bytes))
-		return SIZE_MAX;
-	if (check_mul_overflow(bytes, c, &bytes))
-		return SIZE_MAX;
-
-	return bytes;
-}
-
-/*
- * Compute a*b+c, returning SIZE_MAX on overflow. Internal helper for
- * struct_size() below.
- */
-static inline __must_check size_t __ab_c_size(size_t a, size_t b, size_t c)
-{
-	size_t bytes;
-
-	if (check_mul_overflow(a, b, &bytes))
-		return SIZE_MAX;
-	if (check_add_overflow(bytes, c, &bytes))
-		return SIZE_MAX;
-
-	return bytes;
-}
-
-/**
- * struct_size() - Calculate size of structure with trailing array.
- * @p: Pointer to the structure.
- * @member: Name of the array member.
- * @count: Number of elements in the array.
- *
- * Calculates size of memory needed for structure @p followed by an
- * array of @count number of @member elements.
- *
- * Return: number of bytes needed or SIZE_MAX on overflow.
- */
-#define struct_size(p, member, count)					\
-	__ab_c_size(count,						\
-		    sizeof(*(p)->member) + __must_be_array((p)->member),\
-		    sizeof(*(p)))
+#define array3_size(a, b, c)	size_mul(size_mul(a, b), c)
 
 /**
  * flex_array_size() - Calculate size of a flexible array member
@@ -340,7 +353,22 @@ static inline __must_check size_t __ab_c_size(size_t a, size_t b, size_t c)
  * Return: number of bytes needed or SIZE_MAX on overflow.
  */
 #define flex_array_size(p, member, count)				\
-	array_size(count,						\
-		    sizeof(*(p)->member) + __must_be_array((p)->member))
+	size_mul(count,							\
+		 sizeof(*(p)->member) + __must_be_array((p)->member))
+
+/**
+ * struct_size() - Calculate size of structure with trailing flexible array.
+ *
+ * @p: Pointer to the structure.
+ * @member: Name of the array member.
+ * @count: Number of elements in the array.
+ *
+ * Calculates size of memory needed for structure @p followed by an
+ * array of @count number of @member elements.
+ *
+ * Return: number of bytes needed or SIZE_MAX on overflow.
+ */
+#define struct_size(p, member, count)					\
+	size_add(sizeof(*(p)), flex_array_size(p, member, count))
 
 #endif /* __LINUX_OVERFLOW_H */
diff --git a/lib/test_overflow.c b/lib/test_overflow.c
index 7a4b6f6c5473..7a5a5738d2d2 100644
--- a/lib/test_overflow.c
+++ b/lib/test_overflow.c
@@ -588,12 +588,110 @@ static int __init test_overflow_allocation(void)
 	return err;
 }
 
+struct __test_flex_array {
+	unsigned long flags;
+	size_t count;
+	unsigned long data[];
+};
+
+static int __init test_overflow_size_helpers(void)
+{
+	struct __test_flex_array *obj;
+	int count = 0;
+	int err = 0;
+	int var;
+
+#define check_one_size_helper(expected, func, args...)	({	\
+	bool __failure = false;					\
+	size_t _r;						\
+								\
+	_r = func(args);					\
+	if (_r != (expected)) {					\
+		pr_warn("expected " #func "(" #args ") "	\
+			"to return %zu but got %zu instead\n",	\
+			(size_t)(expected), _r);		\
+		__failure = true;				\
+	}							\
+	count++;						\
+	__failure;						\
+})
+
+	var = 4;
+	err |= check_one_size_helper(20,       size_mul, var++, 5);
+	err |= check_one_size_helper(20,       size_mul, 4, var++);
+	err |= check_one_size_helper(0,	       size_mul, 0, 3);
+	err |= check_one_size_helper(0,	       size_mul, 3, 0);
+	err |= check_one_size_helper(6,	       size_mul, 2, 3);
+	err |= check_one_size_helper(SIZE_MAX, size_mul, SIZE_MAX,  1);
+	err |= check_one_size_helper(SIZE_MAX, size_mul, SIZE_MAX,  3);
+	err |= check_one_size_helper(SIZE_MAX, size_mul, SIZE_MAX, -3);
+
+	var = 4;
+	err |= check_one_size_helper(9,        size_add, var++, 5);
+	err |= check_one_size_helper(9,        size_add, 4, var++);
+	err |= check_one_size_helper(9,	       size_add, 9, 0);
+	err |= check_one_size_helper(9,	       size_add, 0, 9);
+	err |= check_one_size_helper(5,	       size_add, 2, 3);
+	err |= check_one_size_helper(SIZE_MAX, size_add, SIZE_MAX,  1);
+	err |= check_one_size_helper(SIZE_MAX, size_add, SIZE_MAX,  3);
+	err |= check_one_size_helper(SIZE_MAX, size_add, SIZE_MAX, -3);
+
+	var = 4;
+	err |= check_one_size_helper(1,        size_sub, var--, 3);
+	err |= check_one_size_helper(1,        size_sub, 4, var--);
+	err |= check_one_size_helper(1,        size_sub, 3, 2);
+	err |= check_one_size_helper(9,	       size_sub, 9, 0);
+	err |= check_one_size_helper(SIZE_MAX, size_sub, 9, -3);
+	err |= check_one_size_helper(SIZE_MAX, size_sub, 0, 9);
+	err |= check_one_size_helper(SIZE_MAX, size_sub, 2, 3);
+	err |= check_one_size_helper(SIZE_MAX, size_sub, SIZE_MAX,  0);
+	err |= check_one_size_helper(SIZE_MAX, size_sub, SIZE_MAX, 10);
+	err |= check_one_size_helper(SIZE_MAX, size_sub, 0,  SIZE_MAX);
+	err |= check_one_size_helper(SIZE_MAX, size_sub, 14, SIZE_MAX);
+	err |= check_one_size_helper(SIZE_MAX - 2, size_sub, SIZE_MAX - 1,  1);
+	err |= check_one_size_helper(SIZE_MAX - 4, size_sub, SIZE_MAX - 1,  3);
+	err |= check_one_size_helper(1,		size_sub, SIZE_MAX - 1, -3);
+
+	var = 4;
+	err |= check_one_size_helper(4 * sizeof(*obj->data),
+				     flex_array_size, obj, data, var++);
+	err |= check_one_size_helper(5 * sizeof(*obj->data),
+				     flex_array_size, obj, data, var++);
+	err |= check_one_size_helper(0, flex_array_size, obj, data, 0);
+	err |= check_one_size_helper(sizeof(*obj->data),
+				     flex_array_size, obj, data, 1);
+	err |= check_one_size_helper(7 * sizeof(*obj->data),
+				     flex_array_size, obj, data, 7);
+	err |= check_one_size_helper(SIZE_MAX,
+				     flex_array_size, obj, data, -1);
+	err |= check_one_size_helper(SIZE_MAX,
+				     flex_array_size, obj, data, SIZE_MAX - 4);
+
+	var = 4;
+	err |= check_one_size_helper(sizeof(*obj) + (4 * sizeof(*obj->data)),
+				     struct_size, obj, data, var++);
+	err |= check_one_size_helper(sizeof(*obj) + (5 * sizeof(*obj->data)),
+				     struct_size, obj, data, var++);
+	err |= check_one_size_helper(sizeof(*obj), struct_size, obj, data, 0);
+	err |= check_one_size_helper(sizeof(*obj) + sizeof(*obj->data),
+				     struct_size, obj, data, 1);
+	err |= check_one_size_helper(SIZE_MAX,
+				     struct_size, obj, data, -3);
+	err |= check_one_size_helper(SIZE_MAX,
+				     struct_size, obj, data, SIZE_MAX - 3);
+
+	pr_info("%d overflow size helper tests finished\n", count);
+
+	return err;
+}
+
 static int __init test_module_init(void)
 {
 	int err = 0;
 
 	err |= test_overflow_calculation();
 	err |= test_overflow_shift();
+	err |= test_overflow_size_helpers();
 	err |= test_overflow_allocation();
 
 	if (err) {

From f927d4469632947c8a751bed1a9198707a78a0d2 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Fri, 15 Sep 2023 12:17:49 -0600
Subject: [PATCH 0320/1043] gve: Use size_add() in call to struct_size()

[ Upstream commit d692873cbe861a870cdc9cbfb120eefd113c3dfd ]

If, for any reason, `tx_stats_num + rx_stats_num` wraps around, the
protection that struct_size() adds against potential integer overflows
is defeated. Fix this by hardening call to struct_size() with size_add().

Fixes: 691f4077d560 ("gve: Replace zero-length array with flexible-array member")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/google/gve/gve_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
index f0c1e6c80b61..b76d1d019a81 100644
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -128,7 +128,7 @@ static int gve_alloc_stats_report(struct gve_priv *priv)
 	rx_stats_num = (GVE_RX_STATS_REPORT_NUM + NIC_RX_STATS_REPORT_NUM) *
 		       priv->rx_cfg.num_queues;
 	priv->stats_report_len = struct_size(priv->stats_report, stats,
-					     tx_stats_num + rx_stats_num);
+					     size_add(tx_stats_num, rx_stats_num));
 	priv->stats_report =
 		dma_alloc_coherent(&priv->pdev->dev, priv->stats_report_len,
 				   &priv->stats_report_bus, GFP_KERNEL);

From 5f5aabbdc27fe49259c004f475c1c6436174056e Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Fri, 15 Sep 2023 13:01:23 -0600
Subject: [PATCH 0321/1043] mlxsw: Use size_mul() in call to struct_size()

[ Upstream commit e22c6ea025013ae447fe269269753ffec763dde5 ]

If, for any reason, the open-coded arithmetic causes a wraparound, the
protection that `struct_size()` adds against potential integer overflows
is defeated. Fix this by hardening call to `struct_size()` with `size_mul()`.

Fixes: 2285ec872d9d ("mlxsw: spectrum_acl_bloom_filter: use struct_size() in kzalloc()")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
index dbd3bebf11ec..2e8b17e3b935 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
@@ -251,7 +251,7 @@ mlxsw_sp_acl_bf_init(struct mlxsw_sp *mlxsw_sp, unsigned int num_erp_banks)
 	 * is 2^ACL_MAX_BF_LOG
 	 */
 	bf_bank_size = 1 << MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_BF_LOG);
-	bf = kzalloc(struct_size(bf, refcnt, bf_bank_size * num_erp_banks),
+	bf = kzalloc(struct_size(bf, refcnt, size_mul(bf_bank_size, num_erp_banks)),
 		     GFP_KERNEL);
 	if (!bf)
 		return ERR_PTR(-ENOMEM);

From 9b8486fdad6597102c248215e90000085452631d Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Fri, 15 Sep 2023 13:16:26 -0600
Subject: [PATCH 0322/1043] tipc: Use size_add() in calls to struct_size()

[ Upstream commit 2506a91734754de690869824fb0d1ac592ec1266 ]

If, for any reason, the open-coded arithmetic causes a wraparound,
the protection that `struct_size()` adds against potential integer
overflows is defeated. Fix this by hardening call to `struct_size()`
with `size_add()`.

Fixes: e034c6d23bc4 ("tipc: Use struct_size() helper")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/link.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/tipc/link.c b/net/tipc/link.c
index dbb1bc722ba9..5f849c730028 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1410,7 +1410,7 @@ u16 tipc_get_gap_ack_blks(struct tipc_gap_ack_blks **ga, struct tipc_link *l,
 		p = (struct tipc_gap_ack_blks *)msg_data(hdr);
 		sz = ntohs(p->len);
 		/* Sanity check */
-		if (sz == struct_size(p, gacks, p->ugack_cnt + p->bgack_cnt)) {
+		if (sz == struct_size(p, gacks, size_add(p->ugack_cnt, p->bgack_cnt))) {
 			/* Good, check if the desired type exists */
 			if ((uc && p->ugack_cnt) || (!uc && p->bgack_cnt))
 				goto ok;
@@ -1497,7 +1497,7 @@ static u16 tipc_build_gap_ack_blks(struct tipc_link *l, struct tipc_msg *hdr)
 			__tipc_build_gap_ack_blks(ga, l, ga->bgack_cnt) : 0;
 
 	/* Total len */
-	len = struct_size(ga, gacks, ga->bgack_cnt + ga->ugack_cnt);
+	len = struct_size(ga, gacks, size_add(ga->bgack_cnt, ga->ugack_cnt));
 	ga->len = htons(len);
 	return len;
 }

From d44f88b20d44a33e0c9e5528a1a1ba0ca355bcca Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Fri, 15 Sep 2023 13:25:36 -0600
Subject: [PATCH 0323/1043] net: spider_net: Use size_add() in call to
 struct_size()

[ Upstream commit 0201409079b975e46cc40e8bdff4bd61329ee10f ]

If, for any reason, the open-coded arithmetic causes a wraparound,
the protection that `struct_size()` adds against potential integer
overflows is defeated. Fix this by hardening call to `struct_size()`
with `size_add()`.

Fixes: 3f1071ec39f7 ("net: spider_net: Use struct_size() helper")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/toshiba/spider_net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c
index 5f5b33e6653b..9d4c49f28d31 100644
--- a/drivers/net/ethernet/toshiba/spider_net.c
+++ b/drivers/net/ethernet/toshiba/spider_net.c
@@ -2311,7 +2311,7 @@ spider_net_alloc_card(void)
 	struct spider_net_card *card;
 
 	netdev = alloc_etherdev(struct_size(card, darray,
-					    tx_descriptors + rx_descriptors));
+					    size_add(tx_descriptors, rx_descriptors)));
 	if (!netdev)
 		return NULL;
 

From 3068527d17e8293911e71cada05b66f7a3001e28 Mon Sep 17 00:00:00 2001
From: Jinjie Ruan <ruanjinjie@huawei.com>
Date: Tue, 19 Sep 2023 13:06:50 +0800
Subject: [PATCH 0324/1043] wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug
 for debugfs_create_file()

[ Upstream commit 74f7957c9b1b95553faaf146a2553e023a9d1720 ]

Since debugfs_create_file() return ERR_PTR and never return NULL, so use
IS_ERR() to check it instead of checking NULL.

Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230919050651.962694-1-ruanjinjie@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw88/debug.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index 8bb6cc8ca74e..83413cda9bc5 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -901,9 +901,9 @@ static struct rtw_debugfs_priv rtw_debug_priv_coex_info = {
 #define rtw_debugfs_add_core(name, mode, fopname, parent)		\
 	do {								\
 		rtw_debug_priv_ ##name.rtwdev = rtwdev;			\
-		if (!debugfs_create_file(#name, mode,			\
+		if (IS_ERR(debugfs_create_file(#name, mode,		\
 					 parent, &rtw_debug_priv_ ##name,\
-					 &file_ops_ ##fopname))		\
+					 &file_ops_ ##fopname)))	\
 			pr_debug("Unable to initialize debugfs:%s\n",	\
 			       #name);					\
 	} while (0)

From d203f9921ac079a73ebe4591a3db0823a13f62ee Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Fri, 28 Jul 2023 09:51:01 +0200
Subject: [PATCH 0325/1043] wifi: mt76: mt7603: rework/fix rx pse hang check

[ Upstream commit baa19b2e4b7bbb509a7ca7939c8785477dcd40ee ]

It turns out that the code in mt7603_rx_pse_busy() does not detect actual
hardware hangs, it only checks for busy conditions in PSE.
A reset should only be performed if these conditions are true and if there
is no rx activity as well.
Reset the counter whenever a rx interrupt occurs. In order to also deal with
a fully loaded CPU that leaves interrupts disabled with continuous NAPI
polling, also check for pending rx interrupts in the function itself.

Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/mediatek/mt76/mt7603/core.c  |  2 ++
 .../net/wireless/mediatek/mt76/mt7603/mac.c   | 23 +++++++++++++------
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/core.c b/drivers/net/wireless/mediatek/mt76/mt7603/core.c
index 60a996b63c0c..915b8349146a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/core.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/core.c
@@ -42,11 +42,13 @@ irqreturn_t mt7603_irq_handler(int irq, void *dev_instance)
 	}
 
 	if (intr & MT_INT_RX_DONE(0)) {
+		dev->rx_pse_check = 0;
 		mt7603_irq_disable(dev, MT_INT_RX_DONE(0));
 		napi_schedule(&dev->mt76.napi[0]);
 	}
 
 	if (intr & MT_INT_RX_DONE(1)) {
+		dev->rx_pse_check = 0;
 		mt7603_irq_disable(dev, MT_INT_RX_DONE(1));
 		napi_schedule(&dev->mt76.napi[1]);
 	}
diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
index f665a1c95eed..9eb898ebbb44 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
@@ -1535,20 +1535,29 @@ static bool mt7603_rx_pse_busy(struct mt7603_dev *dev)
 {
 	u32 addr, val;
 
-	if (mt76_rr(dev, MT_MCU_DEBUG_RESET) & MT_MCU_DEBUG_RESET_QUEUES)
-		return true;
-
 	if (mt7603_rx_fifo_busy(dev))
-		return false;
+		goto out;
 
 	addr = mt7603_reg_map(dev, MT_CLIENT_BASE_PHYS_ADDR + MT_CLIENT_STATUS);
 	mt76_wr(dev, addr, 3);
 	val = mt76_rr(dev, addr) >> 16;
 
-	if (is_mt7628(dev) && (val & 0x4001) == 0x4001)
-		return true;
+	if (!(val & BIT(0)))
+		return false;
 
-	return (val & 0x8001) == 0x8001 || (val & 0xe001) == 0xe001;
+	if (is_mt7628(dev))
+		val &= 0xa000;
+	else
+		val &= 0x8000;
+	if (!val)
+		return false;
+
+out:
+	if (mt76_rr(dev, MT_INT_SOURCE_CSR) &
+	    (MT_INT_RX_DONE(0) | MT_INT_RX_DONE(1)))
+		return false;
+
+	return true;
 }
 
 static bool

From 37308a39262b763d3f26535424f2384470050950 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 22 Sep 2023 22:03:53 +0000
Subject: [PATCH 0326/1043] tcp_metrics: add missing barriers on delete

[ Upstream commit cbc3a153222805d65f821e10f4f78b6afce06f86 ]

When removing an item from RCU protected list, we must prevent
store-tearing, using rcu_assign_pointer() or WRITE_ONCE().

Fixes: 04f721c671656 ("tcp_metrics: Rewrite tcp_metrics_flush_all")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_metrics.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index a707fa1dbcaf..03ab7500f574 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -908,7 +908,7 @@ static void tcp_metrics_flush_all(struct net *net)
 			match = net ? net_eq(tm_net(tm), net) :
 				!refcount_read(&tm_net(tm)->count);
 			if (match) {
-				*pp = tm->tcpm_next;
+				rcu_assign_pointer(*pp, tm->tcpm_next);
 				kfree_rcu(tm, rcu_head);
 			} else {
 				pp = &tm->tcpm_next;
@@ -949,7 +949,7 @@ static int tcp_metrics_nl_cmd_del(struct sk_buff *skb, struct genl_info *info)
 		if (addr_same(&tm->tcpm_daddr, &daddr) &&
 		    (!src || addr_same(&tm->tcpm_saddr, &saddr)) &&
 		    net_eq(tm_net(tm), net)) {
-			*pp = tm->tcpm_next;
+			rcu_assign_pointer(*pp, tm->tcpm_next);
 			kfree_rcu(tm, rcu_head);
 			found = true;
 		} else {

From 73999f29ab19a6ee0c68fe952f1de75d56c5741e Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 22 Sep 2023 22:03:54 +0000
Subject: [PATCH 0327/1043] tcp_metrics: properly set tp->snd_ssthresh in
 tcp_init_metrics()

[ Upstream commit 081480014a64a69d901f8ef1ffdd56d6085cf87e ]

We need to set tp->snd_ssthresh to TCP_INFINITE_SSTHRESH
in the case tcp_get_metrics() fails for some reason.

Fixes: 9ad7c049f0f7 ("tcp: RFC2988bis + taking RTT sample from 3WHS for the passive open side")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_metrics.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 03ab7500f574..a5d4e69acc05 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -470,6 +470,10 @@ void tcp_init_metrics(struct sock *sk)
 	u32 val, crtt = 0; /* cached RTT scaled by 8 */
 
 	sk_dst_confirm(sk);
+	/* ssthresh may have been reduced unnecessarily during.
+	 * 3WHS. Restore it back to its initial default.
+	 */
+	tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
 	if (!dst)
 		goto reset;
 
@@ -489,11 +493,6 @@ void tcp_init_metrics(struct sock *sk)
 		tp->snd_ssthresh = val;
 		if (tp->snd_ssthresh > tp->snd_cwnd_clamp)
 			tp->snd_ssthresh = tp->snd_cwnd_clamp;
-	} else {
-		/* ssthresh may have been reduced unnecessarily during.
-		 * 3WHS. Restore it back to its initial default.
-		 */
-		tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
 	}
 	val = tcp_metric_get(tm, TCP_METRIC_REORDERING);
 	if (val && tp->reordering != val)

From d8f2e18d1dcfe79128828ac9339b38dbe3e2ee6d Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 22 Sep 2023 22:03:55 +0000
Subject: [PATCH 0328/1043] tcp_metrics: do not create an entry from
 tcp_init_metrics()

[ Upstream commit a135798e6e200ecb2f864cecca6d257ba278370c ]

tcp_init_metrics() only wants to get metrics if they were
previously stored in the cache. Creating an entry is adding
useless costs, especially when tcp_no_metrics_save is set.

Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_metrics.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index a5d4e69acc05..f823a15b973c 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -478,7 +478,7 @@ void tcp_init_metrics(struct sock *sk)
 		goto reset;
 
 	rcu_read_lock();
-	tm = tcp_get_metrics(sk, dst, true);
+	tm = tcp_get_metrics(sk, dst, false);
 	if (!tm) {
 		rcu_read_unlock();
 		goto reset;

From 03d138b6b243d38ba9e3721305e6919b0b9d344b Mon Sep 17 00:00:00 2001
From: Dmitry Antipov <dmantipov@yandex.ru>
Date: Thu, 28 Sep 2023 08:23:19 +0300
Subject: [PATCH 0329/1043] wifi: rtlwifi: fix EDCA limit set by BT coexistence

[ Upstream commit 3391ee7f9ea508c375d443cd712c2e699be235b4 ]

In 'rtl92c_dm_check_edca_turbo()', 'rtl88e_dm_check_edca_turbo()',
and 'rtl8723e_dm_check_edca_turbo()', the DL limit should be set
from the corresponding field of 'rtlpriv->btcoexist' rather than
UL. Compile tested only.

Fixes: 0529c6b81761 ("rtlwifi: rtl8723ae: Update driver to match 06/28/14 Realtek version")
Fixes: c151aed6aa14 ("rtlwifi: rtl8188ee: Update driver to match Realtek release of 06282014")
Fixes: beb5bc402043 ("rtlwifi: rtl8192c-common: Convert common dynamic management routines for addition of rtl8192se and rtl8192de")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230928052327.120178-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtlwifi/rtl8188ee/dm.c       | 2 +-
 drivers/net/wireless/realtek/rtlwifi/rtl8192c/dm_common.c | 2 +-
 drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/dm.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/dm.c
index d10c14c694da..a1b920843b86 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/dm.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/dm.c
@@ -799,7 +799,7 @@ static void rtl88e_dm_check_edca_turbo(struct ieee80211_hw *hw)
 	}
 
 	if (rtlpriv->btcoexist.bt_edca_dl != 0) {
-		edca_be_ul = rtlpriv->btcoexist.bt_edca_dl;
+		edca_be_dl = rtlpriv->btcoexist.bt_edca_dl;
 		bt_change_edca = true;
 	}
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/dm_common.c
index 265a1a336304..c493e50b7bc5 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/dm_common.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/dm_common.c
@@ -640,7 +640,7 @@ static void rtl92c_dm_check_edca_turbo(struct ieee80211_hw *hw)
 	}
 
 	if (rtlpriv->btcoexist.bt_edca_dl != 0) {
-		edca_be_ul = rtlpriv->btcoexist.bt_edca_dl;
+		edca_be_dl = rtlpriv->btcoexist.bt_edca_dl;
 		bt_change_edca = true;
 	}
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c
index 8ada31380efa..0ff8e355c23a 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/dm.c
@@ -466,7 +466,7 @@ static void rtl8723e_dm_check_edca_turbo(struct ieee80211_hw *hw)
 	}
 
 	if (rtlpriv->btcoexist.bt_edca_dl != 0) {
-		edca_be_ul = rtlpriv->btcoexist.bt_edca_dl;
+		edca_be_dl = rtlpriv->btcoexist.bt_edca_dl;
 		bt_change_edca = true;
 	}
 

From 040f65c2821f410524a24bbe90be6feb3c781594 Mon Sep 17 00:00:00 2001
From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Thu, 28 Sep 2023 21:58:23 +0200
Subject: [PATCH 0330/1043] can: dev: can_restart(): don't crash kernel if
 carrier is OK

[ Upstream commit fe5c9940dfd8ba0c73672dddb30acd1b7a11d4c7 ]

During testing, I triggered a can_restart() with the netif carrier
being OK [1]. The BUG_ON, which checks if the carrier is OK, results
in a fatal kernel crash. This is neither helpful for debugging nor for
a production system.

[1] The root cause is a race condition in can_restart() which will be
fixed in the next patch.

Do not crash the kernel, issue an error message instead, and continue
restarting the CAN device anyway.

Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
Link: https://lore.kernel.org/all/20231005-can-dev-fix-can-restart-v2-1-91b5c1fd922c@pengutronix.de
Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/dev/dev.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
index 2b38a99884f2..2af3ac4e5233 100644
--- a/drivers/net/can/dev/dev.c
+++ b/drivers/net/can/dev/dev.c
@@ -578,7 +578,8 @@ static void can_restart(struct net_device *dev)
 	struct can_frame *cf;
 	int err;
 
-	BUG_ON(netif_carrier_ok(dev));
+	if (netif_carrier_ok(dev))
+		netdev_err(dev, "Attempt to restart for bus-off recovery, but carrier is OK?\n");
 
 	/* No synchronization needed because the device is bus-off and
 	 * no messages can come in or go out.

From d7a220bf6bd6266d9bc4f1f862ff1412769650aa Mon Sep 17 00:00:00 2001
From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Fri, 29 Sep 2023 10:25:11 +0200
Subject: [PATCH 0331/1043] can: dev: can_restart(): fix race condition between
 controller restart and netif_carrier_on()

[ Upstream commit 6841cab8c4504835e4011689cbdb3351dec693fd ]

This race condition was discovered while updating the at91_can driver
to use can_bus_off(). The following scenario describes how the
converted at91_can driver would behave.

When a CAN device goes into BUS-OFF state, the driver usually
stops/resets the CAN device and calls can_bus_off().

This function sets the netif carrier to off, and (if configured by
user space) schedules a delayed work that calls can_restart() to
restart the CAN device.

The can_restart() function first checks if the carrier is off and
triggers an error message if the carrier is OK.

Then it calls the driver's do_set_mode() function to restart the
device, then it sets the netif carrier to on. There is a race window
between these two calls.

The at91 CAN controller (observed on the sama5d3, a single core 32 bit
ARM CPU) has a hardware limitation. If the device goes into bus-off
while sending a CAN frame, there is no way to abort the sending of
this frame. After the controller is enabled again, another attempt is
made to send it.

If the bus is still faulty, the device immediately goes back to the
bus-off state. The driver calls can_bus_off(), the netif carrier is
switched off and another can_restart is scheduled. This occurs within
the race window before the original can_restart() handler marks the
netif carrier as OK. This would cause the 2nd can_restart() to be
called with an OK netif carrier, resulting in an error message.

The flow of the 1st can_restart() looks like this:

can_restart()
    // bail out if netif_carrier is OK

    netif_carrier_ok(dev)
    priv->do_set_mode(dev, CAN_MODE_START)
        // enable CAN controller
        // sama5d3 restarts sending old message

        // CAN devices goes into BUS_OFF, triggers IRQ

// IRQ handler start
    at91_irq()
        at91_irq_err_line()
            can_bus_off()
                netif_carrier_off()
                schedule_delayed_work()
// IRQ handler end

    netif_carrier_on()

The 2nd can_restart() will be called with an OK netif carrier and the
error message will be printed.

To close the race window, first set the netif carrier to on, then
restart the controller. In case the restart fails with an error code,
roll back the netif carrier to off.

Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
Link: https://lore.kernel.org/all/20231005-can-dev-fix-can-restart-v2-2-91b5c1fd922c@pengutronix.de
Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/dev/dev.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
index 2af3ac4e5233..b5e79d63d59b 100644
--- a/drivers/net/can/dev/dev.c
+++ b/drivers/net/can/dev/dev.c
@@ -603,11 +603,12 @@ static void can_restart(struct net_device *dev)
 	priv->can_stats.restarts++;
 
 	/* Now restart the device */
-	err = priv->do_set_mode(dev, CAN_MODE_START);
-
 	netif_carrier_on(dev);
-	if (err)
+	err = priv->do_set_mode(dev, CAN_MODE_START);
+	if (err) {
 		netdev_err(dev, "Error %d during restart", err);
+		netif_carrier_off(dev);
+	}
 }
 
 static void can_restart_work(struct work_struct *work)

From ae681e5eff0cc4866239e164128386c36993694f Mon Sep 17 00:00:00 2001
From: Sascha Hauer <s.hauer@pengutronix.de>
Date: Tue, 4 Jul 2023 11:32:17 +0200
Subject: [PATCH 0332/1043] PM / devfreq: rockchip-dfi: Make pmu regmap
 mandatory

[ Upstream commit 1e0731c05c985deb68a97fa44c1adcd3305dda90 ]

As a matter of fact the regmap_pmu already is mandatory because
it is used unconditionally in the driver. Bail out gracefully in
probe() rather than crashing later.

Link: https://lore.kernel.org/lkml/20230704093242.583575-2-s.hauer@pengutronix.de/
Fixes: b9d1262bca0af ("PM / devfreq: event: support rockchip dfi controller")
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/devfreq/event/rockchip-dfi.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c
index 9a88faaf8b27..4dafdf23197b 100644
--- a/drivers/devfreq/event/rockchip-dfi.c
+++ b/drivers/devfreq/event/rockchip-dfi.c
@@ -194,14 +194,15 @@ static int rockchip_dfi_probe(struct platform_device *pdev)
 		return PTR_ERR(data->clk);
 	}
 
-	/* try to find the optional reference to the pmu syscon */
 	node = of_parse_phandle(np, "rockchip,pmu", 0);
-	if (node) {
-		data->regmap_pmu = syscon_node_to_regmap(node);
-		of_node_put(node);
-		if (IS_ERR(data->regmap_pmu))
-			return PTR_ERR(data->regmap_pmu);
-	}
+	if (!node)
+		return dev_err_probe(&pdev->dev, -ENODEV, "Can't find pmu_grf registers\n");
+
+	data->regmap_pmu = syscon_node_to_regmap(node);
+	of_node_put(node);
+	if (IS_ERR(data->regmap_pmu))
+		return PTR_ERR(data->regmap_pmu);
+
 	data->dev = dev;
 
 	desc = devm_kzalloc(dev, sizeof(*desc), GFP_KERNEL);

From 3f795fb35c2d8a637efe76b4518216c9319b998c Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Sat, 7 Oct 2023 11:59:39 +0300
Subject: [PATCH 0333/1043] thermal: core: prevent potential string overflow

[ Upstream commit c99626092efca3061b387043d4a7399bf75fbdd5 ]

The dev->id value comes from ida_alloc() so it's a number between zero
and INT_MAX.  If it's too high then these sprintf()s will overflow.

Fixes: 203d3d4aa482 ("the generic thermal sysfs driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/thermal_core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index dd449945e1e5..1cf49912dc96 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -879,7 +879,8 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
 	if (result)
 		goto release_ida;
 
-	sprintf(dev->attr_name, "cdev%d_trip_point", dev->id);
+	snprintf(dev->attr_name, sizeof(dev->attr_name), "cdev%d_trip_point",
+		 dev->id);
 	sysfs_attr_init(&dev->attr.attr);
 	dev->attr.attr.name = dev->attr_name;
 	dev->attr.attr.mode = 0444;
@@ -888,7 +889,8 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
 	if (result)
 		goto remove_symbol_link;
 
-	sprintf(dev->weight_attr_name, "cdev%d_weight", dev->id);
+	snprintf(dev->weight_attr_name, sizeof(dev->weight_attr_name),
+		 "cdev%d_weight", dev->id);
 	sysfs_attr_init(&dev->weight_attr.attr);
 	dev->weight_attr.attr.name = dev->weight_attr_name;
 	dev->weight_attr.attr.mode = S_IWUSR | S_IRUGO;

From fdd4a3c20ad575f499694cf890d8623538438eb3 Mon Sep 17 00:00:00 2001
From: Juhee Kang <claudiajkang@gmail.com>
Date: Wed, 30 Nov 2022 01:12:44 +0900
Subject: [PATCH 0334/1043] r8169: use tp_to_dev instead of open code

[ Upstream commit 4b6c6065fca123d419afef005a696f51e6590470 ]

The open code is defined as a helper function(tp_to_dev) on r8169_main.c,
which the open code is &tp->pci_dev->dev. The helper function was added
in commit 1e1205b7d3e9 ("r8169: add helper tp_to_dev"). And then later,
commit f1e911d5d0df ("r8169: add basic phylib support") added
r8169_phylink_handler function but it didn't use the helper function.
Thus, tp_to_dev() replaces the open code. This patch doesn't change logic.

Signed-off-by: Juhee Kang <claudiajkang@gmail.com>
Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/20221129161244.5356-1-claudiajkang@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: 621735f59064 ("r8169: fix rare issue with broken rx after link-down on RTL8125")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 37e34d8f7946..4fb204962a11 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -4688,12 +4688,13 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
 static void r8169_phylink_handler(struct net_device *ndev)
 {
 	struct rtl8169_private *tp = netdev_priv(ndev);
+	struct device *d = tp_to_dev(tp);
 
 	if (netif_carrier_ok(ndev)) {
 		rtl_link_chg_patch(tp);
-		pm_request_resume(&tp->pci_dev->dev);
+		pm_request_resume(d);
 	} else {
-		pm_runtime_idle(&tp->pci_dev->dev);
+		pm_runtime_idle(d);
 	}
 
 	if (net_ratelimit())

From d104f6cb41e8f1f7af7c3c5dd5a3344741801db5 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Thu, 12 Oct 2023 08:51:13 +0200
Subject: [PATCH 0335/1043] r8169: fix rare issue with broken rx after
 link-down on RTL8125
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 621735f590643e3048ca2060c285b80551660601 ]

In very rare cases (I've seen two reports so far about different
RTL8125 chip versions) it seems the MAC locks up when link goes down
and requires a software reset to get revived.
Realtek doesn't publish hw errata information, therefore the root cause
is unknown. Realtek vendor drivers do a full hw re-initialization on
each link-up event, the slimmed-down variant here was reported to fix
the issue for the reporting user.
It's not fully clear which parts of the NIC are reset as part of the
software reset, therefore I can't rule out side effects.

Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125")
Reported-by: Martin Kjær Jørgensen <me@lagy.org>
Link: https://lore.kernel.org/netdev/97ec2232-3257-316c-c3e7-a08192ce16a6@gmail.com/T/
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/9edde757-9c3b-4730-be3b-0ef3a374ff71@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 4fb204962a11..9a920e0677e5 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -4693,7 +4693,11 @@ static void r8169_phylink_handler(struct net_device *ndev)
 	if (netif_carrier_ok(ndev)) {
 		rtl_link_chg_patch(tp);
 		pm_request_resume(d);
+		netif_wake_queue(tp->dev);
 	} else {
+		/* In few cases rx is broken after link-down otherwise */
+		if (rtl_is_8125(tp))
+			rtl_reset_work(tp);
 		pm_runtime_idle(d);
 	}
 

From 76894f305c9644c549fd732b4151beee7d90cda3 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 20 Oct 2023 12:57:36 +0000
Subject: [PATCH 0336/1043] chtls: fix tp->rcv_tstamp initialization

[ Upstream commit 225d9ddbacb102621af6d28ff7bf5a0b4ce249d8 ]

tp->rcv_tstamp should be set to tcp_jiffies, not tcp_time_stamp().

Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Ayush Sawal <ayush.sawal@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
index cd6e016e6210..ccf2bec283d3 100644
--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
+++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
@@ -2259,7 +2259,7 @@ static void chtls_rx_ack(struct sock *sk, struct sk_buff *skb)
 
 		if (tp->snd_una != snd_una) {
 			tp->snd_una = snd_una;
-			tp->rcv_tstamp = tcp_time_stamp(tp);
+			tp->rcv_tstamp = tcp_jiffies32;
 			if (tp->snd_una == tp->snd_nxt &&
 			    !csk_flag_nochk(csk, CSK_TX_FAILOVER))
 				csk_reset_flag(csk, CSK_TX_WAIT_IDLE);

From 88be6453d7c969032900dbe26379639d32ce8d30 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 20 Oct 2023 12:57:37 +0000
Subject: [PATCH 0337/1043] tcp: fix cookie_init_timestamp() overflows

[ Upstream commit 73ed8e03388d16c12fc577e5c700b58a29045a15 ]

cookie_init_timestamp() is supposed to return a 64bit timestamp
suitable for both TSval determination and setting of skb->tstamp.

Unfortunately it uses 32bit fields and overflows after
2^32 * 10^6 nsec (~49 days) of uptime.

Generated TSval are still correct, but skb->tstamp might be set
far away in the past, potentially confusing other layers.

tcp_ns_to_ts() is changed to return a full 64bit value,
ts and ts_now variables are changed to u64 type,
and TSMASK is removed in favor of shifts operations.

While we are at it, change this sequence:
		ts >>= TSBITS;
		ts--;
		ts <<= TSBITS;
		ts |= options;
to:
		ts -= (1UL << TSBITS);

Fixes: 9a568de4818d ("tcp: switch TCP TS option (RFC 7323) to 1ms clock")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/tcp.h     |  2 +-
 net/ipv4/syncookies.c | 20 +++++++-------------
 2 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 772e59391028..5c03dc6d0f79 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -776,7 +776,7 @@ static inline u32 tcp_time_stamp(const struct tcp_sock *tp)
 }
 
 /* Convert a nsec timestamp into TCP TSval timestamp (ms based currently) */
-static inline u32 tcp_ns_to_ts(u64 ns)
+static inline u64 tcp_ns_to_ts(u64 ns)
 {
 	return div_u64(ns, NSEC_PER_SEC / TCP_TS_HZ);
 }
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 542b66783493..cc860f2dcf65 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -43,7 +43,6 @@ static siphash_key_t syncookie_secret[2] __read_mostly;
  * requested/supported by the syn/synack exchange.
  */
 #define TSBITS	6
-#define TSMASK	(((__u32)1 << TSBITS) - 1)
 
 static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
 		       u32 count, int c)
@@ -64,27 +63,22 @@ static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
  */
 u64 cookie_init_timestamp(struct request_sock *req, u64 now)
 {
-	struct inet_request_sock *ireq;
-	u32 ts, ts_now = tcp_ns_to_ts(now);
+	const struct inet_request_sock *ireq = inet_rsk(req);
+	u64 ts, ts_now = tcp_ns_to_ts(now);
 	u32 options = 0;
 
-	ireq = inet_rsk(req);
-
 	options = ireq->wscale_ok ? ireq->snd_wscale : TS_OPT_WSCALE_MASK;
 	if (ireq->sack_ok)
 		options |= TS_OPT_SACK;
 	if (ireq->ecn_ok)
 		options |= TS_OPT_ECN;
 
-	ts = ts_now & ~TSMASK;
+	ts = (ts_now >> TSBITS) << TSBITS;
 	ts |= options;
-	if (ts > ts_now) {
-		ts >>= TSBITS;
-		ts--;
-		ts <<= TSBITS;
-		ts |= options;
-	}
-	return (u64)ts * (NSEC_PER_SEC / TCP_TS_HZ);
+	if (ts > ts_now)
+		ts -= (1UL << TSBITS);
+
+	return ts * (NSEC_PER_SEC / TCP_TS_HZ);
 }
 
 

From dea8d9e571ee148f768fb30cde6e60e93e7cb67a Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Mon, 23 Oct 2023 20:32:54 +0200
Subject: [PATCH 0338/1043] ACPI: sysfs: Fix create_pnp_modalias() and
 create_of_modalias()

[ Upstream commit 48cf49d31994ff97b33c4044e618560ec84d35fb ]

snprintf() does not return negative values on error.

To know if the buffer was too small, the returned value needs to be
compared with the length of the passed buffer. If it is greater or
equal, the output has been truncated, so add checks for the truncation
to create_pnp_modalias() and create_of_modalias(). Also make them
return -ENOMEM in that case, as they already do that elsewhere.

Moreover, the remaining size of the buffer used by snprintf() needs to
be updated after the first write to avoid out-of-bounds access as
already done correctly in create_pnp_modalias(), but not in
create_of_modalias(), so change the latter accordingly.

Fixes: 8765c5ba1949 ("ACPI / scan: Rework modalias creation when "compatible" is present")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ rjw: Merge two patches into one, combine changelogs, add subject ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/device_sysfs.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
index fe8c7e79f472..566067a855a1 100644
--- a/drivers/acpi/device_sysfs.c
+++ b/drivers/acpi/device_sysfs.c
@@ -156,8 +156,8 @@ static int create_pnp_modalias(struct acpi_device *acpi_dev, char *modalias,
 		return 0;
 
 	len = snprintf(modalias, size, "acpi:");
-	if (len <= 0)
-		return len;
+	if (len >= size)
+		return -ENOMEM;
 
 	size -= len;
 
@@ -210,8 +210,10 @@ static int create_of_modalias(struct acpi_device *acpi_dev, char *modalias,
 	len = snprintf(modalias, size, "of:N%sT", (char *)buf.pointer);
 	ACPI_FREE(buf.pointer);
 
-	if (len <= 0)
-		return len;
+	if (len >= size)
+		return -ENOMEM;
+
+	size -= len;
 
 	of_compatible = acpi_dev->data.of_compatible;
 	if (of_compatible->type == ACPI_TYPE_PACKAGE) {

From 98e8a5a370da0f8b68a0ac6229a4e3c174082423 Mon Sep 17 00:00:00 2001
From: Yan Zhai <yan@cloudflare.com>
Date: Tue, 24 Oct 2023 07:26:40 -0700
Subject: [PATCH 0339/1043] ipv6: avoid atomic fragment on GSO packets

[ Upstream commit 03d6c848bfb406e9ef6d9846d759e97beaeea113 ]

When the ipv6 stack output a GSO packet, if its gso_size is larger than
dst MTU, then all segments would be fragmented. However, it is possible
for a GSO packet to have a trailing segment with smaller actual size
than both gso_size as well as the MTU, which leads to an "atomic
fragment". Atomic fragments are considered harmful in RFC-8021. An
Existing report from APNIC also shows that atomic fragments are more
likely to be dropped even it is equivalent to a no-op [1].

Add an extra check in the GSO slow output path. For each segment from
the original over-sized packet, if it fits with the path MTU, then avoid
generating an atomic fragment.

Link: https://www.potaroo.net/presentations/2022-03-01-ipv6-frag.pdf [1]
Fixes: b210de4f8c97 ("net: ipv6: Validate GSO SKB before finish IPv6 processing")
Reported-by: David Wragg <dwragg@cloudflare.com>
Signed-off-by: Yan Zhai <yan@cloudflare.com>
Link: https://lore.kernel.org/r/90912e3503a242dca0bc36958b11ed03a2696e5e.1698156966.git.yan@cloudflare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/ip6_output.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 58b5ab5fcdbf..4126be15e0d9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -178,7 +178,13 @@ ip6_finish_output_gso_slowpath_drop(struct net *net, struct sock *sk,
 		int err;
 
 		skb_mark_not_on_list(segs);
-		err = ip6_fragment(net, sk, segs, ip6_finish_output2);
+		/* Last GSO segment can be smaller than gso_size (and MTU).
+		 * Adding a fragment header would produce an "atomic fragment",
+		 * which is considered harmful (RFC-8021). Avoid that.
+		 */
+		err = segs->len > mtu ?
+			ip6_fragment(net, sk, segs, ip6_finish_output2) :
+			ip6_finish_output2(net, sk, segs);
 		if (err && ret == 0)
 			ret = err;
 	}

From e897dcbd5fbcf8f6d9bc62406c04ca9459ab4092 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 21 Sep 2023 08:52:16 +0000
Subject: [PATCH 0340/1043] net: add DEV_STATS_READ() helper

[ Upstream commit 0b068c714ca9479d2783cc333fff5bc2d4a6d45c ]

Companion of DEV_STATS_INC() & DEV_STATS_ADD().

This is going to be used in the series.

Use it in macsec_get_stats64().

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: ff672b9ffeb3 ("ipvlan: properly track tx_errors")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/macsec.c      | 6 +++---
 include/linux/netdevice.h | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 0ffcef2fa10a..83b02dc7dfd2 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -3686,9 +3686,9 @@ static void macsec_get_stats64(struct net_device *dev,
 
 	dev_fetch_sw_netstats(s, dev->tstats);
 
-	s->rx_dropped = atomic_long_read(&dev->stats.__rx_dropped);
-	s->tx_dropped = atomic_long_read(&dev->stats.__tx_dropped);
-	s->rx_errors = atomic_long_read(&dev->stats.__rx_errors);
+	s->rx_dropped = DEV_STATS_READ(dev, rx_dropped);
+	s->tx_dropped = DEV_STATS_READ(dev, tx_dropped);
+	s->rx_errors = DEV_STATS_READ(dev, rx_errors);
 }
 
 static int macsec_get_iflink(const struct net_device *dev)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index e814ce78a196..3380668478e8 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -5286,5 +5286,6 @@ extern struct net_device *blackhole_netdev;
 #define DEV_STATS_INC(DEV, FIELD) atomic_long_inc(&(DEV)->stats.__##FIELD)
 #define DEV_STATS_ADD(DEV, FIELD, VAL) 	\
 		atomic_long_add((VAL), &(DEV)->stats.__##FIELD)
+#define DEV_STATS_READ(DEV, FIELD) atomic_long_read(&(DEV)->stats.__##FIELD)
 
 #endif	/* _LINUX_NETDEVICE_H */

From 9954a7f3808b22b9e7d9e16c8547eb58784a7357 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 26 Oct 2023 13:14:46 +0000
Subject: [PATCH 0341/1043] ipvlan: properly track tx_errors

[ Upstream commit ff672b9ffeb3f82135488ac16c5c5eb4b992999b ]

Both ipvlan_process_v4_outbound() and ipvlan_process_v6_outbound()
increment dev->stats.tx_errors in case of errors.

Unfortunately there are two issues :

1) ipvlan_get_stats64() does not propagate dev->stats.tx_errors to user.

2) Increments are not atomic. KCSAN would complain eventually.

Use DEV_STATS_INC() to not miss an update, and change ipvlan_get_stats64()
to copy the value back to user.

Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Mahesh Bandewar <maheshb@google.com>
Link: https://lore.kernel.org/r/20231026131446.3933175-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ipvlan/ipvlan_core.c | 8 ++++----
 drivers/net/ipvlan/ipvlan_main.c | 1 +
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index ab09d110760e..b5a61b16a7ea 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -442,12 +442,12 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb)
 
 	err = ip_local_out(net, skb->sk, skb);
 	if (unlikely(net_xmit_eval(err)))
-		dev->stats.tx_errors++;
+		DEV_STATS_INC(dev, tx_errors);
 	else
 		ret = NET_XMIT_SUCCESS;
 	goto out;
 err:
-	dev->stats.tx_errors++;
+	DEV_STATS_INC(dev, tx_errors);
 	kfree_skb(skb);
 out:
 	return ret;
@@ -483,12 +483,12 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
 
 	err = ip6_local_out(net, skb->sk, skb);
 	if (unlikely(net_xmit_eval(err)))
-		dev->stats.tx_errors++;
+		DEV_STATS_INC(dev, tx_errors);
 	else
 		ret = NET_XMIT_SUCCESS;
 	goto out;
 err:
-	dev->stats.tx_errors++;
+	DEV_STATS_INC(dev, tx_errors);
 	kfree_skb(skb);
 out:
 	return ret;
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 93be7dd571fc..f59ef2e2a614 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -322,6 +322,7 @@ static void ipvlan_get_stats64(struct net_device *dev,
 		s->rx_dropped = rx_errs;
 		s->tx_dropped = tx_drps;
 	}
+	s->tx_errors = DEV_STATS_READ(dev, tx_errors);
 }
 
 static int ipvlan_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)

From 80836b5859b725f9da8cc6ef90d6b5a99553f55a Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Mon, 4 Sep 2023 22:04:06 +0200
Subject: [PATCH 0342/1043] regmap: debugfs: Fix a erroneous check after
 snprintf()

[ Upstream commit d3601857e14de6369f00ae19564f1d817d175d19 ]

This error handling looks really strange.
Check if the string has been truncated instead.

Fixes: f0c2319f9f19 ("regmap: Expose the driver name in debugfs")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/8595de2462c490561f70020a6d11f4d6b652b468.1693857825.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/regmap/regmap-debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 211a335a608d..ed54dc31e6fd 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -48,7 +48,7 @@ static ssize_t regmap_name_read_file(struct file *file,
 		name = map->dev->driver->name;
 
 	ret = snprintf(buf, PAGE_SIZE, "%s\n", name);
-	if (ret < 0) {
+	if (ret >= PAGE_SIZE) {
 		kfree(buf);
 		return ret;
 	}

From 3181168e61f474da765231cbc1a6593b13b3f2b5 Mon Sep 17 00:00:00 2001
From: Devi Priya <quic_devipriy@quicinc.com>
Date: Fri, 1 Sep 2023 13:06:40 +0530
Subject: [PATCH 0343/1043] clk: qcom: clk-rcg2: Fix clock rate overflow for
 high parent frequencies

[ Upstream commit f7b7d30158cff246667273bd2a62fc93ee0725d2 ]

If the parent clock rate is greater than unsigned long max/2 then
integer overflow happens when calculating the clock rate on 32-bit systems.
As RCG2 uses half integer dividers, the clock rate is first being
multiplied by 2 which will overflow the unsigned long max value.
Hence, replace the common pattern of doing 64-bit multiplication
and then a do_div() call with simpler mult_frac call.

Fixes: bcd61c0f535a ("clk: qcom: Add support for root clock generators (RCGs)")
Signed-off-by: Devi Priya <quic_devipriy@quicinc.com>
Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
Link: https://lore.kernel.org/r/20230901073640.4973-1-quic_devipriy@quicinc.com
[bjorn: Also drop unnecessary {} around single statements]
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/clk-rcg2.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
index 71a0d30cf44d..eb4fd803bae0 100644
--- a/drivers/clk/qcom/clk-rcg2.c
+++ b/drivers/clk/qcom/clk-rcg2.c
@@ -147,17 +147,11 @@ static int clk_rcg2_set_parent(struct clk_hw *hw, u8 index)
 static unsigned long
 calc_rate(unsigned long rate, u32 m, u32 n, u32 mode, u32 hid_div)
 {
-	if (hid_div) {
-		rate *= 2;
-		rate /= hid_div + 1;
-	}
+	if (hid_div)
+		rate = mult_frac(rate, 2, hid_div + 1);
 
-	if (mode) {
-		u64 tmp = rate;
-		tmp *= m;
-		do_div(tmp, n);
-		rate = tmp;
-	}
+	if (mode)
+		rate = mult_frac(rate, m, n);
 
 	return rate;
 }

From 05eebcd4bc5bcb5d69ff390d0c948be1f75d271a Mon Sep 17 00:00:00 2001
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
Date: Thu, 14 Jan 2021 23:10:56 +0100
Subject: [PATCH 0344/1043] clk: qcom: mmcc-msm8998: Add hardware clockgating
 registers to some clks

[ Upstream commit fa92f3b093d6ca624f42d444d5a206f8724b6bb3 ]

Hardware clock gating is supported on some of the clocks declared in
there: ignoring that it does exist may lead to unstabilities on some
firmwares.
Add the HWCG registers where applicable to stop potential crashes.

This was verified on a smartphone shipped with a recent MSM8998
firmware, which will experience random crashes without this change.

Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
Link: https://lore.kernel.org/r/20210114221059.483390-9-angelogioacchino.delregno@somainline.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: 9906c4140897 ("clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/mmcc-msm8998.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/clk/qcom/mmcc-msm8998.c b/drivers/clk/qcom/mmcc-msm8998.c
index dd68983fe22e..0f7c2a48ef2e 100644
--- a/drivers/clk/qcom/mmcc-msm8998.c
+++ b/drivers/clk/qcom/mmcc-msm8998.c
@@ -1211,6 +1211,8 @@ static struct clk_rcg2 vfe1_clk_src = {
 
 static struct clk_branch misc_ahb_clk = {
 	.halt_reg = 0x328,
+	.hwcg_reg = 0x328,
+	.hwcg_bit = 1,
 	.clkr = {
 		.enable_reg = 0x328,
 		.enable_mask = BIT(0),
@@ -1241,6 +1243,8 @@ static struct clk_branch video_core_clk = {
 
 static struct clk_branch video_ahb_clk = {
 	.halt_reg = 0x1030,
+	.hwcg_reg = 0x1030,
+	.hwcg_bit = 1,
 	.clkr = {
 		.enable_reg = 0x1030,
 		.enable_mask = BIT(0),
@@ -1315,6 +1319,8 @@ static struct clk_branch video_subcore1_clk = {
 
 static struct clk_branch mdss_ahb_clk = {
 	.halt_reg = 0x2308,
+	.hwcg_reg = 0x2308,
+	.hwcg_bit = 1,
 	.clkr = {
 		.enable_reg = 0x2308,
 		.enable_mask = BIT(0),
@@ -2496,6 +2502,8 @@ static struct clk_branch mnoc_ahb_clk = {
 
 static struct clk_branch bimc_smmu_ahb_clk = {
 	.halt_reg = 0xe004,
+	.hwcg_reg = 0xe004,
+	.hwcg_bit = 1,
 	.clkr = {
 		.enable_reg = 0xe004,
 		.enable_mask = BIT(0),
@@ -2511,6 +2519,8 @@ static struct clk_branch bimc_smmu_ahb_clk = {
 
 static struct clk_branch bimc_smmu_axi_clk = {
 	.halt_reg = 0xe008,
+	.hwcg_reg = 0xe008,
+	.hwcg_bit = 1,
 	.clkr = {
 		.enable_reg = 0xe008,
 		.enable_mask = BIT(0),

From 97a6711744332647ba4ea15d58bd909f511a9854 Mon Sep 17 00:00:00 2001
From: Konrad Dybcio <konrad.dybcio@linaro.org>
Date: Wed, 9 Aug 2023 21:20:27 +0200
Subject: [PATCH 0345/1043] clk: qcom: mmcc-msm8998: Don't check halt bit on
 some branch clks

[ Upstream commit 9906c4140897bbdbff7bb71c6ae67903cb9954ce ]

Some branch clocks are governed externally and we're only supposed to
send a request concerning their shutdown, not actually ensure it happens.

Use the BRANCH_HALT_SKIP define to skip checking the halt bit.

Fixes: d14b15b5931c ("clk: qcom: Add MSM8998 Multimedia Clock Controller (MMCC) driver")
Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230531-topic-8998_mmssclk-v3-4-ba1b1fd9ee75@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/mmcc-msm8998.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/clk/qcom/mmcc-msm8998.c b/drivers/clk/qcom/mmcc-msm8998.c
index 0f7c2a48ef2e..c0bdefcbb294 100644
--- a/drivers/clk/qcom/mmcc-msm8998.c
+++ b/drivers/clk/qcom/mmcc-msm8998.c
@@ -2487,6 +2487,7 @@ static struct clk_branch fd_ahb_clk = {
 
 static struct clk_branch mnoc_ahb_clk = {
 	.halt_reg = 0x5024,
+	.halt_check = BRANCH_HALT_SKIP,
 	.clkr = {
 		.enable_reg = 0x5024,
 		.enable_mask = BIT(0),
@@ -2502,6 +2503,7 @@ static struct clk_branch mnoc_ahb_clk = {
 
 static struct clk_branch bimc_smmu_ahb_clk = {
 	.halt_reg = 0xe004,
+	.halt_check = BRANCH_HALT_SKIP,
 	.hwcg_reg = 0xe004,
 	.hwcg_bit = 1,
 	.clkr = {
@@ -2519,6 +2521,7 @@ static struct clk_branch bimc_smmu_ahb_clk = {
 
 static struct clk_branch bimc_smmu_axi_clk = {
 	.halt_reg = 0xe008,
+	.halt_check = BRANCH_HALT_SKIP,
 	.hwcg_reg = 0xe008,
 	.hwcg_bit = 1,
 	.clkr = {

From ba7f9695d545831cee39c9ae48ac50ed12953bda Mon Sep 17 00:00:00 2001
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
Date: Thu, 14 Jan 2021 23:10:57 +0100
Subject: [PATCH 0346/1043] clk: qcom: mmcc-msm8998: Set bimc_smmu_gdsc always
 on

[ Upstream commit 68e1d106eb4dceb61bc2818d829786b364fd502b ]

This GDSC enables (or cuts!) power to the Multimedia Subsystem IOMMU
(mmss smmu), which has bootloader pre-set secure contexts.
In the event of a complete power loss, the secure contexts will be
reset and the hypervisor will crash the SoC.

To prevent this, and get a working multimedia subsystem, set this
GDSC as always on.

Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
Link: https://lore.kernel.org/r/20210114221059.483390-10-angelogioacchino.delregno@somainline.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: 1fc62c834739 ("clk: qcom: mmcc-msm8998: Fix the SMMU GDSC")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/mmcc-msm8998.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/qcom/mmcc-msm8998.c b/drivers/clk/qcom/mmcc-msm8998.c
index c0bdefcbb294..8768cdcf0aa3 100644
--- a/drivers/clk/qcom/mmcc-msm8998.c
+++ b/drivers/clk/qcom/mmcc-msm8998.c
@@ -2666,7 +2666,7 @@ static struct gdsc bimc_smmu_gdsc = {
 		.name = "bimc_smmu",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
-	.flags = HW_CTRL,
+	.flags = HW_CTRL | ALWAYS_ON,
 };
 
 static struct clk_regmap *mmcc_msm8998_clocks[] = {

From 355a12fa1c5007730ae1a305da67967ae3942d20 Mon Sep 17 00:00:00 2001
From: Konrad Dybcio <konrad.dybcio@linaro.org>
Date: Wed, 9 Aug 2023 21:20:28 +0200
Subject: [PATCH 0347/1043] clk: qcom: mmcc-msm8998: Fix the SMMU GDSC

[ Upstream commit 1fc62c8347397faf4e18249e88ecd4470c0a5357 ]

The SMMU GDSC doesn't have to be ALWAYS-ON and shouldn't feature the
HW_CTRL flag (it's separate from hw_ctrl_addr).  In addition to that,
it should feature a cxc entry for bimc_smmu_axi_clk and be marked as
votable.

Fix all of these issues.

Fixes: d14b15b5931c ("clk: qcom: Add MSM8998 Multimedia Clock Controller (MMCC) driver")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Link: https://lore.kernel.org/r/20230531-topic-8998_mmssclk-v3-5-ba1b1fd9ee75@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/mmcc-msm8998.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/qcom/mmcc-msm8998.c b/drivers/clk/qcom/mmcc-msm8998.c
index 8768cdcf0aa3..a68764cfb793 100644
--- a/drivers/clk/qcom/mmcc-msm8998.c
+++ b/drivers/clk/qcom/mmcc-msm8998.c
@@ -2662,11 +2662,13 @@ static struct gdsc camss_cpp_gdsc = {
 static struct gdsc bimc_smmu_gdsc = {
 	.gdscr = 0xe020,
 	.gds_hw_ctrl = 0xe024,
+	.cxcs = (unsigned int []){ 0xe008 },
+	.cxc_count = 1,
 	.pd = {
 		.name = "bimc_smmu",
 	},
 	.pwrsts = PWRSTS_OFF_ON,
-	.flags = HW_CTRL | ALWAYS_ON,
+	.flags = VOTABLE,
 };
 
 static struct clk_regmap *mmcc_msm8998_clocks[] = {

From c6919a1576bcfb749690c68a90eb4c33ab9b5fe4 Mon Sep 17 00:00:00 2001
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Date: Tue, 6 Apr 2021 01:47:41 +0300
Subject: [PATCH 0348/1043] clk: qcom: gcc-sm8150: use ARRAY_SIZE instead of
 specifying num_parents

[ Upstream commit 60ca4670fd6436c07cea38472ebcee3b00f03bc7 ]

Use ARRAY_SIZE() instead of manually specifying num_parents. This makes
adding/removing entries to/from parent_data easy and errorproof.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20210405224743.590029-32-dmitry.baryshkov@linaro.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: 7138c244fb29 ("clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/gcc-sm8150.c | 96 +++++++++++++++++------------------
 1 file changed, 48 insertions(+), 48 deletions(-)

diff --git a/drivers/clk/qcom/gcc-sm8150.c b/drivers/clk/qcom/gcc-sm8150.c
index 8e9b5b3cceaf..dc25c40984f2 100644
--- a/drivers/clk/qcom/gcc-sm8150.c
+++ b/drivers/clk/qcom/gcc-sm8150.c
@@ -241,7 +241,7 @@ static struct clk_rcg2 gcc_cpuss_ahb_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_cpuss_ahb_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -264,7 +264,7 @@ static struct clk_rcg2 gcc_emac_ptp_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_emac_ptp_clk_src",
 		.parent_data = gcc_parents_5,
-		.num_parents = 5,
+		.num_parents = ARRAY_SIZE(gcc_parents_5),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -290,7 +290,7 @@ static struct clk_rcg2 gcc_emac_rgmii_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_emac_rgmii_clk_src",
 		.parent_data = gcc_parents_5,
-		.num_parents = 5,
+		.num_parents = ARRAY_SIZE(gcc_parents_5),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -314,7 +314,7 @@ static struct clk_rcg2 gcc_gp1_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_gp1_clk_src",
 		.parent_data = gcc_parents_1,
-		.num_parents = 5,
+		.num_parents = ARRAY_SIZE(gcc_parents_1),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -329,7 +329,7 @@ static struct clk_rcg2 gcc_gp2_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_gp2_clk_src",
 		.parent_data = gcc_parents_1,
-		.num_parents = 5,
+		.num_parents = ARRAY_SIZE(gcc_parents_1),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -344,7 +344,7 @@ static struct clk_rcg2 gcc_gp3_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_gp3_clk_src",
 		.parent_data = gcc_parents_1,
-		.num_parents = 5,
+		.num_parents = ARRAY_SIZE(gcc_parents_1),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -365,7 +365,7 @@ static struct clk_rcg2 gcc_pcie_0_aux_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_pcie_0_aux_clk_src",
 		.parent_data = gcc_parents_2,
-		.num_parents = 3,
+		.num_parents = ARRAY_SIZE(gcc_parents_2),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -380,7 +380,7 @@ static struct clk_rcg2 gcc_pcie_1_aux_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_pcie_1_aux_clk_src",
 		.parent_data = gcc_parents_2,
-		.num_parents = 3,
+		.num_parents = ARRAY_SIZE(gcc_parents_2),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -401,7 +401,7 @@ static struct clk_rcg2 gcc_pcie_phy_refgen_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_pcie_phy_refgen_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -423,7 +423,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_pdm2_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -446,7 +446,7 @@ static struct clk_rcg2 gcc_qspi_core_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qspi_core_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -480,7 +480,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap0_s0_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -495,7 +495,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap0_s1_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -510,7 +510,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap0_s2_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -525,7 +525,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap0_s3_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -540,7 +540,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap0_s4_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -555,7 +555,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap0_s5_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -570,7 +570,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s6_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap0_s6_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -585,7 +585,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s7_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap0_s7_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -600,7 +600,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap1_s0_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -615,7 +615,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap1_s1_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -630,7 +630,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap1_s2_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -645,7 +645,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap1_s3_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -660,7 +660,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap1_s4_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -675,7 +675,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap1_s5_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -690,7 +690,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s0_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap2_s0_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -705,7 +705,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s1_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap2_s1_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -720,7 +720,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s2_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap2_s2_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -735,7 +735,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s3_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap2_s3_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -750,7 +750,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s4_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap2_s4_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -765,7 +765,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s5_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_qupv3_wrap2_s5_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -791,7 +791,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_sdcc2_apps_clk_src",
 		.parent_data = gcc_parents_6,
-		.num_parents = 5,
+		.num_parents = ARRAY_SIZE(gcc_parents_6),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_floor_ops,
 	},
@@ -816,7 +816,7 @@ static struct clk_rcg2 gcc_sdcc4_apps_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_sdcc4_apps_clk_src",
 		.parent_data = gcc_parents_3,
-		.num_parents = 3,
+		.num_parents = ARRAY_SIZE(gcc_parents_3),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_floor_ops,
 	},
@@ -836,7 +836,7 @@ static struct clk_rcg2 gcc_tsif_ref_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_tsif_ref_clk_src",
 		.parent_data = gcc_parents_7,
-		.num_parents = 5,
+		.num_parents = ARRAY_SIZE(gcc_parents_7),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -860,7 +860,7 @@ static struct clk_rcg2 gcc_ufs_card_axi_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_ufs_card_axi_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -883,7 +883,7 @@ static struct clk_rcg2 gcc_ufs_card_ice_core_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_ufs_card_ice_core_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -903,7 +903,7 @@ static struct clk_rcg2 gcc_ufs_card_phy_aux_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_ufs_card_phy_aux_clk_src",
 		.parent_data = gcc_parents_4,
-		.num_parents = 2,
+		.num_parents = ARRAY_SIZE(gcc_parents_4),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -925,7 +925,7 @@ static struct clk_rcg2 gcc_ufs_card_unipro_core_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_ufs_card_unipro_core_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -949,7 +949,7 @@ static struct clk_rcg2 gcc_ufs_phy_axi_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_ufs_phy_axi_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -964,7 +964,7 @@ static struct clk_rcg2 gcc_ufs_phy_ice_core_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_ufs_phy_ice_core_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -979,7 +979,7 @@ static struct clk_rcg2 gcc_ufs_phy_phy_aux_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_ufs_phy_phy_aux_clk_src",
 		.parent_data = gcc_parents_4,
-		.num_parents = 2,
+		.num_parents = ARRAY_SIZE(gcc_parents_4),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -994,7 +994,7 @@ static struct clk_rcg2 gcc_ufs_phy_unipro_core_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_ufs_phy_unipro_core_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -1018,7 +1018,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_usb30_prim_master_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -1040,7 +1040,7 @@ static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_usb30_prim_mock_utmi_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -1055,7 +1055,7 @@ static struct clk_rcg2 gcc_usb30_sec_master_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_usb30_sec_master_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -1070,7 +1070,7 @@ static struct clk_rcg2 gcc_usb30_sec_mock_utmi_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_usb30_sec_mock_utmi_clk_src",
 		.parent_data = gcc_parents_0,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(gcc_parents_0),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -1085,7 +1085,7 @@ static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_usb3_prim_phy_aux_clk_src",
 		.parent_data = gcc_parents_2,
-		.num_parents = 3,
+		.num_parents = ARRAY_SIZE(gcc_parents_2),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},
@@ -1100,7 +1100,7 @@ static struct clk_rcg2 gcc_usb3_sec_phy_aux_clk_src = {
 	.clkr.hw.init = &(struct clk_init_data){
 		.name = "gcc_usb3_sec_phy_aux_clk_src",
 		.parent_data = gcc_parents_2,
-		.num_parents = 3,
+		.num_parents = ARRAY_SIZE(gcc_parents_2),
 		.flags = CLK_SET_RATE_PARENT,
 		.ops = &clk_rcg2_ops,
 	},

From a52c963d8d7ba9d10fea5bfec06f485c85199567 Mon Sep 17 00:00:00 2001
From: Danila Tikhonov <danila@jiaxyga.com>
Date: Wed, 13 Sep 2023 20:56:11 +0300
Subject: [PATCH 0349/1043] clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src

[ Upstream commit 7138c244fb293f24ce8ab782961022eff00a10c4 ]

Set .flags = CLK_OPS_PARENT_ENABLE to fix "gcc_sdcc2_apps_clk_src: rcg
didn't update its configuration" error.

Fixes: 2a1d7eb854bb ("clk: qcom: gcc: Add global clock controller driver for SM8150")
Tested-by: Arseniy Velikanov <adomerlee@gmail.com>
Signed-off-by: Danila Tikhonov <danila@jiaxyga.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230913175612.8685-1-danila@jiaxyga.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/gcc-sm8150.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/qcom/gcc-sm8150.c b/drivers/clk/qcom/gcc-sm8150.c
index dc25c40984f2..3d9ba3ccb6b6 100644
--- a/drivers/clk/qcom/gcc-sm8150.c
+++ b/drivers/clk/qcom/gcc-sm8150.c
@@ -792,7 +792,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
 		.name = "gcc_sdcc2_apps_clk_src",
 		.parent_data = gcc_parents_6,
 		.num_parents = ARRAY_SIZE(gcc_parents_6),
-		.flags = CLK_SET_RATE_PARENT,
+		.flags = CLK_OPS_PARENT_ENABLE,
 		.ops = &clk_rcg2_floor_ops,
 	},
 };

From c1bacea8a64be101477578fff69536fb455fa7e3 Mon Sep 17 00:00:00 2001
From: Abel Vesa <abel.vesa@linaro.org>
Date: Thu, 21 Sep 2023 12:23:54 +0300
Subject: [PATCH 0350/1043] clk: imx: Select MXC_CLK for CLK_IMX8QXP

[ Upstream commit 317e69c49b4ceef8aebb47d771498ccb3571bdf9 ]

If the i.MX8QXP clock provider is built-in but the MXC_CLK is
built as module, build fails:

aarch64-linux-ld: drivers/clk/imx/clk-imx8-acm.o: in function `imx8_acm_clk_probe':
clk-imx8-acm.c:(.text+0x3d0): undefined reference to `imx_check_clk_hws'

Fix that by selecting MXC_CLK in case of CLK_IMX8QXP.

Fixes: c2cccb6d0b33 ("clk: imx: add imx8qxp clk driver")
Closes: https://lore.kernel.org/all/8b77219e-b59e-40f1-96f1-980a0b2debcf@infradead.org/
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/imx/Kconfig b/drivers/clk/imx/Kconfig
index 47d9ec3abd2f..d3d730610cb4 100644
--- a/drivers/clk/imx/Kconfig
+++ b/drivers/clk/imx/Kconfig
@@ -96,5 +96,6 @@ config CLK_IMX8QXP
 	depends on (ARCH_MXC && ARM64) || COMPILE_TEST
 	depends on IMX_SCU && HAVE_ARM_SMCCC
 	select MXC_CLK_SCU
+	select MXC_CLK
 	help
 	  Build the driver for IMX8QXP SCU based clocks.

From 8d03f7c5800d51be850cdf644821db899faf5351 Mon Sep 17 00:00:00 2001
From: Peng Fan <peng.fan@nxp.com>
Date: Sun, 1 Oct 2023 20:26:18 +0800
Subject: [PATCH 0351/1043] clk: imx: imx8mq: correct error handling path

[ Upstream commit 577ad169966e6e75b10e004389a3f79813e84b5d ]

Avoid memory leak in error handling path. It does not make
much sense for the SoC without clk driver, to make program behavior
correct, let's fix it.

Fixes: b80522040cd3 ("clk: imx: Add clock driver for i.MX8MQ CCM")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202309240551.e46NllPa-lkp@intel.com/
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Link: https://lore.kernel.org/r/20231001122618.194498-1-peng.fan@oss.nxp.com
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-imx8mq.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/clk/imx/clk-imx8mq.c b/drivers/clk/imx/clk-imx8mq.c
index f679e5cc320b..89313dd7a57f 100644
--- a/drivers/clk/imx/clk-imx8mq.c
+++ b/drivers/clk/imx/clk-imx8mq.c
@@ -280,8 +280,7 @@ static int imx8mq_clocks_probe(struct platform_device *pdev)
 	void __iomem *base;
 	int err;
 
-	clk_hw_data = kzalloc(struct_size(clk_hw_data, hws,
-					  IMX8MQ_CLK_END), GFP_KERNEL);
+	clk_hw_data = devm_kzalloc(dev, struct_size(clk_hw_data, hws, IMX8MQ_CLK_END), GFP_KERNEL);
 	if (WARN_ON(!clk_hw_data))
 		return -ENOMEM;
 
@@ -298,10 +297,12 @@ static int imx8mq_clocks_probe(struct platform_device *pdev)
 	hws[IMX8MQ_CLK_EXT4] = imx_obtain_fixed_clk_hw(np, "clk_ext4");
 
 	np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-anatop");
-	base = of_iomap(np, 0);
+	base = devm_of_iomap(dev, np, 0, NULL);
 	of_node_put(np);
-	if (WARN_ON(!base))
-		return -ENOMEM;
+	if (WARN_ON(IS_ERR(base))) {
+		err = PTR_ERR(base);
+		goto unregister_hws;
+	}
 
 	hws[IMX8MQ_ARM_PLL_REF_SEL] = imx_clk_hw_mux("arm_pll_ref_sel", base + 0x28, 16, 2, pll_ref_sels, ARRAY_SIZE(pll_ref_sels));
 	hws[IMX8MQ_GPU_PLL_REF_SEL] = imx_clk_hw_mux("gpu_pll_ref_sel", base + 0x18, 16, 2, pll_ref_sels, ARRAY_SIZE(pll_ref_sels));
@@ -373,8 +374,10 @@ static int imx8mq_clocks_probe(struct platform_device *pdev)
 
 	np = dev->of_node;
 	base = devm_platform_ioremap_resource(pdev, 0);
-	if (WARN_ON(IS_ERR(base)))
-		return PTR_ERR(base);
+	if (WARN_ON(IS_ERR(base))) {
+		err = PTR_ERR(base);
+		goto unregister_hws;
+	}
 
 	/* CORE */
 	hws[IMX8MQ_CLK_A53_DIV] = imx8m_clk_hw_composite_core("arm_a53_div", imx8mq_a53_sels, base + 0x8000);

From f28709097db43d5051e12ceedd9eee562632f613 Mon Sep 17 00:00:00 2001
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Date: Fri, 16 Sep 2022 09:17:38 +0300
Subject: [PATCH 0352/1043] clk: asm9260: use parent index to link the
 reference clock

[ Upstream commit f5290d8e4f0caa81a491448a27dd70e726095d07 ]

Rewrite clk-asm9260 to use parent index to use the reference clock.
During this rework two helpers are added:

- clk_hw_register_mux_table_parent_data() to supplement
  clk_hw_register_mux_table() but using parent_data instead of
  parent_names

- clk_hw_register_fixed_rate_parent_accuracy() to be used instead of
  directly calling __clk_hw_register_fixed_rate(). The later function is
  an internal API, which is better not to be called directly.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20220916061740.87167-2-dmitry.baryshkov@linaro.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: 84aefafe6b29 ("clk: linux/clk-provider.h: fix kernel-doc warnings and typos")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-asm9260.c    | 29 ++++++++++++-----------------
 include/linux/clk-provider.h | 21 +++++++++++++++++++++
 2 files changed, 33 insertions(+), 17 deletions(-)

diff --git a/drivers/clk/clk-asm9260.c b/drivers/clk/clk-asm9260.c
index bacebd457e6f..8b3c059e19a1 100644
--- a/drivers/clk/clk-asm9260.c
+++ b/drivers/clk/clk-asm9260.c
@@ -80,7 +80,7 @@ struct asm9260_mux_clock {
 	u8			mask;
 	u32			*table;
 	const char		*name;
-	const char		**parent_names;
+	const struct clk_parent_data *parent_data;
 	u8			num_parents;
 	unsigned long		offset;
 	unsigned long		flags;
@@ -232,10 +232,10 @@ static const struct asm9260_gate_data asm9260_ahb_gates[] __initconst = {
 		HW_AHBCLKCTRL1,	16 },
 };
 
-static const char __initdata *main_mux_p[] =   { NULL, NULL };
-static const char __initdata *i2s0_mux_p[] =   { NULL, NULL, "i2s0m_div"};
-static const char __initdata *i2s1_mux_p[] =   { NULL, NULL, "i2s1m_div"};
-static const char __initdata *clkout_mux_p[] = { NULL, NULL, "rtc"};
+static struct clk_parent_data __initdata main_mux_p[] =   { { .index = 0, }, { .name = "pll" } };
+static struct clk_parent_data __initdata i2s0_mux_p[] =   { { .index = 0, }, { .name = "pll" }, { .name = "i2s0m_div"} };
+static struct clk_parent_data __initdata i2s1_mux_p[] =   { { .index = 0, }, { .name = "pll" }, { .name = "i2s1m_div"} };
+static struct clk_parent_data __initdata clkout_mux_p[] = { { .index = 0, }, { .name = "pll" }, { .name = "rtc"} };
 static u32 three_mux_table[] = {0, 1, 3};
 
 static struct asm9260_mux_clock asm9260_mux_clks[] __initdata = {
@@ -255,9 +255,10 @@ static struct asm9260_mux_clock asm9260_mux_clks[] __initdata = {
 
 static void __init asm9260_acc_init(struct device_node *np)
 {
-	struct clk_hw *hw;
+	struct clk_hw *hw, *pll_hw;
 	struct clk_hw **hws;
-	const char *ref_clk, *pll_clk = "pll";
+	const char *pll_clk = "pll";
+	struct clk_parent_data pll_parent_data = { .index = 0 };
 	u32 rate;
 	int n;
 
@@ -274,21 +275,15 @@ static void __init asm9260_acc_init(struct device_node *np)
 	/* register pll */
 	rate = (ioread32(base + HW_SYSPLLCTRL) & 0xffff) * 1000000;
 
-	/* TODO: Convert to DT parent scheme */
-	ref_clk = of_clk_get_parent_name(np, 0);
-	hw = __clk_hw_register_fixed_rate(NULL, NULL, pll_clk,
-			ref_clk, NULL, NULL, 0, rate, 0,
-			CLK_FIXED_RATE_PARENT_ACCURACY);
-
-	if (IS_ERR(hw))
+	pll_hw = clk_hw_register_fixed_rate_parent_accuracy(NULL, pll_clk, &pll_parent_data,
+							0, rate);
+	if (IS_ERR(pll_hw))
 		panic("%pOFn: can't register REFCLK. Check DT!", np);
 
 	for (n = 0; n < ARRAY_SIZE(asm9260_mux_clks); n++) {
 		const struct asm9260_mux_clock *mc = &asm9260_mux_clks[n];
 
-		mc->parent_names[0] = ref_clk;
-		mc->parent_names[1] = pll_clk;
-		hw = clk_hw_register_mux_table(NULL, mc->name, mc->parent_names,
+		hw = clk_hw_register_mux_table_parent_data(NULL, mc->name, mc->parent_data,
 				mc->num_parents, mc->flags, base + mc->offset,
 				0, mc->mask, 0, mc->table, &asm9260_clk_lock);
 	}
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index 03a5de5f99f4..d199f79c7091 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -439,6 +439,20 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
 	__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL,	      \
 				     (parent_data), NULL, (flags),	      \
 				     (fixed_rate), (fixed_accuracy), 0)
+/**
+ * clk_hw_register_fixed_rate_parent_accuracy - register fixed-rate clock with
+ * the clock framework
+ * @dev: device that is registering this clock
+ * @name: name of this clock
+ * @parent_name: name of clock's parent
+ * @flags: framework-specific flags
+ * @fixed_rate: non-adjustable clock rate
+ */
+#define clk_hw_register_fixed_rate_parent_accuracy(dev, name, parent_data,    \
+						   flags, fixed_rate)	      \
+	__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL,      \
+				     (parent_data), (flags), (fixed_rate), 0,    \
+				     CLK_FIXED_RATE_PARENT_ACCURACY)
 
 void clk_unregister_fixed_rate(struct clk *clk);
 void clk_hw_unregister_fixed_rate(struct clk_hw *hw);
@@ -858,6 +872,13 @@ struct clk *clk_register_mux_table(struct device *dev, const char *name,
 			      (parent_names), NULL, NULL, (flags), (reg),     \
 			      (shift), (mask), (clk_mux_flags), (table),      \
 			      (lock))
+#define clk_hw_register_mux_table_parent_data(dev, name, parent_data,	      \
+				  num_parents, flags, reg, shift, mask,	      \
+				  clk_mux_flags, table, lock)		      \
+	__clk_hw_register_mux((dev), NULL, (name), (num_parents),	      \
+			      NULL, NULL, (parent_data), (flags), (reg),      \
+			      (shift), (mask), (clk_mux_flags), (table),      \
+			      (lock))
 #define clk_hw_register_mux(dev, name, parent_names, num_parents, flags, reg, \
 			    shift, width, clk_mux_flags, lock)		      \
 	__clk_hw_register_mux((dev), NULL, (name), (num_parents),	      \

From d459cb4244830ab450c3591708ccb628f3979484 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sat, 30 Sep 2023 15:14:26 -0700
Subject: [PATCH 0353/1043] clk: linux/clk-provider.h: fix kernel-doc warnings
 and typos

[ Upstream commit 84aefafe6b294041b7fa0757414c4a29c1bdeea2 ]

Fix spelling of "Structure".

Fix multiple kernel-doc warnings:

clk-provider.h:269: warning: Function parameter or member 'recalc_rate' not described in 'clk_ops'
clk-provider.h:468: warning: Function parameter or member 'parent_data' not described in 'clk_hw_register_fixed_rate_with_accuracy_parent_data'
clk-provider.h:468: warning: Excess function parameter 'parent_name' description in 'clk_hw_register_fixed_rate_with_accuracy_parent_data'
clk-provider.h:482: warning: Function parameter or member 'parent_data' not described in 'clk_hw_register_fixed_rate_parent_accuracy'
clk-provider.h:482: warning: Excess function parameter 'parent_name' description in 'clk_hw_register_fixed_rate_parent_accuracy'
clk-provider.h:687: warning: Function parameter or member 'flags' not described in 'clk_divider'
clk-provider.h:1164: warning: Function parameter or member 'flags' not described in 'clk_fractional_divider'
clk-provider.h:1164: warning: Function parameter or member 'approximation' not described in 'clk_fractional_divider'
clk-provider.h:1213: warning: Function parameter or member 'flags' not described in 'clk_multiplier'

Fixes: 9fba738a53dd ("clk: add duty cycle support")
Fixes: b2476490ef11 ("clk: introduce the common clock framework")
Fixes: 2d34f09e79c9 ("clk: fixed-rate: Add support for specifying parents via DT/pointers")
Fixes: f5290d8e4f0c ("clk: asm9260: use parent index to link the reference clock")
Fixes: 9d9f78ed9af0 ("clk: basic clock hardware types")
Fixes: e2d0e90fae82 ("clk: new basic clk type for fractional divider")
Fixes: f2e0a53271a4 ("clk: Add a basic multiplier clock")

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Michael Turquette <mturquette@baylibre.com>
Cc: Stephen Boyd <sboyd@kernel.org>
Cc: linux-clk@vger.kernel.org
Link: https://lore.kernel.org/r/20230930221428.18463-1-rdunlap@infradead.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/clk-provider.h | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index d199f79c7091..aa8cbf882914 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -61,7 +61,7 @@ struct clk_rate_request {
 };
 
 /**
- * struct clk_duty - Struture encoding the duty cycle ratio of a clock
+ * struct clk_duty - Structure encoding the duty cycle ratio of a clock
  *
  * @num:	Numerator of the duty cycle ratio
  * @den:	Denominator of the duty cycle ratio
@@ -116,7 +116,7 @@ struct clk_duty {
  * @restore_context: Restore the context of the clock after a restoration
  *		of power.
  *
- * @recalc_rate	Recalculate the rate of this clock, by querying hardware. The
+ * @recalc_rate: Recalculate the rate of this clock, by querying hardware. The
  *		parent rate is an input parameter.  It is up to the caller to
  *		ensure that the prepare_mutex is held across this call.
  *		Returns the calculated rate.  Optional, but recommended - if
@@ -429,7 +429,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
  * clock with the clock framework
  * @dev: device that is registering this clock
  * @name: name of this clock
- * @parent_name: name of clock's parent
+ * @parent_data: name of clock's parent
  * @flags: framework-specific flags
  * @fixed_rate: non-adjustable clock rate
  * @fixed_accuracy: non-adjustable clock accuracy
@@ -444,7 +444,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
  * the clock framework
  * @dev: device that is registering this clock
  * @name: name of this clock
- * @parent_name: name of clock's parent
+ * @parent_data: name of clock's parent
  * @flags: framework-specific flags
  * @fixed_rate: non-adjustable clock rate
  */
@@ -580,7 +580,7 @@ struct clk_div_table {
  * Clock with an adjustable divider affecting its output frequency.  Implements
  * .recalc_rate, .set_rate and .round_rate
  *
- * Flags:
+ * @flags:
  * CLK_DIVIDER_ONE_BASED - by default the divisor is the value read from the
  *	register plus one.  If CLK_DIVIDER_ONE_BASED is set then the divider is
  *	the raw value read from the register, with the value of zero considered
@@ -945,11 +945,12 @@ void clk_hw_unregister_fixed_factor(struct clk_hw *hw);
  * @mwidth:	width of the numerator bit field
  * @nshift:	shift to the denominator bit field
  * @nwidth:	width of the denominator bit field
+ * @approximation: clk driver's callback for calculating the divider clock
  * @lock:	register lock
  *
  * Clock with adjustable fractional divider affecting its output frequency.
  *
- * Flags:
+ * @flags:
  * CLK_FRAC_DIVIDER_ZERO_BASED - by default the numerator and denominator
  *	is the value read from the register. If CLK_FRAC_DIVIDER_ZERO_BASED
  *	is set then the numerator and denominator are both the value read
@@ -1002,7 +1003,7 @@ void clk_hw_unregister_fractional_divider(struct clk_hw *hw);
  * Clock with an adjustable multiplier affecting its output frequency.
  * Implements .recalc_rate, .set_rate and .round_rate
  *
- * Flags:
+ * @flags:
  * CLK_MULTIPLIER_ZERO_BYPASS - By default, the multiplier is the value read
  *	from the register, with 0 being a valid value effectively
  *	zeroing the output clock rate. If CLK_MULTIPLIER_ZERO_BYPASS is

From c07a0e2e93b6404f768fb2b4df822b1540655bf5 Mon Sep 17 00:00:00 2001
From: Han Xu <han.xu@nxp.com>
Date: Tue, 10 Oct 2023 15:15:24 -0500
Subject: [PATCH 0354/1043] spi: nxp-fspi: use the correct ioremap function

[ Upstream commit c3aa5cb264a38ae9bbcce32abca4c155af0456df ]

AHB memory as MMIO should be mapped with ioremap rather than ioremap_wc,
which should have been used initially just to handle unaligned access as
a workaround.

Fixes: d166a73503ef ("spi: fspi: dynamically alloc AHB memory")
Signed-off-by: Han Xu <han.xu@nxp.com>
Link: https://lore.kernel.org/r/20231010201524.2021340-1-han.xu@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-nxp-fspi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c
index 90b5fbc914ae..f40b93960b89 100644
--- a/drivers/spi/spi-nxp-fspi.c
+++ b/drivers/spi/spi-nxp-fspi.c
@@ -685,7 +685,7 @@ static int nxp_fspi_read_ahb(struct nxp_fspi *f, const struct spi_mem_op *op)
 		f->memmap_len = len > NXP_FSPI_MIN_IOMAP ?
 				len : NXP_FSPI_MIN_IOMAP;
 
-		f->ahb_addr = ioremap_wc(f->memmap_phy + f->memmap_start,
+		f->ahb_addr = ioremap(f->memmap_phy + f->memmap_start,
 					 f->memmap_len);
 
 		if (!f->ahb_addr) {

From de33b367f80d1fd8810640f5fc8d9ba9999fdc84 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Thu, 5 Oct 2023 17:01:57 +0300
Subject: [PATCH 0355/1043] clk: keystone: pll: fix a couple NULL vs IS_ERR()
 checks

[ Upstream commit a5d14f8b551eb1551c10053653ee8e27f19672fa ]

The clk_register_divider() and clk_register_mux() functions returns
error pointers on error but this code checks for NULL.  Fix that.

Fixes: b9e0d40c0d83 ("clk: keystone: add Keystone PLL clock driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/d9da4c97-0da9-499f-9a21-1f8e3f148dc1@moroto.mountain
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/keystone/pll.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/clk/keystone/pll.c b/drivers/clk/keystone/pll.c
index ee5c72369334..6bbdd4705d71 100644
--- a/drivers/clk/keystone/pll.c
+++ b/drivers/clk/keystone/pll.c
@@ -281,12 +281,13 @@ static void __init of_pll_div_clk_init(struct device_node *node)
 
 	clk = clk_register_divider(NULL, clk_name, parent_name, 0, reg, shift,
 				 mask, 0, NULL);
-	if (clk) {
-		of_clk_add_provider(node, of_clk_src_simple_get, clk);
-	} else {
+	if (IS_ERR(clk)) {
 		pr_err("%s: error registering divider %s\n", __func__, clk_name);
 		iounmap(reg);
+		return;
 	}
+
+	of_clk_add_provider(node, of_clk_src_simple_get, clk);
 }
 CLK_OF_DECLARE(pll_divider_clock, "ti,keystone,pll-divider-clock", of_pll_div_clk_init);
 
@@ -328,10 +329,12 @@ static void __init of_pll_mux_clk_init(struct device_node *node)
 	clk = clk_register_mux(NULL, clk_name, (const char **)&parents,
 				ARRAY_SIZE(parents) , 0, reg, shift, mask,
 				0, NULL);
-	if (clk)
-		of_clk_add_provider(node, of_clk_src_simple_get, clk);
-	else
+	if (IS_ERR(clk)) {
 		pr_err("%s: error registering mux %s\n", __func__, clk_name);
+		return;
+	}
+
+	of_clk_add_provider(node, of_clk_src_simple_get, clk);
 }
 CLK_OF_DECLARE(pll_mux_clock, "ti,keystone,pll-mux-clock", of_pll_mux_clk_init);
 

From 00c67e0aa7e4677834ef84e8f6517e9fa053497d Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Fri, 4 Feb 2022 09:14:47 +0200
Subject: [PATCH 0356/1043] clk: ti: Add ti_dt_clk_name() helper to use
 clock-output-names

[ Upstream commit 2c1593328d7f02fe49de5ad6b42c36296c9d6922 ]

Let's create the clock alias based on the clock-output-names property if
available. Also the component clock drivers can use ti_dt_clk_name() in
the following patches.

Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20220204071449.16762-7-tony@atomide.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: 7af5b9eadd64 ("clk: ti: fix double free in of_ti_divider_clk_setup()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/clk.c   | 20 +++++++++++++++++++-
 drivers/clk/ti/clock.h |  1 +
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c
index 29eafab4353e..b941ce0f3c39 100644
--- a/drivers/clk/ti/clk.c
+++ b/drivers/clk/ti/clk.c
@@ -402,6 +402,24 @@ static const struct of_device_id simple_clk_match_table[] __initconst = {
 	{ }
 };
 
+/**
+ * ti_dt_clk_name - init clock name from first output name or node name
+ * @np: device node
+ *
+ * Use the first clock-output-name for the clock name if found. Fall back
+ * to legacy naming based on node name.
+ */
+const char *ti_dt_clk_name(struct device_node *np)
+{
+	const char *name;
+
+	if (!of_property_read_string_index(np, "clock-output-names", 0,
+					   &name))
+		return name;
+
+	return np->name;
+}
+
 /**
  * ti_clk_add_aliases - setup clock aliases
  *
@@ -418,7 +436,7 @@ void __init ti_clk_add_aliases(void)
 		clkspec.np = np;
 		clk = of_clk_get_from_provider(&clkspec);
 
-		ti_clk_add_alias(NULL, clk, np->name);
+		ti_clk_add_alias(NULL, clk, ti_dt_clk_name(np));
 	}
 }
 
diff --git a/drivers/clk/ti/clock.h b/drivers/clk/ti/clock.h
index f1dd62de2bfc..938f34e290ed 100644
--- a/drivers/clk/ti/clock.h
+++ b/drivers/clk/ti/clock.h
@@ -214,6 +214,7 @@ struct clk *ti_clk_register(struct device *dev, struct clk_hw *hw,
 			    const char *con);
 struct clk *ti_clk_register_omap_hw(struct device *dev, struct clk_hw *hw,
 				    const char *con);
+const char *ti_dt_clk_name(struct device_node *np);
 int ti_clk_add_alias(struct device *dev, struct clk *clk, const char *con);
 void ti_clk_add_aliases(void);
 

From 1c4253252c7f77e7688428e00f48f08f83669b21 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Fri, 4 Feb 2022 09:14:48 +0200
Subject: [PATCH 0357/1043] clk: ti: Update pll and clockdomain clocks to use
 ti_dt_clk_name()

[ Upstream commit 9e56a7d4263ca1c51d867e811cf2dd7e61b6469e ]

Let's update the TI pll and clockdomain clocks to use ti_dt_clk_name()
instead of devicetree node name if available.

Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20220204071449.16762-8-tony@atomide.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: 7af5b9eadd64 ("clk: ti: fix double free in of_ti_divider_clk_setup()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/apll.c        | 13 +++++++++----
 drivers/clk/ti/clockdomain.c |  2 +-
 drivers/clk/ti/dpll.c        |  8 +++++---
 drivers/clk/ti/fapll.c       | 11 +++++++----
 4 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/drivers/clk/ti/apll.c b/drivers/clk/ti/apll.c
index ac5bc8857a51..e4db6b9a55c6 100644
--- a/drivers/clk/ti/apll.c
+++ b/drivers/clk/ti/apll.c
@@ -139,6 +139,7 @@ static void __init omap_clk_register_apll(void *user,
 	struct clk_hw *hw = user;
 	struct clk_hw_omap *clk_hw = to_clk_hw_omap(hw);
 	struct dpll_data *ad = clk_hw->dpll_data;
+	const char *name;
 	struct clk *clk;
 	const struct clk_init_data *init = clk_hw->hw.init;
 
@@ -166,7 +167,8 @@ static void __init omap_clk_register_apll(void *user,
 
 	ad->clk_bypass = __clk_get_hw(clk);
 
-	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, node->name);
+	name = ti_dt_clk_name(node);
+	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
 	if (!IS_ERR(clk)) {
 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
 		kfree(init->parent_names);
@@ -198,7 +200,7 @@ static void __init of_dra7_apll_setup(struct device_node *node)
 	clk_hw->dpll_data = ad;
 	clk_hw->hw.init = init;
 
-	init->name = node->name;
+	init->name = ti_dt_clk_name(node);
 	init->ops = &apll_ck_ops;
 
 	init->num_parents = of_clk_get_parent_count(node);
@@ -347,6 +349,7 @@ static void __init of_omap2_apll_setup(struct device_node *node)
 	struct dpll_data *ad = NULL;
 	struct clk_hw_omap *clk_hw = NULL;
 	struct clk_init_data *init = NULL;
+	const char *name;
 	struct clk *clk;
 	const char *parent_name;
 	u32 val;
@@ -362,7 +365,8 @@ static void __init of_omap2_apll_setup(struct device_node *node)
 	clk_hw->dpll_data = ad;
 	clk_hw->hw.init = init;
 	init->ops = &omap2_apll_ops;
-	init->name = node->name;
+	name = ti_dt_clk_name(node);
+	init->name = name;
 	clk_hw->ops = &omap2_apll_hwops;
 
 	init->num_parents = of_clk_get_parent_count(node);
@@ -403,7 +407,8 @@ static void __init of_omap2_apll_setup(struct device_node *node)
 	if (ret)
 		goto cleanup;
 
-	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, node->name);
+	name = ti_dt_clk_name(node);
+	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
 	if (!IS_ERR(clk)) {
 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
 		kfree(init);
diff --git a/drivers/clk/ti/clockdomain.c b/drivers/clk/ti/clockdomain.c
index 700b7f44f671..e5f447f4377b 100644
--- a/drivers/clk/ti/clockdomain.c
+++ b/drivers/clk/ti/clockdomain.c
@@ -131,7 +131,7 @@ static void __init of_ti_clockdomain_setup(struct device_node *node)
 {
 	struct clk *clk;
 	struct clk_hw *clk_hw;
-	const char *clkdm_name = node->name;
+	const char *clkdm_name = ti_dt_clk_name(node);
 	int i;
 	unsigned int num_clks;
 
diff --git a/drivers/clk/ti/dpll.c b/drivers/clk/ti/dpll.c
index 247510e306e2..6013c1d30c26 100644
--- a/drivers/clk/ti/dpll.c
+++ b/drivers/clk/ti/dpll.c
@@ -164,6 +164,7 @@ static void __init _register_dpll(void *user,
 	struct clk_hw *hw = user;
 	struct clk_hw_omap *clk_hw = to_clk_hw_omap(hw);
 	struct dpll_data *dd = clk_hw->dpll_data;
+	const char *name;
 	struct clk *clk;
 	const struct clk_init_data *init = hw->init;
 
@@ -193,7 +194,8 @@ static void __init _register_dpll(void *user,
 	dd->clk_bypass = __clk_get_hw(clk);
 
 	/* register the clock */
-	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, node->name);
+	name = ti_dt_clk_name(node);
+	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
 
 	if (!IS_ERR(clk)) {
 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
@@ -227,7 +229,7 @@ static void _register_dpll_x2(struct device_node *node,
 	struct clk *clk;
 	struct clk_init_data init = { NULL };
 	struct clk_hw_omap *clk_hw;
-	const char *name = node->name;
+	const char *name = ti_dt_clk_name(node);
 	const char *parent_name;
 
 	parent_name = of_clk_get_parent_name(node, 0);
@@ -302,7 +304,7 @@ static void __init of_ti_dpll_setup(struct device_node *node,
 	clk_hw->ops = &clkhwops_omap3_dpll;
 	clk_hw->hw.init = init;
 
-	init->name = node->name;
+	init->name = ti_dt_clk_name(node);
 	init->ops = ops;
 
 	init->num_parents = of_clk_get_parent_count(node);
diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index 8024c6d2b9e9..749c6b73abff 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -19,6 +19,8 @@
 #include <linux/of_address.h>
 #include <linux/clk/ti.h>
 
+#include "clock.h"
+
 /* FAPLL Control Register PLL_CTRL */
 #define FAPLL_MAIN_MULT_N_SHIFT	16
 #define FAPLL_MAIN_DIV_P_SHIFT	8
@@ -542,6 +544,7 @@ static void __init ti_fapll_setup(struct device_node *node)
 	struct clk_init_data *init = NULL;
 	const char *parent_name[2];
 	struct clk *pll_clk;
+	const char *name;
 	int i;
 
 	fd = kzalloc(sizeof(*fd), GFP_KERNEL);
@@ -559,7 +562,8 @@ static void __init ti_fapll_setup(struct device_node *node)
 		goto free;
 
 	init->ops = &ti_fapll_ops;
-	init->name = node->name;
+	name = ti_dt_clk_name(node);
+	init->name = name;
 
 	init->num_parents = of_clk_get_parent_count(node);
 	if (init->num_parents != 2) {
@@ -591,7 +595,7 @@ static void __init ti_fapll_setup(struct device_node *node)
 	if (fapll_is_ddr_pll(fd->base))
 		fd->bypass_bit_inverted = true;
 
-	fd->name = node->name;
+	fd->name = name;
 	fd->hw.init = init;
 
 	/* Register the parent PLL */
@@ -638,8 +642,7 @@ static void __init ti_fapll_setup(struct device_node *node)
 				freq = NULL;
 		}
 		synth_clk = ti_fapll_synth_setup(fd, freq, div, output_instance,
-						 output_name, node->name,
-						 pll_clk);
+						 output_name, name, pll_clk);
 		if (IS_ERR(synth_clk))
 			continue;
 

From 98c5012c11a1d26e7fcab0a77032d54ab3d65d92 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Fri, 4 Feb 2022 09:14:49 +0200
Subject: [PATCH 0358/1043] clk: ti: Update component clocks to use
 ti_dt_clk_name()

[ Upstream commit ed06099c5d0b329082cc19c58eace0b20bf7fe70 ]

Let's update all the TI component clocks to use ti_dt_clk_name() instead
of devicetree node name if available.

Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20220204071449.16762-9-tony@atomide.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: 7af5b9eadd64 ("clk: ti: fix double free in of_ti_divider_clk_setup()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/autoidle.c     | 2 +-
 drivers/clk/ti/clk-dra7-atl.c | 6 ++++--
 drivers/clk/ti/composite.c    | 6 ++++--
 drivers/clk/ti/divider.c      | 6 ++++--
 drivers/clk/ti/fixed-factor.c | 2 +-
 drivers/clk/ti/gate.c         | 4 +++-
 drivers/clk/ti/interface.c    | 4 +++-
 drivers/clk/ti/mux.c          | 4 +++-
 8 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/drivers/clk/ti/autoidle.c b/drivers/clk/ti/autoidle.c
index f6f8a409f148..d6e5f1511ace 100644
--- a/drivers/clk/ti/autoidle.c
+++ b/drivers/clk/ti/autoidle.c
@@ -205,7 +205,7 @@ int __init of_ti_clk_autoidle_setup(struct device_node *node)
 		return -ENOMEM;
 
 	clk->shift = shift;
-	clk->name = node->name;
+	clk->name = ti_dt_clk_name(node);
 	ret = ti_clk_get_reg_addr(node, 0, &clk->reg);
 	if (ret) {
 		kfree(clk);
diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
index e2e59d78c173..5c278d6c985e 100644
--- a/drivers/clk/ti/clk-dra7-atl.c
+++ b/drivers/clk/ti/clk-dra7-atl.c
@@ -173,6 +173,7 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
 	struct dra7_atl_desc *clk_hw = NULL;
 	struct clk_init_data init = { NULL };
 	const char **parent_names = NULL;
+	const char *name;
 	struct clk *clk;
 
 	clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL);
@@ -183,7 +184,8 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
 
 	clk_hw->hw.init = &init;
 	clk_hw->divider = 1;
-	init.name = node->name;
+	name = ti_dt_clk_name(node);
+	init.name = name;
 	init.ops = &atl_clk_ops;
 	init.flags = CLK_IGNORE_UNUSED;
 	init.num_parents = of_clk_get_parent_count(node);
@@ -203,7 +205,7 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
 
 	init.parent_names = parent_names;
 
-	clk = ti_clk_register(NULL, &clk_hw->hw, node->name);
+	clk = ti_clk_register(NULL, &clk_hw->hw, name);
 
 	if (!IS_ERR(clk)) {
 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
diff --git a/drivers/clk/ti/composite.c b/drivers/clk/ti/composite.c
index eaa43575cfa5..8d60319be368 100644
--- a/drivers/clk/ti/composite.c
+++ b/drivers/clk/ti/composite.c
@@ -125,6 +125,7 @@ static void __init _register_composite(void *user,
 	struct component_clk *comp;
 	int num_parents = 0;
 	const char **parent_names = NULL;
+	const char *name;
 	int i;
 	int ret;
 
@@ -172,7 +173,8 @@ static void __init _register_composite(void *user,
 		goto cleanup;
 	}
 
-	clk = clk_register_composite(NULL, node->name,
+	name = ti_dt_clk_name(node);
+	clk = clk_register_composite(NULL, name,
 				     parent_names, num_parents,
 				     _get_hw(cclk, CLK_COMPONENT_TYPE_MUX),
 				     &ti_clk_mux_ops,
@@ -182,7 +184,7 @@ static void __init _register_composite(void *user,
 				     &ti_composite_gate_ops, 0);
 
 	if (!IS_ERR(clk)) {
-		ret = ti_clk_add_alias(NULL, clk, node->name);
+		ret = ti_clk_add_alias(NULL, clk, name);
 		if (ret) {
 			clk_unregister(clk);
 			goto cleanup;
diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index 28080df92f72..9fbea0997b43 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -320,10 +320,12 @@ static struct clk *_register_divider(struct device_node *node,
 	struct clk *clk;
 	struct clk_init_data init;
 	const char *parent_name;
+	const char *name;
 
 	parent_name = of_clk_get_parent_name(node, 0);
 
-	init.name = node->name;
+	name = ti_dt_clk_name(node);
+	init.name = name;
 	init.ops = &ti_clk_divider_ops;
 	init.flags = flags;
 	init.parent_names = (parent_name ? &parent_name : NULL);
@@ -332,7 +334,7 @@ static struct clk *_register_divider(struct device_node *node,
 	div->hw.init = &init;
 
 	/* register the clock */
-	clk = ti_clk_register(NULL, &div->hw, node->name);
+	clk = ti_clk_register(NULL, &div->hw, name);
 
 	if (IS_ERR(clk))
 		kfree(div);
diff --git a/drivers/clk/ti/fixed-factor.c b/drivers/clk/ti/fixed-factor.c
index 7cbe896db071..8cb00d0af966 100644
--- a/drivers/clk/ti/fixed-factor.c
+++ b/drivers/clk/ti/fixed-factor.c
@@ -36,7 +36,7 @@
 static void __init of_ti_fixed_factor_clk_setup(struct device_node *node)
 {
 	struct clk *clk;
-	const char *clk_name = node->name;
+	const char *clk_name = ti_dt_clk_name(node);
 	const char *parent_name;
 	u32 div, mult;
 	u32 flags = 0;
diff --git a/drivers/clk/ti/gate.c b/drivers/clk/ti/gate.c
index 42389558418c..2fee7d681a67 100644
--- a/drivers/clk/ti/gate.c
+++ b/drivers/clk/ti/gate.c
@@ -138,6 +138,7 @@ static void __init _of_ti_gate_clk_setup(struct device_node *node,
 	struct clk *clk;
 	const char *parent_name;
 	struct clk_omap_reg reg;
+	const char *name;
 	u8 enable_bit = 0;
 	u32 val;
 	u32 flags = 0;
@@ -164,7 +165,8 @@ static void __init _of_ti_gate_clk_setup(struct device_node *node,
 	if (of_property_read_bool(node, "ti,set-bit-to-disable"))
 		clk_gate_flags |= INVERT_ENABLE;
 
-	clk = _register_gate(NULL, node->name, parent_name, flags, &reg,
+	name = ti_dt_clk_name(node);
+	clk = _register_gate(NULL, name, parent_name, flags, &reg,
 			     enable_bit, clk_gate_flags, ops, hw_ops);
 
 	if (!IS_ERR(clk))
diff --git a/drivers/clk/ti/interface.c b/drivers/clk/ti/interface.c
index 83e34429d3b1..dd2b455183a9 100644
--- a/drivers/clk/ti/interface.c
+++ b/drivers/clk/ti/interface.c
@@ -72,6 +72,7 @@ static void __init _of_ti_interface_clk_setup(struct device_node *node,
 	const char *parent_name;
 	struct clk_omap_reg reg;
 	u8 enable_bit = 0;
+	const char *name;
 	u32 val;
 
 	if (ti_clk_get_reg_addr(node, 0, &reg))
@@ -86,7 +87,8 @@ static void __init _of_ti_interface_clk_setup(struct device_node *node,
 		return;
 	}
 
-	clk = _register_interface(NULL, node->name, parent_name, &reg,
+	name = ti_dt_clk_name(node);
+	clk = _register_interface(NULL, name, parent_name, &reg,
 				  enable_bit, ops);
 
 	if (!IS_ERR(clk))
diff --git a/drivers/clk/ti/mux.c b/drivers/clk/ti/mux.c
index 0069e7cf3ebc..15de513d2d81 100644
--- a/drivers/clk/ti/mux.c
+++ b/drivers/clk/ti/mux.c
@@ -176,6 +176,7 @@ static void of_mux_clk_setup(struct device_node *node)
 	struct clk_omap_reg reg;
 	unsigned int num_parents;
 	const char **parent_names;
+	const char *name;
 	u8 clk_mux_flags = 0;
 	u32 mask = 0;
 	u32 shift = 0;
@@ -213,7 +214,8 @@ static void of_mux_clk_setup(struct device_node *node)
 
 	mask = (1 << fls(mask)) - 1;
 
-	clk = _register_mux(NULL, node->name, parent_names, num_parents,
+	name = ti_dt_clk_name(node);
+	clk = _register_mux(NULL, name, parent_names, num_parents,
 			    flags, &reg, shift, mask, latch, clk_mux_flags,
 			    NULL);
 

From acb535d750773359ced9d12ee8317fde01ed91c9 Mon Sep 17 00:00:00 2001
From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Date: Sun, 13 Nov 2022 19:11:46 +0100
Subject: [PATCH 0359/1043] clk: ti: change ti_clk_register[_omap_hw]() API

[ Upstream commit 3400d546a741a2b2001d88e7fa29110d45a3930d ]

The ti_clk_register() and ti_clk_register_omap_hw() functions are always
called with the parameter of type "struct device" set to NULL, since the
functions from which they are called always have a parameter of type
"struct device_node". Replacing "struct device" type parameter with
"struct device_node" will allow you to register a TI clock to the common
clock framework by taking advantage of the facilities provided by the
"struct device_node" type. Further, adding the "of_" prefix to the name
of these functions explicitly binds them to the "struct device_node"
type.

The patch has been tested on a Beaglebone board.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Tested-by: Tony Lindgren <tony@atomide.com>
Reviewed-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20221113181147.1626585-1-dario.binacchi@amarulasolutions.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: 7af5b9eadd64 ("clk: ti: fix double free in of_ti_divider_clk_setup()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/apll.c         |  4 ++--
 drivers/clk/ti/clk-dra7-atl.c |  2 +-
 drivers/clk/ti/clk.c          | 34 ++++++++++++++++------------------
 drivers/clk/ti/clkctrl.c      |  4 ++--
 drivers/clk/ti/clock.h        | 10 +++++-----
 drivers/clk/ti/composite.c    |  2 +-
 drivers/clk/ti/divider.c      |  2 +-
 drivers/clk/ti/dpll.c         |  4 ++--
 drivers/clk/ti/fixed-factor.c |  2 +-
 drivers/clk/ti/gate.c         |  6 +++---
 drivers/clk/ti/interface.c    |  7 ++++---
 drivers/clk/ti/mux.c          |  6 +++---
 12 files changed, 41 insertions(+), 42 deletions(-)

diff --git a/drivers/clk/ti/apll.c b/drivers/clk/ti/apll.c
index e4db6b9a55c6..f921c6812852 100644
--- a/drivers/clk/ti/apll.c
+++ b/drivers/clk/ti/apll.c
@@ -168,7 +168,7 @@ static void __init omap_clk_register_apll(void *user,
 	ad->clk_bypass = __clk_get_hw(clk);
 
 	name = ti_dt_clk_name(node);
-	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
+	clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
 	if (!IS_ERR(clk)) {
 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
 		kfree(init->parent_names);
@@ -408,7 +408,7 @@ static void __init of_omap2_apll_setup(struct device_node *node)
 		goto cleanup;
 
 	name = ti_dt_clk_name(node);
-	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
+	clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
 	if (!IS_ERR(clk)) {
 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
 		kfree(init);
diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
index 5c278d6c985e..62508e74a47a 100644
--- a/drivers/clk/ti/clk-dra7-atl.c
+++ b/drivers/clk/ti/clk-dra7-atl.c
@@ -205,7 +205,7 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
 
 	init.parent_names = parent_names;
 
-	clk = ti_clk_register(NULL, &clk_hw->hw, name);
+	clk = of_ti_clk_register(node, &clk_hw->hw, name);
 
 	if (!IS_ERR(clk)) {
 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c
index b941ce0f3c39..6a39fb051b2e 100644
--- a/drivers/clk/ti/clk.c
+++ b/drivers/clk/ti/clk.c
@@ -436,7 +436,7 @@ void __init ti_clk_add_aliases(void)
 		clkspec.np = np;
 		clk = of_clk_get_from_provider(&clkspec);
 
-		ti_clk_add_alias(NULL, clk, ti_dt_clk_name(np));
+		ti_clk_add_alias(clk, ti_dt_clk_name(np));
 	}
 }
 
@@ -489,7 +489,6 @@ void omap2_clk_enable_init_clocks(const char **clk_names, u8 num_clocks)
 
 /**
  * ti_clk_add_alias - add a clock alias for a TI clock
- * @dev: device alias for this clock
  * @clk: clock handle to create alias for
  * @con: connection ID for this clock
  *
@@ -497,7 +496,7 @@ void omap2_clk_enable_init_clocks(const char **clk_names, u8 num_clocks)
  * and assigns the data to it. Returns 0 if successful, negative error
  * value otherwise.
  */
-int ti_clk_add_alias(struct device *dev, struct clk *clk, const char *con)
+int ti_clk_add_alias(struct clk *clk, const char *con)
 {
 	struct clk_lookup *cl;
 
@@ -511,8 +510,6 @@ int ti_clk_add_alias(struct device *dev, struct clk *clk, const char *con)
 	if (!cl)
 		return -ENOMEM;
 
-	if (dev)
-		cl->dev_id = dev_name(dev);
 	cl->con_id = con;
 	cl->clk = clk;
 
@@ -522,8 +519,8 @@ int ti_clk_add_alias(struct device *dev, struct clk *clk, const char *con)
 }
 
 /**
- * ti_clk_register - register a TI clock to the common clock framework
- * @dev: device for this clock
+ * of_ti_clk_register - register a TI clock to the common clock framework
+ * @node: device node for this clock
  * @hw: hardware clock handle
  * @con: connection ID for this clock
  *
@@ -531,17 +528,18 @@ int ti_clk_add_alias(struct device *dev, struct clk *clk, const char *con)
  * alias for it. Returns a handle to the registered clock if successful,
  * ERR_PTR value in failure.
  */
-struct clk *ti_clk_register(struct device *dev, struct clk_hw *hw,
-			    const char *con)
+struct clk *of_ti_clk_register(struct device_node *node, struct clk_hw *hw,
+			       const char *con)
 {
 	struct clk *clk;
 	int ret;
 
-	clk = clk_register(dev, hw);
-	if (IS_ERR(clk))
-		return clk;
+	ret = of_clk_hw_register(node, hw);
+	if (ret)
+		return ERR_PTR(ret);
 
-	ret = ti_clk_add_alias(dev, clk, con);
+	clk = hw->clk;
+	ret = ti_clk_add_alias(clk, con);
 	if (ret) {
 		clk_unregister(clk);
 		return ERR_PTR(ret);
@@ -551,8 +549,8 @@ struct clk *ti_clk_register(struct device *dev, struct clk_hw *hw,
 }
 
 /**
- * ti_clk_register_omap_hw - register a clk_hw_omap to the clock framework
- * @dev: device for this clock
+ * of_ti_clk_register_omap_hw - register a clk_hw_omap to the clock framework
+ * @node: device node for this clock
  * @hw: hardware clock handle
  * @con: connection ID for this clock
  *
@@ -561,13 +559,13 @@ struct clk *ti_clk_register(struct device *dev, struct clk_hw *hw,
  * Returns a handle to the registered clock if successful, ERR_PTR value
  * in failure.
  */
-struct clk *ti_clk_register_omap_hw(struct device *dev, struct clk_hw *hw,
-				    const char *con)
+struct clk *of_ti_clk_register_omap_hw(struct device_node *node,
+				       struct clk_hw *hw, const char *con)
 {
 	struct clk *clk;
 	struct clk_hw_omap *oclk;
 
-	clk = ti_clk_register(dev, hw, con);
+	clk = of_ti_clk_register(node, hw, con);
 	if (IS_ERR(clk))
 		return clk;
 
diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
index 157abc46dcf4..1424b615a4cc 100644
--- a/drivers/clk/ti/clkctrl.c
+++ b/drivers/clk/ti/clkctrl.c
@@ -317,7 +317,7 @@ _ti_clkctrl_clk_register(struct omap_clkctrl_provider *provider,
 	init.ops = ops;
 	init.flags = 0;
 
-	clk = ti_clk_register(NULL, clk_hw, init.name);
+	clk = of_ti_clk_register(node, clk_hw, init.name);
 	if (IS_ERR_OR_NULL(clk)) {
 		ret = -EINVAL;
 		goto cleanup;
@@ -701,7 +701,7 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node)
 		init.ops = &omap4_clkctrl_clk_ops;
 		hw->hw.init = &init;
 
-		clk = ti_clk_register_omap_hw(NULL, &hw->hw, init.name);
+		clk = of_ti_clk_register_omap_hw(node, &hw->hw, init.name);
 		if (IS_ERR_OR_NULL(clk))
 			goto cleanup;
 
diff --git a/drivers/clk/ti/clock.h b/drivers/clk/ti/clock.h
index 938f34e290ed..821f33ee330e 100644
--- a/drivers/clk/ti/clock.h
+++ b/drivers/clk/ti/clock.h
@@ -210,12 +210,12 @@ extern const struct omap_clkctrl_data dm816_clkctrl_data[];
 
 typedef void (*ti_of_clk_init_cb_t)(void *, struct device_node *);
 
-struct clk *ti_clk_register(struct device *dev, struct clk_hw *hw,
-			    const char *con);
-struct clk *ti_clk_register_omap_hw(struct device *dev, struct clk_hw *hw,
-				    const char *con);
+struct clk *of_ti_clk_register(struct device_node *node, struct clk_hw *hw,
+			       const char *con);
+struct clk *of_ti_clk_register_omap_hw(struct device_node *node,
+				       struct clk_hw *hw, const char *con);
 const char *ti_dt_clk_name(struct device_node *np);
-int ti_clk_add_alias(struct device *dev, struct clk *clk, const char *con);
+int ti_clk_add_alias(struct clk *clk, const char *con);
 void ti_clk_add_aliases(void);
 
 void ti_clk_latch(struct clk_omap_reg *reg, s8 shift);
diff --git a/drivers/clk/ti/composite.c b/drivers/clk/ti/composite.c
index 8d60319be368..78d44158fb7d 100644
--- a/drivers/clk/ti/composite.c
+++ b/drivers/clk/ti/composite.c
@@ -184,7 +184,7 @@ static void __init _register_composite(void *user,
 				     &ti_composite_gate_ops, 0);
 
 	if (!IS_ERR(clk)) {
-		ret = ti_clk_add_alias(NULL, clk, name);
+		ret = ti_clk_add_alias(clk, name);
 		if (ret) {
 			clk_unregister(clk);
 			goto cleanup;
diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index 9fbea0997b43..83931cc29971 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -334,7 +334,7 @@ static struct clk *_register_divider(struct device_node *node,
 	div->hw.init = &init;
 
 	/* register the clock */
-	clk = ti_clk_register(NULL, &div->hw, name);
+	clk = of_ti_clk_register(node, &div->hw, name);
 
 	if (IS_ERR(clk))
 		kfree(div);
diff --git a/drivers/clk/ti/dpll.c b/drivers/clk/ti/dpll.c
index 6013c1d30c26..13d01594516d 100644
--- a/drivers/clk/ti/dpll.c
+++ b/drivers/clk/ti/dpll.c
@@ -195,7 +195,7 @@ static void __init _register_dpll(void *user,
 
 	/* register the clock */
 	name = ti_dt_clk_name(node);
-	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
+	clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
 
 	if (!IS_ERR(clk)) {
 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
@@ -267,7 +267,7 @@ static void _register_dpll_x2(struct device_node *node,
 #endif
 
 	/* register the clock */
-	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
+	clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
 
 	if (IS_ERR(clk))
 		kfree(clk_hw);
diff --git a/drivers/clk/ti/fixed-factor.c b/drivers/clk/ti/fixed-factor.c
index 8cb00d0af966..a4f9c1c15613 100644
--- a/drivers/clk/ti/fixed-factor.c
+++ b/drivers/clk/ti/fixed-factor.c
@@ -62,7 +62,7 @@ static void __init of_ti_fixed_factor_clk_setup(struct device_node *node)
 	if (!IS_ERR(clk)) {
 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
 		of_ti_clk_autoidle_setup(node);
-		ti_clk_add_alias(NULL, clk, clk_name);
+		ti_clk_add_alias(clk, clk_name);
 	}
 }
 CLK_OF_DECLARE(ti_fixed_factor_clk, "ti,fixed-factor-clock",
diff --git a/drivers/clk/ti/gate.c b/drivers/clk/ti/gate.c
index 2fee7d681a67..0cc1babad661 100644
--- a/drivers/clk/ti/gate.c
+++ b/drivers/clk/ti/gate.c
@@ -93,7 +93,7 @@ static int omap36xx_gate_clk_enable_with_hsdiv_restore(struct clk_hw *hw)
 	return ret;
 }
 
-static struct clk *_register_gate(struct device *dev, const char *name,
+static struct clk *_register_gate(struct device_node *node, const char *name,
 				  const char *parent_name, unsigned long flags,
 				  struct clk_omap_reg *reg, u8 bit_idx,
 				  u8 clk_gate_flags, const struct clk_ops *ops,
@@ -123,7 +123,7 @@ static struct clk *_register_gate(struct device *dev, const char *name,
 
 	init.flags = flags;
 
-	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
+	clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
 
 	if (IS_ERR(clk))
 		kfree(clk_hw);
@@ -166,7 +166,7 @@ static void __init _of_ti_gate_clk_setup(struct device_node *node,
 		clk_gate_flags |= INVERT_ENABLE;
 
 	name = ti_dt_clk_name(node);
-	clk = _register_gate(NULL, name, parent_name, flags, &reg,
+	clk = _register_gate(node, name, parent_name, flags, &reg,
 			     enable_bit, clk_gate_flags, ops, hw_ops);
 
 	if (!IS_ERR(clk))
diff --git a/drivers/clk/ti/interface.c b/drivers/clk/ti/interface.c
index dd2b455183a9..1ccd5dbf2bb4 100644
--- a/drivers/clk/ti/interface.c
+++ b/drivers/clk/ti/interface.c
@@ -32,7 +32,8 @@ static const struct clk_ops ti_interface_clk_ops = {
 	.is_enabled	= &omap2_dflt_clk_is_enabled,
 };
 
-static struct clk *_register_interface(struct device *dev, const char *name,
+static struct clk *_register_interface(struct device_node *node,
+				       const char *name,
 				       const char *parent_name,
 				       struct clk_omap_reg *reg, u8 bit_idx,
 				       const struct clk_hw_omap_ops *ops)
@@ -57,7 +58,7 @@ static struct clk *_register_interface(struct device *dev, const char *name,
 	init.num_parents = 1;
 	init.parent_names = &parent_name;
 
-	clk = ti_clk_register_omap_hw(NULL, &clk_hw->hw, name);
+	clk = of_ti_clk_register_omap_hw(node, &clk_hw->hw, name);
 
 	if (IS_ERR(clk))
 		kfree(clk_hw);
@@ -88,7 +89,7 @@ static void __init _of_ti_interface_clk_setup(struct device_node *node,
 	}
 
 	name = ti_dt_clk_name(node);
-	clk = _register_interface(NULL, name, parent_name, &reg,
+	clk = _register_interface(node, name, parent_name, &reg,
 				  enable_bit, ops);
 
 	if (!IS_ERR(clk))
diff --git a/drivers/clk/ti/mux.c b/drivers/clk/ti/mux.c
index 15de513d2d81..4205ff4bad21 100644
--- a/drivers/clk/ti/mux.c
+++ b/drivers/clk/ti/mux.c
@@ -126,7 +126,7 @@ const struct clk_ops ti_clk_mux_ops = {
 	.restore_context = clk_mux_restore_context,
 };
 
-static struct clk *_register_mux(struct device *dev, const char *name,
+static struct clk *_register_mux(struct device_node *node, const char *name,
 				 const char * const *parent_names,
 				 u8 num_parents, unsigned long flags,
 				 struct clk_omap_reg *reg, u8 shift, u32 mask,
@@ -156,7 +156,7 @@ static struct clk *_register_mux(struct device *dev, const char *name,
 	mux->table = table;
 	mux->hw.init = &init;
 
-	clk = ti_clk_register(dev, &mux->hw, name);
+	clk = of_ti_clk_register(node, &mux->hw, name);
 
 	if (IS_ERR(clk))
 		kfree(mux);
@@ -215,7 +215,7 @@ static void of_mux_clk_setup(struct device_node *node)
 	mask = (1 << fls(mask)) - 1;
 
 	name = ti_dt_clk_name(node);
-	clk = _register_mux(NULL, name, parent_names, num_parents,
+	clk = _register_mux(node, name, parent_names, num_parents,
 			    flags, &reg, shift, mask, latch, clk_mux_flags,
 			    NULL);
 

From 0beaefa9885ff4c7cb3692cc10ba390c7f530725 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Mon, 2 Oct 2023 10:04:36 +0300
Subject: [PATCH 0360/1043] clk: ti: fix double free in
 of_ti_divider_clk_setup()

[ Upstream commit 7af5b9eadd64c9e02a71f97c45bcdf3b64841f6b ]

The "div" pointer is freed in _register_divider() and again in
of_ti_divider_clk_setup().  Delete the free in _register_divider()

Fixes: fbbc18591585 ("clk: ti: divider: cleanup _register_divider and ti_clk_get_div_table")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/6d36eeec-6c8a-4f11-a579-aa3cd7c38749@moroto.mountain
Reviewed-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/ti/divider.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index 83931cc29971..4cc0aaa6cb13 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -317,7 +317,6 @@ static struct clk *_register_divider(struct device_node *node,
 				     u32 flags,
 				     struct clk_omap_divider *div)
 {
-	struct clk *clk;
 	struct clk_init_data init;
 	const char *parent_name;
 	const char *name;
@@ -334,12 +333,7 @@ static struct clk *_register_divider(struct device_node *node,
 	div->hw.init = &init;
 
 	/* register the clock */
-	clk = of_ti_clk_register(node, &div->hw, name);
-
-	if (IS_ERR(clk))
-		kfree(div);
-
-	return clk;
+	return of_ti_clk_register(node, &div->hw, name);
 }
 
 int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div,

From 55e5fd11a21d48263c2a5bcf10ef1e28332bea20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonathan=20Neusch=C3=A4fer?= <j.neuschaefer@gmx.net>
Date: Sat, 23 Sep 2023 15:31:27 +0200
Subject: [PATCH 0361/1043] clk: npcm7xx: Fix incorrect kfree
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit bbc5080bef4a245106aa8e8d424ba8847ca7c0ca ]

The corresponding allocation is:

> npcm7xx_clk_data = kzalloc(struct_size(npcm7xx_clk_data, hws,
> 			     NPCM7XX_NUM_CLOCKS), GFP_KERNEL);

... so, kfree should be applied to npcm7xx_clk_data, not
npcm7xx_clk_data->hws.

Fixes: fcfd14369856 ("clk: npcm7xx: add clock controller")
Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
Link: https://lore.kernel.org/r/20230923133127.1815621-1-j.neuschaefer@gmx.net
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-npcm7xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/clk-npcm7xx.c b/drivers/clk/clk-npcm7xx.c
index 27a86b7a34db..c82df105b0a2 100644
--- a/drivers/clk/clk-npcm7xx.c
+++ b/drivers/clk/clk-npcm7xx.c
@@ -647,7 +647,7 @@ static void __init npcm7xx_clk_init(struct device_node *clk_np)
 	return;
 
 npcm7xx_init_fail:
-	kfree(npcm7xx_clk_data->hws);
+	kfree(npcm7xx_clk_data);
 npcm7xx_init_np_err:
 	iounmap(clk_base);
 npcm7xx_init_error:

From 2617aa8ceaf30e41d3eb7f5fef3445542bef193a Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Date: Tue, 12 Sep 2023 17:34:03 +0800
Subject: [PATCH 0362/1043] clk: mediatek: clk-mt6765: Add check for
 mtk_alloc_clk_data

[ Upstream commit b82681042724924ae3ba0f2f2eeec217fa31e830 ]

Add the check for the return value of mtk_alloc_clk_data() in order to
avoid NULL pointer dereference.

Fixes: 1aca9939bf72 ("clk: mediatek: Add MT6765 clock support")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20230912093407.21505-1-jiasheng@iscas.ac.cn
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mediatek/clk-mt6765.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/clk/mediatek/clk-mt6765.c b/drivers/clk/mediatek/clk-mt6765.c
index d77ea5aff292..17352342b698 100644
--- a/drivers/clk/mediatek/clk-mt6765.c
+++ b/drivers/clk/mediatek/clk-mt6765.c
@@ -785,6 +785,8 @@ static int clk_mt6765_apmixed_probe(struct platform_device *pdev)
 	}
 
 	clk_data = mtk_alloc_clk_data(CLK_APMIXED_NR_CLK);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
 
@@ -820,6 +822,8 @@ static int clk_mt6765_top_probe(struct platform_device *pdev)
 	}
 
 	clk_data = mtk_alloc_clk_data(CLK_TOP_NR_CLK);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_fixed_clks(fixed_clks, ARRAY_SIZE(fixed_clks),
 				    clk_data);
@@ -860,6 +864,8 @@ static int clk_mt6765_ifr_probe(struct platform_device *pdev)
 	}
 
 	clk_data = mtk_alloc_clk_data(CLK_IFR_NR_CLK);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_gates(node, ifr_clks, ARRAY_SIZE(ifr_clks),
 			       clk_data);

From 3994387ba3564976731179c4d4a6d7850ddda71a Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Date: Tue, 12 Sep 2023 17:34:04 +0800
Subject: [PATCH 0363/1043] clk: mediatek: clk-mt6779: Add check for
 mtk_alloc_clk_data

[ Upstream commit 1f57f78fbacf630430bf954e5a84caafdfea30c0 ]

Add the check for the return value of mtk_alloc_clk_data() in order to
avoid NULL pointer dereference.

Fixes: 710774e04861 ("clk: mediatek: Add MT6779 clock support")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20230912093407.21505-2-jiasheng@iscas.ac.cn
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mediatek/clk-mt6779.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/clk/mediatek/clk-mt6779.c b/drivers/clk/mediatek/clk-mt6779.c
index 6e0d3a166729..cf720651fc53 100644
--- a/drivers/clk/mediatek/clk-mt6779.c
+++ b/drivers/clk/mediatek/clk-mt6779.c
@@ -1216,6 +1216,8 @@ static int clk_mt6779_apmixed_probe(struct platform_device *pdev)
 	struct device_node *node = pdev->dev.of_node;
 
 	clk_data = mtk_alloc_clk_data(CLK_APMIXED_NR_CLK);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
 
@@ -1236,6 +1238,8 @@ static int clk_mt6779_top_probe(struct platform_device *pdev)
 		return PTR_ERR(base);
 
 	clk_data = mtk_alloc_clk_data(CLK_TOP_NR_CLK);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks),
 				    clk_data);

From 81b16286110728674dcf81137be0687c5055e7bf Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Date: Tue, 12 Sep 2023 17:34:05 +0800
Subject: [PATCH 0364/1043] clk: mediatek: clk-mt6797: Add check for
 mtk_alloc_clk_data

[ Upstream commit 606f6366a35a3329545e38129804d65ef26ed7d2 ]

Add the check for the return value of mtk_alloc_clk_data() in order to
avoid NULL pointer dereference.

Fixes: 96596aa06628 ("clk: mediatek: add clk support for MT6797")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20230912093407.21505-3-jiasheng@iscas.ac.cn
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mediatek/clk-mt6797.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/clk/mediatek/clk-mt6797.c b/drivers/clk/mediatek/clk-mt6797.c
index 428eb24ffec5..98d456023f4e 100644
--- a/drivers/clk/mediatek/clk-mt6797.c
+++ b/drivers/clk/mediatek/clk-mt6797.c
@@ -391,6 +391,8 @@ static int mtk_topckgen_init(struct platform_device *pdev)
 		return PTR_ERR(base);
 
 	clk_data = mtk_alloc_clk_data(CLK_TOP_NR);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_factors(top_fixed_divs, ARRAY_SIZE(top_fixed_divs),
 				 clk_data);
@@ -563,6 +565,8 @@ static void mtk_infrasys_init_early(struct device_node *node)
 
 	if (!infra_clk_data) {
 		infra_clk_data = mtk_alloc_clk_data(CLK_INFRA_NR);
+		if (!infra_clk_data)
+			return;
 
 		for (i = 0; i < CLK_INFRA_NR; i++)
 			infra_clk_data->clks[i] = ERR_PTR(-EPROBE_DEFER);
@@ -587,6 +591,8 @@ static int mtk_infrasys_init(struct platform_device *pdev)
 
 	if (!infra_clk_data) {
 		infra_clk_data = mtk_alloc_clk_data(CLK_INFRA_NR);
+		if (!infra_clk_data)
+			return -ENOMEM;
 	} else {
 		for (i = 0; i < CLK_INFRA_NR; i++) {
 			if (infra_clk_data->clks[i] == ERR_PTR(-EPROBE_DEFER))

From 96e9544a0c4faca616b3f9f4034dcd83a14e7f22 Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Date: Tue, 12 Sep 2023 17:34:06 +0800
Subject: [PATCH 0365/1043] clk: mediatek: clk-mt7629-eth: Add check for
 mtk_alloc_clk_data

[ Upstream commit 0884393c63cc9a1772f7121a6645ba7bd76feeb9 ]

Add the check for the return value of mtk_alloc_clk_data() in order to
avoid NULL pointer dereference.

Fixes: 3b5e748615e7 ("clk: mediatek: add clock support for MT7629 SoC")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20230912093407.21505-4-jiasheng@iscas.ac.cn
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mediatek/clk-mt7629-eth.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/clk/mediatek/clk-mt7629-eth.c b/drivers/clk/mediatek/clk-mt7629-eth.c
index 88279d0ea1a7..3ab7b672f8c7 100644
--- a/drivers/clk/mediatek/clk-mt7629-eth.c
+++ b/drivers/clk/mediatek/clk-mt7629-eth.c
@@ -83,6 +83,8 @@ static int clk_mt7629_ethsys_init(struct platform_device *pdev)
 	int r;
 
 	clk_data = mtk_alloc_clk_data(CLK_ETH_NR_CLK);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_gates(node, eth_clks, CLK_ETH_NR_CLK, clk_data);
 
@@ -105,6 +107,8 @@ static int clk_mt7629_sgmiisys_init(struct platform_device *pdev)
 	int r;
 
 	clk_data = mtk_alloc_clk_data(CLK_SGMII_NR_CLK);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_gates(node, sgmii_clks[id++], CLK_SGMII_NR_CLK,
 			       clk_data);

From 4f861b63945e076f9f003a5fad958174096df1ee Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Date: Tue, 12 Sep 2023 17:34:07 +0800
Subject: [PATCH 0366/1043] clk: mediatek: clk-mt7629: Add check for
 mtk_alloc_clk_data

[ Upstream commit 2befa515c1bb6cdd33c262b909d93d1973a219aa ]

Add the check for the return value of mtk_alloc_clk_data() in order to
avoid NULL pointer dereference.

Fixes: 3b5e748615e7 ("clk: mediatek: add clock support for MT7629 SoC")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20230912093407.21505-5-jiasheng@iscas.ac.cn
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mediatek/clk-mt7629.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/clk/mediatek/clk-mt7629.c b/drivers/clk/mediatek/clk-mt7629.c
index a0ee079670c7..f791e53b812a 100644
--- a/drivers/clk/mediatek/clk-mt7629.c
+++ b/drivers/clk/mediatek/clk-mt7629.c
@@ -580,6 +580,8 @@ static int mtk_topckgen_init(struct platform_device *pdev)
 		return PTR_ERR(base);
 
 	clk_data = mtk_alloc_clk_data(CLK_TOP_NR_CLK);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks),
 				    clk_data);
@@ -603,6 +605,8 @@ static int mtk_infrasys_init(struct platform_device *pdev)
 	struct clk_onecell_data *clk_data;
 
 	clk_data = mtk_alloc_clk_data(CLK_INFRA_NR_CLK);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_gates(node, infra_clks, ARRAY_SIZE(infra_clks),
 			       clk_data);
@@ -626,6 +630,8 @@ static int mtk_pericfg_init(struct platform_device *pdev)
 		return PTR_ERR(base);
 
 	clk_data = mtk_alloc_clk_data(CLK_PERI_NR_CLK);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks),
 			       clk_data);

From 001e5def774fa1a8f2b29567c0b0cd3e3a859a96 Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Date: Fri, 1 Sep 2023 10:46:58 +0800
Subject: [PATCH 0367/1043] clk: mediatek: clk-mt2701: Add check for
 mtk_alloc_clk_data

[ Upstream commit 0d6e24b422a2166a9297a8286ff2e6ab9a5e8cd3 ]

Add the check for the return value of mtk_alloc_clk_data() in order to
avoid NULL pointer dereference.

Fixes: e9862118272a ("clk: mediatek: Add MT2701 clock support")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20230901024658.23405-1-jiasheng@iscas.ac.cn
Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mediatek/clk-mt2701.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/clk/mediatek/clk-mt2701.c b/drivers/clk/mediatek/clk-mt2701.c
index 695be0f77427..c67cd73aca17 100644
--- a/drivers/clk/mediatek/clk-mt2701.c
+++ b/drivers/clk/mediatek/clk-mt2701.c
@@ -675,6 +675,8 @@ static int mtk_topckgen_init(struct platform_device *pdev)
 		return PTR_ERR(base);
 
 	clk_data = mtk_alloc_clk_data(CLK_TOP_NR);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_fixed_clks(top_fixed_clks, ARRAY_SIZE(top_fixed_clks),
 								clk_data);
@@ -742,6 +744,8 @@ static void __init mtk_infrasys_init_early(struct device_node *node)
 
 	if (!infra_clk_data) {
 		infra_clk_data = mtk_alloc_clk_data(CLK_INFRA_NR);
+		if (!infra_clk_data)
+			return;
 
 		for (i = 0; i < CLK_INFRA_NR; i++)
 			infra_clk_data->clks[i] = ERR_PTR(-EPROBE_DEFER);
@@ -768,6 +772,8 @@ static int mtk_infrasys_init(struct platform_device *pdev)
 
 	if (!infra_clk_data) {
 		infra_clk_data = mtk_alloc_clk_data(CLK_INFRA_NR);
+		if (!infra_clk_data)
+			return -ENOMEM;
 	} else {
 		for (i = 0; i < CLK_INFRA_NR; i++) {
 			if (infra_clk_data->clks[i] == ERR_PTR(-EPROBE_DEFER))
@@ -896,6 +902,8 @@ static int mtk_pericfg_init(struct platform_device *pdev)
 		return PTR_ERR(base);
 
 	clk_data = mtk_alloc_clk_data(CLK_PERI_NR);
+	if (!clk_data)
+		return -ENOMEM;
 
 	mtk_clk_register_gates(node, peri_clks, ARRAY_SIZE(peri_clks),
 						clk_data);

From b16622d304e7d81f771d0cb79f33a47e7d8b6fe4 Mon Sep 17 00:00:00 2001
From: Varadarajan Narayanan <quic_varada@quicinc.com>
Date: Fri, 20 Oct 2023 11:49:31 +0530
Subject: [PATCH 0368/1043] clk: qcom: config IPQ_APSS_6018 should depend on
 QCOM_SMEM

[ Upstream commit 6a15647d0adc686226045e8046369f34d6ab03ed ]

The config IPQ_APSS_6018 should depend on QCOM_SMEM, to
avoid the following error reported by 'kernel test robot'

	loongarch64-linux-ld: drivers/clk/qcom/apss-ipq6018.o: in function `apss_ipq6018_probe':
	>> apss-ipq6018.c:(.text+0xd0): undefined reference to `qcom_smem_get_soc_id'

Fixes: 5e77b4ef1b19 ("clk: qcom: Add ipq6018 apss clock controller")
Reported-by: kernel test robot <yujie.liu@intel.com>
Closes: https://lore.kernel.org/r/202310181650.g8THtfsm-lkp@intel.com/
Signed-off-by: Varadarajan Narayanan <quic_varada@quicinc.com>
Link: https://lore.kernel.org/r/f4c4d65a7cb71e807d6d472c63c7718408c8f5f0.1697781921.git.quic_varada@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/qcom/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig
index 3a965bd326d5..3998e25c4192 100644
--- a/drivers/clk/qcom/Kconfig
+++ b/drivers/clk/qcom/Kconfig
@@ -110,6 +110,7 @@ config IPQ_APSS_6018
 	tristate "IPQ APSS Clock Controller"
 	select IPQ_APSS_PLL
 	depends on QCOM_APCS_IPC || COMPILE_TEST
+	depends on QCOM_SMEM
 	help
 	  Support for APSS clock controller on IPQ platforms. The
 	  APSS clock controller manages the Mux and enable block that feeds the

From 3433a69c00eebdda9270ed7f82228445a27b2075 Mon Sep 17 00:00:00 2001
From: Armin Wolf <W_Armin@gmx.de>
Date: Fri, 20 Oct 2023 23:10:03 +0200
Subject: [PATCH 0369/1043] platform/x86: wmi: Fix probe failure when failing
 to register WMI devices
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit ed85891a276edaf7a867de0e9acd0837bc3008f2 ]

When a WMI device besides the first one somehow fails to register,
retval is returned while still containing a negative error code. This
causes the ACPI device fail to probe, leaving behind zombie WMI devices
leading to various errors later.

Handle the single error path separately and return 0 unconditionally
after trying to register all WMI devices to solve the issue. Also
continue to register WMI devices even if some fail to allocate memory.

Fixes: 6ee50aaa9a20 ("platform/x86: wmi: Instantiate all devices before adding them")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://lore.kernel.org/r/20231020211005.38216-4-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/wmi.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 567c28705cb1..404fe3cac4cc 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -1157,8 +1157,8 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
 	struct wmi_block *wblock, *next;
 	union acpi_object *obj;
 	acpi_status status;
-	int retval = 0;
 	u32 i, total;
+	int retval;
 
 	status = acpi_evaluate_object(device->handle, "_WDG", NULL, &out);
 	if (ACPI_FAILURE(status))
@@ -1169,8 +1169,8 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
 		return -ENXIO;
 
 	if (obj->type != ACPI_TYPE_BUFFER) {
-		retval = -ENXIO;
-		goto out_free_pointer;
+		kfree(obj);
+		return -ENXIO;
 	}
 
 	gblock = (const struct guid_block *)obj->buffer.pointer;
@@ -1191,8 +1191,8 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
 
 		wblock = kzalloc(sizeof(struct wmi_block), GFP_KERNEL);
 		if (!wblock) {
-			retval = -ENOMEM;
-			break;
+			dev_err(wmi_bus_dev, "Failed to allocate %pUL\n", &gblock[i].guid);
+			continue;
 		}
 
 		wblock->acpi_device = device;
@@ -1231,9 +1231,9 @@ static int parse_wdg(struct device *wmi_bus_dev, struct acpi_device *device)
 		}
 	}
 
-out_free_pointer:
-	kfree(out.pointer);
-	return retval;
+	kfree(obj);
+
+	return 0;
 }
 
 /*

From d2220737330b137c5dfb8b6a2b9b958c0a9c398a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?= <pobrn@protonmail.com>
Date: Sat, 4 Sep 2021 17:55:10 +0000
Subject: [PATCH 0370/1043] platform/x86: wmi: remove unnecessary
 initializations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 43aacf838ef7384d985ef5385ecb0124f8c70007 ]

Some pointers are initialized when they are defined,
but they are almost immediately reassigned in the
following lines. Remove these superfluous assignments.

Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
Link: https://lore.kernel.org/r/20210904175450.156801-6-pobrn@protonmail.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Stable-dep-of: eba9ac7abab9 ("platform/x86: wmi: Fix opening of char device")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/wmi.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 404fe3cac4cc..6f8145520bce 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -185,7 +185,7 @@ static int get_subobj_info(acpi_handle handle, const char *pathname,
 
 static acpi_status wmi_method_enable(struct wmi_block *wblock, int enable)
 {
-	struct guid_block *block = NULL;
+	struct guid_block *block;
 	char method[5];
 	acpi_status status;
 	acpi_handle handle;
@@ -259,8 +259,8 @@ EXPORT_SYMBOL_GPL(wmi_evaluate_method);
 acpi_status wmidev_evaluate_method(struct wmi_device *wdev, u8 instance,
 	u32 method_id, const struct acpi_buffer *in, struct acpi_buffer *out)
 {
-	struct guid_block *block = NULL;
-	struct wmi_block *wblock = NULL;
+	struct guid_block *block;
+	struct wmi_block *wblock;
 	acpi_handle handle;
 	acpi_status status;
 	struct acpi_object_list input;
@@ -307,7 +307,7 @@ EXPORT_SYMBOL_GPL(wmidev_evaluate_method);
 static acpi_status __query_block(struct wmi_block *wblock, u8 instance,
 				 struct acpi_buffer *out)
 {
-	struct guid_block *block = NULL;
+	struct guid_block *block;
 	acpi_handle handle;
 	acpi_status status, wc_status = AE_ERROR;
 	struct acpi_object_list input;
@@ -420,8 +420,8 @@ EXPORT_SYMBOL_GPL(wmidev_block_query);
 acpi_status wmi_set_block(const char *guid_string, u8 instance,
 			  const struct acpi_buffer *in)
 {
-	struct guid_block *block = NULL;
 	struct wmi_block *wblock = NULL;
+	struct guid_block *block;
 	acpi_handle handle;
 	struct acpi_object_list input;
 	union acpi_object params[2];
@@ -821,8 +821,8 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
 static int wmi_char_open(struct inode *inode, struct file *filp)
 {
 	const char *driver_name = filp->f_path.dentry->d_iname;
-	struct wmi_block *wblock = NULL;
-	struct wmi_block *next = NULL;
+	struct wmi_block *wblock;
+	struct wmi_block *next;
 
 	list_for_each_entry_safe(wblock, next, &wmi_block_list, list) {
 		if (!wblock->dev.dev.driver)
@@ -854,8 +854,8 @@ static long wmi_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	struct wmi_ioctl_buffer __user *input =
 		(struct wmi_ioctl_buffer __user *) arg;
 	struct wmi_block *wblock = filp->private_data;
-	struct wmi_ioctl_buffer *buf = NULL;
-	struct wmi_driver *wdriver = NULL;
+	struct wmi_ioctl_buffer *buf;
+	struct wmi_driver *wdriver;
 	int ret;
 
 	if (_IOC_TYPE(cmd) != WMI_IOC)

From d426a2955e45a95b2282764105fcfb110a540453 Mon Sep 17 00:00:00 2001
From: Armin Wolf <W_Armin@gmx.de>
Date: Fri, 20 Oct 2023 23:10:04 +0200
Subject: [PATCH 0371/1043] platform/x86: wmi: Fix opening of char device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit eba9ac7abab91c8f6d351460239108bef5e7a0b6 ]

Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via
file private data"), the miscdevice stores a pointer to itself inside
filp->private_data, which means that private_data will not be NULL when
wmi_char_open() is called. This might cause memory corruption should
wmi_char_open() be unable to find its driver, something which can
happen when the associated WMI device is deleted in wmi_free_devices().

Fix the problem by using the miscdevice pointer to retrieve the WMI
device data associated with a char device using container_of(). This
also avoids wmi_char_open() picking a wrong WMI device bound to a
driver with the same name as the original driver.

Fixes: 44b6b7661132 ("platform/x86: wmi: create userspace interface for drivers")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://lore.kernel.org/r/20231020211005.38216-5-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/wmi.c | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 6f8145520bce..62c673660c9a 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -820,21 +820,13 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
 }
 static int wmi_char_open(struct inode *inode, struct file *filp)
 {
-	const char *driver_name = filp->f_path.dentry->d_iname;
-	struct wmi_block *wblock;
-	struct wmi_block *next;
+	/*
+	 * The miscdevice already stores a pointer to itself
+	 * inside filp->private_data
+	 */
+	struct wmi_block *wblock = container_of(filp->private_data, struct wmi_block, char_dev);
 
-	list_for_each_entry_safe(wblock, next, &wmi_block_list, list) {
-		if (!wblock->dev.dev.driver)
-			continue;
-		if (strcmp(driver_name, wblock->dev.dev.driver->name) == 0) {
-			filp->private_data = wblock;
-			break;
-		}
-	}
-
-	if (!filp->private_data)
-		return -ENODEV;
+	filp->private_data = wblock;
 
 	return nonseekable_open(inode, filp);
 }

From 060d54f09004546fac2f9cc0c0aa2361f97eb537 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com>
Date: Wed, 11 Aug 2021 13:48:53 +0200
Subject: [PATCH 0372/1043] hwmon: (axi-fan-control) Support temperature vs pwm
 points
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 2aee7e67bee7a5aa741bad6a0a472f108b29ad40 ]

The HW has some predefined points where it will associate a PWM value.
However some users might want to better set these points to their
usecases. This patch exposes these points as pwm auto_points:

 * pwm1_auto_point1_temp_hyst: temperature threshold below which PWM should
   be 0%;
 * pwm1_auto_point1_temp: temperature threshold above which PWM should be
   25%;
 * pwm1_auto_point2_temp_hyst: temperature threshold below which PWM should
   be 25%;
 * pwm1_auto_point2_temp: temperature threshold above which PWM should be
   50%;
 * pwm1_auto_point3_temp_hyst: temperature threshold below which PWM should
   be 50%;
 * pwm1_auto_point3_temp: temperature threshold above which PWM should be
   75%;
 * pwm1_auto_point4_temp_hyst: temperature threshold below which PWM should
   be 75%;
 * pwm1_auto_point4_temp: temperature threshold above which PWM should be
   100%;

Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20210811114853.159298-4-nuno.sa@analog.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Stable-dep-of: 2a5b3370a1d9 ("hwmon: (axi-fan-control) Fix possible NULL pointer dereference")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/axi-fan-control.c | 74 ++++++++++++++++++++++++++++++++-
 1 file changed, 73 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/axi-fan-control.c b/drivers/hwmon/axi-fan-control.c
index e3f6b03e6764..da0c3b6101f5 100644
--- a/drivers/hwmon/axi-fan-control.c
+++ b/drivers/hwmon/axi-fan-control.c
@@ -8,6 +8,7 @@
 #include <linux/clk.h>
 #include <linux/fpga/adi-axi-common.h>
 #include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
@@ -23,6 +24,14 @@
 #define ADI_REG_PWM_PERIOD	0x00c0
 #define ADI_REG_TACH_MEASUR	0x00c4
 #define ADI_REG_TEMPERATURE	0x00c8
+#define ADI_REG_TEMP_00_H	0x0100
+#define ADI_REG_TEMP_25_L	0x0104
+#define ADI_REG_TEMP_25_H	0x0108
+#define ADI_REG_TEMP_50_L	0x010c
+#define ADI_REG_TEMP_50_H	0x0110
+#define ADI_REG_TEMP_75_L	0x0114
+#define ADI_REG_TEMP_75_H	0x0118
+#define ADI_REG_TEMP_100_L	0x011c
 
 #define ADI_REG_IRQ_MASK	0x0040
 #define ADI_REG_IRQ_PENDING	0x0044
@@ -62,6 +71,39 @@ static inline u32 axi_ioread(const u32 reg,
 	return ioread32(ctl->base + reg);
 }
 
+/*
+ * The core calculates the temperature as:
+ *	T = /raw * 509.3140064 / 65535) - 280.2308787
+ */
+static ssize_t axi_fan_control_show(struct device *dev, struct device_attribute *da, char *buf)
+{
+	struct axi_fan_control_data *ctl = dev_get_drvdata(dev);
+	struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
+	u32 temp = axi_ioread(attr->index, ctl);
+
+	temp = DIV_ROUND_CLOSEST_ULL(temp * 509314ULL, 65535) - 280230;
+
+	return sprintf(buf, "%u\n", temp);
+}
+
+static ssize_t axi_fan_control_store(struct device *dev, struct device_attribute *da,
+				     const char *buf, size_t count)
+{
+	struct axi_fan_control_data *ctl = dev_get_drvdata(dev);
+	struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
+	u32 temp;
+	int ret;
+
+	ret = kstrtou32(buf, 10, &temp);
+	if (ret)
+		return ret;
+
+	temp = DIV_ROUND_CLOSEST_ULL((temp + 280230) * 65535ULL, 509314);
+	axi_iowrite(temp, attr->index, ctl);
+
+	return count;
+}
+
 static long axi_fan_control_get_pwm_duty(const struct axi_fan_control_data *ctl)
 {
 	u32 pwm_width = axi_ioread(ADI_REG_PWM_WIDTH, ctl);
@@ -370,6 +412,36 @@ static const struct hwmon_chip_info axi_chip_info = {
 	.info = axi_fan_control_info,
 };
 
+/* temperature threshold below which PWM should be 0% */
+static SENSOR_DEVICE_ATTR_RW(pwm1_auto_point1_temp_hyst, axi_fan_control, ADI_REG_TEMP_00_H);
+/* temperature threshold above which PWM should be 25% */
+static SENSOR_DEVICE_ATTR_RW(pwm1_auto_point1_temp, axi_fan_control, ADI_REG_TEMP_25_L);
+/* temperature threshold below which PWM should be 25% */
+static SENSOR_DEVICE_ATTR_RW(pwm1_auto_point2_temp_hyst, axi_fan_control, ADI_REG_TEMP_25_H);
+/* temperature threshold above which PWM should be 50% */
+static SENSOR_DEVICE_ATTR_RW(pwm1_auto_point2_temp, axi_fan_control, ADI_REG_TEMP_50_L);
+/* temperature threshold below which PWM should be 50% */
+static SENSOR_DEVICE_ATTR_RW(pwm1_auto_point3_temp_hyst, axi_fan_control, ADI_REG_TEMP_50_H);
+/* temperature threshold above which PWM should be 75% */
+static SENSOR_DEVICE_ATTR_RW(pwm1_auto_point3_temp, axi_fan_control, ADI_REG_TEMP_75_L);
+/* temperature threshold below which PWM should be 75% */
+static SENSOR_DEVICE_ATTR_RW(pwm1_auto_point4_temp_hyst, axi_fan_control, ADI_REG_TEMP_75_H);
+/* temperature threshold above which PWM should be 100% */
+static SENSOR_DEVICE_ATTR_RW(pwm1_auto_point4_temp, axi_fan_control, ADI_REG_TEMP_100_L);
+
+static struct attribute *axi_fan_control_attrs[] = {
+	&sensor_dev_attr_pwm1_auto_point1_temp_hyst.dev_attr.attr,
+	&sensor_dev_attr_pwm1_auto_point1_temp.dev_attr.attr,
+	&sensor_dev_attr_pwm1_auto_point2_temp_hyst.dev_attr.attr,
+	&sensor_dev_attr_pwm1_auto_point2_temp.dev_attr.attr,
+	&sensor_dev_attr_pwm1_auto_point3_temp_hyst.dev_attr.attr,
+	&sensor_dev_attr_pwm1_auto_point3_temp.dev_attr.attr,
+	&sensor_dev_attr_pwm1_auto_point4_temp_hyst.dev_attr.attr,
+	&sensor_dev_attr_pwm1_auto_point4_temp.dev_attr.attr,
+	NULL,
+};
+ATTRIBUTE_GROUPS(axi_fan_control);
+
 static const u32 version_1_0_0 = ADI_AXI_PCORE_VER(1, 0, 'a');
 
 static const struct of_device_id axi_fan_control_of_match[] = {
@@ -446,7 +518,7 @@ static int axi_fan_control_probe(struct platform_device *pdev)
 							 name,
 							 ctl,
 							 &axi_chip_info,
-							 NULL);
+							 axi_fan_control_groups);
 
 	return PTR_ERR_OR_ZERO(ctl->hdev);
 }

From 7d870088db4863c514a7f8751cd593751983029a Mon Sep 17 00:00:00 2001
From: Dragos Bogdan <dragos.bogdan@analog.com>
Date: Wed, 25 Oct 2023 15:21:00 +0200
Subject: [PATCH 0373/1043] hwmon: (axi-fan-control) Fix possible NULL pointer
 dereference

[ Upstream commit 2a5b3370a1d9750eca325292e291c8c7cb8cf2e0 ]

axi_fan_control_irq_handler(), dependent on the private
axi_fan_control_data structure, might be called before the hwmon
device is registered. That will cause an "Unable to handle kernel
NULL pointer dereference" error.

Fixes: 8412b410fa5e ("hwmon: Support ADI Fan Control IP")
Signed-off-by: Dragos Bogdan <dragos.bogdan@analog.com>
Signed-off-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20231025132100.649499-1-nuno.sa@analog.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/axi-fan-control.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/drivers/hwmon/axi-fan-control.c b/drivers/hwmon/axi-fan-control.c
index da0c3b6101f5..4b8250f2bb42 100644
--- a/drivers/hwmon/axi-fan-control.c
+++ b/drivers/hwmon/axi-fan-control.c
@@ -495,6 +495,21 @@ static int axi_fan_control_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
+	ret = axi_fan_control_init(ctl, pdev->dev.of_node);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to initialize device\n");
+		return ret;
+	}
+
+	ctl->hdev = devm_hwmon_device_register_with_info(&pdev->dev,
+							 name,
+							 ctl,
+							 &axi_chip_info,
+							 axi_fan_control_groups);
+
+	if (IS_ERR(ctl->hdev))
+		return PTR_ERR(ctl->hdev);
+
 	ctl->irq = platform_get_irq(pdev, 0);
 	if (ctl->irq < 0)
 		return ctl->irq;
@@ -508,19 +523,7 @@ static int axi_fan_control_probe(struct platform_device *pdev)
 		return ret;
 	}
 
-	ret = axi_fan_control_init(ctl, pdev->dev.of_node);
-	if (ret) {
-		dev_err(&pdev->dev, "Failed to initialize device\n");
-		return ret;
-	}
-
-	ctl->hdev = devm_hwmon_device_register_with_info(&pdev->dev,
-							 name,
-							 ctl,
-							 &axi_chip_info,
-							 axi_fan_control_groups);
-
-	return PTR_ERR_OR_ZERO(ctl->hdev);
+	return 0;
 }
 
 static struct platform_driver axi_fan_control_driver = {

From 9899097b1fcffd5226168ce19152d55d7d7e59a5 Mon Sep 17 00:00:00 2001
From: Zhang Rui <rui.zhang@intel.com>
Date: Wed, 25 Oct 2023 20:23:16 +0800
Subject: [PATCH 0374/1043] hwmon: (coretemp) Fix potentially truncated sysfs
 attribute name

[ Upstream commit bbfff736d30e5283ad09e748caff979d75ddef7f ]

When build with W=1 and "-Werror=format-truncation", below error is
observed in coretemp driver,

   drivers/hwmon/coretemp.c: In function 'create_core_data':
>> drivers/hwmon/coretemp.c:393:34: error: '%s' directive output may be truncated writing likely 5 or more bytes into a region of size between 3 and 13 [-Werror=format-truncation=]
     393 |                          "temp%d_%s", attr_no, suffixes[i]);
         |                                  ^~
   drivers/hwmon/coretemp.c:393:26: note: assuming directive output of 5 bytes
     393 |                          "temp%d_%s", attr_no, suffixes[i]);
         |                          ^~~~~~~~~~~
   drivers/hwmon/coretemp.c:392:17: note: 'snprintf' output 7 or more bytes (assuming 22) into a destination of size 19
     392 |                 snprintf(tdata->attr_name[i], CORETEMP_NAME_LENGTH,
         |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     393 |                          "temp%d_%s", attr_no, suffixes[i]);
         |                          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   cc1: all warnings being treated as errors

Given that
1. '%d' could take 10 charactors,
2. '%s' could take 10 charactors ("crit_alarm"),
3. "temp", "_" and the NULL terminator take 6 charactors,
fix the problem by increasing CORETEMP_NAME_LENGTH to 28.

Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Fixes: 7108b80a542b ("hwmon/coretemp: Handle large core ID value")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310200443.iD3tUbbK-lkp@intel.com/
Link: https://lore.kernel.org/r/20231025122316.836400-1-rui.zhang@intel.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/coretemp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index eaae5de2ab61..5b2057ce5a59 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -41,7 +41,7 @@ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
 #define PKG_SYSFS_ATTR_NO	1	/* Sysfs attribute for package temp */
 #define BASE_SYSFS_ATTR_NO	2	/* Sysfs Base attr no for coretemp */
 #define NUM_REAL_CORES		128	/* Number of Real cores per cpu */
-#define CORETEMP_NAME_LENGTH	19	/* String Length of attrs */
+#define CORETEMP_NAME_LENGTH	28	/* String Length of attrs */
 #define MAX_CORE_ATTRS		4	/* Maximum no of basic attrs */
 #define TOTAL_ATTRS		(MAX_CORE_ATTRS + 1)
 #define MAX_CORE_DATA		(NUM_REAL_CORES + BASE_SYSFS_ATTR_NO)

From bb814301613044155b3f949517dfa5298fa8a4b5 Mon Sep 17 00:00:00 2001
From: Jonas Karlman <jonas@kwiboo.se>
Date: Wed, 21 Jun 2023 22:33:17 +0000
Subject: [PATCH 0375/1043] drm/rockchip: vop: Fix reset of state in duplicate
 state crtc funcs

[ Upstream commit 13fc28804bf10ca0b7bce3efbba95c534836d7ca ]

struct rockchip_crtc_state members such as output_type, output_bpc and
enable_afbc is always reset to zero in the atomic_duplicate_state crtc
funcs.

Fix this by using kmemdup on the subclass rockchip_crtc_state struct.

Fixes: 4e257d9eee23 ("drm/rockchip: get rid of rockchip_drm_crtc_mode_config")
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230621223311.2239547-2-jonas@kwiboo.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 65dde9df9793..2f1e55a905d4 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -1533,7 +1533,8 @@ static struct drm_crtc_state *vop_crtc_duplicate_state(struct drm_crtc *crtc)
 	if (WARN_ON(!crtc->state))
 		return NULL;
 
-	rockchip_state = kzalloc(sizeof(*rockchip_state), GFP_KERNEL);
+	rockchip_state = kmemdup(to_rockchip_crtc_state(crtc->state),
+				 sizeof(*rockchip_state), GFP_KERNEL);
 	if (!rockchip_state)
 		return NULL;
 

From a6d6769e2db67bd7aed7a08b3e3af1bf082c2f95 Mon Sep 17 00:00:00 2001
From: Jonas Karlman <jonas@kwiboo.se>
Date: Wed, 21 Jun 2023 22:33:20 +0000
Subject: [PATCH 0376/1043] drm/rockchip: vop: Fix call to crtc reset helper

[ Upstream commit 5aacd290837828c089a83ac9795c74c4c9e2c923 ]

Allocation of crtc_state may fail in vop_crtc_reset, causing an invalid
pointer to be passed to __drm_atomic_helper_crtc_reset.

Fix this by adding a NULL check of crtc_state, similar to other drivers.

Fixes: 01e2eaf40c9d ("drm/rockchip: Convert to using __drm_atomic_helper_crtc_reset() for reset.")
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230621223311.2239547-4-jonas@kwiboo.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 2f1e55a905d4..05fcc9e078d6 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -1559,7 +1559,10 @@ static void vop_crtc_reset(struct drm_crtc *crtc)
 	if (crtc->state)
 		vop_crtc_destroy_state(crtc, crtc->state);
 
-	__drm_atomic_helper_crtc_reset(crtc, &crtc_state->base);
+	if (crtc_state)
+		__drm_atomic_helper_crtc_reset(crtc, &crtc_state->base);
+	else
+		__drm_atomic_helper_crtc_reset(crtc, NULL);
 }
 
 #ifdef CONFIG_DRM_ANALOGIX_DP

From 7b063c93bece827fde237fae1c101bceeee4e896 Mon Sep 17 00:00:00 2001
From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Date: Thu, 17 Aug 2023 19:33:49 +0800
Subject: [PATCH 0377/1043] drm/radeon: possible buffer overflow

[ Upstream commit dd05484f99d16715a88eedfca363828ef9a4c2d4 ]

Buffer 'afmt_status' of size 6 could overflow, since index 'afmt_idx' is
checked after access.

Fixes: 5cc4e5fc293b ("drm/radeon: Cleanup HDMI audio interrupt handling for evergreen")
Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/radeon/evergreen.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 14d90dc376e7..061ef6c00859 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -4819,14 +4819,15 @@ int evergreen_irq_process(struct radeon_device *rdev)
 			break;
 		case 44: /* hdmi */
 			afmt_idx = src_data;
-			if (!(afmt_status[afmt_idx] & AFMT_AZ_FORMAT_WTRIG))
-				DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-
 			if (afmt_idx > 5) {
 				DRM_ERROR("Unhandled interrupt: %d %d\n",
 					  src_id, src_data);
 				break;
 			}
+
+			if (!(afmt_status[afmt_idx] & AFMT_AZ_FORMAT_WTRIG))
+				DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
 			afmt_status[afmt_idx] &= ~AFMT_AZ_FORMAT_WTRIG;
 			queue_hdmi = true;
 			DRM_DEBUG("IH: HDMI%d\n", afmt_idx + 1);

From c0d25ef81a11251cf40658adbbb97aa825781432 Mon Sep 17 00:00:00 2001
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Date: Wed, 6 Sep 2023 09:50:49 +0300
Subject: [PATCH 0378/1043] drm/bridge: tc358768: Fix use of uninitialized
 variable

[ Upstream commit a2d9036615f0adfa5b0a46bb2ce42ef1d9a04fbe ]

smatch reports:

drivers/gpu/drm/bridge/tc358768.c:223 tc358768_update_bits() error: uninitialized symbol 'orig'.

Fix this by bailing out from tc358768_update_bits() if the
tc358768_read() produces an error.

Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> # Asus TF700T
Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230906-tc358768-v4-2-31725f008a50@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/tc358768.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index b4a69b210451..a5e7afa5e627 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -217,6 +217,10 @@ static void tc358768_update_bits(struct tc358768_priv *priv, u32 reg, u32 mask,
 	u32 tmp, orig;
 
 	tc358768_read(priv, reg, &orig);
+
+	if (priv->error)
+		return;
+
 	tmp = orig & ~mask;
 	tmp |= val & mask;
 	if (tmp != orig)

From 1133e72cd82b572ffeab778ad9c0ae07c075c817 Mon Sep 17 00:00:00 2001
From: Dmitry Osipenko <digetx@gmail.com>
Date: Sun, 3 Oct 2021 02:34:46 +0300
Subject: [PATCH 0379/1043] drm/bridge: tc358768: Disable non-continuous clock
 mode

[ Upstream commit fbc5a90e82c1131869e76ce5b082693b8a75c121 ]

Non-continuous clock mode doesn't work because driver doesn't support it
properly. The bridge driver programs wrong bitfields that are required by
the non-continuous mode (BTACNTRL1 register bitfields are swapped in the
code), but fixing them doesn't help.

Display panel of ASUS Transformer TF700T tablet supports non-continuous
mode and display doesn't work at all using that mode. There are no
device-trees that are actively using this DSI bridge in upstream yet,
so clearly the broken mode wasn't ever tested properly. It's a bit too
difficult to get LP mode working, hence let's disable the offending mode
for now and fall back to continuous mode.

Tested-by: Andreas Westman Dorcsak <hedmoo@yahoo.com> # Asus TF700T
Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> #TF700T
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Reviewed-by: Robert Foss <robert.foss@linaro.org>
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211002233447.1105-5-digetx@gmail.com
Stable-dep-of: 66962d5c3c51 ("drm/bridge: tc358768: Fix bit updates")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/tc358768.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index a5e7afa5e627..8f7460f011ae 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -637,6 +637,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
 {
 	struct tc358768_priv *priv = bridge_to_tc358768(bridge);
 	struct mipi_dsi_device *dsi_dev = priv->output.dev;
+	unsigned long mode_flags = dsi_dev->mode_flags;
 	u32 val, val2, lptxcnt, hact, data_type;
 	s32 raw_val;
 	const struct drm_display_mode *mode;
@@ -644,6 +645,11 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
 	u32 dsiclk, dsibclk;
 	int ret, i;
 
+	if (mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS) {
+		dev_warn_once(priv->dev, "Non-continuous mode unimplemented, falling back to continuous\n");
+		mode_flags &= ~MIPI_DSI_CLOCK_NON_CONTINUOUS;
+	}
+
 	tc358768_hw_enable(priv);
 
 	ret = tc358768_sw_reset(priv);
@@ -779,7 +785,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
 		val |= BIT(i + 1);
 	tc358768_write(priv, TC358768_HSTXVREGEN, val);
 
-	if (!(dsi_dev->mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS))
+	if (!(mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS))
 		tc358768_write(priv, TC358768_TXOPTIONCNTRL, 0x1);
 
 	/* TXTAGOCNT[26:16] RXTASURECNT[10:0] */
@@ -836,7 +842,7 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
 
 	val |= TC358768_DSI_CONTROL_TXMD;
 
-	if (!(dsi_dev->mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS))
+	if (!(mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS))
 		val |= TC358768_DSI_CONTROL_HSCKMD;
 
 	if (dsi_dev->mode_flags & MIPI_DSI_MODE_EOT_PACKET)

From c12f2eaeb38b417ccd1d059a44b9fd3f55185bcb Mon Sep 17 00:00:00 2001
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Date: Wed, 6 Sep 2023 09:50:51 +0300
Subject: [PATCH 0380/1043] drm/bridge: tc358768: Fix bit updates

[ Upstream commit 66962d5c3c51377b9b90cae35b7e038950438e02 ]

The driver has a few places where it does:

if (thing_is_enabled_in_config)
	update_thing_bit_in_hw()

This means that if the thing is _not_ enabled, the bit never gets
cleared. This affects the h/vsyncs and continuous DSI clock bits.

Fix the driver to always update the bit.

Fixes: ff1ca6397b1d ("drm/bridge: Add tc358768 driver")
Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> # Asus TF700T
Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230906-tc358768-v4-4-31725f008a50@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/tc358768.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/bridge/tc358768.c b/drivers/gpu/drm/bridge/tc358768.c
index 8f7460f011ae..48dab19f3e23 100644
--- a/drivers/gpu/drm/bridge/tc358768.c
+++ b/drivers/gpu/drm/bridge/tc358768.c
@@ -785,8 +785,8 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
 		val |= BIT(i + 1);
 	tc358768_write(priv, TC358768_HSTXVREGEN, val);
 
-	if (!(mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS))
-		tc358768_write(priv, TC358768_TXOPTIONCNTRL, 0x1);
+	tc358768_write(priv, TC358768_TXOPTIONCNTRL,
+		       (mode_flags & MIPI_DSI_CLOCK_NON_CONTINUOUS) ? 0 : BIT(0));
 
 	/* TXTAGOCNT[26:16] RXTASURECNT[10:0] */
 	val = tc358768_to_ns((lptxcnt + 1) * dsibclk_nsk * 4);
@@ -822,11 +822,12 @@ static void tc358768_bridge_pre_enable(struct drm_bridge *bridge)
 	tc358768_write(priv, TC358768_DSI_HACT, hact);
 
 	/* VSYNC polarity */
-	if (!(mode->flags & DRM_MODE_FLAG_NVSYNC))
-		tc358768_update_bits(priv, TC358768_CONFCTL, BIT(5), BIT(5));
+	tc358768_update_bits(priv, TC358768_CONFCTL, BIT(5),
+			     (mode->flags & DRM_MODE_FLAG_PVSYNC) ? BIT(5) : 0);
+
 	/* HSYNC polarity */
-	if (mode->flags & DRM_MODE_FLAG_PHSYNC)
-		tc358768_update_bits(priv, TC358768_PP_MISC, BIT(0), BIT(0));
+	tc358768_update_bits(priv, TC358768_PP_MISC, BIT(0),
+			     (mode->flags & DRM_MODE_FLAG_PHSYNC) ? BIT(0) : 0);
 
 	/* Start DSI Tx */
 	tc358768_write(priv, TC358768_DSI_START, 0x1);

From 6f710918df7d2537f18126db4e050c47f40f324b Mon Sep 17 00:00:00 2001
From: "Jason-JH.Lin" <jason-jh.lin@mediatek.com>
Date: Wed, 9 Aug 2023 20:57:22 +0800
Subject: [PATCH 0381/1043] drm/mediatek: Fix iommu fault during crtc enabling

[ Upstream commit 53412dc2905401207f264dc30890f6b9e41524a6 ]

The difference between drm_atomic_helper_commit_tail() and
drm_atomic_helper_commit_tail_rpm() is
drm_atomic_helper_commit_tail() will commit plane first and
then enable crtc, drm_atomic_helper_commit_tail_rpm() will
enable crtc first and then commit plane.

Before mediatek-drm enables crtc, the power and clk required
by OVL have not been turned on, so the commit plane cannot be
committed before crtc is enabled. That means OVL layer should
not be enabled before crtc is enabled.
Therefore, the atomic_commit_tail of mediatek-drm is hooked with
drm_atomic_helper_commit_tail_rpm().

Another reason is that the plane_state of drm_atomic_state is not
synchronized with the plane_state stored in mtk_crtc during crtc enablng,
so just set all planes to disabled.

Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com>
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: CK Hu <ck.hu@mediatek.com>
Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230809125722.24112-3-jason-jh.lin@mediatek.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index e83b1c406b96..cc3cb5b63d44 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
@@ -320,6 +320,9 @@ static int mtk_crtc_ddp_hw_init(struct mtk_drm_crtc *mtk_crtc)
 		unsigned int local_layer;
 
 		plane_state = to_mtk_plane_state(plane->state);
+
+		/* should not enable layer before crtc enabled */
+		plane_state->pending.enable = false;
 		comp = mtk_drm_ddp_comp_for_plane(crtc, plane, &local_layer);
 		if (comp)
 			mtk_ddp_comp_layer_config(comp, local_layer,

From 0dd40dca1ebbc8530ea61f431081a8e03cf1d71b Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 2 Sep 2023 19:34:31 +0200
Subject: [PATCH 0382/1043] drm/rockchip: cdn-dp: Fix some error handling paths
 in cdn_dp_probe()

[ Upstream commit 44b968d0d0868b7a9b7a5c64464ada464ff4d532 ]

cdn_dp_audio_codec_init() can fail. So add some error handling.

If component_add() fails, the previous cdn_dp_audio_codec_init() call
should be undone, as already done in the remove function.

Fixes: 88582f564692 ("drm/rockchip: cdn-dp: Don't unregister audio dev when unbinding")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/8494a41602fadb7439630921a9779640698f2f9f.1693676045.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rockchip/cdn-dp-core.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c
index adeaa0140f0f..53cad1003ad7 100644
--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
+++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
@@ -1145,6 +1145,7 @@ static int cdn_dp_probe(struct platform_device *pdev)
 	struct cdn_dp_device *dp;
 	struct extcon_dev *extcon;
 	struct phy *phy;
+	int ret;
 	int i;
 
 	dp = devm_kzalloc(dev, sizeof(*dp), GFP_KERNEL);
@@ -1185,9 +1186,19 @@ static int cdn_dp_probe(struct platform_device *pdev)
 	mutex_init(&dp->lock);
 	dev_set_drvdata(dev, dp);
 
-	cdn_dp_audio_codec_init(dp, dev);
+	ret = cdn_dp_audio_codec_init(dp, dev);
+	if (ret)
+		return ret;
 
-	return component_add(dev, &cdn_dp_component_ops);
+	ret = component_add(dev, &cdn_dp_component_ops);
+	if (ret)
+		goto err_audio_deinit;
+
+	return 0;
+
+err_audio_deinit:
+	platform_device_unregister(dp->audio_pdev);
+	return ret;
 }
 
 static int cdn_dp_remove(struct platform_device *pdev)

From 666a4120dcf66586bdabd1b67a0d00507394fb14 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Mon, 16 Oct 2023 11:24:25 +0100
Subject: [PATCH 0383/1043] arm64/arm: xen: enlighten: Fix KPTI checks

[ Upstream commit 20f3b8eafe0ba5d3c69d5011a9b07739e9645132 ]

When KPTI is in use, we cannot register a runstate region as XEN
requires that this is always a valid VA, which we cannot guarantee. Due
to this, xen_starting_cpu() must avoid registering each CPU's runstate
region, and xen_guest_init() must avoid setting up features that depend
upon it.

We tried to ensure that in commit:

  f88af7229f6f22ce (" xen/arm: do not setup the runstate info page if kpti is enabled")

... where we added checks for xen_kernel_unmapped_at_usr(), which wraps
arm64_kernel_unmapped_at_el0() on arm64 and is always false on 32-bit
arm.

Unfortunately, as xen_guest_init() is an early_initcall, this happens
before secondary CPUs are booted and arm64 has finalized the
ARM64_UNMAP_KERNEL_AT_EL0 cpucap which backs
arm64_kernel_unmapped_at_el0(), and so this can subsequently be set as
secondary CPUs are onlined. On a big.LITTLE system where the boot CPU
does not require KPTI but some secondary CPUs do, this will result in
xen_guest_init() intializing features that depend on the runstate
region, and xen_starting_cpu() registering the runstate region on some
CPUs before KPTI is subsequent enabled, resulting the the problems the
aforementioned commit tried to avoid.

Handle this more robsutly by deferring the initialization of the
runstate region until secondary CPUs have been initialized and the
ARM64_UNMAP_KERNEL_AT_EL0 cpucap has been finalized. The per-cpu work is
moved into a new hotplug starting function which is registered later
when we're certain that KPTI will not be used.

Fixes: f88af7229f6f ("xen/arm: do not setup the runstate info page if kpti is enabled")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Bertrand Marquis <bertrand.marquis@arm.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Stefano Stabellini <sstabellini@kernel.org>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/xen/enlighten.c   | 25 ++++++++++++++++---------
 include/linux/cpuhotplug.h |  1 +
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index 8ad576ecd0f1..3d25fd615250 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -158,9 +158,6 @@ static int xen_starting_cpu(unsigned int cpu)
 	BUG_ON(err);
 	per_cpu(xen_vcpu, cpu) = vcpup;
 
-	if (!xen_kernel_unmapped_at_usr())
-		xen_setup_runstate_info(cpu);
-
 after_register_vcpu_info:
 	enable_percpu_irq(xen_events_irq, 0);
 	return 0;
@@ -386,9 +383,6 @@ static int __init xen_guest_init(void)
 		return -EINVAL;
 	}
 
-	if (!xen_kernel_unmapped_at_usr())
-		xen_time_setup_guest();
-
 	if (xen_initial_domain())
 		pvclock_gtod_register_notifier(&xen_pvclock_gtod_notifier);
 
@@ -398,7 +392,13 @@ static int __init xen_guest_init(void)
 }
 early_initcall(xen_guest_init);
 
-static int __init xen_pm_init(void)
+static int xen_starting_runstate_cpu(unsigned int cpu)
+{
+	xen_setup_runstate_info(cpu);
+	return 0;
+}
+
+static int __init xen_late_init(void)
 {
 	if (!xen_domain())
 		return -ENODEV;
@@ -411,9 +411,16 @@ static int __init xen_pm_init(void)
 		do_settimeofday64(&ts);
 	}
 
-	return 0;
+	if (xen_kernel_unmapped_at_usr())
+		return 0;
+
+	xen_time_setup_guest();
+
+	return cpuhp_setup_state(CPUHP_AP_ARM_XEN_RUNSTATE_STARTING,
+				 "arm/xen_runstate:starting",
+				 xen_starting_runstate_cpu, NULL);
 }
-late_initcall(xen_pm_init);
+late_initcall(xen_late_init);
 
 
 /* empty stubs */
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index cb87247da5ba..7cc2889608e0 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -144,6 +144,7 @@ enum cpuhp_state {
 	/* Must be the last timer callback */
 	CPUHP_AP_DUMMY_TIMER_STARTING,
 	CPUHP_AP_ARM_XEN_STARTING,
+	CPUHP_AP_ARM_XEN_RUNSTATE_STARTING,
 	CPUHP_AP_ARM_CORESIGHT_STARTING,
 	CPUHP_AP_ARM_CORESIGHT_CTI_STARTING,
 	CPUHP_AP_ARM64_ISNDEP_STARTING,

From bc714abe7dc064fb1b9bcdd901df64a5db16e235 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Wed, 11 Oct 2023 11:01:48 +0300
Subject: [PATCH 0384/1043] drm/rockchip: Fix type promotion bug in
 rockchip_gem_iommu_map()

[ Upstream commit 6471da5ee311d53ef46eebcb7725bc94266cc0cf ]

The "ret" variable is declared as ssize_t and it can hold negative error
codes but the "rk_obj->base.size" variable is type size_t.  This means
that when we compare them, they are both type promoted to size_t and the
negative error code becomes a high unsigned value and is treated as
success.  Add a cast to fix this.

Fixes: 38f993b7c59e ("drm/rockchip: Do not use DMA mapping API if attached to IOMMU domain")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/2bfa28b5-145d-4b9e-a18a-98819dd686ce@moroto.mountain
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
index 22ff4a592976..6038aafa29c6 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
@@ -38,7 +38,7 @@ static int rockchip_gem_iommu_map(struct rockchip_gem_object *rk_obj)
 
 	ret = iommu_map_sgtable(private->domain, rk_obj->dma_addr, rk_obj->sgt,
 				prot);
-	if (ret < rk_obj->base.size) {
+	if (ret < (ssize_t)rk_obj->base.size) {
 		DRM_ERROR("failed to map buffer: size=%zd request_size=%zd\n",
 			  ret, rk_obj->base.size);
 		ret = -ENOMEM;

From 1e17eab1a49a58f754dfbc1e535dfeee50cd78ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?=
 <marmarek@invisiblethingslab.com>
Date: Mon, 16 Oct 2023 15:13:25 +0200
Subject: [PATCH 0385/1043] xen-pciback: Consider INTx disabled when MSI/MSI-X
 is enabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 2c269f42d0f382743ab230308b836ffe5ae9b2ae ]

Linux enables MSI-X before disabling INTx, but keeps MSI-X masked until
the table is filled. Then it disables INTx just before clearing MASKALL
bit. Currently this approach is rejected by xen-pciback.
According to the PCIe spec, device cannot use INTx when MSI/MSI-X is
enabled (in other words: enabling MSI/MSI-X implicitly disables INTx).

Change the logic to consider INTx disabled if MSI/MSI-X is enabled. This
applies to three places:
 - checking currently enabled interrupts type,
 - transition to MSI/MSI-X - where INTx would be implicitly disabled,
 - clearing INTx disable bit - which can be allowed even if MSI/MSI-X is
   enabled, as device should consider INTx disabled anyway in that case

Fixes: 5e29500eba2a ("xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too")
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20231016131348.1734721-1-marmarek@invisiblethingslab.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/xen-pciback/conf_space.c          | 19 +++++++++++------
 .../xen/xen-pciback/conf_space_capability.c   |  8 ++++++-
 drivers/xen/xen-pciback/conf_space_header.c   | 21 +++----------------
 3 files changed, 23 insertions(+), 25 deletions(-)

diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
index 059de92aea7d..d47eee6c5143 100644
--- a/drivers/xen/xen-pciback/conf_space.c
+++ b/drivers/xen/xen-pciback/conf_space.c
@@ -288,12 +288,6 @@ int xen_pcibk_get_interrupt_type(struct pci_dev *dev)
 	u16 val;
 	int ret = 0;
 
-	err = pci_read_config_word(dev, PCI_COMMAND, &val);
-	if (err)
-		return err;
-	if (!(val & PCI_COMMAND_INTX_DISABLE))
-		ret |= INTERRUPT_TYPE_INTX;
-
 	/*
 	 * Do not trust dev->msi(x)_enabled here, as enabling could be done
 	 * bypassing the pci_*msi* functions, by the qemu.
@@ -316,6 +310,19 @@ int xen_pcibk_get_interrupt_type(struct pci_dev *dev)
 		if (val & PCI_MSIX_FLAGS_ENABLE)
 			ret |= INTERRUPT_TYPE_MSIX;
 	}
+
+	/*
+	 * PCIe spec says device cannot use INTx if MSI/MSI-X is enabled,
+	 * so check for INTx only when both are disabled.
+	 */
+	if (!ret) {
+		err = pci_read_config_word(dev, PCI_COMMAND, &val);
+		if (err)
+			return err;
+		if (!(val & PCI_COMMAND_INTX_DISABLE))
+			ret |= INTERRUPT_TYPE_INTX;
+	}
+
 	return ret ?: INTERRUPT_TYPE_NONE;
 }
 
diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c
index 097316a74126..1948a9700c8f 100644
--- a/drivers/xen/xen-pciback/conf_space_capability.c
+++ b/drivers/xen/xen-pciback/conf_space_capability.c
@@ -236,10 +236,16 @@ static int msi_msix_flags_write(struct pci_dev *dev, int offset, u16 new_value,
 		return PCIBIOS_SET_FAILED;
 
 	if (new_value & field_config->enable_bit) {
-		/* don't allow enabling together with other interrupt types */
+		/*
+		 * Don't allow enabling together with other interrupt type, but do
+		 * allow enabling MSI(-X) while INTx is still active to please Linuxes
+		 * MSI(-X) startup sequence. It is safe to do, as according to PCI
+		 * spec, device with enabled MSI(-X) shouldn't use INTx.
+		 */
 		int int_type = xen_pcibk_get_interrupt_type(dev);
 
 		if (int_type == INTERRUPT_TYPE_NONE ||
+		    int_type == INTERRUPT_TYPE_INTX ||
 		    int_type == field_config->int_type)
 			goto write;
 		return PCIBIOS_SET_FAILED;
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index ac45cdc38e85..fcaa050d692d 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -104,24 +104,9 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
 		pci_clear_mwi(dev);
 	}
 
-	if (dev_data && dev_data->allow_interrupt_control) {
-		if ((cmd->val ^ value) & PCI_COMMAND_INTX_DISABLE) {
-			if (value & PCI_COMMAND_INTX_DISABLE) {
-				pci_intx(dev, 0);
-			} else {
-				/* Do not allow enabling INTx together with MSI or MSI-X. */
-				switch (xen_pcibk_get_interrupt_type(dev)) {
-				case INTERRUPT_TYPE_NONE:
-					pci_intx(dev, 1);
-					break;
-				case INTERRUPT_TYPE_INTX:
-					break;
-				default:
-					return PCIBIOS_SET_FAILED;
-				}
-			}
-		}
-	}
+	if (dev_data && dev_data->allow_interrupt_control &&
+	    ((cmd->val ^ value) & PCI_COMMAND_INTX_DISABLE))
+		pci_intx(dev, !(value & PCI_COMMAND_INTX_DISABLE));
 
 	cmd->val = value;
 

From 4df18b233ef2f9143467bf47b0925e6950a1551d Mon Sep 17 00:00:00 2001
From: Gaurav Kohli <quic_gkohli@quicinc.com>
Date: Fri, 15 Sep 2023 20:03:04 +0530
Subject: [PATCH 0386/1043] arm64: dts: qcom: msm8916: Fix iommu local address
 range

[ Upstream commit 2de8ee9f58fa51f707c71f8fbcd8470ab0078102 ]

Fix the apps iommu local address space range as per data sheet.

Fixes: 6a6729f38436 ("arm64: dts: qcom: msm8916: Add IOMMU support")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Gaurav Kohli <quic_gkohli@quicinc.com>
Reviewed-by: Stephan Gerhold <stephan@gerhold.net>
Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230915143304.477-1-quic_gkohli@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
index 5b79e4a37331..c39a299fc636 100644
--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
@@ -1175,7 +1175,7 @@ apps_iommu: iommu@1ef0000 {
 			#size-cells = <1>;
 			#iommu-cells = <1>;
 			compatible = "qcom,msm8916-iommu", "qcom,msm-iommu-v1";
-			ranges = <0 0x01e20000 0x40000>;
+			ranges = <0 0x01e20000 0x20000>;
 			reg = <0x01ef0000 0x3000>;
 			clocks = <&gcc GCC_SMMU_CFG_CLK>,
 				 <&gcc GCC_APSS_TCU_CLK>;

From 8bd7c8a9b838d1d18282cc37c3a583c1cb75f00b Mon Sep 17 00:00:00 2001
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Date: Sun, 27 Aug 2023 01:19:11 +0300
Subject: [PATCH 0387/1043] arm64: dts: qcom: sdm845-mtp: fix WiFi
 configuration

[ Upstream commit b33868a52f342d9b1f20aa5bffe40cbd69bd0a4b ]

Enable the host-cap-8bit quirk on this device. It is required for the
WiFi to function properly.

Fixes: 022bccb840b7 ("arm64: dts: sdm845: Add WCN3990 WLAN module device node")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20230826221915.846937-2-dmitry.baryshkov@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sdm845-mtp.dts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
index 1372fe8601f5..e3d2fb9aafe4 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
@@ -564,6 +564,8 @@ &wifi {
 	vdd-1.8-xo-supply = <&vreg_l7a_1p8>;
 	vdd-1.3-rfa-supply = <&vreg_l17a_1p3>;
 	vdd-3.3-ch0-supply = <&vreg_l25a_3p3>;
+
+	qcom,snoc-host-cap-8bit-quirk;
 };
 
 /* PINCTRL - additions to nodes defined in sdm845.dtsi */

From a44aa8d8a5320770b446f8ababa23daae4316d0d Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date: Sun, 24 Sep 2023 20:39:13 +0200
Subject: [PATCH 0388/1043] ARM: dts: qcom: mdm9615: populate vsdcc fixed
 regulator

[ Upstream commit 09f8ee81b6da5f76de8b83c8bfc4475b54e101e0 ]

Fixed regulator put under "regulators" node will not be populated,
unless simple-bus or something similar is used.  Drop the "regulators"
wrapper node to fix this.

Fixes: 2c5e596524e7 ("ARM: dts: Add MDM9615 dtsi")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20230924183914.51414-3-krzysztof.kozlowski@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/qcom-mdm9615.dtsi | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/arch/arm/boot/dts/qcom-mdm9615.dtsi b/arch/arm/boot/dts/qcom-mdm9615.dtsi
index ad9b52d53ef9..982f3c392196 100644
--- a/arch/arm/boot/dts/qcom-mdm9615.dtsi
+++ b/arch/arm/boot/dts/qcom-mdm9615.dtsi
@@ -82,14 +82,12 @@ cxo_board {
 		};
 	};
 
-	regulators {
-		vsdcc_fixed: vsdcc-regulator {
-			compatible = "regulator-fixed";
-			regulator-name = "SDCC Power";
-			regulator-min-microvolt = <2700000>;
-			regulator-max-microvolt = <2700000>;
-			regulator-always-on;
-		};
+	vsdcc_fixed: vsdcc-regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "SDCC Power";
+		regulator-min-microvolt = <2700000>;
+		regulator-max-microvolt = <2700000>;
+		regulator-always-on;
 	};
 
 	soc: soc {

From 5e5b85ea0f4bc484bfe4cc73ead51fa48d2366a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Tue, 26 Sep 2023 10:32:29 +0200
Subject: [PATCH 0389/1043] soc: qcom: llcc: Handle a second device without
 data corruption
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f1a1bc8775b26345aba2be278118999e7f661d3d ]

Usually there is only one llcc device. But if there were a second, even
a failed probe call would modify the global drv_data pointer. So check
if drv_data is valid before overwriting it.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Fixes: a3134fb09e0b ("drivers: soc: Add LLCC driver")
Link: https://lore.kernel.org/r/20230926083229.2073890-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/llcc-qcom.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c
index c60fe98f03e3..8cf7b142e141 100644
--- a/drivers/soc/qcom/llcc-qcom.c
+++ b/drivers/soc/qcom/llcc-qcom.c
@@ -413,6 +413,9 @@ static int qcom_llcc_probe(struct platform_device *pdev)
 	const struct llcc_slice_config *llcc_cfg;
 	u32 sz;
 
+	if (!IS_ERR(drv_data))
+		return -EBUSY;
+
 	drv_data = devm_kzalloc(dev, sizeof(*drv_data), GFP_KERNEL);
 	if (!drv_data) {
 		ret = -ENOMEM;

From bcc7d46fa4ddd16554f4fabe1e9684c903e4aa11 Mon Sep 17 00:00:00 2001
From: Dhruva Gole <d-gole@ti.com>
Date: Thu, 21 Sep 2023 14:40:26 +0530
Subject: [PATCH 0390/1043] firmware: ti_sci: Mark driver as non removable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 7b7a224b1ba1703583b25a3641ad9798f34d832a ]

The TI-SCI message protocol provides a way to communicate between
various compute processors with a central system controller entity. It
provides the fundamental device management capability and clock control
in the SOCs that it's used in.

The remove function failed to do all the necessary cleanup if
there are registered users. Some things are freed however which
likely results in an oops later on.

Ensure that the driver isn't unbound by suppressing its bind and unbind
sysfs attributes. As the driver is built-in there is no way to remove
device once bound.

We can also remove the ti_sci_remove call along with the
ti_sci_debugfs_destroy as there are no callers for it any longer.

Fixes: aa276781a64a ("firmware: Add basic support for TI System Control Interface (TI-SCI) protocol")
Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Closes: https://lore.kernel.org/linux-arm-kernel/20230216083908.mvmydic5lpi3ogo7@pengutronix.de/
Suggested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Dhruva Gole <d-gole@ti.com>
Link: https://lore.kernel.org/r/20230921091025.133130-1-d-gole@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/ti_sci.c | 46 +--------------------------------------
 1 file changed, 1 insertion(+), 45 deletions(-)

diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
index 896f53ec7857..fe6be0771a07 100644
--- a/drivers/firmware/ti_sci.c
+++ b/drivers/firmware/ti_sci.c
@@ -190,19 +190,6 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
 	return 0;
 }
 
-/**
- * ti_sci_debugfs_destroy() - clean up log debug file
- * @pdev:	platform device pointer
- * @info:	Pointer to SCI entity information
- */
-static void ti_sci_debugfs_destroy(struct platform_device *pdev,
-				   struct ti_sci_info *info)
-{
-	if (IS_ERR(info->debug_region))
-		return;
-
-	debugfs_remove(info->d);
-}
 #else /* CONFIG_DEBUG_FS */
 static inline int ti_sci_debugfs_create(struct platform_device *dev,
 					struct ti_sci_info *info)
@@ -3510,43 +3497,12 @@ static int ti_sci_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static int ti_sci_remove(struct platform_device *pdev)
-{
-	struct ti_sci_info *info;
-	struct device *dev = &pdev->dev;
-	int ret = 0;
-
-	of_platform_depopulate(dev);
-
-	info = platform_get_drvdata(pdev);
-
-	if (info->nb.notifier_call)
-		unregister_restart_handler(&info->nb);
-
-	mutex_lock(&ti_sci_list_mutex);
-	if (info->users)
-		ret = -EBUSY;
-	else
-		list_del(&info->node);
-	mutex_unlock(&ti_sci_list_mutex);
-
-	if (!ret) {
-		ti_sci_debugfs_destroy(pdev, info);
-
-		/* Safe to free channels since no more users */
-		mbox_free_channel(info->chan_tx);
-		mbox_free_channel(info->chan_rx);
-	}
-
-	return ret;
-}
-
 static struct platform_driver ti_sci_driver = {
 	.probe = ti_sci_probe,
-	.remove = ti_sci_remove,
 	.driver = {
 		   .name = "ti-sci",
 		   .of_match_table = of_match_ptr(ti_sci_of_match),
+		   .suppress_bind_attrs = true,
 	},
 };
 module_platform_driver(ti_sci_driver);

From a0846b4c8e7490196a1c3561f96c7c5aea970121 Mon Sep 17 00:00:00 2001
From: Sudeep Holla <sudeep.holla@arm.com>
Date: Wed, 4 Oct 2023 20:36:00 +0100
Subject: [PATCH 0391/1043] clk: scmi: Free scmi_clk allocated when the clocks
 with invalid info are skipped

[ Upstream commit 3537a75e73f3420614a358d0c8b390ea483cc87d ]

Add the missing devm_kfree() when we skip the clocks with invalid or
missing information from the firmware.

Cc: Cristian Marussi <cristian.marussi@arm.com>
Cc: Michael Turquette <mturquette@baylibre.com>
Cc: Stephen Boyd <sboyd@kernel.org>
Cc: linux-clk@vger.kernel.org
Fixes: 6d6a1d82eaef ("clk: add support for clocks provided by SCMI")
Link: https://lore.kernel.org/r/20231004193600.66232-1-sudeep.holla@arm.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/clk-scmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c
index c754dfbb73fd..c62636fb4aca 100644
--- a/drivers/clk/clk-scmi.c
+++ b/drivers/clk/clk-scmi.c
@@ -170,6 +170,7 @@ static int scmi_clocks_probe(struct scmi_device *sdev)
 		sclk->info = handle->clk_ops->info_get(handle, idx);
 		if (!sclk->info) {
 			dev_dbg(dev, "invalid clock info for idx %d\n", idx);
+			devm_kfree(dev, sclk);
 			continue;
 		}
 

From b3768f089210cb4e939f77477c0b30c2f45fa230 Mon Sep 17 00:00:00 2001
From: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
Date: Fri, 13 Oct 2023 13:36:28 +0200
Subject: [PATCH 0392/1043] selftests/pidfd: Fix ksft print formats

[ Upstream commit 4d7f4e8158b62f63031510cdc24acc520956c091 ]

Compiling pidfd selftest after adding a __printf() attribute to
ksft_print_msg() and ksft_test_result_pass() exposes -Wformat warnings
in error_report(), test_pidfd_poll_exec_thread(),
child_poll_exec_test(), test_pidfd_poll_leader_exit_thread(),
child_poll_leader_exit_test().

The ksft_test_result_pass() in error_report() expects a string but
doesn't provide any argument after the format string. All the other
calls to ksft_print_msg() in the functions mentioned above have format
strings that don't match with other passed arguments.

Fix format specifiers so they match the passed variables.

Add a missing variable to ksft_test_result_pass() inside
error_report() so it matches other cases in the switch statement.

Fixes: 2def297ec7fb ("pidfd: add tests for NSpid info in fdinfo")

Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/pidfd/pidfd_fdinfo_test.c |  2 +-
 tools/testing/selftests/pidfd/pidfd_test.c        | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/tools/testing/selftests/pidfd/pidfd_fdinfo_test.c b/tools/testing/selftests/pidfd/pidfd_fdinfo_test.c
index 3fd8e903118f..3bc46d6151f4 100644
--- a/tools/testing/selftests/pidfd/pidfd_fdinfo_test.c
+++ b/tools/testing/selftests/pidfd/pidfd_fdinfo_test.c
@@ -62,7 +62,7 @@ static void error_report(struct error *err, const char *test_name)
 		break;
 
 	case PIDFD_PASS:
-		ksft_test_result_pass("%s test: Passed\n");
+		ksft_test_result_pass("%s test: Passed\n", test_name);
 		break;
 
 	default:
diff --git a/tools/testing/selftests/pidfd/pidfd_test.c b/tools/testing/selftests/pidfd/pidfd_test.c
index 9a2d64901d59..79f543ad394c 100644
--- a/tools/testing/selftests/pidfd/pidfd_test.c
+++ b/tools/testing/selftests/pidfd/pidfd_test.c
@@ -380,13 +380,13 @@ static int test_pidfd_send_signal_syscall_support(void)
 
 static void *test_pidfd_poll_exec_thread(void *priv)
 {
-	ksft_print_msg("Child Thread: starting. pid %d tid %d ; and sleeping\n",
+	ksft_print_msg("Child Thread: starting. pid %d tid %ld ; and sleeping\n",
 			getpid(), syscall(SYS_gettid));
 	ksft_print_msg("Child Thread: doing exec of sleep\n");
 
 	execl("/bin/sleep", "sleep", str(CHILD_THREAD_MIN_WAIT), (char *)NULL);
 
-	ksft_print_msg("Child Thread: DONE. pid %d tid %d\n",
+	ksft_print_msg("Child Thread: DONE. pid %d tid %ld\n",
 			getpid(), syscall(SYS_gettid));
 	return NULL;
 }
@@ -426,7 +426,7 @@ static int child_poll_exec_test(void *args)
 {
 	pthread_t t1;
 
-	ksft_print_msg("Child (pidfd): starting. pid %d tid %d\n", getpid(),
+	ksft_print_msg("Child (pidfd): starting. pid %d tid %ld\n", getpid(),
 			syscall(SYS_gettid));
 	pthread_create(&t1, NULL, test_pidfd_poll_exec_thread, NULL);
 	/*
@@ -477,10 +477,10 @@ static void test_pidfd_poll_exec(int use_waitpid)
 
 static void *test_pidfd_poll_leader_exit_thread(void *priv)
 {
-	ksft_print_msg("Child Thread: starting. pid %d tid %d ; and sleeping\n",
+	ksft_print_msg("Child Thread: starting. pid %d tid %ld ; and sleeping\n",
 			getpid(), syscall(SYS_gettid));
 	sleep(CHILD_THREAD_MIN_WAIT);
-	ksft_print_msg("Child Thread: DONE. pid %d tid %d\n", getpid(), syscall(SYS_gettid));
+	ksft_print_msg("Child Thread: DONE. pid %d tid %ld\n", getpid(), syscall(SYS_gettid));
 	return NULL;
 }
 
@@ -489,7 +489,7 @@ static int child_poll_leader_exit_test(void *args)
 {
 	pthread_t t1, t2;
 
-	ksft_print_msg("Child: starting. pid %d tid %d\n", getpid(), syscall(SYS_gettid));
+	ksft_print_msg("Child: starting. pid %d tid %ld\n", getpid(), syscall(SYS_gettid));
 	pthread_create(&t1, NULL, test_pidfd_poll_leader_exit_thread, NULL);
 	pthread_create(&t2, NULL, test_pidfd_poll_leader_exit_thread, NULL);
 

From 5176ebe6aa2bd08eeb9e43fd4ea37f2c50d8a937 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
Date: Mon, 4 Sep 2023 12:53:32 +0300
Subject: [PATCH 0393/1043] selftests/resctrl: Ensure the benchmark commands
 fits to its array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4a28c7665c2a1ac0400864eabb0c641e135f61aa ]

Benchmark command is copied into an array in the stack. The array is
BENCHMARK_ARGS items long but the command line could try to provide a
longer command. Argument size is also fixed by BENCHMARK_ARG_SIZE (63
bytes of space after fitting the terminating \0 character) and user
could have inputted argument longer than that.

Return error in case the benchmark command does not fit to the space
allocated for it.

Fixes: ecdbb911f22d ("selftests/resctrl: Add MBM test")
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Tested-by: Shaopeng Tan <tan.shaopeng@jp.fujitsu.com>
Reviewed-by: Shaopeng Tan <tan.shaopeng@jp.fujitsu.com>
Reviewed-by: "Wieczor-Retman, Maciej" <maciej.wieczor-retman@intel.com>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/resctrl/resctrl_tests.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/testing/selftests/resctrl/resctrl_tests.c b/tools/testing/selftests/resctrl/resctrl_tests.c
index bd98746c6f85..b33d1d6dd99a 100644
--- a/tools/testing/selftests/resctrl/resctrl_tests.c
+++ b/tools/testing/selftests/resctrl/resctrl_tests.c
@@ -132,9 +132,14 @@ int main(int argc, char **argv)
 	detect_amd();
 
 	if (has_ben) {
+		if (argc - ben_ind >= BENCHMARK_ARGS)
+			ksft_exit_fail_msg("Too long benchmark command.\n");
+
 		/* Extract benchmark command from command line. */
 		for (i = ben_ind; i < argc; i++) {
 			benchmark_cmd[i - ben_ind] = benchmark_cmd_area[i];
+			if (strlen(argv[i]) >= BENCHMARK_ARG_SIZE)
+				ksft_exit_fail_msg("Too long benchmark command argument.\n");
 			sprintf(benchmark_cmd[i - ben_ind], "%s", argv[i]);
 		}
 		benchmark_cmd[ben_count] = NULL;

From 02db438311f85b803b15767d51f9b2bc7fd7301d Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Mon, 4 Sep 2023 22:17:29 +0200
Subject: [PATCH 0394/1043] crypto: hisilicon/hpre - Fix a erroneous check
 after snprintf()

[ Upstream commit c977950146720abff14e46d8c53f5638b06a9182 ]

This error handling looks really strange.
Check if the string has been truncated instead.

Fixes: 02ab994635eb ("crypto: hisilicon - Fixed some tiny bugs of HPRE")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/hisilicon/hpre/hpre_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
index a33394d91bbf..8da9d6dc6e87 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
@@ -637,7 +637,7 @@ static int hpre_cluster_debugfs_init(struct hisi_qm *qm)
 
 	for (i = 0; i < HPRE_CLUSTERS_NUM; i++) {
 		ret = snprintf(buf, HPRE_DBGFS_VAL_MAX_LEN, "cluster%d", i);
-		if (ret < 0)
+		if (ret >= HPRE_DBGFS_VAL_MAX_LEN)
 			return -EINVAL;
 		tmp_d = debugfs_create_dir(buf, qm->debug.debug_root);
 

From ffb3483c4b0bff1951e4020b9d73e4c13bf7fe93 Mon Sep 17 00:00:00 2001
From: Jonas Gorski <jonas.gorski@gmail.com>
Date: Sun, 10 Sep 2023 10:34:17 +0200
Subject: [PATCH 0395/1043] hwrng: geode - fix accessing registers

[ Upstream commit 464bd8ec2f06707f3773676a1bd2c64832a3c805 ]

When the membase and pci_dev pointer were moved to a new struct in priv,
the actual membase users were left untouched, and they started reading
out arbitrary memory behind the struct instead of registers. This
unfortunately turned the RNG into a constant number generator, depending
on the content of what was at that offset.

To fix this, update geode_rng_data_{read,present}() to also get the
membase via amd_geode_priv, and properly read from the right addresses
again.

Fixes: 9f6ec8dc574e ("hwrng: geode - Fix PCI device refcount leak")
Reported-by: Timur I. Davletshin <timur.davletshin@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217882
Tested-by: Timur I. Davletshin <timur.davletshin@gmail.com>
Suggested-by: Jo-Philipp Wich <jo@mein.io>
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/hw_random/geode-rng.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c
index 207272979f23..2f8289865ec8 100644
--- a/drivers/char/hw_random/geode-rng.c
+++ b/drivers/char/hw_random/geode-rng.c
@@ -58,7 +58,8 @@ struct amd_geode_priv {
 
 static int geode_rng_data_read(struct hwrng *rng, u32 *data)
 {
-	void __iomem *mem = (void __iomem *)rng->priv;
+	struct amd_geode_priv *priv = (struct amd_geode_priv *)rng->priv;
+	void __iomem *mem = priv->membase;
 
 	*data = readl(mem + GEODE_RNG_DATA_REG);
 
@@ -67,7 +68,8 @@ static int geode_rng_data_read(struct hwrng *rng, u32 *data)
 
 static int geode_rng_data_present(struct hwrng *rng, int wait)
 {
-	void __iomem *mem = (void __iomem *)rng->priv;
+	struct amd_geode_priv *priv = (struct amd_geode_priv *)rng->priv;
+	void __iomem *mem = priv->membase;
 	int data, i;
 
 	for (i = 0; i < 20; i++) {

From efeaa2396e3b89fedfb721a838dbc46cded52574 Mon Sep 17 00:00:00 2001
From: Chen Ni <nichen@iscas.ac.cn>
Date: Thu, 14 Sep 2023 07:03:27 +0000
Subject: [PATCH 0396/1043] libnvdimm/of_pmem: Use devm_kstrdup instead of
 kstrdup and check its return value

[ Upstream commit 6fd4ebfc4d61e3097b595ab2725d513e3bbd6739 ]

Use devm_kstrdup() instead of kstrdup() and check its return value to
avoid memory leak.

Fixes: 49bddc73d15c ("libnvdimm/of_pmem: Provide a unique name for bus provider")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvdimm/of_pmem.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/nvdimm/of_pmem.c b/drivers/nvdimm/of_pmem.c
index 10dbdcdfb9ce..0243789ba914 100644
--- a/drivers/nvdimm/of_pmem.c
+++ b/drivers/nvdimm/of_pmem.c
@@ -30,7 +30,13 @@ static int of_pmem_region_probe(struct platform_device *pdev)
 	if (!priv)
 		return -ENOMEM;
 
-	priv->bus_desc.provider_name = kstrdup(pdev->name, GFP_KERNEL);
+	priv->bus_desc.provider_name = devm_kstrdup(&pdev->dev, pdev->name,
+							GFP_KERNEL);
+	if (!priv->bus_desc.provider_name) {
+		kfree(priv);
+		return -ENOMEM;
+	}
+
 	priv->bus_desc.module = THIS_MODULE;
 	priv->bus_desc.of_node = np;
 

From b0e7a935739f33ed2bd6868b89f97dd4c2683c26 Mon Sep 17 00:00:00 2001
From: Tomas Glozar <tglozar@redhat.com>
Date: Wed, 20 Sep 2023 07:37:12 +0200
Subject: [PATCH 0397/1043] nd_btt: Make BTT lanes preemptible

[ Upstream commit 36c75ce3bd299878fd9b238e9803d3817ddafbf3 ]

nd_region_acquire_lane uses get_cpu, which disables preemption. This is
an issue on PREEMPT_RT kernels, since btt_write_pg and also
nd_region_acquire_lane itself take a spin lock, resulting in BUG:
sleeping function called from invalid context.

Fix the issue by replacing get_cpu with smp_process_id and
migrate_disable when needed. This makes BTT operations preemptible, thus
permitting the use of spin_lock.

BUG example occurring when running ndctl tests on PREEMPT_RT kernel:

BUG: sleeping function called from invalid context at
kernel/locking/spinlock_rt.c:48
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4903, name:
libndctl
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
Preemption disabled at:
[<ffffffffc1313db5>] nd_region_acquire_lane+0x15/0x90 [libnvdimm]
Call Trace:
 <TASK>
 dump_stack_lvl+0x8e/0xb0
 __might_resched+0x19b/0x250
 rt_spin_lock+0x4c/0x100
 ? btt_write_pg+0x2d7/0x500 [nd_btt]
 btt_write_pg+0x2d7/0x500 [nd_btt]
 ? local_clock_noinstr+0x9/0xc0
 btt_submit_bio+0x16d/0x270 [nd_btt]
 __submit_bio+0x48/0x80
 __submit_bio_noacct+0x7e/0x1e0
 submit_bio_wait+0x58/0xb0
 __blkdev_direct_IO_simple+0x107/0x240
 ? inode_set_ctime_current+0x51/0x110
 ? __pfx_submit_bio_wait_endio+0x10/0x10
 blkdev_write_iter+0x1d8/0x290
 vfs_write+0x237/0x330
 ...
 </TASK>

Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvdimm/region_devs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index 1d72653b5c8d..0a75948cde5a 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -959,7 +959,8 @@ unsigned int nd_region_acquire_lane(struct nd_region *nd_region)
 {
 	unsigned int cpu, lane;
 
-	cpu = get_cpu();
+	migrate_disable();
+	cpu = smp_processor_id();
 	if (nd_region->num_lanes < nr_cpu_ids) {
 		struct nd_percpu_lane *ndl_lock, *ndl_count;
 
@@ -978,16 +979,15 @@ EXPORT_SYMBOL(nd_region_acquire_lane);
 void nd_region_release_lane(struct nd_region *nd_region, unsigned int lane)
 {
 	if (nd_region->num_lanes < nr_cpu_ids) {
-		unsigned int cpu = get_cpu();
+		unsigned int cpu = smp_processor_id();
 		struct nd_percpu_lane *ndl_lock, *ndl_count;
 
 		ndl_count = per_cpu_ptr(nd_region->lane, cpu);
 		ndl_lock = per_cpu_ptr(nd_region->lane, lane);
 		if (--ndl_count->count == 0)
 			spin_unlock(&ndl_lock->lock);
-		put_cpu();
 	}
-	put_cpu();
+	migrate_enable();
 }
 EXPORT_SYMBOL(nd_region_release_lane);
 

From 727ba935d906241edb3b8a64a4375701357a4188 Mon Sep 17 00:00:00 2001
From: Gaurav Jain <gaurav.jain@nxp.com>
Date: Thu, 21 Sep 2023 15:14:44 +0530
Subject: [PATCH 0398/1043] crypto: caam/qi2 - fix Chacha20 + Poly1305 self
 test failure

[ Upstream commit 7b8c6aee0d5b864e70c0da82583f9862e374eaf3 ]

key buffer is not copied in chachapoly_setkey function,
results in wrong output for encryption/decryption operation.

fix this by memcpy the key in caam_ctx key arrary

Fixes: c10a53367901 ("crypto: caam/qi2 - add support for Chacha20 + Poly1305")
Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/caam/caamalg_qi2.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c
index 5a40c7d10cc9..43bed47ce59b 100644
--- a/drivers/crypto/caam/caamalg_qi2.c
+++ b/drivers/crypto/caam/caamalg_qi2.c
@@ -636,7 +636,8 @@ static int chachapoly_setkey(struct crypto_aead *aead, const u8 *key,
 	if (keylen != CHACHA_KEY_SIZE + saltlen)
 		return -EINVAL;
 
-	ctx->cdata.key_virt = key;
+	memcpy(ctx->key, key, keylen);
+	ctx->cdata.key_virt = ctx->key;
 	ctx->cdata.keylen = keylen - saltlen;
 
 	return chachapoly_set_sh_desc(aead);

From 16f2033de013d8a88cb750a7bf8abfb99f45a01f Mon Sep 17 00:00:00 2001
From: Gaurav Jain <gaurav.jain@nxp.com>
Date: Thu, 21 Sep 2023 18:12:37 +0530
Subject: [PATCH 0399/1043] crypto: caam/jr - fix Chacha20 + Poly1305 self test
 failure

[ Upstream commit a8d3cdcc092fb2f2882acb6c20473a1be0ef4484 ]

key buffer is not copied in chachapoly_setkey function,
results in wrong output for encryption/decryption operation.

fix this by memcpy the key in caam_ctx key arrary

Fixes: d6bbd4eea243 ("crypto: caam/jr - add support for Chacha20 + Poly1305")
Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/caam/caamalg.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 8697ae53b063..6b513555df34 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -566,7 +566,8 @@ static int chachapoly_setkey(struct crypto_aead *aead, const u8 *key,
 	if (keylen != CHACHA_KEY_SIZE + saltlen)
 		return -EINVAL;
 
-	ctx->cdata.key_virt = key;
+	memcpy(ctx->key, key, keylen);
+	ctx->cdata.key_virt = ctx->key;
 	ctx->cdata.keylen = keylen - saltlen;
 
 	return chachapoly_set_sh_desc(aead);

From a921d6b795a00c0b7fc5dffada4b9afd54ed1ca0 Mon Sep 17 00:00:00 2001
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Date: Mon, 12 Oct 2020 21:38:18 +0100
Subject: [PATCH 0400/1043] crypto: qat - mask device capabilities with soft
 straps

[ Upstream commit 7b07ed5042c5d21467af5aa055f2b49b2e661a83 ]

Enable acceleration engines (AEs) and accelerators based on soft straps
and fuses. When looping with a number of AEs or accelerators, ignore the
ones that are disabled.

This patch is based on earlier work done by Conor McLoughlin.

Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Reviewed-by: Wojciech Ziemba <wojciech.ziemba@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: 4e4e2ed22d50 ("crypto: qat - increase size of buffers")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../crypto/qat/qat_c3xxx/adf_c3xxx_hw_data.c  | 34 +++++++++++++++----
 .../crypto/qat/qat_c3xxx/adf_c3xxx_hw_data.h  |  1 +
 drivers/crypto/qat/qat_c3xxx/adf_drv.c        |  6 ++--
 .../qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c     |  4 +--
 drivers/crypto/qat/qat_c3xxxvf/adf_drv.c      |  4 +--
 .../crypto/qat/qat_c62x/adf_c62x_hw_data.c    | 34 +++++++++++++++----
 .../crypto/qat/qat_c62x/adf_c62x_hw_data.h    |  1 +
 drivers/crypto/qat/qat_c62x/adf_drv.c         |  6 ++--
 .../qat/qat_c62xvf/adf_c62xvf_hw_data.c       |  4 +--
 drivers/crypto/qat/qat_c62xvf/adf_drv.c       |  4 +--
 .../crypto/qat/qat_common/adf_accel_devices.h |  5 +--
 drivers/crypto/qat/qat_common/qat_hal.c       | 27 ++++++++-------
 .../qat/qat_dh895xcc/adf_dh895xcc_hw_data.c   | 20 +++++++----
 drivers/crypto/qat/qat_dh895xcc/adf_drv.c     |  4 +--
 .../qat_dh895xccvf/adf_dh895xccvf_hw_data.c   |  4 +--
 drivers/crypto/qat/qat_dh895xccvf/adf_drv.c   |  4 +--
 16 files changed, 109 insertions(+), 53 deletions(-)

diff --git a/drivers/crypto/qat/qat_c3xxx/adf_c3xxx_hw_data.c b/drivers/crypto/qat/qat_c3xxx/adf_c3xxx_hw_data.c
index aee494d3da52..4b2f5aa83391 100644
--- a/drivers/crypto/qat/qat_c3xxx/adf_c3xxx_hw_data.c
+++ b/drivers/crypto/qat/qat_c3xxx/adf_c3xxx_hw_data.c
@@ -17,15 +17,33 @@ static struct adf_hw_device_class c3xxx_class = {
 	.instances = 0
 };
 
-static u32 get_accel_mask(u32 fuse)
+static u32 get_accel_mask(struct adf_hw_device_data *self)
 {
-	return (~fuse) >> ADF_C3XXX_ACCELERATORS_REG_OFFSET &
-		ADF_C3XXX_ACCELERATORS_MASK;
+	u32 straps = self->straps;
+	u32 fuses = self->fuses;
+	u32 accel;
+
+	accel = ~(fuses | straps) >> ADF_C3XXX_ACCELERATORS_REG_OFFSET;
+	accel &= ADF_C3XXX_ACCELERATORS_MASK;
+
+	return accel;
 }
 
-static u32 get_ae_mask(u32 fuse)
+static u32 get_ae_mask(struct adf_hw_device_data *self)
 {
-	return (~fuse) & ADF_C3XXX_ACCELENGINES_MASK;
+	u32 straps = self->straps;
+	u32 fuses = self->fuses;
+	unsigned long disabled;
+	u32 ae_disable;
+	int accel;
+
+	/* If an accel is disabled, then disable the corresponding two AEs */
+	disabled = ~get_accel_mask(self) & ADF_C3XXX_ACCELERATORS_MASK;
+	ae_disable = BIT(1) | BIT(0);
+	for_each_set_bit(accel, &disabled, ADF_C3XXX_MAX_ACCELERATORS)
+		straps |= ae_disable << (accel << 1);
+
+	return ~(fuses | straps) & ADF_C3XXX_ACCELENGINES_MASK;
 }
 
 static u32 get_num_accels(struct adf_hw_device_data *self)
@@ -109,11 +127,13 @@ static void adf_enable_error_correction(struct adf_accel_dev *accel_dev)
 {
 	struct adf_hw_device_data *hw_device = accel_dev->hw_device;
 	struct adf_bar *misc_bar = &GET_BARS(accel_dev)[ADF_C3XXX_PMISC_BAR];
+	unsigned long accel_mask = hw_device->accel_mask;
+	unsigned long ae_mask = hw_device->ae_mask;
 	void __iomem *csr = misc_bar->virt_addr;
 	unsigned int val, i;
 
 	/* Enable Accel Engine error detection & correction */
-	for (i = 0; i < hw_device->get_num_aes(hw_device); i++) {
+	for_each_set_bit(i, &ae_mask, GET_MAX_ACCELENGINES(accel_dev)) {
 		val = ADF_CSR_RD(csr, ADF_C3XXX_AE_CTX_ENABLES(i));
 		val |= ADF_C3XXX_ENABLE_AE_ECC_ERR;
 		ADF_CSR_WR(csr, ADF_C3XXX_AE_CTX_ENABLES(i), val);
@@ -123,7 +143,7 @@ static void adf_enable_error_correction(struct adf_accel_dev *accel_dev)
 	}
 
 	/* Enable shared memory error detection & correction */
-	for (i = 0; i < hw_device->get_num_accels(hw_device); i++) {
+	for_each_set_bit(i, &accel_mask, ADF_C3XXX_MAX_ACCELERATORS) {
 		val = ADF_CSR_RD(csr, ADF_C3XXX_UERRSSMSH(i));
 		val |= ADF_C3XXX_ERRSSMSH_EN;
 		ADF_CSR_WR(csr, ADF_C3XXX_UERRSSMSH(i), val);
diff --git a/drivers/crypto/qat/qat_c3xxx/adf_c3xxx_hw_data.h b/drivers/crypto/qat/qat_c3xxx/adf_c3xxx_hw_data.h
index 8b5dd2c94ebf..94097816f68a 100644
--- a/drivers/crypto/qat/qat_c3xxx/adf_c3xxx_hw_data.h
+++ b/drivers/crypto/qat/qat_c3xxx/adf_c3xxx_hw_data.h
@@ -18,6 +18,7 @@
 #define ADF_C3XXX_SMIAPF1_MASK_OFFSET (0x3A000 + 0x30)
 #define ADF_C3XXX_SMIA0_MASK 0xFFFF
 #define ADF_C3XXX_SMIA1_MASK 0x1
+#define ADF_C3XXX_SOFTSTRAP_CSR_OFFSET 0x2EC
 /* Error detection and correction */
 #define ADF_C3XXX_AE_CTX_ENABLES(i) (i * 0x1000 + 0x20818)
 #define ADF_C3XXX_AE_MISC_CONTROL(i) (i * 0x1000 + 0x20960)
diff --git a/drivers/crypto/qat/qat_c3xxx/adf_drv.c b/drivers/crypto/qat/qat_c3xxx/adf_drv.c
index ed0e8e33fe4b..da6e88026988 100644
--- a/drivers/crypto/qat/qat_c3xxx/adf_drv.c
+++ b/drivers/crypto/qat/qat_c3xxx/adf_drv.c
@@ -126,10 +126,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	pci_read_config_byte(pdev, PCI_REVISION_ID, &accel_pci_dev->revid);
 	pci_read_config_dword(pdev, ADF_DEVICE_FUSECTL_OFFSET,
 			      &hw_data->fuses);
+	pci_read_config_dword(pdev, ADF_C3XXX_SOFTSTRAP_CSR_OFFSET,
+			      &hw_data->straps);
 
 	/* Get Accelerators and Accelerators Engines masks */
-	hw_data->accel_mask = hw_data->get_accel_mask(hw_data->fuses);
-	hw_data->ae_mask = hw_data->get_ae_mask(hw_data->fuses);
+	hw_data->accel_mask = hw_data->get_accel_mask(hw_data);
+	hw_data->ae_mask = hw_data->get_ae_mask(hw_data);
 	accel_pci_dev->sku = hw_data->get_sku(hw_data);
 	/* If the device has no acceleration engines then ignore it. */
 	if (!hw_data->accel_mask || !hw_data->ae_mask ||
diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
index 9709f29b6454..26b13973f9ac 100644
--- a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
+++ b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
@@ -11,12 +11,12 @@ static struct adf_hw_device_class c3xxxiov_class = {
 	.instances = 0
 };
 
-static u32 get_accel_mask(u32 fuse)
+static u32 get_accel_mask(struct adf_hw_device_data *self)
 {
 	return ADF_C3XXXIOV_ACCELERATORS_MASK;
 }
 
-static u32 get_ae_mask(u32 fuse)
+static u32 get_ae_mask(struct adf_hw_device_data *self)
 {
 	return ADF_C3XXXIOV_ACCELENGINES_MASK;
 }
diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
index ea932b6c4534..067ca5e17d38 100644
--- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
@@ -119,8 +119,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	adf_init_hw_data_c3xxxiov(accel_dev->hw_device);
 
 	/* Get Accelerators and Accelerators Engines masks */
-	hw_data->accel_mask = hw_data->get_accel_mask(hw_data->fuses);
-	hw_data->ae_mask = hw_data->get_ae_mask(hw_data->fuses);
+	hw_data->accel_mask = hw_data->get_accel_mask(hw_data);
+	hw_data->ae_mask = hw_data->get_ae_mask(hw_data);
 	accel_pci_dev->sku = hw_data->get_sku(hw_data);
 
 	/* Create dev top level debugfs entry */
diff --git a/drivers/crypto/qat/qat_c62x/adf_c62x_hw_data.c b/drivers/crypto/qat/qat_c62x/adf_c62x_hw_data.c
index 844ad5ed33fc..c0b5751e9682 100644
--- a/drivers/crypto/qat/qat_c62x/adf_c62x_hw_data.c
+++ b/drivers/crypto/qat/qat_c62x/adf_c62x_hw_data.c
@@ -22,15 +22,33 @@ static struct adf_hw_device_class c62x_class = {
 	.instances = 0
 };
 
-static u32 get_accel_mask(u32 fuse)
+static u32 get_accel_mask(struct adf_hw_device_data *self)
 {
-	return (~fuse) >> ADF_C62X_ACCELERATORS_REG_OFFSET &
-			  ADF_C62X_ACCELERATORS_MASK;
+	u32 straps = self->straps;
+	u32 fuses = self->fuses;
+	u32 accel;
+
+	accel = ~(fuses | straps) >> ADF_C62X_ACCELERATORS_REG_OFFSET;
+	accel &= ADF_C62X_ACCELERATORS_MASK;
+
+	return accel;
 }
 
-static u32 get_ae_mask(u32 fuse)
+static u32 get_ae_mask(struct adf_hw_device_data *self)
 {
-	return (~fuse) & ADF_C62X_ACCELENGINES_MASK;
+	u32 straps = self->straps;
+	u32 fuses = self->fuses;
+	unsigned long disabled;
+	u32 ae_disable;
+	int accel;
+
+	/* If an accel is disabled, then disable the corresponding two AEs */
+	disabled = ~get_accel_mask(self) & ADF_C62X_ACCELERATORS_MASK;
+	ae_disable = BIT(1) | BIT(0);
+	for_each_set_bit(accel, &disabled, ADF_C62X_MAX_ACCELERATORS)
+		straps |= ae_disable << (accel << 1);
+
+	return ~(fuses | straps) & ADF_C62X_ACCELENGINES_MASK;
 }
 
 static u32 get_num_accels(struct adf_hw_device_data *self)
@@ -119,11 +137,13 @@ static void adf_enable_error_correction(struct adf_accel_dev *accel_dev)
 {
 	struct adf_hw_device_data *hw_device = accel_dev->hw_device;
 	struct adf_bar *misc_bar = &GET_BARS(accel_dev)[ADF_C62X_PMISC_BAR];
+	unsigned long accel_mask = hw_device->accel_mask;
+	unsigned long ae_mask = hw_device->ae_mask;
 	void __iomem *csr = misc_bar->virt_addr;
 	unsigned int val, i;
 
 	/* Enable Accel Engine error detection & correction */
-	for (i = 0; i < hw_device->get_num_aes(hw_device); i++) {
+	for_each_set_bit(i, &ae_mask, GET_MAX_ACCELENGINES(accel_dev)) {
 		val = ADF_CSR_RD(csr, ADF_C62X_AE_CTX_ENABLES(i));
 		val |= ADF_C62X_ENABLE_AE_ECC_ERR;
 		ADF_CSR_WR(csr, ADF_C62X_AE_CTX_ENABLES(i), val);
@@ -133,7 +153,7 @@ static void adf_enable_error_correction(struct adf_accel_dev *accel_dev)
 	}
 
 	/* Enable shared memory error detection & correction */
-	for (i = 0; i < hw_device->get_num_accels(hw_device); i++) {
+	for_each_set_bit(i, &accel_mask, ADF_C62X_MAX_ACCELERATORS) {
 		val = ADF_CSR_RD(csr, ADF_C62X_UERRSSMSH(i));
 		val |= ADF_C62X_ERRSSMSH_EN;
 		ADF_CSR_WR(csr, ADF_C62X_UERRSSMSH(i), val);
diff --git a/drivers/crypto/qat/qat_c62x/adf_c62x_hw_data.h b/drivers/crypto/qat/qat_c62x/adf_c62x_hw_data.h
index 88504d2bf30d..a2e2961a2102 100644
--- a/drivers/crypto/qat/qat_c62x/adf_c62x_hw_data.h
+++ b/drivers/crypto/qat/qat_c62x/adf_c62x_hw_data.h
@@ -19,6 +19,7 @@
 #define ADF_C62X_SMIAPF1_MASK_OFFSET (0x3A000 + 0x30)
 #define ADF_C62X_SMIA0_MASK 0xFFFF
 #define ADF_C62X_SMIA1_MASK 0x1
+#define ADF_C62X_SOFTSTRAP_CSR_OFFSET 0x2EC
 /* Error detection and correction */
 #define ADF_C62X_AE_CTX_ENABLES(i) (i * 0x1000 + 0x20818)
 #define ADF_C62X_AE_MISC_CONTROL(i) (i * 0x1000 + 0x20960)
diff --git a/drivers/crypto/qat/qat_c62x/adf_drv.c b/drivers/crypto/qat/qat_c62x/adf_drv.c
index d8e7c9c25590..3da697a566ad 100644
--- a/drivers/crypto/qat/qat_c62x/adf_drv.c
+++ b/drivers/crypto/qat/qat_c62x/adf_drv.c
@@ -126,10 +126,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	pci_read_config_byte(pdev, PCI_REVISION_ID, &accel_pci_dev->revid);
 	pci_read_config_dword(pdev, ADF_DEVICE_FUSECTL_OFFSET,
 			      &hw_data->fuses);
+	pci_read_config_dword(pdev, ADF_C62X_SOFTSTRAP_CSR_OFFSET,
+			      &hw_data->straps);
 
 	/* Get Accelerators and Accelerators Engines masks */
-	hw_data->accel_mask = hw_data->get_accel_mask(hw_data->fuses);
-	hw_data->ae_mask = hw_data->get_ae_mask(hw_data->fuses);
+	hw_data->accel_mask = hw_data->get_accel_mask(hw_data);
+	hw_data->ae_mask = hw_data->get_ae_mask(hw_data);
 	accel_pci_dev->sku = hw_data->get_sku(hw_data);
 	/* If the device has no acceleration engines then ignore it. */
 	if (!hw_data->accel_mask || !hw_data->ae_mask ||
diff --git a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
index 5e6909d6cfc6..ff5a57824eca 100644
--- a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
+++ b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
@@ -11,12 +11,12 @@ static struct adf_hw_device_class c62xiov_class = {
 	.instances = 0
 };
 
-static u32 get_accel_mask(u32 fuse)
+static u32 get_accel_mask(struct adf_hw_device_data *self)
 {
 	return ADF_C62XIOV_ACCELERATORS_MASK;
 }
 
-static u32 get_ae_mask(u32 fuse)
+static u32 get_ae_mask(struct adf_hw_device_data *self)
 {
 	return ADF_C62XIOV_ACCELENGINES_MASK;
 }
diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
index 6200ad448b11..51ea88c0b17d 100644
--- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
@@ -119,8 +119,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	adf_init_hw_data_c62xiov(accel_dev->hw_device);
 
 	/* Get Accelerators and Accelerators Engines masks */
-	hw_data->accel_mask = hw_data->get_accel_mask(hw_data->fuses);
-	hw_data->ae_mask = hw_data->get_ae_mask(hw_data->fuses);
+	hw_data->accel_mask = hw_data->get_accel_mask(hw_data);
+	hw_data->ae_mask = hw_data->get_ae_mask(hw_data);
 	accel_pci_dev->sku = hw_data->get_sku(hw_data);
 
 	/* Create dev top level debugfs entry */
diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
index 06952ece53d9..411a505e1f59 100644
--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
+++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
@@ -104,8 +104,8 @@ struct adf_etr_ring_data;
 
 struct adf_hw_device_data {
 	struct adf_hw_device_class *dev_class;
-	u32 (*get_accel_mask)(u32 fuse);
-	u32 (*get_ae_mask)(u32 fuse);
+	u32 (*get_accel_mask)(struct adf_hw_device_data *self);
+	u32 (*get_ae_mask)(struct adf_hw_device_data *self);
 	u32 (*get_sram_bar_id)(struct adf_hw_device_data *self);
 	u32 (*get_misc_bar_id)(struct adf_hw_device_data *self);
 	u32 (*get_etr_bar_id)(struct adf_hw_device_data *self);
@@ -131,6 +131,7 @@ struct adf_hw_device_data {
 	const char *fw_name;
 	const char *fw_mmp_name;
 	u32 fuses;
+	u32 straps;
 	u32 accel_capabilities_mask;
 	u32 instance_id;
 	u16 accel_mask;
diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
index b40e81e0088f..76d8470651b8 100644
--- a/drivers/crypto/qat/qat_common/qat_hal.c
+++ b/drivers/crypto/qat/qat_common/qat_hal.c
@@ -346,11 +346,12 @@ static void qat_hal_put_wakeup_event(struct icp_qat_fw_loader_handle *handle,
 
 static int qat_hal_check_ae_alive(struct icp_qat_fw_loader_handle *handle)
 {
+	unsigned long ae_mask = handle->hal_handle->ae_mask;
 	unsigned int base_cnt, cur_cnt;
 	unsigned char ae;
 	int times = MAX_RETRY_TIMES;
 
-	for (ae = 0; ae < handle->hal_handle->ae_max_num; ae++) {
+	for_each_set_bit(ae, &ae_mask, handle->hal_handle->ae_max_num) {
 		base_cnt = qat_hal_rd_ae_csr(handle, ae, PROFILE_COUNT);
 		base_cnt &= 0xffff;
 
@@ -384,6 +385,7 @@ int qat_hal_check_ae_active(struct icp_qat_fw_loader_handle *handle,
 
 static void qat_hal_reset_timestamp(struct icp_qat_fw_loader_handle *handle)
 {
+	unsigned long ae_mask = handle->hal_handle->ae_mask;
 	unsigned int misc_ctl;
 	unsigned char ae;
 
@@ -393,7 +395,7 @@ static void qat_hal_reset_timestamp(struct icp_qat_fw_loader_handle *handle)
 		SET_GLB_CSR(handle, MISC_CONTROL, misc_ctl &
 			    (~MC_TIMESTAMP_ENABLE));
 
-	for (ae = 0; ae < handle->hal_handle->ae_max_num; ae++) {
+	for_each_set_bit(ae, &ae_mask, handle->hal_handle->ae_max_num) {
 		qat_hal_wr_ae_csr(handle, ae, TIMESTAMP_LOW, 0);
 		qat_hal_wr_ae_csr(handle, ae, TIMESTAMP_HIGH, 0);
 	}
@@ -438,6 +440,7 @@ static int qat_hal_init_esram(struct icp_qat_fw_loader_handle *handle)
 #define SHRAM_INIT_CYCLES 2060
 int qat_hal_clr_reset(struct icp_qat_fw_loader_handle *handle)
 {
+	unsigned long ae_mask = handle->hal_handle->ae_mask;
 	unsigned int ae_reset_csr;
 	unsigned char ae;
 	unsigned int clk_csr;
@@ -464,7 +467,7 @@ int qat_hal_clr_reset(struct icp_qat_fw_loader_handle *handle)
 		goto out_err;
 
 	/* Set undefined power-up/reset states to reasonable default values */
-	for (ae = 0; ae < handle->hal_handle->ae_max_num; ae++) {
+	for_each_set_bit(ae, &ae_mask, handle->hal_handle->ae_max_num) {
 		qat_hal_wr_ae_csr(handle, ae, CTX_ENABLES,
 				  INIT_CTX_ENABLE_VALUE);
 		qat_hal_wr_indr_csr(handle, ae, ICP_QAT_UCLO_AE_ALL_CTX,
@@ -570,10 +573,11 @@ static void qat_hal_enable_ctx(struct icp_qat_fw_loader_handle *handle,
 
 static void qat_hal_clear_xfer(struct icp_qat_fw_loader_handle *handle)
 {
+	unsigned long ae_mask = handle->hal_handle->ae_mask;
 	unsigned char ae;
 	unsigned short reg;
 
-	for (ae = 0; ae < handle->hal_handle->ae_max_num; ae++) {
+	for_each_set_bit(ae, &ae_mask, handle->hal_handle->ae_max_num) {
 		for (reg = 0; reg < ICP_QAT_UCLO_MAX_GPR_REG; reg++) {
 			qat_hal_init_rd_xfer(handle, ae, 0, ICP_SR_RD_ABS,
 					     reg, 0);
@@ -585,6 +589,7 @@ static void qat_hal_clear_xfer(struct icp_qat_fw_loader_handle *handle)
 
 static int qat_hal_clear_gpr(struct icp_qat_fw_loader_handle *handle)
 {
+	unsigned long ae_mask = handle->hal_handle->ae_mask;
 	unsigned char ae;
 	unsigned int ctx_mask = ICP_QAT_UCLO_AE_ALL_CTX;
 	int times = MAX_RETRY_TIMES;
@@ -592,7 +597,7 @@ static int qat_hal_clear_gpr(struct icp_qat_fw_loader_handle *handle)
 	unsigned int savctx = 0;
 	int ret = 0;
 
-	for (ae = 0; ae < handle->hal_handle->ae_max_num; ae++) {
+	for_each_set_bit(ae, &ae_mask, handle->hal_handle->ae_max_num) {
 		csr_val = qat_hal_rd_ae_csr(handle, ae, AE_MISC_CONTROL);
 		csr_val &= ~(1 << MMC_SHARE_CS_BITPOS);
 		qat_hal_wr_ae_csr(handle, ae, AE_MISC_CONTROL, csr_val);
@@ -613,7 +618,7 @@ static int qat_hal_clear_gpr(struct icp_qat_fw_loader_handle *handle)
 		qat_hal_wr_ae_csr(handle, ae, CTX_SIG_EVENTS_ACTIVE, 0);
 		qat_hal_enable_ctx(handle, ae, ctx_mask);
 	}
-	for (ae = 0; ae < handle->hal_handle->ae_max_num; ae++) {
+	for_each_set_bit(ae, &ae_mask, handle->hal_handle->ae_max_num) {
 		/* wait for AE to finish */
 		do {
 			ret = qat_hal_wait_cycles(handle, ae, 20, 1);
@@ -654,6 +659,8 @@ int qat_hal_init(struct adf_accel_dev *accel_dev)
 	struct adf_hw_device_data *hw_data = accel_dev->hw_device;
 	struct adf_bar *misc_bar =
 			&pci_info->pci_bars[hw_data->get_misc_bar_id(hw_data)];
+	unsigned long ae_mask = hw_data->ae_mask;
+	unsigned int csr_val = 0;
 	struct adf_bar *sram_bar;
 
 	handle = kzalloc(sizeof(*handle), GFP_KERNEL);
@@ -689,9 +696,7 @@ int qat_hal_init(struct adf_accel_dev *accel_dev)
 	/* create AE objects */
 	handle->hal_handle->upc_mask = 0x1ffff;
 	handle->hal_handle->max_ustore = 0x4000;
-	for (ae = 0; ae < ICP_QAT_UCLO_MAX_AE; ae++) {
-		if (!(hw_data->ae_mask & (1 << ae)))
-			continue;
+	for_each_set_bit(ae, &ae_mask, ICP_QAT_UCLO_MAX_AE) {
 		handle->hal_handle->aes[ae].free_addr = 0;
 		handle->hal_handle->aes[ae].free_size =
 		    handle->hal_handle->max_ustore;
@@ -714,9 +719,7 @@ int qat_hal_init(struct adf_accel_dev *accel_dev)
 	}
 
 	/* Set SIGNATURE_ENABLE[0] to 0x1 in order to enable ALU_OUT csr */
-	for (ae = 0; ae < handle->hal_handle->ae_max_num; ae++) {
-		unsigned int csr_val = 0;
-
+	for_each_set_bit(ae, &ae_mask, handle->hal_handle->ae_max_num) {
 		csr_val = qat_hal_rd_ae_csr(handle, ae, SIGNATURE_ENABLE);
 		csr_val |= 0x1;
 		qat_hal_wr_ae_csr(handle, ae, SIGNATURE_ENABLE, csr_val);
diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c
index b975c263446d..6a0d01103136 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c
@@ -24,15 +24,19 @@ static struct adf_hw_device_class dh895xcc_class = {
 	.instances = 0
 };
 
-static u32 get_accel_mask(u32 fuse)
+static u32 get_accel_mask(struct adf_hw_device_data *self)
 {
-	return (~fuse) >> ADF_DH895XCC_ACCELERATORS_REG_OFFSET &
-			  ADF_DH895XCC_ACCELERATORS_MASK;
+	u32 fuses = self->fuses;
+
+	return ~fuses >> ADF_DH895XCC_ACCELERATORS_REG_OFFSET &
+			 ADF_DH895XCC_ACCELERATORS_MASK;
 }
 
-static u32 get_ae_mask(u32 fuse)
+static u32 get_ae_mask(struct adf_hw_device_data *self)
 {
-	return (~fuse) & ADF_DH895XCC_ACCELENGINES_MASK;
+	u32 fuses = self->fuses;
+
+	return ~fuses & ADF_DH895XCC_ACCELENGINES_MASK;
 }
 
 static u32 get_num_accels(struct adf_hw_device_data *self)
@@ -131,11 +135,13 @@ static void adf_enable_error_correction(struct adf_accel_dev *accel_dev)
 {
 	struct adf_hw_device_data *hw_device = accel_dev->hw_device;
 	struct adf_bar *misc_bar = &GET_BARS(accel_dev)[ADF_DH895XCC_PMISC_BAR];
+	unsigned long accel_mask = hw_device->accel_mask;
+	unsigned long ae_mask = hw_device->ae_mask;
 	void __iomem *csr = misc_bar->virt_addr;
 	unsigned int val, i;
 
 	/* Enable Accel Engine error detection & correction */
-	for (i = 0; i < hw_device->get_num_aes(hw_device); i++) {
+	for_each_set_bit(i, &ae_mask, GET_MAX_ACCELENGINES(accel_dev)) {
 		val = ADF_CSR_RD(csr, ADF_DH895XCC_AE_CTX_ENABLES(i));
 		val |= ADF_DH895XCC_ENABLE_AE_ECC_ERR;
 		ADF_CSR_WR(csr, ADF_DH895XCC_AE_CTX_ENABLES(i), val);
@@ -145,7 +151,7 @@ static void adf_enable_error_correction(struct adf_accel_dev *accel_dev)
 	}
 
 	/* Enable shared memory error detection & correction */
-	for (i = 0; i < hw_device->get_num_accels(hw_device); i++) {
+	for_each_set_bit(i, &accel_mask, ADF_DH895XCC_MAX_ACCELERATORS) {
 		val = ADF_CSR_RD(csr, ADF_DH895XCC_UERRSSMSH(i));
 		val |= ADF_DH895XCC_ERRSSMSH_EN;
 		ADF_CSR_WR(csr, ADF_DH895XCC_UERRSSMSH(i), val);
diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
index ecb4f6f20e22..d7941bc2bafd 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
@@ -128,8 +128,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 			      &hw_data->fuses);
 
 	/* Get Accelerators and Accelerators Engines masks */
-	hw_data->accel_mask = hw_data->get_accel_mask(hw_data->fuses);
-	hw_data->ae_mask = hw_data->get_ae_mask(hw_data->fuses);
+	hw_data->accel_mask = hw_data->get_accel_mask(hw_data);
+	hw_data->ae_mask = hw_data->get_ae_mask(hw_data);
 	accel_pci_dev->sku = hw_data->get_sku(hw_data);
 	/* If the device has no acceleration engines then ignore it. */
 	if (!hw_data->accel_mask || !hw_data->ae_mask ||
diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
index fc4cf141b1de..7930e4c7883d 100644
--- a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
+++ b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
@@ -11,12 +11,12 @@ static struct adf_hw_device_class dh895xcciov_class = {
 	.instances = 0
 };
 
-static u32 get_accel_mask(u32 fuse)
+static u32 get_accel_mask(struct adf_hw_device_data *self)
 {
 	return ADF_DH895XCCIOV_ACCELERATORS_MASK;
 }
 
-static u32 get_ae_mask(u32 fuse)
+static u32 get_ae_mask(struct adf_hw_device_data *self)
 {
 	return ADF_DH895XCCIOV_ACCELENGINES_MASK;
 }
diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
index 737508ded37b..29999da716cc 100644
--- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
@@ -119,8 +119,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	adf_init_hw_data_dh895xcciov(accel_dev->hw_device);
 
 	/* Get Accelerators and Accelerators Engines masks */
-	hw_data->accel_mask = hw_data->get_accel_mask(hw_data->fuses);
-	hw_data->ae_mask = hw_data->get_ae_mask(hw_data->fuses);
+	hw_data->accel_mask = hw_data->get_accel_mask(hw_data);
+	hw_data->ae_mask = hw_data->get_ae_mask(hw_data);
 	accel_pci_dev->sku = hw_data->get_sku(hw_data);
 
 	/* Create dev top level debugfs entry */

From 63e8e2ee58156935490c293ef4363ded088866b8 Mon Sep 17 00:00:00 2001
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Date: Fri, 22 Sep 2023 10:03:47 +0100
Subject: [PATCH 0401/1043] crypto: qat - increase size of buffers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4e4e2ed22d505c5bacf65c6a39bfb6d120d24785 ]

Increase the size of the buffers used for composing the names used for
the transport debugfs entries and the vector name to avoid a potential
truncation.

This resolves the following errors when compiling the driver with W=1
and KCFLAGS=-Werror on GCC 12.3.1:

    drivers/crypto/intel/qat/qat_common/adf_transport_debug.c: In function ‘adf_ring_debugfs_add’:
    drivers/crypto/intel/qat/qat_common/adf_transport_debug.c:100:60: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
    drivers/crypto/intel/qat/qat_common/adf_isr.c: In function ‘adf_isr_resource_alloc’:
    drivers/crypto/intel/qat/qat_common/adf_isr.c:197:47: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size between 0 and 5 [-Werror=format-truncation=]

Fixes: a672a9dc872e ("crypto: qat - Intel(R) QAT transport code")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Damian Muszynski <damian.muszynski@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/adf_accel_devices.h   | 2 +-
 drivers/crypto/qat/qat_common/adf_transport_debug.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
index 411a505e1f59..961a8b3650c7 100644
--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
+++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
@@ -23,7 +23,7 @@
 #define ADF_PCI_MAX_BARS 3
 #define ADF_DEVICE_NAME_LENGTH 32
 #define ADF_ETR_MAX_RINGS_PER_BANK 16
-#define ADF_MAX_MSIX_VECTOR_NAME 16
+#define ADF_MAX_MSIX_VECTOR_NAME 48
 #define ADF_DEVICE_NAME_PREFIX "qat_"
 
 enum adf_accel_capabilities {
diff --git a/drivers/crypto/qat/qat_common/adf_transport_debug.c b/drivers/crypto/qat/qat_common/adf_transport_debug.c
index dac25ba47260..e6bdbd3c9b1f 100644
--- a/drivers/crypto/qat/qat_common/adf_transport_debug.c
+++ b/drivers/crypto/qat/qat_common/adf_transport_debug.c
@@ -89,7 +89,7 @@ DEFINE_SEQ_ATTRIBUTE(adf_ring_debug);
 int adf_ring_debugfs_add(struct adf_etr_ring_data *ring, const char *name)
 {
 	struct adf_etr_ring_debug_entry *ring_debug;
-	char entry_name[8];
+	char entry_name[16];
 
 	ring_debug = kzalloc(sizeof(*ring_debug), GFP_KERNEL);
 	if (!ring_debug)
@@ -184,7 +184,7 @@ int adf_bank_debugfs_add(struct adf_etr_bank_data *bank)
 {
 	struct adf_accel_dev *accel_dev = bank->accel_dev;
 	struct dentry *parent = accel_dev->transport->debug;
-	char name[8];
+	char name[16];
 
 	snprintf(name, sizeof(name), "bank_%02d", bank->bank_number);
 	bank->bank_debug_dir = debugfs_create_dir(name, parent);

From 3d959406c8fff2334d83d0c352d54fd6f5b2e7cd Mon Sep 17 00:00:00 2001
From: Danny Kaehn <danny.kaehn@plexus.com>
Date: Tue, 19 Sep 2023 16:22:45 -0500
Subject: [PATCH 0402/1043] hid: cp2112: Fix duplicate workqueue initialization

[ Upstream commit e3c2d2d144c082dd71596953193adf9891491f42 ]

Previously the cp2112 driver called INIT_DELAYED_WORK within
cp2112_gpio_irq_startup, resulting in duplicate initilizations of the
workqueue on subsequent IRQ startups following an initial request. This
resulted in a warning in set_work_data in workqueue.c, as well as a rare
NULL dereference within process_one_work in workqueue.c.

Initialize the workqueue within _probe instead.

Fixes: 13de9cca514e ("HID: cp2112: add IRQ chip handling")
Signed-off-by: Danny Kaehn <danny.kaehn@plexus.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-cp2112.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index d902fe43cb81..a683d3820026 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -1157,8 +1157,6 @@ static unsigned int cp2112_gpio_irq_startup(struct irq_data *d)
 	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
 	struct cp2112_device *dev = gpiochip_get_data(gc);
 
-	INIT_DELAYED_WORK(&dev->gpio_poll_worker, cp2112_gpio_poll_callback);
-
 	if (!dev->gpio_poll) {
 		dev->gpio_poll = true;
 		schedule_delayed_work(&dev->gpio_poll_worker, 0);
@@ -1354,6 +1352,8 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
 	girq->handler = handle_simple_irq;
 	girq->threaded = true;
 
+	INIT_DELAYED_WORK(&dev->gpio_poll_worker, cp2112_gpio_poll_callback);
+
 	ret = gpiochip_add_data(&dev->gc, dev);
 	if (ret < 0) {
 		hid_err(hdev, "error registering gpio chip\n");

From 67959b362687edbacdfeefc5e72dcb5916a7c487 Mon Sep 17 00:00:00 2001
From: Kursad Oney <kursad.oney@broadcom.com>
Date: Tue, 22 Aug 2023 15:06:06 +0100
Subject: [PATCH 0403/1043] ARM: 9321/1: memset: cast the constant byte to
 unsigned char

[ Upstream commit c0e824661f443b8cab3897006c1bbc69fd0e7bc4 ]

memset() description in ISO/IEC 9899:1999 (and elsewhere) says:

	The memset function copies the value of c (converted to an
	unsigned char) into each of the first n characters of the
	object pointed to by s.

The kernel's arm32 memset does not cast c to unsigned char. This results
in the following code to produce erroneous output:

	char a[128];
	memset(a, -128, sizeof(a));

This is because gcc will generally emit the following code before
it calls memset() :

	mov   r0, r7
	mvn   r1, #127        ; 0x7f
	bl    00000000 <memset>

r1 ends up with 0xffffff80 before being used by memset() and the
'a' array will have -128 once in every four bytes while the other
bytes will be set incorrectly to -1 like this (printing the first
8 bytes) :

	test_module: -128 -1 -1 -1
	test_module: -1 -1 -1 -128

The change here is to 'and' r1 with 255 before it is used.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kursad Oney <kursad.oney@broadcom.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/lib/memset.S | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/lib/memset.S b/arch/arm/lib/memset.S
index 6ca4535c47fb..e36d053a8a90 100644
--- a/arch/arm/lib/memset.S
+++ b/arch/arm/lib/memset.S
@@ -16,6 +16,7 @@
 ENTRY(mmioset)
 ENTRY(memset)
 UNWIND( .fnstart         )
+	and	r1, r1, #255		@ cast to unsigned char
 	ands	r3, r0, #3		@ 1 unaligned?
 	mov	ip, r0			@ preserve r0 as return value
 	bne	6f			@ 1

From 83eee515e41518b8d31ef84275a2682739de6438 Mon Sep 17 00:00:00 2001
From: Gou Hao <gouhao@uniontech.com>
Date: Wed, 6 Sep 2023 09:33:41 +0800
Subject: [PATCH 0404/1043] ext4: move 'ix' sanity check to corrent position

[ Upstream commit af90a8f4a09ec4a3de20142e37f37205d4687f28 ]

Check 'ix' before it is used.

Fixes: 80e675f906db ("ext4: optimize memmmove lengths in extent/index insertions")
Signed-off-by: Gou Hao <gouhao@uniontech.com>
Link: https://lore.kernel.org/r/20230906013341.7199-1-gouhao@uniontech.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/extents.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 2c2e1cc43e0e..193b13630ac1 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -1003,6 +1003,11 @@ static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
 		ix = curp->p_idx;
 	}
 
+	if (unlikely(ix > EXT_MAX_INDEX(curp->p_hdr))) {
+		EXT4_ERROR_INODE(inode, "ix > EXT_MAX_INDEX!");
+		return -EFSCORRUPTED;
+	}
+
 	len = EXT_LAST_INDEX(curp->p_hdr) - ix + 1;
 	BUG_ON(len < 0);
 	if (len > 0) {
@@ -1012,11 +1017,6 @@ static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
 		memmove(ix + 1, ix, len * sizeof(struct ext4_extent_idx));
 	}
 
-	if (unlikely(ix > EXT_MAX_INDEX(curp->p_hdr))) {
-		EXT4_ERROR_INODE(inode, "ix > EXT_MAX_INDEX!");
-		return -EFSCORRUPTED;
-	}
-
 	ix->ei_block = cpu_to_le32(logical);
 	ext4_idx_store_pblock(ix, ptr);
 	le16_add_cpu(&curp->p_hdr->eh_entries, 1);

From 53067926cd837b7729782ada16e2be421c7cb82b Mon Sep 17 00:00:00 2001
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Date: Mon, 9 Oct 2023 23:39:43 +0000
Subject: [PATCH 0405/1043] ASoC: fsl: mpc5200_dma.c: Fix warning of Function
 parameter or member not described

[ Upstream commit 4a221b2e3340f4a3c2b414c46c846a26c6caf820 ]

This patch fixes the warnings of "Function parameter or member 'xxx'
not described".

>> sound/soc/fsl/mpc5200_dma.c:116: warning: Function parameter or member 'component' not described in 'psc_dma_trigger'
   sound/soc/fsl/mpc5200_dma.c:116: warning: Function parameter or member 'substream' not described in 'psc_dma_trigger'
   sound/soc/fsl/mpc5200_dma.c:116: warning: Function parameter or member 'cmd' not described in 'psc_dma_trigger'

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310061914.jJuekdHs-lkp@intel.com/
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Fixes: 6d1048bc1152 ("ASoC: fsl: mpc5200_dma: remove snd_pcm_ops")
Link: https://lore.kernel.org/r/87il7fcqm8.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/mpc5200_dma.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sound/soc/fsl/mpc5200_dma.c b/sound/soc/fsl/mpc5200_dma.c
index 231984882176..2e82731072c9 100644
--- a/sound/soc/fsl/mpc5200_dma.c
+++ b/sound/soc/fsl/mpc5200_dma.c
@@ -107,6 +107,9 @@ static int psc_dma_hw_free(struct snd_soc_component *component,
 
 /**
  * psc_dma_trigger: start and stop the DMA transfer.
+ * @component: triggered component
+ * @substream: triggered substream
+ * @cmd: triggered command
  *
  * This function is called by ALSA to start, stop, pause, and resume the DMA
  * transfer of data.

From 08a246064defa8bf281cc9dbf54cdf13220cdcc2 Mon Sep 17 00:00:00 2001
From: Patrisious Haddad <phaddad@nvidia.com>
Date: Mon, 9 Oct 2023 13:41:20 +0300
Subject: [PATCH 0406/1043] IB/mlx5: Fix rdma counter binding for RAW QP

[ Upstream commit c1336bb4aa5e809a622a87d74311275514086596 ]

Previously when we had a RAW QP, we bound a counter to it when it moved
to INIT state, using the counter context inside RQC.

But when we try to modify that counter later in RTS state we used
modify QP which tries to change the counter inside QPC instead of RQC.

Now we correctly modify the counter set_id inside of RQC instead of QPC
for the RAW QP.

Fixes: d14133dd4161 ("IB/mlx5: Support set qp counter")
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Mark Zhang <markzhang@nvidia.com>
Link: https://lore.kernel.org/r/2e5ab6713784a8fe997d19c508187a0dfecf2dfc.1696847964.git.leon@kernel.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx5/qp.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 0c47e3e24b2a..e3cc856e70e5 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -3714,6 +3714,30 @@ static unsigned int get_tx_affinity(struct ib_qp *qp,
 	return tx_affinity;
 }
 
+static int __mlx5_ib_qp_set_raw_qp_counter(struct mlx5_ib_qp *qp, u32 set_id,
+					   struct mlx5_core_dev *mdev)
+{
+	struct mlx5_ib_raw_packet_qp *raw_packet_qp = &qp->raw_packet_qp;
+	struct mlx5_ib_rq *rq = &raw_packet_qp->rq;
+	u32 in[MLX5_ST_SZ_DW(modify_rq_in)] = {};
+	void *rqc;
+
+	if (!qp->rq.wqe_cnt)
+		return 0;
+
+	MLX5_SET(modify_rq_in, in, rq_state, rq->state);
+	MLX5_SET(modify_rq_in, in, uid, to_mpd(qp->ibqp.pd)->uid);
+
+	rqc = MLX5_ADDR_OF(modify_rq_in, in, ctx);
+	MLX5_SET(rqc, rqc, state, MLX5_RQC_STATE_RDY);
+
+	MLX5_SET64(modify_rq_in, in, modify_bitmask,
+		   MLX5_MODIFY_RQ_IN_MODIFY_BITMASK_RQ_COUNTER_SET_ID);
+	MLX5_SET(rqc, rqc, counter_set_id, set_id);
+
+	return mlx5_core_modify_rq(mdev, rq->base.mqp.qpn, in);
+}
+
 static int __mlx5_ib_qp_set_counter(struct ib_qp *qp,
 				    struct rdma_counter *counter)
 {
@@ -3729,6 +3753,9 @@ static int __mlx5_ib_qp_set_counter(struct ib_qp *qp,
 	else
 		set_id = mlx5_ib_get_counters_id(dev, mqp->port - 1);
 
+	if (mqp->type == IB_QPT_RAW_PACKET)
+		return __mlx5_ib_qp_set_raw_qp_counter(mqp, set_id, dev->mdev);
+
 	base = &mqp->trans_qp.base;
 	MLX5_SET(rts2rts_qp_in, in, opcode, MLX5_CMD_OP_RTS2RTS_QP);
 	MLX5_SET(rts2rts_qp_in, in, qpn, base->mqp.qpn);

From 8018a3444e39db294bbac365b2a12cc3ceefc82b Mon Sep 17 00:00:00 2001
From: Chengchang Tang <tangchengchang@huawei.com>
Date: Tue, 17 Oct 2023 20:52:34 +0800
Subject: [PATCH 0407/1043] RDMA/hns: Fix uninitialized ucmd in
 hns_roce_create_qp_common()

[ Upstream commit c64e9710f9241e38a1c761ed1c1a30854784da66 ]

ucmd in hns_roce_create_qp_common() are not initialized. But it works fine
until new member sdb_addr is added to struct hns_roce_ib_create_qp.

If the user-mode driver uses an old version ABI, then the value of the new
member will be undefined after ib_copy_from_udata().

This patch fixes it by initialize this variable to 0. And the default value
of the new member sdb_addr will be 0 which is invalid.

Fixes: 0425e3e6e0c7 ("RDMA/hns: Support flush cqe for hip08 in kernel space")
Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20231017125239.164455-3-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_qp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index c42c6761382d..d1c07f1f8fe9 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -906,7 +906,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
 {
 	struct hns_roce_ib_create_qp_resp resp = {};
 	struct ib_device *ibdev = &hr_dev->ib_dev;
-	struct hns_roce_ib_create_qp ucmd;
+	struct hns_roce_ib_create_qp ucmd = {};
 	int ret;
 
 	mutex_init(&hr_qp->mutex);

From 1596394868346562839545d610a7775894e94f69 Mon Sep 17 00:00:00 2001
From: Chengchang Tang <tangchengchang@huawei.com>
Date: Tue, 17 Oct 2023 20:52:35 +0800
Subject: [PATCH 0408/1043] RDMA/hns: Fix signed-unsigned mixed comparisons

[ Upstream commit b5f9efff101b06fd06a5e280a2b00b1335f5f476 ]

The ib_mtu_enum_to_int() and uverbs_attr_get_len() may returns a negative
value. In this case, mixed comparisons of signed and unsigned types will
throw wrong results.

This patch adds judgement for this situation.

Fixes: 30b707886aeb ("RDMA/hns: Support inline data in extented sge space for RC")
Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20231017125239.164455-4-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 322f341f4145..518b38e9158d 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -247,7 +247,7 @@ static bool check_inl_data_len(struct hns_roce_qp *qp, unsigned int len)
 	struct hns_roce_dev *hr_dev = to_hr_dev(qp->ibqp.device);
 	int mtu = ib_mtu_enum_to_int(qp->path_mtu);
 
-	if (len > qp->max_inline_data || len > mtu) {
+	if (mtu < 0 || len > qp->max_inline_data || len > mtu) {
 		ibdev_err(&hr_dev->ib_dev,
 			  "invalid length of data, data len = %u, max inline len = %u, path mtu = %d.\n",
 			  len, qp->max_inline_data, mtu);

From cded69a7f8b34ff694fe020b7259bc3e399c3872 Mon Sep 17 00:00:00 2001
From: Zhang Shurong <zhang_shurong@foxmail.com>
Date: Thu, 12 Oct 2023 21:03:15 +0800
Subject: [PATCH 0409/1043] ASoC: fsl: Fix PM disable depth imbalance in
 fsl_easrc_probe

[ Upstream commit 9e630efb5a4af56fdb15aa10405f5cfd3f5f5b83 ]

The pm_runtime_enable will increase power disable depth. Thus
a pairing decrement is needed on the error handling path to
keep it balanced according to context. We fix it by calling
pm_runtime_disable when error returns.

Fixes: 955ac624058f ("ASoC: fsl_easrc: Add EASRC ASoC CPU DAI drivers")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Link: https://lore.kernel.org/r/tencent_C0D62E6D89818179A02A04A0C248F0DDC40A@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/fsl_easrc.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sound/soc/fsl/fsl_easrc.c b/sound/soc/fsl/fsl_easrc.c
index 3cf1f40e6892..acd500c3b9d0 100644
--- a/sound/soc/fsl/fsl_easrc.c
+++ b/sound/soc/fsl/fsl_easrc.c
@@ -1971,17 +1971,21 @@ static int fsl_easrc_probe(struct platform_device *pdev)
 					      &fsl_easrc_dai, 1);
 	if (ret) {
 		dev_err(dev, "failed to register ASoC DAI\n");
-		return ret;
+		goto err_pm_disable;
 	}
 
 	ret = devm_snd_soc_register_component(dev, &fsl_asrc_component,
 					      NULL, 0);
 	if (ret) {
 		dev_err(&pdev->dev, "failed to register ASoC platform\n");
-		return ret;
+		goto err_pm_disable;
 	}
 
 	return 0;
+
+err_pm_disable:
+	pm_runtime_disable(&pdev->dev);
+	return ret;
 }
 
 static int fsl_easrc_remove(struct platform_device *pdev)

From cd268264f594fa6856f89266cd881a80317adb93 Mon Sep 17 00:00:00 2001
From: Daniel Mentz <danielmentz@google.com>
Date: Tue, 17 Oct 2023 11:20:26 -0700
Subject: [PATCH 0410/1043] scsi: ufs: core: Leave space for '\0' in utf8 desc
 string

[ Upstream commit a75a16c62a2540f11eeae4f2b50e95deefb652ea ]

utf16s_to_utf8s does not NULL terminate the output string. For us to be
able to add a NULL character when utf16s_to_utf8s returns, we need to make
sure that there is space for such NULL character at the end of the output
buffer. We can achieve this by passing an output buffer size to
utf16s_to_utf8s that is one character less than what we allocated.

Other call sites of utf16s_to_utf8s appear to be using the same technique
where they artificially reduce the buffer size by one to leave space for a
NULL character or line feed character.

Fixes: 4b828fe156a6 ("scsi: ufs: revamp string descriptor reading")
Reviewed-by: Mars Cheng <marscheng@google.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Yen-lin Lai <yenlinlai@google.com>
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Link: https://lore.kernel.org/r/20231017182026.2141163-1-danielmentz@google.com
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufshcd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index f3389e913179..a432aebd14be 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -3339,7 +3339,7 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8 desc_index,
 		 */
 		ret = utf16s_to_utf8s(uc_str->uc,
 				      uc_str->len - QUERY_DESC_HDR_SIZE,
-				      UTF16_BIG_ENDIAN, str, ascii_len);
+				      UTF16_BIG_ENDIAN, str, ascii_len - 1);
 
 		/* replace non-printable or non-ASCII characters with spaces */
 		for (i = 0; i < ret; i++)

From 9c895d20f8ee5da80c3ab8a840fda7ea6118e7f9 Mon Sep 17 00:00:00 2001
From: Leon Romanovsky <leonro@nvidia.com>
Date: Tue, 24 Oct 2023 18:07:31 +0300
Subject: [PATCH 0411/1043] RDMA/hfi1: Workaround truncation compilation error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d4b2d165714c0ce8777d5131f6e0aad617b7adc4 ]

Increase name array to be large enough to overcome the following
compilation error.

drivers/infiniband/hw/hfi1/efivar.c: In function ‘read_hfi1_efi_var’:
drivers/infiniband/hw/hfi1/efivar.c:124:44: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
  124 |         snprintf(name, sizeof(name), "%s-%s", prefix_name, kind);
      |                                            ^
drivers/infiniband/hw/hfi1/efivar.c:124:9: note: ‘snprintf’ output 2 or more bytes (assuming 65) into a destination of size 64
  124 |         snprintf(name, sizeof(name), "%s-%s", prefix_name, kind);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/infiniband/hw/hfi1/efivar.c:133:52: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
  133 |                 snprintf(name, sizeof(name), "%s-%s", prefix_name, kind);
      |                                                    ^
drivers/infiniband/hw/hfi1/efivar.c:133:17: note: ‘snprintf’ output 2 or more bytes (assuming 65) into a destination of size 64
  133 |                 snprintf(name, sizeof(name), "%s-%s", prefix_name, kind);
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:243: drivers/infiniband/hw/hfi1/efivar.o] Error 1

Fixes: c03c08d50b3d ("IB/hfi1: Check upper-case EFI variables")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Link: https://lore.kernel.org/r/238fa39a8fd60e87a5ad7e1ca6584fcdf32e9519.1698159993.git.leonro@nvidia.com
Acked-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hfi1/efivar.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/hfi1/efivar.c b/drivers/infiniband/hw/hfi1/efivar.c
index c22ab7b5163b..49b2c751197e 100644
--- a/drivers/infiniband/hw/hfi1/efivar.c
+++ b/drivers/infiniband/hw/hfi1/efivar.c
@@ -152,7 +152,7 @@ int read_hfi1_efi_var(struct hfi1_devdata *dd, const char *kind,
 		      unsigned long *size, void **return_data)
 {
 	char prefix_name[64];
-	char name[64];
+	char name[128];
 	int result;
 	int i;
 

From 2ca51477c6da9e6742ea40421dac11e42d2a6796 Mon Sep 17 00:00:00 2001
From: Danny Kaehn <danny.kaehn@plexus.com>
Date: Wed, 11 Oct 2023 13:23:17 -0500
Subject: [PATCH 0412/1043] hid: cp2112: Fix IRQ shutdown stopping polling for
 all IRQs on chip

[ Upstream commit dc3115e6c5d9863ec1a9ff1acf004ede93c34361 ]

Previously cp2112_gpio_irq_shutdown() always cancelled the
gpio_poll_worker, even if other IRQs were still active, and did not set
the gpio_poll flag to false. This resulted in any call to _shutdown()
resulting in interrupts no longer functioning on the chip until a
_remove() occurred (a.e. the cp2112 is unplugged or system rebooted).

Only cancel polling if all IRQs are disabled/masked, and correctly set
the gpio_poll flag, allowing polling to restart when an interrupt is
next enabled.

Signed-off-by: Danny Kaehn <danny.kaehn@plexus.com>
Fixes: 13de9cca514e ("HID: cp2112: add IRQ chip handling")
Link: https://lore.kernel.org/r/20231011182317.1053344-1-danny.kaehn@plexus.com
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-cp2112.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index a683d3820026..6a11b3a329ae 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -1171,7 +1171,10 @@ static void cp2112_gpio_irq_shutdown(struct irq_data *d)
 	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
 	struct cp2112_device *dev = gpiochip_get_data(gc);
 
-	cancel_delayed_work_sync(&dev->gpio_poll_worker);
+	if (!dev->irq_mask) {
+		dev->gpio_poll = false;
+		cancel_delayed_work_sync(&dev->gpio_poll_worker);
+	}
 }
 
 static int cp2112_gpio_irq_type(struct irq_data *d, unsigned int type)

From 6d2de161cdc676ffe9c220ec0973e3b5cc8ddabb Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Thu, 19 Oct 2023 11:46:43 +0200
Subject: [PATCH 0413/1043] sh: bios: Revive earlyprintk support

[ Upstream commit 553f7ac78fbb41b2c93ab9b9d78e42274d27daa9 ]

The SuperH BIOS earlyprintk code is protected by CONFIG_EARLY_PRINTK.
However, when this protection was added, it was missed that SuperH no
longer defines an EARLY_PRINTK config symbol since commit
e76fe57447e88916 ("sh: Remove old early serial console code V2"), so
BIOS earlyprintk can no longer be used.

Fix this by reviving the EARLY_PRINTK config symbol.

Fixes: d0380e6c3c0f6edb ("early_printk: consolidate random copies of identical code")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Link: https://lore.kernel.org/r/c40972dfec3dcc6719808d5df388857360262878.1697708489.git.geert+renesas@glider.be
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sh/Kconfig.debug | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug
index 7bc1b10b81c9..f030dd4c0860 100644
--- a/arch/sh/Kconfig.debug
+++ b/arch/sh/Kconfig.debug
@@ -25,6 +25,17 @@ config STACK_DEBUG
 	  every function call and will therefore incur a major
 	  performance hit. Most users should say N.
 
+config EARLY_PRINTK
+	bool "Early printk"
+	depends on SH_STANDARD_BIOS
+	help
+	  Say Y here to redirect kernel printk messages to the serial port
+	  used by the SH-IPL bootloader, starting very early in the boot
+	  process and ending when the kernel's serial console is initialised.
+	  This option is only useful while porting the kernel to a new machine,
+	  when the kernel may crash or hang before the serial console is
+	  initialised.  If unsure, say N.
+
 config 4KSTACKS
 	bool "Use 4Kb for kernel stacks instead of 8Kb"
 	depends on DEBUG_KERNEL && (MMU || BROKEN) && !PAGE_SIZE_64KB

From 8337286600cd9265fdb95ae8e07b78264cc70edf Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Tue, 20 Dec 2022 16:43:43 +0100
Subject: [PATCH 0414/1043] Revert "HID: logitech-hidpp: add a module parameter
 to keep firmware gestures"

[ Upstream commit cae253d6033da885e71c29c1591b22838a52de76 ]

Now that we're in 2022, and the majority of desktop environments can and
should support touchpad gestures through libinput, remove the legacy
module parameter that made it possible to use gestures implemented in
firmware.

This will eventually allow simplifying the driver's initialisation code.

This reverts commit 9188dbaed68a4b23dc96eba165265c08caa7dc2a.

Signed-off-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20221220154345.474596-1-hadess@hadess.net
Stable-dep-of: 11ca0322a419 ("HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-logitech-hidpp.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 651fa0966939..8d81a700886f 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -31,11 +31,6 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Benjamin Tissoires <benjamin.tissoires@gmail.com>");
 MODULE_AUTHOR("Nestor Lopez Casado <nlopezcasad@logitech.com>");
 
-static bool disable_raw_mode;
-module_param(disable_raw_mode, bool, 0644);
-MODULE_PARM_DESC(disable_raw_mode,
-	"Disable Raw mode reporting for touchpads and keep firmware gestures.");
-
 static bool disable_tap_to_click;
 module_param(disable_tap_to_click, bool, 0644);
 MODULE_PARM_DESC(disable_tap_to_click,
@@ -3851,11 +3846,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 	    hidpp_application_equals(hdev, HID_GD_KEYBOARD))
 		hidpp->quirks |= HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS;
 
-	if (disable_raw_mode) {
-		hidpp->quirks &= ~HIDPP_QUIRK_CLASS_WTP;
-		hidpp->quirks &= ~HIDPP_QUIRK_NO_HIDINPUT;
-	}
-
 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP) {
 		ret = wtp_allocate(hdev, id);
 		if (ret)

From 0fe443314cf65a3902282a18a2899f1d80e71251 Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Wed, 25 Jan 2023 13:17:23 +0100
Subject: [PATCH 0415/1043] HID: logitech-hidpp: Remove HIDPP_QUIRK_NO_HIDINPUT
 quirk

[ Upstream commit d83956c8855c6c2ed4bd16cec4a5083d63df17e4 ]

HIDPP_QUIRK_NO_HIDINPUT isn't used by any devices but still happens to
work as HIDPP_QUIRK_DELAYED_INIT is defined to the same value. Remove
HIDPP_QUIRK_NO_HIDINPUT and use HIDPP_QUIRK_DELAYED_INIT everywhere
instead.

Tested on a T650 which requires that quirk, and a number of unifying and
Bluetooth devices that don't.

Signed-off-by: Bastien Nocera <hadess@hadess.net>
Link: https://lore.kernel.org/r/20230125121723.3122-2-hadess@hadess.net
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Stable-dep-of: 11ca0322a419 ("HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-logitech-hidpp.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 8d81a700886f..e012d2d1a644 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -61,7 +61,7 @@ MODULE_PARM_DESC(disable_tap_to_click,
 /* bits 2..20 are reserved for classes */
 /* #define HIDPP_QUIRK_CONNECT_EVENTS		BIT(21) disabled */
 #define HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS	BIT(22)
-#define HIDPP_QUIRK_NO_HIDINPUT			BIT(23)
+#define HIDPP_QUIRK_DELAYED_INIT		BIT(23)
 #define HIDPP_QUIRK_FORCE_OUTPUT_REPORTS	BIT(24)
 #define HIDPP_QUIRK_UNIFYING			BIT(25)
 #define HIDPP_QUIRK_HI_RES_SCROLL_1P0		BIT(26)
@@ -80,8 +80,6 @@ MODULE_PARM_DESC(disable_tap_to_click,
 					 HIDPP_QUIRK_HI_RES_SCROLL_X2120 | \
 					 HIDPP_QUIRK_HI_RES_SCROLL_X2121)
 
-#define HIDPP_QUIRK_DELAYED_INIT		HIDPP_QUIRK_NO_HIDINPUT
-
 #define HIDPP_CAPABILITY_HIDPP10_BATTERY	BIT(0)
 #define HIDPP_CAPABILITY_HIDPP20_BATTERY	BIT(1)
 #define HIDPP_CAPABILITY_BATTERY_MILEAGE	BIT(2)
@@ -3702,7 +3700,7 @@ static void hidpp_connect_event(struct hidpp_device *hidpp)
 	if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL)
 		hi_res_scroll_enable(hidpp);
 
-	if (!(hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT) || hidpp->delayed_input)
+	if (!(hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT) || hidpp->delayed_input)
 		/* if the input nodes are already created, we can stop now */
 		return;
 
@@ -3935,7 +3933,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 		hid_hw_close(hdev);
 		hid_hw_stop(hdev);
 
-		if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT)
+		if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT)
 			connect_mask &= ~HID_CONNECT_HIDINPUT;
 
 		/* Now export the actual inputs and hidraw nodes to the world */

From c82e376bc24ef0309424218987e20055ad6b9f95 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 10 Oct 2023 12:20:18 +0200
Subject: [PATCH 0416/1043] HID: logitech-hidpp: Don't restart IO, instead
 defer hid_connect() only

[ Upstream commit 11ca0322a41920df2b462d2e45b0731e47ff475b ]

Restarting IO causes 2 problems:

1. Some devices do not like IO being restarted this was addressed in
   commit 498ba2069035 ("HID: logitech-hidpp: Don't restart communication
   if not necessary"), but that change has issues of its own and needs to
   be reverted.

2. Restarting IO and specifically calling hid_device_io_stop() causes
   received packets to be missed, which may cause connect-events to
   get missed.

Restarting IO was introduced in commit 91cf9a98ae41 ("HID: logitech-hidpp:
make .probe usbhid capable") to allow to retrieve the device's name and
serial number and store these in hdev->name and hdev->uniq before
connecting any hid subdrivers (hid-input, hidraw) exporting this info
to userspace.

But this does not require restarting IO, this merely requires deferring
calling hid_connect(). Calling hid_hw_start() with a connect-mask of
0 makes it skip calling hid_connect(), so hidpp_probe() can simply call
hid_connect() later without needing to restart IO.

Remove the stop + restart of IO and instead just call hid_connect() later
to avoid the issues caused by restarting IO.

Now that IO is no longer stopped, hid_hw_close() must be called at the end
of probe() to balance the hid_hw_open() done at the beginning probe().

This series has been tested on the following devices:
Logitech Bluetooth Laser Travel Mouse (bluetooth, HID++ 1.0)
Logitech M720 Triathlon (bluetooth, HID++ 4.5)
Logitech M720 Triathlon (unifying, HID++ 4.5)
Logitech K400 Pro (unifying, HID++ 4.1)
Logitech K270 (eQUAD nano Lite, HID++ 2.0)
Logitech M185 (eQUAD nano Lite, HID++ 4.5)
Logitech LX501 keyboard (27 Mhz, HID++ builtin scroll-wheel, HID++ 1.0)
Logitech M-RAZ105 mouse (27 Mhz, HID++ extra mouse buttons, HID++ 1.0)

And by bentiss:
Logitech Touchpad T650 (unifying)
Logitech Touchpad T651 (bluetooth)
Logitech MX Master 3B (BLE)
Logitech G403 (plain USB / Gaming receiver)

Fixes: 498ba2069035 ("HID: logitech-hidpp: Don't restart communication if not necessary")
Suggested-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231010102029.111003-2-hdegoede@redhat.com
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-logitech-hidpp.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index e012d2d1a644..5755b3e63c33 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3869,8 +3869,10 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 			 hdev->name);
 
 	/*
-	 * Plain USB connections need to actually call start and open
-	 * on the transport driver to allow incoming data.
+	 * First call hid_hw_start(hdev, 0) to allow IO without connecting any
+	 * hid subdrivers (hid-input, hidraw). This allows retrieving the dev's
+	 * name and serial number and store these in hdev->name and hdev->uniq,
+	 * before the hid-input and hidraw drivers expose these to userspace.
 	 */
 	ret = hid_hw_start(hdev, will_restart ? 0 : connect_mask);
 	if (ret) {
@@ -3928,19 +3930,14 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 	flush_work(&hidpp->work);
 
 	if (will_restart) {
-		/* Reset the HID node state */
-		hid_device_io_stop(hdev);
-		hid_hw_close(hdev);
-		hid_hw_stop(hdev);
-
 		if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT)
 			connect_mask &= ~HID_CONNECT_HIDINPUT;
 
 		/* Now export the actual inputs and hidraw nodes to the world */
-		ret = hid_hw_start(hdev, connect_mask);
+		ret = hid_connect(hdev, connect_mask);
 		if (ret) {
-			hid_err(hdev, "%s:hid_hw_start returned error\n", __func__);
-			goto hid_hw_start_fail;
+			hid_err(hdev, "%s:hid_connect returned error %d\n", __func__, ret);
+			goto hid_hw_init_fail;
 		}
 	}
 
@@ -3952,6 +3949,11 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 				 ret);
 	}
 
+	/*
+	 * This relies on logi_dj_ll_close() being a no-op so that DJ connection
+	 * events will still be received.
+	 */
+	hid_hw_close(hdev);
 	return ret;
 
 hid_hw_init_fail:

From 7581eef4aef2053d905b4e4588ef30375b1c4316 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 10 Oct 2023 12:20:19 +0200
Subject: [PATCH 0417/1043] HID: logitech-hidpp: Revert "Don't restart
 communication if not necessary"

[ Upstream commit 55bf70362ffc4ddd7c8745e2fe880edac00e4aff ]

Commit 91cf9a98ae41 ("HID: logitech-hidpp: make .probe usbhid capable")
makes hidpp_probe() first call hid_hw_start(hdev, 0) to allow IO
without connecting any hid subdrivers (hid-input, hidraw).

This is done to allow to retrieve the device's name and serial number
and store these in hdev->name and hdev->uniq.

Then later on IO was stopped and started again with hid_hw_start(hdev,
HID_CONNECT_DEFAULT) connecting hid-input and hidraw after the name
and serial number have been setup.

Commit 498ba2069035 ("HID: logitech-hidpp: Don't restart communication
if not necessary") changed the probe() code to only do the start with
a 0 connect-mask + restart later for unifying devices.

But for non unifying devices hdev->name and hdev->uniq are updated too.
So this change re-introduces the problem for which the start with
a 0 connect-mask + restart later behavior was introduced.

The previous patch in this series changes the unifying path to instead of
restarting IO only call hid_connect() later. This avoids possible issues
with restarting IO seen on non unifying devices.

Revert the change to limit the restart behavior to unifying devices to
fix hdev->name changing after userspace facing devices have already been
registered.

This series has been tested on the following devices:
Logitech Bluetooth Laser Travel Mouse (bluetooth, HID++ 1.0)
Logitech M720 Triathlon (bluetooth, HID++ 4.5)
Logitech M720 Triathlon (unifying, HID++ 4.5)
Logitech K400 Pro (unifying, HID++ 4.1)
Logitech K270 (eQUAD nano Lite, HID++ 2.0)
Logitech M185 (eQUAD nano Lite, HID++ 4.5)
Logitech LX501 keyboard (27 Mhz, HID++ builtin scroll-wheel, HID++ 1.0)
Logitech M-RAZ105 mouse (27 Mhz, HID++ extra mouse buttons, HID++ 1.0)

And by bentiss:
Logitech Touchpad T650 (unifying)
Logitech Touchpad T651 (bluetooth)
Logitech MX Master 3B (BLE)
Logitech G403 (plain USB / Gaming receiver)

Fixes: 498ba2069035 ("HID: logitech-hidpp: Don't restart communication if not necessary")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231010102029.111003-3-hdegoede@redhat.com
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-logitech-hidpp.c | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 5755b3e63c33..6342363248cc 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3803,7 +3803,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 	bool connected;
 	unsigned int connect_mask = HID_CONNECT_DEFAULT;
 	struct hidpp_ff_private_data data;
-	bool will_restart = false;
 
 	/* report_fixup needs drvdata to be set before we call hid_parse */
 	hidpp = devm_kzalloc(&hdev->dev, sizeof(*hidpp), GFP_KERNEL);
@@ -3854,10 +3853,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 			return ret;
 	}
 
-	if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT ||
-	    hidpp->quirks & HIDPP_QUIRK_UNIFYING)
-		will_restart = true;
-
 	INIT_WORK(&hidpp->work, delayed_work_cb);
 	mutex_init(&hidpp->send_mutex);
 	init_waitqueue_head(&hidpp->wait);
@@ -3874,7 +3869,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 	 * name and serial number and store these in hdev->name and hdev->uniq,
 	 * before the hid-input and hidraw drivers expose these to userspace.
 	 */
-	ret = hid_hw_start(hdev, will_restart ? 0 : connect_mask);
+	ret = hid_hw_start(hdev, 0);
 	if (ret) {
 		hid_err(hdev, "hw start failed\n");
 		goto hid_hw_start_fail;
@@ -3913,7 +3908,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 			hidpp->wireless_feature_index = 0;
 		else if (ret)
 			goto hid_hw_init_fail;
-		ret = 0;
 	}
 
 	if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) {
@@ -3929,16 +3923,14 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 	schedule_work(&hidpp->work);
 	flush_work(&hidpp->work);
 
-	if (will_restart) {
-		if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT)
-			connect_mask &= ~HID_CONNECT_HIDINPUT;
+	if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT)
+		connect_mask &= ~HID_CONNECT_HIDINPUT;
 
-		/* Now export the actual inputs and hidraw nodes to the world */
-		ret = hid_connect(hdev, connect_mask);
-		if (ret) {
-			hid_err(hdev, "%s:hid_connect returned error %d\n", __func__, ret);
-			goto hid_hw_init_fail;
-		}
+	/* Now export the actual inputs and hidraw nodes to the world */
+	ret = hid_connect(hdev, connect_mask);
+	if (ret) {
+		hid_err(hdev, "%s:hid_connect returned error %d\n", __func__, ret);
+		goto hid_hw_init_fail;
 	}
 
 	if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {

From 6fd432f392a7e60c12712e68eb904f8f646f844f Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 10 Oct 2023 12:20:20 +0200
Subject: [PATCH 0418/1043] HID: logitech-hidpp: Move
 get_wireless_feature_index() check to hidpp_connect_event()

[ Upstream commit ba9de350509504fb748837b71e23d7e84c83d93c ]

Calling get_wireless_feature_index() from probe() causes
the wireless_feature_index to only get set for unifying devices which
are already connected at probe() time. It does not get set for devices
which connect later.

Fix this by moving get_wireless_feature_index() to hidpp_connect_event(),
this does not make a difference for devices connected at probe() since
probe() will queue the hidpp_connect_event() for those at probe time.

This series has been tested on the following devices:
Logitech Bluetooth Laser Travel Mouse (bluetooth, HID++ 1.0)
Logitech M720 Triathlon (bluetooth, HID++ 4.5)
Logitech M720 Triathlon (unifying, HID++ 4.5)
Logitech K400 Pro (unifying, HID++ 4.1)
Logitech K270 (eQUAD nano Lite, HID++ 2.0)
Logitech M185 (eQUAD nano Lite, HID++ 4.5)
Logitech LX501 keyboard (27 Mhz, HID++ builtin scroll-wheel, HID++ 1.0)
Logitech M-RAZ105 mouse (27 Mhz, HID++ extra mouse buttons, HID++ 1.0)

And by bentiss:
Logitech Touchpad T650 (unifying)
Logitech Touchpad T651 (bluetooth)
Logitech MX Master 3B (BLE)
Logitech G403 (plain USB / Gaming receiver)

Fixes: 0da0a63b7cba ("HID: logitech-hidpp: Support WirelessDeviceStatus connect events")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231010102029.111003-4-hdegoede@redhat.com
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-logitech-hidpp.c | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 6342363248cc..8bdcd4027416 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -1488,15 +1488,14 @@ static int hidpp_battery_get_property(struct power_supply *psy,
 /* -------------------------------------------------------------------------- */
 #define HIDPP_PAGE_WIRELESS_DEVICE_STATUS			0x1d4b
 
-static int hidpp_set_wireless_feature_index(struct hidpp_device *hidpp)
+static int hidpp_get_wireless_feature_index(struct hidpp_device *hidpp, u8 *feature_index)
 {
 	u8 feature_type;
 	int ret;
 
 	ret = hidpp_root_get_feature(hidpp,
 				     HIDPP_PAGE_WIRELESS_DEVICE_STATUS,
-				     &hidpp->wireless_feature_index,
-				     &feature_type);
+				     feature_index, &feature_type);
 
 	return ret;
 }
@@ -3666,6 +3665,13 @@ static void hidpp_connect_event(struct hidpp_device *hidpp)
 		}
 	}
 
+	if (hidpp->protocol_major >= 2) {
+		u8 feature_index;
+
+		if (!hidpp_get_wireless_feature_index(hidpp, &feature_index))
+			hidpp->wireless_feature_index = feature_index;
+	}
+
 	if (hidpp->name == hdev->name && hidpp->protocol_major >= 2) {
 		name = hidpp_get_device_name(hidpp);
 		if (name) {
@@ -3902,14 +3908,6 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 		hidpp_overwrite_name(hdev);
 	}
 
-	if (connected && hidpp->protocol_major >= 2) {
-		ret = hidpp_set_wireless_feature_index(hidpp);
-		if (ret == -ENOENT)
-			hidpp->wireless_feature_index = 0;
-		else if (ret)
-			goto hid_hw_init_fail;
-	}
-
 	if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) {
 		ret = wtp_get_config(hidpp);
 		if (ret)

From 2de16f6169a2bd5c0ae81d01f005638cf5307e03 Mon Sep 17 00:00:00 2001
From: Cezary Rojewski <cezary.rojewski@intel.com>
Date: Thu, 26 Oct 2023 10:25:58 +0200
Subject: [PATCH 0419/1043] ASoC: Intel: Skylake: Fix mem leak when parsing
 UUIDs fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 168d97844a61db302dec76d44406e9d4d7106b8e ]

Error path in snd_skl_parse_uuids() shall free last allocated module if
its instance_id allocation fails.

Fixes: f8e066521192 ("ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Link: https://lore.kernel.org/r/20231026082558.1864910-1-amadeuszx.slawinski@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/skylake/skl-sst-utils.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/intel/skylake/skl-sst-utils.c b/sound/soc/intel/skylake/skl-sst-utils.c
index 57ea815d3f04..b776c58dcf47 100644
--- a/sound/soc/intel/skylake/skl-sst-utils.c
+++ b/sound/soc/intel/skylake/skl-sst-utils.c
@@ -299,6 +299,7 @@ int snd_skl_parse_uuids(struct sst_dsp *ctx, const struct firmware *fw,
 		module->instance_id = devm_kzalloc(ctx->dev, size, GFP_KERNEL);
 		if (!module->instance_id) {
 			ret = -ENOMEM;
+			kfree(module);
 			goto free_uuid_list;
 		}
 

From 7606807bd6d0c0448d2970b6c3e8ba1a56ac825b Mon Sep 17 00:00:00 2001
From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Date: Tue, 20 Jul 2021 11:05:11 -0400
Subject: [PATCH 0420/1043] padata: Convert from atomic_t to refcount_t on
 parallel_data->refcnt

[ Upstream commit d5ee8e750c9449e9849a09ce6fb6b8adeaa66adc ]

refcount_t type and corresponding API can protect refcounters from
accidental underflow and overflow and further use-after-free situations.

Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: 7ddc21e317b3 ("padata: Fix refcnt handling in padata_free_shell()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/padata.h | 3 ++-
 kernel/padata.c        | 8 ++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/linux/padata.h b/include/linux/padata.h
index a433f13fc4bf..495b16b6b4d7 100644
--- a/include/linux/padata.h
+++ b/include/linux/padata.h
@@ -12,6 +12,7 @@
 #ifndef PADATA_H
 #define PADATA_H
 
+#include <linux/refcount.h>
 #include <linux/compiler_types.h>
 #include <linux/workqueue.h>
 #include <linux/spinlock.h>
@@ -96,7 +97,7 @@ struct parallel_data {
 	struct padata_shell		*ps;
 	struct padata_list		__percpu *reorder_list;
 	struct padata_serial_queue	__percpu *squeue;
-	atomic_t			refcnt;
+	refcount_t			refcnt;
 	unsigned int			seq_nr;
 	unsigned int			processed;
 	int				cpu;
diff --git a/kernel/padata.c b/kernel/padata.c
index 11ca3ebd8b12..dc81c756da3d 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -211,7 +211,7 @@ int padata_do_parallel(struct padata_shell *ps,
 	if ((pinst->flags & PADATA_RESET))
 		goto out;
 
-	atomic_inc(&pd->refcnt);
+	refcount_inc(&pd->refcnt);
 	padata->pd = pd;
 	padata->cb_cpu = *cb_cpu;
 
@@ -385,7 +385,7 @@ static void padata_serial_worker(struct work_struct *serial_work)
 	}
 	local_bh_enable();
 
-	if (atomic_sub_and_test(cnt, &pd->refcnt))
+	if (refcount_sub_and_test(cnt, &pd->refcnt))
 		padata_free_pd(pd);
 }
 
@@ -598,7 +598,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_shell *ps)
 	padata_init_reorder_list(pd);
 	padata_init_squeues(pd);
 	pd->seq_nr = -1;
-	atomic_set(&pd->refcnt, 1);
+	refcount_set(&pd->refcnt, 1);
 	spin_lock_init(&pd->lock);
 	pd->cpu = cpumask_first(pd->cpumask.pcpu);
 	INIT_WORK(&pd->reorder_work, invoke_padata_reorder);
@@ -672,7 +672,7 @@ static int padata_replace(struct padata_instance *pinst)
 	synchronize_rcu();
 
 	list_for_each_entry_continue_reverse(ps, &pinst->pslist, list)
-		if (atomic_dec_and_test(&ps->opd->refcnt))
+		if (refcount_dec_and_test(&ps->opd->refcnt))
 			padata_free_pd(ps->opd);
 
 	pinst->flags &= ~PADATA_RESET;

From 41aad9d6953984d134fc50f631f24ef476875d4d Mon Sep 17 00:00:00 2001
From: WangJinchao <wangjinchao@xfusion.com>
Date: Mon, 16 Oct 2023 09:15:21 +0800
Subject: [PATCH 0421/1043] padata: Fix refcnt handling in padata_free_shell()

[ Upstream commit 7ddc21e317b360c3444de3023bcc83b85fabae2f ]

In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead
to system UAF (Use-After-Free) issues. Due to the lengthy analysis of
the pcrypt_aead01 function call, I'll describe the problem scenario
using a simplified model:

Suppose there's a user of padata named `user_function` that adheres to
the padata requirement of calling `padata_free_shell` after `serial()`
has been invoked, as demonstrated in the following code:

```c
struct request {
    struct padata_priv padata;
    struct completion *done;
};

void parallel(struct padata_priv *padata) {
    do_something();
}

void serial(struct padata_priv *padata) {
    struct request *request = container_of(padata,
    				struct request,
				padata);
    complete(request->done);
}

void user_function() {
    DECLARE_COMPLETION(done)
    padata->parallel = parallel;
    padata->serial = serial;
    padata_do_parallel();
    wait_for_completion(&done);
    padata_free_shell();
}
```

In the corresponding padata.c file, there's the following code:

```c
static void padata_serial_worker(struct work_struct *serial_work) {
    ...
    cnt = 0;

    while (!list_empty(&local_list)) {
        ...
        padata->serial(padata);
        cnt++;
    }

    local_bh_enable();

    if (refcount_sub_and_test(cnt, &pd->refcnt))
        padata_free_pd(pd);
}
```

Because of the high system load and the accumulation of unexecuted
softirq at this moment, `local_bh_enable()` in padata takes longer
to execute than usual. Subsequently, when accessing `pd->refcnt`,
`pd` has already been released by `padata_free_shell()`, resulting
in a UAF issue with `pd->refcnt`.

The fix is straightforward: add `refcount_dec_and_test` before calling
`padata_free_pd` in `padata_free_shell`.

Fixes: 07928d9bfc81 ("padata: Remove broken queue flushing")

Signed-off-by: WangJinchao <wangjinchao@xfusion.com>
Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/padata.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/padata.c b/kernel/padata.c
index dc81c756da3d..7d500219f96b 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -1107,12 +1107,16 @@ EXPORT_SYMBOL(padata_alloc_shell);
  */
 void padata_free_shell(struct padata_shell *ps)
 {
+	struct parallel_data *pd;
+
 	if (!ps)
 		return;
 
 	mutex_lock(&ps->pinst->lock);
 	list_del(&ps->list);
-	padata_free_pd(rcu_dereference_protected(ps->pd, 1));
+	pd = rcu_dereference_protected(ps->pd, 1);
+	if (refcount_dec_and_test(&pd->refcnt))
+		padata_free_pd(pd);
 	mutex_unlock(&ps->pinst->lock);
 
 	kfree(ps);

From b7b4851e630dda45c559b1cfdd8aeb85ddecc285 Mon Sep 17 00:00:00 2001
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Date: Fri, 27 Oct 2023 00:09:56 +0000
Subject: [PATCH 0422/1043] ASoC: ams-delta.c: use component after check

[ Upstream commit bd0f7498bc9084d8cccc5484cd004b40f314b763 ]

	static void cx81801_close()
	{
		...
(A)		struct snd_soc_dapm_context *dapm = &component->card->dapm;
		...
(B)		if (!component)
			return;
	}

(A) uses component before NULL check (B). This patch moves it after (B).

Fixes: d0fdfe34080c ("ASoC: cx20442: replace codec to component")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/3e608474-e99a-4866-ae98-3054a4221f09@moroto.mountain
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87ttqdq623.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/ti/ams-delta.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/soc/ti/ams-delta.c b/sound/soc/ti/ams-delta.c
index 57feb473a579..fbd75732a68b 100644
--- a/sound/soc/ti/ams-delta.c
+++ b/sound/soc/ti/ams-delta.c
@@ -303,7 +303,7 @@ static int cx81801_open(struct tty_struct *tty)
 static void cx81801_close(struct tty_struct *tty)
 {
 	struct snd_soc_component *component = tty->disc_data;
-	struct snd_soc_dapm_context *dapm = &component->card->dapm;
+	struct snd_soc_dapm_context *dapm;
 
 	del_timer_sync(&cx81801_timer);
 
@@ -315,6 +315,8 @@ static void cx81801_close(struct tty_struct *tty)
 
 	v253_ops.close(tty);
 
+	dapm = &component->card->dapm;
+
 	/* Revert back to default audio input/output constellation */
 	snd_soc_dapm_mutex_lock(dapm);
 

From 9f831533d2d094b7e6774bd127dcc92ee3ed6ebc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
Date: Mon, 28 Aug 2023 22:16:11 +0200
Subject: [PATCH 0423/1043] mfd: core: Un-constify mfd_cell.of_reg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 3c70342f1f0045dc827bb2f02d814ce31e0e0d05 ]

Enable dynamically filling in the whole mfd_cell structure. All other
fields already allow that.

Fixes: 466a62d7642f ("mfd: core: Make a best effort attempt to match devices with the correct of_nodes")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://lore.kernel.org/r/b73fe4bc4bd6ba1af90940a640ed65fe254c0408.1693253717.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/mfd/core.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/mfd/core.h b/include/linux/mfd/core.h
index 4b35baa14d30..8974c7142c94 100644
--- a/include/linux/mfd/core.h
+++ b/include/linux/mfd/core.h
@@ -92,7 +92,7 @@ struct mfd_cell {
 	 * (above) when matching OF nodes with devices that have identical
 	 * compatible strings
 	 */
-	const u64 of_reg;
+	u64 of_reg;
 
 	/* Set to 'true' to use 'of_reg' (above) - allows for of_reg=0 */
 	bool use_of_reg;

From b708eb26b560da7160a8d10a224ecc7f1a4dc258 Mon Sep 17 00:00:00 2001
From: Herve Codina <herve.codina@bootlin.com>
Date: Fri, 18 Aug 2023 18:39:17 +0200
Subject: [PATCH 0424/1043] mfd: core: Ensure disabled devices are skipped
 without aborting

[ Upstream commit 7ba7bdef4d14e3722e2842da3b48cbadb73e52d6 ]

The loop searching for a matching device based on its compatible
string is aborted when a matching disabled device is found.
This abort prevents to add devices as soon as one disabled device
is found.

Continue searching for an other device instead of aborting on the
first disabled one fixes the issue.

Fixes: 22380b65dc70 ("mfd: mfd-core: Ensure disabled devices are ignored without error")
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Link: https://lore.kernel.org/r/528425d6472176bb1d02d79596b51f8c28a551cc.1692376361.git.christophe.leroy@csgroup.eu
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/mfd-core.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index a3a6faa99de0..c0083e38d527 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -171,6 +171,7 @@ static int mfd_add_device(struct device *parent, int id,
 	struct platform_device *pdev;
 	struct device_node *np = NULL;
 	struct mfd_of_node_entry *of_entry, *tmp;
+	bool disabled = false;
 	int ret = -ENOMEM;
 	int platform_id;
 	int r;
@@ -208,11 +209,10 @@ static int mfd_add_device(struct device *parent, int id,
 	if (IS_ENABLED(CONFIG_OF) && parent->of_node && cell->of_compatible) {
 		for_each_child_of_node(parent->of_node, np) {
 			if (of_device_is_compatible(np, cell->of_compatible)) {
-				/* Ignore 'disabled' devices error free */
+				/* Skip 'disabled' devices */
 				if (!of_device_is_available(np)) {
-					of_node_put(np);
-					ret = 0;
-					goto fail_alias;
+					disabled = true;
+					continue;
 				}
 
 				ret = mfd_match_of_node_to_dev(pdev, np, cell);
@@ -222,10 +222,17 @@ static int mfd_add_device(struct device *parent, int id,
 				if (ret)
 					goto fail_alias;
 
-				break;
+				goto match;
 			}
 		}
 
+		if (disabled) {
+			/* Ignore 'disabled' devices error free */
+			ret = 0;
+			goto fail_alias;
+		}
+
+match:
 		if (!pdev->dev.of_node)
 			pr_warn("%s: Failed to locate of_node [id: %d]\n",
 				cell->name, platform_id);

From c2766ed2b7afc25bc2b6063ce64ae9a83bc86176 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Mon, 25 Sep 2023 10:41:33 +0800
Subject: [PATCH 0425/1043] mfd: dln2: Fix double put in dln2_probe

[ Upstream commit 759c409bc5fc496cbc22cd0b392d3cbb0c0e23eb ]

The dln2_free() already contains usb_put_dev(). Therefore,
the redundant usb_put_dev() before dln2_free() may lead to
a double free.

Fixes: 96da8f148396 ("mfd: dln2: Fix memory leak in dln2_probe()")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Link: https://lore.kernel.org/r/20230925024134.9683-1-dinghao.liu@zju.edu.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/dln2.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
index fc65f9e25fda..852129ea0766 100644
--- a/drivers/mfd/dln2.c
+++ b/drivers/mfd/dln2.c
@@ -836,7 +836,6 @@ static int dln2_probe(struct usb_interface *interface,
 	dln2_stop_rx_urbs(dln2);
 
 out_free:
-	usb_put_dev(dln2->usb_dev);
 	dln2_free(dln2);
 
 	return ret;

From 23eb8629c22f7a36587ef2de22a9dedd699b3ac5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Fri, 22 Sep 2023 21:28:34 +0200
Subject: [PATCH 0426/1043] leds: pwm: Don't disable the PWM when the LED
 should be off
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 76fe464c8e64e71b2e4af11edeef0e5d85eeb6aa ]

Disabling a PWM (i.e. calling pwm_apply_state with .enabled = false)
gives no guarantees what the PWM output does. It might freeze where it
currently is, or go in a High-Z state or drive the active or inactive
state, it might even continue to toggle.

To ensure that the LED gets really disabled, don't disable the PWM even
when .duty_cycle is zero.

This fixes disabling a leds-pwm LED on i.MX28. The PWM on this SoC is
one of those that freezes its output on disable, so if you disable an
LED that is full on, it stays on. If you disable a LED with half
brightness it goes off in 50% of the cases and full on in the other 50%.

Fixes: 41c42ff5dbe2 ("leds: simple driver for pwm driven LEDs")
Reported-by: Rogan Dawes <rogan@dawes.za.net>
Reported-by: Fabio Estevam <festevam@denx.de>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Fabio Estevam <festevam@denx.de>
Link: https://lore.kernel.org/r/20230922192834.1695727-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/leds-pwm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
index f53f9309ca6c..f4c0507becb3 100644
--- a/drivers/leds/leds-pwm.c
+++ b/drivers/leds/leds-pwm.c
@@ -51,7 +51,7 @@ static int led_pwm_set(struct led_classdev *led_cdev,
 		duty = led_dat->pwmstate.period - duty;
 
 	led_dat->pwmstate.duty_cycle = duty;
-	led_dat->pwmstate.enabled = duty > 0;
+	led_dat->pwmstate.enabled = true;
 	return pwm_apply_state(led_dat->pwm, &led_dat->pwmstate);
 }
 

From 380837052669b0a5e3cc928dc2f55731521e395c Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 23 Sep 2023 09:15:38 +0200
Subject: [PATCH 0427/1043] leds: trigger: ledtrig-cpu:: Fix 'output may be
 truncated' issue for 'cpu'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit ff50f53276131a3059e8307d11293af388ed2bcd ]

In order to teach the compiler that 'trig->name' will never be truncated,
we need to tell it that 'cpu' is not negative.

When building with W=1, this fixes the following warnings:

  drivers/leds/trigger/ledtrig-cpu.c: In function ‘ledtrig_cpu_init’:
  drivers/leds/trigger/ledtrig-cpu.c:155:56: error: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 5 [-Werror=format-truncation=]
    155 |                 snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu);
        |                                                        ^~
  drivers/leds/trigger/ledtrig-cpu.c:155:52: note: directive argument in the range [-2147483648, 7]
    155 |                 snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu);
        |                                                    ^~~~~~~
  drivers/leds/trigger/ledtrig-cpu.c:155:17: note: ‘snprintf’ output between 5 and 15 bytes into a destination of size 8
    155 |                 snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu);
        |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fixes: 8f88731d052d ("led-triggers: create a trigger for CPU activity")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/3f4be7a99933cf8566e630da54f6ab913caac432.1695453322.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/trigger/ledtrig-cpu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/leds/trigger/ledtrig-cpu.c b/drivers/leds/trigger/ledtrig-cpu.c
index fca62d503590..f19baed61502 100644
--- a/drivers/leds/trigger/ledtrig-cpu.c
+++ b/drivers/leds/trigger/ledtrig-cpu.c
@@ -130,7 +130,7 @@ static int ledtrig_prepare_down_cpu(unsigned int cpu)
 
 static int __init ledtrig_cpu_init(void)
 {
-	int cpu;
+	unsigned int cpu;
 	int ret;
 
 	/* Supports up to 9999 cpu cores */
@@ -152,7 +152,7 @@ static int __init ledtrig_cpu_init(void)
 		if (cpu >= 8)
 			continue;
 
-		snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu);
+		snprintf(trig->name, MAX_NAME_LEN, "cpu%u", cpu);
 
 		led_trigger_register_simple(trig->name, &trig->_trig);
 	}

From 3ebf42fe8cc78791c9e05d0415bfe919c18af81e Mon Sep 17 00:00:00 2001
From: Yi Yang <yiyang13@huawei.com>
Date: Thu, 31 Aug 2023 10:33:29 +0800
Subject: [PATCH 0428/1043] tty: tty_jobctrl: fix pid memleak in
 disassociate_ctty()

[ Upstream commit 11e7f27b79757b6586645d87b95d5b78375ecdfc ]

There is a pid leakage:
------------------------------
unreferenced object 0xffff88810c181940 (size 224):
  comm "sshd", pid 8191, jiffies 4294946950 (age 524.570s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de  .............N..
    ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff  ....kkkk........
  backtrace:
    [<ffffffff814774e6>] kmem_cache_alloc+0x5c6/0x9b0
    [<ffffffff81177342>] alloc_pid+0x72/0x570
    [<ffffffff81140ac4>] copy_process+0x1374/0x2470
    [<ffffffff81141d77>] kernel_clone+0xb7/0x900
    [<ffffffff81142645>] __se_sys_clone+0x85/0xb0
    [<ffffffff8114269b>] __x64_sys_clone+0x2b/0x30
    [<ffffffff83965a72>] do_syscall_64+0x32/0x80
    [<ffffffff83a00085>] entry_SYSCALL_64_after_hwframe+0x61/0xc6

It turns out that there is a race condition between disassociate_ctty() and
tty_signal_session_leader(), which caused this leakage.

The pid memleak is triggered by the following race:
task[sshd]                     task[bash]
-----------------------        -----------------------
                               disassociate_ctty();
                               spin_lock_irq(&current->sighand->siglock);
                               put_pid(current->signal->tty_old_pgrp);
                               current->signal->tty_old_pgrp = NULL;
                               tty = tty_kref_get(current->signal->tty);
                               spin_unlock_irq(&current->sighand->siglock);
tty_vhangup();
tty_lock(tty);
...
tty_signal_session_leader();
spin_lock_irq(&p->sighand->siglock);
...
if (tty->ctrl.pgrp) //tty->ctrl.pgrp is not NULL
p->signal->tty_old_pgrp = get_pid(tty->ctrl.pgrp); //An extra get
spin_unlock_irq(&p->sighand->siglock);
...
tty_unlock(tty);
                               if (tty) {
                                   tty_lock(tty);
                                   ...
                                   put_pid(tty->ctrl.pgrp);
                                   tty->ctrl.pgrp = NULL; //It's too late
                                   ...
                                   tty_unlock(tty);
                               }

The issue is believed to be introduced by commit c8bcd9c5be24 ("tty:
Fix ->session locking") who moves the unlock of siglock in
disassociate_ctty() above "if (tty)", making a small window allowing
tty_signal_session_leader() to kick in. It can be easily reproduced by
adding a delay before "if (tty)" and at the entrance of
tty_signal_session_leader().

To fix this issue, we move "put_pid(current->signal->tty_old_pgrp)" after
"tty->ctrl.pgrp = NULL".

Fixes: c8bcd9c5be24 ("tty: Fix ->session locking")
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Co-developed-by: GUO Zihua <guozihua@huawei.com>
Signed-off-by: GUO Zihua <guozihua@huawei.com>
Link: https://lore.kernel.org/r/20230831023329.165737-1-yiyang13@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/tty_jobctrl.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/tty/tty_jobctrl.c b/drivers/tty/tty_jobctrl.c
index 95d67613b25b..a27d02187174 100644
--- a/drivers/tty/tty_jobctrl.c
+++ b/drivers/tty/tty_jobctrl.c
@@ -291,12 +291,7 @@ void disassociate_ctty(int on_exit)
 		return;
 	}
 
-	spin_lock_irq(&current->sighand->siglock);
-	put_pid(current->signal->tty_old_pgrp);
-	current->signal->tty_old_pgrp = NULL;
-	tty = tty_kref_get(current->signal->tty);
-	spin_unlock_irq(&current->sighand->siglock);
-
+	tty = get_current_tty();
 	if (tty) {
 		unsigned long flags;
 
@@ -311,6 +306,16 @@ void disassociate_ctty(int on_exit)
 		tty_kref_put(tty);
 	}
 
+	/* If tty->ctrl.pgrp is not NULL, it may be assigned to
+	 * current->signal->tty_old_pgrp in a race condition, and
+	 * cause pid memleak. Release current->signal->tty_old_pgrp
+	 * after tty->ctrl.pgrp set to NULL.
+	 */
+	spin_lock_irq(&current->sighand->siglock);
+	put_pid(current->signal->tty_old_pgrp);
+	current->signal->tty_old_pgrp = NULL;
+	spin_unlock_irq(&current->sighand->siglock);
+
 	/* Now clear signal->tty under the lock */
 	read_lock(&tasklist_lock);
 	session_clear_tty(task_session(current));

From 05de1536d0523da4248b5d0926b45b4c4b2f3da3 Mon Sep 17 00:00:00 2001
From: Zheng Yejian <zhengyejian1@huawei.com>
Date: Thu, 14 Sep 2023 15:26:44 +0800
Subject: [PATCH 0429/1043] livepatch: Fix missing newline character in
 klp_resolve_symbols()

[ Upstream commit 67e18e132f0fd738f8c8cac3aa1420312073f795 ]

Without the newline character, the log may not be printed immediately
after the error occurs.

Fixes: ca376a937486 ("livepatch: Prevent module-specific KLP rela sections from referencing vmlinux symbols")
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20230914072644.4098857-1-zhengyejian1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/livepatch/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index e8bdce6fdd64..f5faf935c2d8 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -245,7 +245,7 @@ static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab,
 		 * symbols are exported and normal relas can be used instead.
 		 */
 		if (!sec_vmlinux && sym_vmlinux) {
-			pr_err("invalid access to vmlinux symbol '%s' from module-specific livepatch relocation section",
+			pr_err("invalid access to vmlinux symbol '%s' from module-specific livepatch relocation section\n",
 			       sym_name);
 			return -EINVAL;
 		}

From bdb3dd4096302d6b87441fdc528439f171b04be6 Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju@buaa.edu.cn>
Date: Tue, 26 Sep 2023 10:44:04 +0800
Subject: [PATCH 0430/1043] usb: dwc2: fix possible NULL pointer dereference
 caused by driver concurrency

[ Upstream commit ef307bc6ef04e8c1ea843231db58e3afaafa9fa6 ]

In _dwc2_hcd_urb_enqueue(), "urb->hcpriv = NULL" is executed without
holding the lock "hsotg->lock". In _dwc2_hcd_urb_dequeue():

    spin_lock_irqsave(&hsotg->lock, flags);
    ...
	if (!urb->hcpriv) {
		dev_dbg(hsotg->dev, "## urb->hcpriv is NULL ##\n");
		goto out;
	}
    rc = dwc2_hcd_urb_dequeue(hsotg, urb->hcpriv); // Use urb->hcpriv
    ...
out:
    spin_unlock_irqrestore(&hsotg->lock, flags);

When _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() are
concurrently executed, the NULL check of "urb->hcpriv" can be executed
before "urb->hcpriv = NULL". After urb->hcpriv is NULL, it can be used
in the function call to dwc2_hcd_urb_dequeue(), which can cause a NULL
pointer dereference.

This possible bug is found by an experimental static analysis tool
developed by myself. This tool analyzes the locking APIs to extract
function pairs that can be concurrently executed, and then analyzes the
instructions in the paired functions to identify possible concurrency
bugs including data races and atomicity violations. The above possible
bug is reported, when my tool analyzes the source code of Linux 6.5.

To fix this possible bug, "urb->hcpriv = NULL" should be executed with
holding the lock "hsotg->lock". After using this patch, my tool never
reports the possible bug, with the kernelconfiguration allyesconfig for
x86_64. Because I have no associated hardware, I cannot test the patch
in runtime testing, and just verify it according to the code logic.

Fixes: 33ad261aa62b ("usb: dwc2: host: spinlock urb_enqueue")
Signed-off-by: Jia-Ju Bai <baijiaju@buaa.edu.cn>
Link: https://lore.kernel.org/r/20230926024404.832096-1-baijiaju@buaa.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/hcd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index 9279d3d3698c..14925fedb01a 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -4684,8 +4684,8 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
 	if (qh_allocated && qh->channel && qh->channel->qh == qh)
 		qh->channel->qh = NULL;
 fail2:
-	spin_unlock_irqrestore(&hsotg->lock, flags);
 	urb->hcpriv = NULL;
+	spin_unlock_irqrestore(&hsotg->lock, flags);
 	kfree(qtd);
 fail1:
 	if (qh_allocated) {

From c53cfe99c2aa9c3c9471febb508ce6c70623745b Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Fri, 15 Sep 2023 15:59:59 +0300
Subject: [PATCH 0431/1043] dmaengine: ti: edma: handle irq_of_parse_and_map()
 errors

[ Upstream commit 14f6d317913f634920a640e9047aa2e66f5bdcb7 ]

Zero is not a valid IRQ for in-kernel code and the irq_of_parse_and_map()
function returns zero on error.  So this check for valid IRQs should only
accept values > 0.

Fixes: 2b6b3b742019 ("ARM/dmaengine: edma: Merge the two drivers under drivers/dma/")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Link: https://lore.kernel.org/r/f15cb6a7-8449-4f79-98b6-34072f04edbc@moroto.mountain
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/ti/edma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
index 35d81bd857f1..a1adc8d91fd8 100644
--- a/drivers/dma/ti/edma.c
+++ b/drivers/dma/ti/edma.c
@@ -2459,7 +2459,7 @@ static int edma_probe(struct platform_device *pdev)
 	if (irq < 0 && node)
 		irq = irq_of_parse_and_map(node, 0);
 
-	if (irq >= 0) {
+	if (irq > 0) {
 		irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccint",
 					  dev_name(dev));
 		ret = devm_request_irq(dev, irq, dma_irq_handler, 0, irq_name,
@@ -2475,7 +2475,7 @@ static int edma_probe(struct platform_device *pdev)
 	if (irq < 0 && node)
 		irq = irq_of_parse_and_map(node, 2);
 
-	if (irq >= 0) {
+	if (irq > 0) {
 		irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccerrint",
 					  dev_name(dev));
 		ret = devm_request_irq(dev, irq, dma_ccerr_handler, 0, irq_name,

From d046e3f8de1d851837ac5fe7243f5337419a6537 Mon Sep 17 00:00:00 2001
From: Jinjie Ruan <ruanjinjie@huawei.com>
Date: Wed, 23 Aug 2023 11:50:20 +0800
Subject: [PATCH 0432/1043] misc: st_core: Do not call kfree_skb() under
 spin_lock_irqsave()

[ Upstream commit 4d08c3d12b61022501989f9f071514d2d6f77c47 ]

It is not allowed to call kfree_skb() from hardware interrupt
context or with hardware interrupts being disabled.
So replace kfree_skb() with dev_kfree_skb_irq() under
spin_lock_irqsave(). Compile tested only.

Fixes: 53618cc1e51e ("Staging: sources for ST core")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Link: https://lore.kernel.org/r/20230823035020.1281892-1-ruanjinjie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/ti-st/st_core.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index f4ddd1e67015..ca115f344fa2 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -15,6 +15,7 @@
 #include <linux/skbuff.h>
 
 #include <linux/ti_wilink_st.h>
+#include <linux/netdevice.h>
 
 extern void st_kim_recv(void *, const unsigned char *, long);
 void st_int_recv(void *, const unsigned char *, long);
@@ -436,7 +437,7 @@ static void st_int_enqueue(struct st_data_s *st_gdata, struct sk_buff *skb)
 	case ST_LL_AWAKE_TO_ASLEEP:
 		pr_err("ST LL is illegal state(%ld),"
 			   "purging received skb.", st_ll_getstate(st_gdata));
-		kfree_skb(skb);
+		dev_kfree_skb_irq(skb);
 		break;
 	case ST_LL_ASLEEP:
 		skb_queue_tail(&st_gdata->tx_waitq, skb);
@@ -445,7 +446,7 @@ static void st_int_enqueue(struct st_data_s *st_gdata, struct sk_buff *skb)
 	default:
 		pr_err("ST LL is illegal state(%ld),"
 			   "purging received skb.", st_ll_getstate(st_gdata));
-		kfree_skb(skb);
+		dev_kfree_skb_irq(skb);
 		break;
 	}
 
@@ -499,7 +500,7 @@ void st_tx_wakeup(struct st_data_s *st_data)
 				spin_unlock_irqrestore(&st_data->lock, flags);
 				break;
 			}
-			kfree_skb(skb);
+			dev_kfree_skb_irq(skb);
 			spin_unlock_irqrestore(&st_data->lock, flags);
 		}
 		/* if wake-up is set in another context- restart sending */

From a0a41991ddf294941a6bfbd466a5ad57608d2dd9 Mon Sep 17 00:00:00 2001
From: Alexandru Ardelean <alexandru.ardelean@analog.com>
Date: Mon, 15 Feb 2021 12:40:42 +0200
Subject: [PATCH 0433/1043] tools: iio: privatize globals and functions in
 iio_generic_buffer.c file

[ Upstream commit ebe5112535b5cf389ca7d337cf6a0c1d885f9880 ]

Mostly a tidy-up.
But also helps to understand the limits of scope of these functions and
globals.

Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Link: https://lore.kernel.org/r/20210215104043.91251-24-alexandru.ardelean@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: 2d3dff577dd0 ("tools: iio: iio_generic_buffer ensure alignment")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/iio/iio_generic_buffer.c | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index 34d63bcebcd2..7c7240553777 100644
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -49,7 +49,7 @@ enum autochan {
  * Has the side effect of filling the channels[i].location values used
  * in processing the buffer output.
  **/
-int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
+static int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
 {
 	int bytes = 0;
 	int i = 0;
@@ -68,7 +68,7 @@ int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
 	return bytes;
 }
 
-void print1byte(uint8_t input, struct iio_channel_info *info)
+static void print1byte(uint8_t input, struct iio_channel_info *info)
 {
 	/*
 	 * Shift before conversion to avoid sign extension
@@ -85,7 +85,7 @@ void print1byte(uint8_t input, struct iio_channel_info *info)
 	}
 }
 
-void print2byte(uint16_t input, struct iio_channel_info *info)
+static void print2byte(uint16_t input, struct iio_channel_info *info)
 {
 	/* First swap if incorrect endian */
 	if (info->be)
@@ -108,7 +108,7 @@ void print2byte(uint16_t input, struct iio_channel_info *info)
 	}
 }
 
-void print4byte(uint32_t input, struct iio_channel_info *info)
+static void print4byte(uint32_t input, struct iio_channel_info *info)
 {
 	/* First swap if incorrect endian */
 	if (info->be)
@@ -131,7 +131,7 @@ void print4byte(uint32_t input, struct iio_channel_info *info)
 	}
 }
 
-void print8byte(uint64_t input, struct iio_channel_info *info)
+static void print8byte(uint64_t input, struct iio_channel_info *info)
 {
 	/* First swap if incorrect endian */
 	if (info->be)
@@ -167,9 +167,8 @@ void print8byte(uint64_t input, struct iio_channel_info *info)
  *			      to fill the location offsets.
  * @num_channels:	number of channels
  **/
-void process_scan(char *data,
-		  struct iio_channel_info *channels,
-		  int num_channels)
+static void process_scan(char *data, struct iio_channel_info *channels,
+			 int num_channels)
 {
 	int k;
 
@@ -238,7 +237,7 @@ static int enable_disable_all_channels(char *dev_dir_name, int enable)
 	return 0;
 }
 
-void print_usage(void)
+static void print_usage(void)
 {
 	fprintf(stderr, "Usage: generic_buffer [options]...\n"
 		"Capture, convert and output data from IIO device buffer\n"
@@ -257,12 +256,12 @@ void print_usage(void)
 		"  -w <n>     Set delay between reads in us (event-less mode)\n");
 }
 
-enum autochan autochannels = AUTOCHANNELS_DISABLED;
-char *dev_dir_name = NULL;
-char *buf_dir_name = NULL;
-bool current_trigger_set = false;
+static enum autochan autochannels = AUTOCHANNELS_DISABLED;
+static char *dev_dir_name = NULL;
+static char *buf_dir_name = NULL;
+static bool current_trigger_set = false;
 
-void cleanup(void)
+static void cleanup(void)
 {
 	int ret;
 
@@ -294,14 +293,14 @@ void cleanup(void)
 	}
 }
 
-void sig_handler(int signum)
+static void sig_handler(int signum)
 {
 	fprintf(stderr, "Caught signal %d\n", signum);
 	cleanup();
 	exit(-signum);
 }
 
-void register_cleanup(void)
+static void register_cleanup(void)
 {
 	struct sigaction sa = { .sa_handler = sig_handler };
 	const int signums[] = { SIGINT, SIGTERM, SIGABRT };

From 3eadba058276f18b16236426ea6c4ff2e37af407 Mon Sep 17 00:00:00 2001
From: Chenyuan Mi <michenyuan@huawei.com>
Date: Tue, 25 Jul 2023 09:24:07 +0000
Subject: [PATCH 0434/1043] tools: iio: iio_generic_buffer: Fix some integer
 type and calculation

[ Upstream commit 49d736313d0975ddeb156f4f59801da833f78b30 ]

In function size_from_channelarray(), the return value 'bytes' is defined
as int type. However, the calcution of 'bytes' in this function is designed
to use the unsigned int type. So it is necessary to change 'bytes' type to
unsigned int to avoid integer overflow.

The size_from_channelarray() is called in main() function, its return value
is directly multipled by 'buf_len' and then used as the malloc() parameter.
The 'buf_len' is completely controllable by user, thus a multiplication
overflow may occur here. This could allocate an unexpected small area.

Signed-off-by: Chenyuan Mi <michenyuan@huawei.com>
Link: https://lore.kernel.org/r/20230725092407.62545-1-michenyuan@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: 2d3dff577dd0 ("tools: iio: iio_generic_buffer ensure alignment")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/iio/iio_generic_buffer.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index 7c7240553777..e38c72fd58cc 100644
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -49,9 +49,9 @@ enum autochan {
  * Has the side effect of filling the channels[i].location values used
  * in processing the buffer output.
  **/
-static int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
+static unsigned int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
 {
-	int bytes = 0;
+	unsigned int bytes = 0;
 	int i = 0;
 
 	while (i < num_channels) {
@@ -342,7 +342,7 @@ int main(int argc, char **argv)
 	ssize_t read_size;
 	int dev_num = -1, trig_num = -1;
 	char *buffer_access = NULL;
-	int scan_size;
+	unsigned int scan_size;
 	int noevents = 0;
 	int notrigger = 0;
 	char *dummy;
@@ -612,7 +612,16 @@ int main(int argc, char **argv)
 	}
 
 	scan_size = size_from_channelarray(channels, num_channels);
-	data = malloc(scan_size * buf_len);
+
+	size_t total_buf_len = scan_size * buf_len;
+
+	if (scan_size > 0 && total_buf_len / scan_size != buf_len) {
+		ret = -EFAULT;
+		perror("Integer overflow happened when calculate scan_size * buf_len");
+		goto error;
+	}
+
+	data = malloc(total_buf_len);
 	if (!data) {
 		ret = -ENOMEM;
 		goto error;

From 798692e48c0a0cc4f36335ffe62cae3cd1c624ff Mon Sep 17 00:00:00 2001
From: Matti Vaittinen <mazziesaccount@gmail.com>
Date: Tue, 3 Oct 2023 12:57:47 +0300
Subject: [PATCH 0435/1043] tools: iio: iio_generic_buffer ensure alignment

[ Upstream commit 2d3dff577dd0ea8fe9637a13822f7603c4a881c8 ]

The iio_generic_buffer can return garbage values when the total size of
scan data is not a multiple of the largest element in the scan. This can be
demonstrated by reading a scan, consisting, for example of one 4-byte and
one 2-byte element, where the 4-byte element is first in the buffer.

The IIO generic buffer code does not take into account the last two
padding bytes that are needed to ensure that the 4-byte data for next
scan is correctly aligned.

Add the padding bytes required to align the next sample with the scan size.

Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
Fixes: e58537ccce73 ("staging: iio: update example application.")
Link: https://lore.kernel.org/r/ZRvlm4ktNLu+qmlf@dc78bmyyyyyyyyyyyyydt-3.rev.dnainternet.fi
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/iio/iio_generic_buffer.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index e38c72fd58cc..2fd10eab75b5 100644
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -52,9 +52,12 @@ enum autochan {
 static unsigned int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
 {
 	unsigned int bytes = 0;
-	int i = 0;
+	int i = 0, max = 0;
+	unsigned int misalignment;
 
 	while (i < num_channels) {
+		if (channels[i].bytes > max)
+			max = channels[i].bytes;
 		if (bytes % channels[i].bytes == 0)
 			channels[i].location = bytes;
 		else
@@ -64,6 +67,14 @@ static unsigned int size_from_channelarray(struct iio_channel_info *channels, in
 		bytes = channels[i].location + channels[i].bytes;
 		i++;
 	}
+	/*
+	 * We want the data in next sample to also be properly aligned so
+	 * we'll add padding at the end if needed. Adding padding only
+	 * works for channel data which size is 2^n bytes.
+	 */
+	misalignment = bytes % max;
+	if (misalignment)
+		bytes += max - misalignment;
 
 	return bytes;
 }

From 5fe228041c511d8e1dcbd005c0891fc9e1f72722 Mon Sep 17 00:00:00 2001
From: Jonas Blixt <jonas.blixt@actia.se>
Date: Thu, 15 Jun 2023 11:28:10 +0200
Subject: [PATCH 0436/1043] USB: usbip: fix stub_dev hub disconnect

[ Upstream commit 97475763484245916735a1aa9a3310a01d46b008 ]

If a hub is disconnected that has device(s) that's attached to the usbip layer
the disconnect function might fail because it tries to release the port
on an already disconnected hub.

Fixes: 6080cd0e9239 ("staging: usbip: claim ports used by shared devices")
Signed-off-by: Jonas Blixt <jonas.blixt@actia.se>
Acked-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20230615092810.1215490-1-jonas.blixt@actia.se
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/usbip/stub_dev.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index 3c6d452e3bf4..4104eea03e80 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -462,8 +462,13 @@ static void stub_disconnect(struct usb_device *udev)
 	/* release port */
 	rc = usb_hub_release_port(udev->parent, udev->portnum,
 				  (struct usb_dev_state *) udev);
-	if (rc) {
-		dev_dbg(&udev->dev, "unable to release port\n");
+	/*
+	 * NOTE: If a HUB disconnect triggered disconnect of the down stream
+	 * device usb_hub_release_port will return -ENODEV so we can safely ignore
+	 * that error here.
+	 */
+	if (rc && (rc != -ENODEV)) {
+		dev_dbg(&udev->dev, "unable to release port (%i)\n", rc);
 		return;
 	}
 

From 758f735604f82ad77b15aaa5cd6f5287c114b21c Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 7 Oct 2023 13:13:09 +0200
Subject: [PATCH 0437/1043] dmaengine: pxa_dma: Remove an erroneous BUG_ON() in
 pxad_free_desc()

[ Upstream commit 83c761f568733277ce1f7eb9dc9e890649c29a8c ]

If pxad_alloc_desc() fails on the first dma_pool_alloc() call, then
sw_desc->nb_desc is zero.
In such a case pxad_free_desc() is called and it will BUG_ON().

Remove this erroneous BUG_ON().

It is also useless, because if "sw_desc->nb_desc == 0", then, on the first
iteration of the for loop, i is -1 and the loop will not be executed.
(both i and sw_desc->nb_desc are 'int')

Fixes: a57e16cf0333 ("dmaengine: pxa: add pxa dmaengine driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/c8fc5563c9593c914fde41f0f7d1489a21b45a9a.1696676782.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/pxa_dma.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c
index 68d9d60c051d..9ce75ff9fa1c 100644
--- a/drivers/dma/pxa_dma.c
+++ b/drivers/dma/pxa_dma.c
@@ -723,7 +723,6 @@ static void pxad_free_desc(struct virt_dma_desc *vd)
 	dma_addr_t dma;
 	struct pxad_desc_sw *sw_desc = to_pxad_sw_desc(vd);
 
-	BUG_ON(sw_desc->nb_desc == 0);
 	for (i = sw_desc->nb_desc - 1; i >= 0; i--) {
 		if (i > 0)
 			dma = sw_desc->hw_desc[i - 1]->ddadr;

From ebaf7a73f6344fae98087bed4dd92cc9bfba822b Mon Sep 17 00:00:00 2001
From: Chao Yu <chao@kernel.org>
Date: Sat, 7 Oct 2023 15:45:52 +0800
Subject: [PATCH 0438/1043] f2fs: fix to initialize map.m_pblk in
 f2fs_precache_extents()

[ Upstream commit 8b07c1fb0f1ad139373c8253f2fad8bc43fab07d ]

Otherwise, it may print random physical block address in tracepoint
of f2fs_map_blocks() as below:

f2fs_map_blocks: dev = (253,16), ino = 2297, file offset = 0, start blkaddr = 0xa356c421, len = 0x0, flags = 0

Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/file.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 6e91be5b8c30..4e6b93f16758 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3315,6 +3315,7 @@ int f2fs_precache_extents(struct inode *inode)
 		return -EOPNOTSUPP;
 
 	map.m_lblk = 0;
+	map.m_pblk = 0;
 	map.m_next_pgofs = NULL;
 	map.m_next_extent = &m_next_extent;
 	map.m_seg_type = NO_CHECK_TYPE;

From 08588fac00b172372397a7a18ac6dfd0b6aa202d Mon Sep 17 00:00:00 2001
From: Konrad Dybcio <konrad.dybcio@linaro.org>
Date: Fri, 11 Aug 2023 14:15:22 +0200
Subject: [PATCH 0439/1043] interconnect: qcom: sc7180: Retire DEFINE_QBCM

[ Upstream commit e451b2ea5a11fb3f6d83e1f834ae6a5f55a02bba ]

The struct definition macros are hard to read and compare, expand them.

Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Bjorn Andersson <quic_bjorande@quicinc.com>
Link: https://lore.kernel.org/r/20230811-topic-icc_retire_macrosd-v1-11-c03aaeffc769@linaro.org
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Stable-dep-of: 1ad83c479272 ("interconnect: qcom: sc7180: Set ACV enable_mask")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/interconnect/qcom/sc7180.c | 255 ++++++++++++++++++++++++++---
 1 file changed, 231 insertions(+), 24 deletions(-)

diff --git a/drivers/interconnect/qcom/sc7180.c b/drivers/interconnect/qcom/sc7180.c
index 597a7ee7a9bb..c179cbb1f1d2 100644
--- a/drivers/interconnect/qcom/sc7180.c
+++ b/drivers/interconnect/qcom/sc7180.c
@@ -153,30 +153,237 @@ DEFINE_QNODE(srvc_snoc, SC7180_SLAVE_SERVICE_SNOC, 1, 4);
 DEFINE_QNODE(xs_qdss_stm, SC7180_SLAVE_QDSS_STM, 1, 4);
 DEFINE_QNODE(xs_sys_tcu_cfg, SC7180_SLAVE_TCU, 1, 8);
 
-DEFINE_QBCM(bcm_acv, "ACV", false, &ebi);
-DEFINE_QBCM(bcm_mc0, "MC0", true, &ebi);
-DEFINE_QBCM(bcm_sh0, "SH0", true, &qns_llcc);
-DEFINE_QBCM(bcm_mm0, "MM0", false, &qns_mem_noc_hf);
-DEFINE_QBCM(bcm_ce0, "CE0", false, &qxm_crypto);
-DEFINE_QBCM(bcm_cn0, "CN0", true, &qnm_snoc, &xm_qdss_dap, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_ahb2phy0, &qhs_aop, &qhs_aoss, &qhs_boot_rom, &qhs_camera_cfg, &qhs_camera_nrt_throttle_cfg, &qhs_camera_rt_throttle_cfg, &qhs_clk_ctl, &qhs_cpr_cx, &qhs_cpr_mx, &qhs_crypto0_cfg, &qhs_dcc_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_display_rt_throttle_cfg, &qhs_display_throttle_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_mss_cfg, &qhs_npu_cfg, &qhs_npu_dma_throttle_cfg, &qhs_npu_dsp_throttle_cfg, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qm_cfg, &qhs_qm_mpu_cfg, &qhs_qup0, &qhs_qup1, &qhs_security, &qhs_snoc_cfg, &qhs_tcsr, &qhs_tlmm_1, &qhs_tlmm_2, &qhs_tlmm_3, &qhs_ufs_mem_cfg, &qhs_usb3, &qhs_venus_cfg, &qhs_venus_throttle_cfg, &qhs_vsense_ctrl_cfg, &srvc_cnoc);
-DEFINE_QBCM(bcm_mm1, "MM1", false, &qxm_camnoc_hf0_uncomp, &qxm_camnoc_hf1_uncomp, &qxm_camnoc_sf_uncomp, &qhm_mnoc_cfg, &qxm_mdp0, &qxm_rot, &qxm_venus0, &qxm_venus_arm9);
-DEFINE_QBCM(bcm_sh2, "SH2", false, &acm_sys_tcu);
-DEFINE_QBCM(bcm_mm2, "MM2", false, &qns_mem_noc_sf);
-DEFINE_QBCM(bcm_qup0, "QUP0", false, &qup_core_master_1, &qup_core_master_2);
-DEFINE_QBCM(bcm_sh3, "SH3", false, &qnm_cmpnoc);
-DEFINE_QBCM(bcm_sh4, "SH4", false, &acm_apps0);
-DEFINE_QBCM(bcm_sn0, "SN0", true, &qns_gemnoc_sf);
-DEFINE_QBCM(bcm_co0, "CO0", false, &qns_cdsp_gemnoc);
-DEFINE_QBCM(bcm_sn1, "SN1", false, &qxs_imem);
-DEFINE_QBCM(bcm_cn1, "CN1", false, &qhm_qspi, &xm_sdc2, &xm_emmc, &qhs_ahb2phy2, &qhs_emmc_cfg, &qhs_pdm, &qhs_qspi, &qhs_sdc2);
-DEFINE_QBCM(bcm_sn2, "SN2", false, &qxm_pimem, &qns_gemnoc_gc);
-DEFINE_QBCM(bcm_co2, "CO2", false, &qnm_npu);
-DEFINE_QBCM(bcm_sn3, "SN3", false, &qxs_pimem);
-DEFINE_QBCM(bcm_co3, "CO3", false, &qxm_npu_dsp);
-DEFINE_QBCM(bcm_sn4, "SN4", false, &xs_qdss_stm);
-DEFINE_QBCM(bcm_sn7, "SN7", false, &qnm_aggre1_noc);
-DEFINE_QBCM(bcm_sn9, "SN9", false, &qnm_aggre2_noc);
-DEFINE_QBCM(bcm_sn12, "SN12", false, &qnm_gemnoc);
+static struct qcom_icc_bcm bcm_acv = {
+	.name = "ACV",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &ebi },
+};
+
+static struct qcom_icc_bcm bcm_mc0 = {
+	.name = "MC0",
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &ebi },
+};
+
+static struct qcom_icc_bcm bcm_sh0 = {
+	.name = "SH0",
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &qns_llcc },
+};
+
+static struct qcom_icc_bcm bcm_mm0 = {
+	.name = "MM0",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qns_mem_noc_hf },
+};
+
+static struct qcom_icc_bcm bcm_ce0 = {
+	.name = "CE0",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qxm_crypto },
+};
+
+static struct qcom_icc_bcm bcm_cn0 = {
+	.name = "CN0",
+	.keepalive = true,
+	.num_nodes = 48,
+	.nodes = { &qnm_snoc,
+		   &xm_qdss_dap,
+		   &qhs_a1_noc_cfg,
+		   &qhs_a2_noc_cfg,
+		   &qhs_ahb2phy0,
+		   &qhs_aop,
+		   &qhs_aoss,
+		   &qhs_boot_rom,
+		   &qhs_camera_cfg,
+		   &qhs_camera_nrt_throttle_cfg,
+		   &qhs_camera_rt_throttle_cfg,
+		   &qhs_clk_ctl,
+		   &qhs_cpr_cx,
+		   &qhs_cpr_mx,
+		   &qhs_crypto0_cfg,
+		   &qhs_dcc_cfg,
+		   &qhs_ddrss_cfg,
+		   &qhs_display_cfg,
+		   &qhs_display_rt_throttle_cfg,
+		   &qhs_display_throttle_cfg,
+		   &qhs_glm,
+		   &qhs_gpuss_cfg,
+		   &qhs_imem_cfg,
+		   &qhs_ipa,
+		   &qhs_mnoc_cfg,
+		   &qhs_mss_cfg,
+		   &qhs_npu_cfg,
+		   &qhs_npu_dma_throttle_cfg,
+		   &qhs_npu_dsp_throttle_cfg,
+		   &qhs_pimem_cfg,
+		   &qhs_prng,
+		   &qhs_qdss_cfg,
+		   &qhs_qm_cfg,
+		   &qhs_qm_mpu_cfg,
+		   &qhs_qup0,
+		   &qhs_qup1,
+		   &qhs_security,
+		   &qhs_snoc_cfg,
+		   &qhs_tcsr,
+		   &qhs_tlmm_1,
+		   &qhs_tlmm_2,
+		   &qhs_tlmm_3,
+		   &qhs_ufs_mem_cfg,
+		   &qhs_usb3,
+		   &qhs_venus_cfg,
+		   &qhs_venus_throttle_cfg,
+		   &qhs_vsense_ctrl_cfg,
+		   &srvc_cnoc
+	},
+};
+
+static struct qcom_icc_bcm bcm_mm1 = {
+	.name = "MM1",
+	.keepalive = false,
+	.num_nodes = 8,
+	.nodes = { &qxm_camnoc_hf0_uncomp,
+		   &qxm_camnoc_hf1_uncomp,
+		   &qxm_camnoc_sf_uncomp,
+		   &qhm_mnoc_cfg,
+		   &qxm_mdp0,
+		   &qxm_rot,
+		   &qxm_venus0,
+		   &qxm_venus_arm9
+	},
+};
+
+static struct qcom_icc_bcm bcm_sh2 = {
+	.name = "SH2",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &acm_sys_tcu },
+};
+
+static struct qcom_icc_bcm bcm_mm2 = {
+	.name = "MM2",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qns_mem_noc_sf },
+};
+
+static struct qcom_icc_bcm bcm_qup0 = {
+	.name = "QUP0",
+	.keepalive = false,
+	.num_nodes = 2,
+	.nodes = { &qup_core_master_1, &qup_core_master_2 },
+};
+
+static struct qcom_icc_bcm bcm_sh3 = {
+	.name = "SH3",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qnm_cmpnoc },
+};
+
+static struct qcom_icc_bcm bcm_sh4 = {
+	.name = "SH4",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &acm_apps0 },
+};
+
+static struct qcom_icc_bcm bcm_sn0 = {
+	.name = "SN0",
+	.keepalive = true,
+	.num_nodes = 1,
+	.nodes = { &qns_gemnoc_sf },
+};
+
+static struct qcom_icc_bcm bcm_co0 = {
+	.name = "CO0",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qns_cdsp_gemnoc },
+};
+
+static struct qcom_icc_bcm bcm_sn1 = {
+	.name = "SN1",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qxs_imem },
+};
+
+static struct qcom_icc_bcm bcm_cn1 = {
+	.name = "CN1",
+	.keepalive = false,
+	.num_nodes = 8,
+	.nodes = { &qhm_qspi,
+		   &xm_sdc2,
+		   &xm_emmc,
+		   &qhs_ahb2phy2,
+		   &qhs_emmc_cfg,
+		   &qhs_pdm,
+		   &qhs_qspi,
+		   &qhs_sdc2
+	},
+};
+
+static struct qcom_icc_bcm bcm_sn2 = {
+	.name = "SN2",
+	.keepalive = false,
+	.num_nodes = 2,
+	.nodes = { &qxm_pimem, &qns_gemnoc_gc },
+};
+
+static struct qcom_icc_bcm bcm_co2 = {
+	.name = "CO2",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qnm_npu },
+};
+
+static struct qcom_icc_bcm bcm_sn3 = {
+	.name = "SN3",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qxs_pimem },
+};
+
+static struct qcom_icc_bcm bcm_co3 = {
+	.name = "CO3",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qxm_npu_dsp },
+};
+
+static struct qcom_icc_bcm bcm_sn4 = {
+	.name = "SN4",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &xs_qdss_stm },
+};
+
+static struct qcom_icc_bcm bcm_sn7 = {
+	.name = "SN7",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qnm_aggre1_noc },
+};
+
+static struct qcom_icc_bcm bcm_sn9 = {
+	.name = "SN9",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qnm_aggre2_noc },
+};
+
+static struct qcom_icc_bcm bcm_sn12 = {
+	.name = "SN12",
+	.keepalive = false,
+	.num_nodes = 1,
+	.nodes = { &qnm_gemnoc },
+};
 
 static struct qcom_icc_bcm *aggre1_noc_bcms[] = {
 	&bcm_cn1,

From 362f0241dbe941afd2dbad17a311b388524ac920 Mon Sep 17 00:00:00 2001
From: Konrad Dybcio <konrad.dybcio@linaro.org>
Date: Sat, 12 Aug 2023 01:20:45 +0200
Subject: [PATCH 0440/1043] interconnect: qcom: sc7180: Set ACV enable_mask

[ Upstream commit 1ad83c4792722fe134c1352591420702ff7b9091 ]

ACV expects an enable_mask corresponding to the APPS RSC, fill it in.

Fixes: 2d1f95ab9feb ("interconnect: qcom: Add SC7180 interconnect provider driver")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230811-topic-acv-v2-2-765ad70e539a@linaro.org
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/interconnect/qcom/sc7180.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/interconnect/qcom/sc7180.c b/drivers/interconnect/qcom/sc7180.c
index c179cbb1f1d2..f5b3c68bb66c 100644
--- a/drivers/interconnect/qcom/sc7180.c
+++ b/drivers/interconnect/qcom/sc7180.c
@@ -155,6 +155,7 @@ DEFINE_QNODE(xs_sys_tcu_cfg, SC7180_SLAVE_TCU, 1, 8);
 
 static struct qcom_icc_bcm bcm_acv = {
 	.name = "ACV",
+	.enable_mask = BIT(3),
 	.keepalive = false,
 	.num_nodes = 1,
 	.nodes = { &ebi },

From b54a4c8ca1c8ef2b6798937f934295ba69982af3 Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <masahiroy@kernel.org>
Date: Sun, 8 Oct 2023 02:04:44 +0900
Subject: [PATCH 0441/1043] modpost: fix tee MODULE_DEVICE_TABLE built on
 big-endian host

[ Upstream commit 7f54e00e5842663c2cea501bbbdfa572c94348a3 ]

When MODULE_DEVICE_TABLE(tee, ) is built on a host with a different
endianness from the target architecture, it results in an incorrect
MODULE_ALIAS().

For example, see a case where drivers/char/hw_random/optee-rng.c
is built as a module for ARM little-endian.

If you build it on a little-endian host, you will get the correct
MODULE_ALIAS:

    $ grep MODULE_ALIAS drivers/char/hw_random/optee-rng.mod.c
    MODULE_ALIAS("tee:ab7a617c-b8e7-4d8f-8301-d09b61036b64*");

However, if you build it on a big-endian host, you will get a wrong
MODULE_ALIAS:

    $ grep MODULE_ALIAS drivers/char/hw_random/optee-rng.mod.c
    MODULE_ALIAS("tee:646b0361-9bd0-0183-8f4d-e7b87c617aab*");

The same problem also occurs when you enable CONFIG_CPU_BIG_ENDIAN,
and build it on a little-endian host.

This issue has been unnoticed because the ARM kernel is configured for
little-endian by default, and most likely built on a little-endian host
(cross-build on x86 or native-build on ARM).

The uuid field must not be reversed because uuid_t is an array of __u8.

Fixes: 0fc1db9d1059 ("tee: add bus driver framework for TEE based devices")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/mod/file2alias.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index da4df53ee695..7154df094f40 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -1326,13 +1326,13 @@ static int do_typec_entry(const char *filename, void *symval, char *alias)
 /* Looks like: tee:uuid */
 static int do_tee_entry(const char *filename, void *symval, char *alias)
 {
-	DEF_FIELD(symval, tee_client_device_id, uuid);
+	DEF_FIELD_ADDR(symval, tee_client_device_id, uuid);
 
 	sprintf(alias, "tee:%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
-		uuid.b[0], uuid.b[1], uuid.b[2], uuid.b[3], uuid.b[4],
-		uuid.b[5], uuid.b[6], uuid.b[7], uuid.b[8], uuid.b[9],
-		uuid.b[10], uuid.b[11], uuid.b[12], uuid.b[13], uuid.b[14],
-		uuid.b[15]);
+		uuid->b[0], uuid->b[1], uuid->b[2], uuid->b[3], uuid->b[4],
+		uuid->b[5], uuid->b[6], uuid->b[7], uuid->b[8], uuid->b[9],
+		uuid->b[10], uuid->b[11], uuid->b[12], uuid->b[13], uuid->b[14],
+		uuid->b[15]);
 
 	add_wildcard(alias);
 	return 1;

From f95f5512fdcb4d40dfd969f70a4e8c2c54ffa927 Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@csgroup.eu>
Date: Mon, 25 Sep 2023 20:31:17 +0200
Subject: [PATCH 0442/1043] powerpc/40x: Remove stale PTE_ATOMIC_UPDATES macro

[ Upstream commit cc8ee288f484a2a59c01ccd4d8a417d6ed3466e3 ]

40x TLB handlers were reworked by commit 2c74e2586bb9 ("powerpc/40x:
Rework 40x PTE access and TLB miss") to not require PTE_ATOMIC_UPDATES
anymore.

Then commit 4e1df545e2fa ("powerpc/pgtable: Drop PTE_ATOMIC_UPDATES")
removed all code related to PTE_ATOMIC_UPDATES.

Remove left over PTE_ATOMIC_UPDATES macro.

Fixes: 2c74e2586bb9 ("powerpc/40x: Rework 40x PTE access and TLB miss")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/f061db5857fcd748f84a6707aad01754686ce97e.1695659959.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/nohash/32/pte-40x.h | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/powerpc/include/asm/nohash/32/pte-40x.h b/arch/powerpc/include/asm/nohash/32/pte-40x.h
index 2d3153cfc0d7..acf61242e85b 100644
--- a/arch/powerpc/include/asm/nohash/32/pte-40x.h
+++ b/arch/powerpc/include/asm/nohash/32/pte-40x.h
@@ -69,9 +69,6 @@
 
 #define _PTE_NONE_MASK	0
 
-/* Until my rework is finished, 40x still needs atomic PTE updates */
-#define PTE_ATOMIC_UPDATES	1
-
 #define _PAGE_BASE_NC	(_PAGE_PRESENT | _PAGE_ACCESSED)
 #define _PAGE_BASE	(_PAGE_BASE_NC)
 

From c75707293dcf68569cc8360b964034aa3b16ef23 Mon Sep 17 00:00:00 2001
From: Benjamin Gray <bgray@linux.ibm.com>
Date: Wed, 11 Oct 2023 16:37:00 +1100
Subject: [PATCH 0443/1043] powerpc/xive: Fix endian conversion size

[ Upstream commit ff7a60ab1e065257a0e467c13b519f4debcd7fcf ]

Sparse reports a size mismatch in the endian swap. The Opal
implementation[1] passes the value as a __be64, and the receiving
variable out_qsize is a u64, so the use of be32_to_cpu() appears to be
an error.

[1]: https://github.com/open-power/skiboot/blob/80e2b1dc73/hw/xive.c#L3854

Fixes: 88ec6b93c8e7 ("powerpc/xive: add OPAL extensions for the XIVE native exploitation support")
Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231011053711.93427-2-bgray@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/sysdev/xive/native.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
index cb58ec7ce77a..1c7e49d9eaee 100644
--- a/arch/powerpc/sysdev/xive/native.c
+++ b/arch/powerpc/sysdev/xive/native.c
@@ -779,7 +779,7 @@ int xive_native_get_queue_info(u32 vp_id, u32 prio,
 	if (out_qpage)
 		*out_qpage = be64_to_cpu(qpage);
 	if (out_qsize)
-		*out_qsize = be32_to_cpu(qsize);
+		*out_qsize = be64_to_cpu(qsize);
 	if (out_qeoi_page)
 		*out_qeoi_page = be64_to_cpu(qeoi_page);
 	if (out_escalate_irq)

From d12372af8955f98b684d4f625d6f028045e5e319 Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: Thu, 9 Mar 2023 14:48:31 +0100
Subject: [PATCH 0444/1043] powerpc/imc-pmu: Use the correct spinlock
 initializer.

[ Upstream commit 007240d59c11f87ac4f6cfc6a1d116630b6b634c ]

The macro __SPIN_LOCK_INITIALIZER() is implementation specific. Users
that desire to initialize a spinlock in a struct must use
__SPIN_LOCK_UNLOCKED().

Use __SPIN_LOCK_UNLOCKED() for the spinlock_t in imc_global_refc.

Fixes: 76d588dddc459 ("powerpc/imc-pmu: Fix use of mutex in IRQs disabled section")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230309134831.Nz12nqsU@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/perf/imc-pmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
index b773c411aa5c..3e15d0d054b2 100644
--- a/arch/powerpc/perf/imc-pmu.c
+++ b/arch/powerpc/perf/imc-pmu.c
@@ -50,7 +50,7 @@ static int trace_imc_mem_size;
  * core and trace-imc
  */
 static struct imc_pmu_ref imc_global_refc = {
-	.lock = __SPIN_LOCK_INITIALIZER(imc_global_refc.lock),
+	.lock = __SPIN_LOCK_UNLOCKED(imc_global_refc.lock),
 	.id = 0,
 	.refc = 0,
 };

From ad0370c41a19add69a5cf6cfd7bc82f3fa4f3509 Mon Sep 17 00:00:00 2001
From: Wang Yufen <wangyufen@huawei.com>
Date: Wed, 14 Dec 2022 15:46:23 +0800
Subject: [PATCH 0445/1043] powerpc/pseries: fix potential memory leak in
 init_cpu_associativity()

[ Upstream commit 95f1a128cd728a7257d78e868f1f5a145fc43736 ]

If the vcpu_associativity alloc memory successfully but the
pcpu_associativity fails to alloc memory, the vcpu_associativity
memory leaks.

Fixes: d62c8deeb6e6 ("powerpc/pseries: Provide vcpu dispatch statistics")
Signed-off-by: Wang Yufen <wangyufen@huawei.com>
Reviewed-by: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/1671003983-10794-1-git-send-email-wangyufen@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/lpar.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 68f3b082245e..4a3425fb1939 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -523,8 +523,10 @@ static ssize_t vcpudispatch_stats_write(struct file *file, const char __user *p,
 
 	if (cmd) {
 		rc = init_cpu_associativity();
-		if (rc)
+		if (rc) {
+			destroy_cpu_associativity();
 			goto out;
+		}
 
 		for_each_possible_cpu(cpu) {
 			disp = per_cpu_ptr(&vcpu_disp_data, cpu);

From ba894bd2737c2943263c6bbc27eac4a0a8771443 Mon Sep 17 00:00:00 2001
From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Date: Thu, 19 Oct 2023 13:29:19 +0300
Subject: [PATCH 0446/1043] xhci: Loosen RPM as default policy to cover for AMD
 xHC 1.1

[ Upstream commit 4baf1218150985ee3ab0a27220456a1f027ea0ac ]

The AMD USB host controller (1022:43f7) isn't going into PCI D3 by default
without anything connected. This is because the policy that was introduced
by commit a611bf473d1f ("xhci-pci: Set runtime PM as default policy on all
xHC 1.2 or later devices") only covered 1.2 or later.

The 1.1 specification also has the same requirement as the 1.2
specification for D3 support. So expand the runtime PM as default policy
to all AMD 1.1 devices as well.

Fixes: a611bf473d1f ("xhci-pci: Set runtime PM as default policy on all xHC 1.2 or later devices")
Link: https://composter.com.ua/documents/xHCI_Specification_for_USB.pdf
Co-developed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20231019102924.2797346-15-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-pci.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 8034e643a4af..7d0c2cccbfc0 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -345,6 +345,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
 	/* xHC spec requires PCI devices to support D3hot and D3cold */
 	if (xhci->hci_version >= 0x120)
 		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
+	else if (pdev->vendor == PCI_VENDOR_ID_AMD && xhci->hci_version >= 0x110)
+		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
 
 	if (xhci->quirks & XHCI_RESET_ON_RESUME)
 		xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,

From 188425eb2da2a0d4f43c7be73fb81a65c264c0b4 Mon Sep 17 00:00:00 2001
From: Sergey Shtylyov <s.shtylyov@omp.ru>
Date: Thu, 19 Oct 2023 13:29:23 +0300
Subject: [PATCH 0447/1043] usb: host: xhci-plat: fix possible kernel oops
 while resuming

[ Upstream commit a5f928db59519a15e82ecba4ae3e7cbf5a44715a ]

If this driver enables the xHC clocks while resuming from sleep, it calls
clk_prepare_enable() without checking for errors and blithely goes on to
read/write the xHC's registers -- which, with the xHC not being clocked,
at least on ARM32 usually causes an imprecise external abort exceptions
which cause kernel oops.  Currently, the chips for which the driver does
the clock dance on suspend/resume seem to be the Broadcom STB SoCs, based
on ARM32 CPUs, as it seems...

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

Fixes: 8bd954c56197 ("usb: host: xhci-plat: suspend and resume clocks")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20231019102924.2797346-19-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-plat.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 972a44b2a7f1..e56a1fb9715a 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -466,23 +466,38 @@ static int __maybe_unused xhci_plat_resume(struct device *dev)
 	int ret;
 
 	if (!device_may_wakeup(dev) && (xhci->quirks & XHCI_SUSPEND_RESUME_CLKS)) {
-		clk_prepare_enable(xhci->clk);
-		clk_prepare_enable(xhci->reg_clk);
+		ret = clk_prepare_enable(xhci->clk);
+		if (ret)
+			return ret;
+
+		ret = clk_prepare_enable(xhci->reg_clk);
+		if (ret) {
+			clk_disable_unprepare(xhci->clk);
+			return ret;
+		}
 	}
 
 	ret = xhci_priv_resume_quirk(hcd);
 	if (ret)
-		return ret;
+		goto disable_clks;
 
 	ret = xhci_resume(xhci, 0);
 	if (ret)
-		return ret;
+		goto disable_clks;
 
 	pm_runtime_disable(dev);
 	pm_runtime_set_active(dev);
 	pm_runtime_enable(dev);
 
 	return 0;
+
+disable_clks:
+	if (!device_may_wakeup(dev) && (xhci->quirks & XHCI_SUSPEND_RESUME_CLKS)) {
+		clk_disable_unprepare(xhci->clk);
+		clk_disable_unprepare(xhci->reg_clk);
+	}
+
+	return ret;
 }
 
 static int __maybe_unused xhci_plat_runtime_suspend(struct device *dev)

From 4e66bde5c7d107e9b07e20251e212e25b722b320 Mon Sep 17 00:00:00 2001
From: Ian Rogers <irogers@google.com>
Date: Tue, 24 Oct 2023 15:23:05 -0700
Subject: [PATCH 0448/1043] perf machine: Avoid out of bounds LBR memory read

[ Upstream commit ab8ce150781d326c6bfbe1e09f175ffde1186f80 ]

Running perf top with address sanitizer and "--call-graph=lbr" fails
due to reading sample 0 when no samples exist. Add a guard to prevent
this.

Fixes: e2b23483eb1d ("perf machine: Factor out lbr_callchain_add_lbr_ip()")
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: K Prateek Nayak <kprateek.nayak@amd.com>
Cc: Ravi Bangoria <ravi.bangoria@amd.com>
Cc: Sandipan Das <sandipan.das@amd.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: German Gomez <german.gomez@arm.com>
Cc: James Clark <james.clark@arm.com>
Cc: Nick Terrell <terrelln@fb.com>
Cc: Sean Christopherson <seanjc@google.com>
Cc: Changbin Du <changbin.du@huawei.com>
Cc: liuwenyu <liuwenyu7@huawei.com>
Cc: Yang Jihong <yangjihong1@huawei.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Miguel Ojeda <ojeda@kernel.org>
Cc: Song Liu <song@kernel.org>
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Kajol Jain <kjain@linux.ibm.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Cc: Yanteng Si <siyanteng@loongson.cn>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20231024222353.3024098-3-irogers@google.com
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/machine.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index df515cd8d018..eec926c313b1 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -2387,16 +2387,18 @@ static int lbr_callchain_add_lbr_ip(struct thread *thread,
 		save_lbr_cursor_node(thread, cursor, i);
 	}
 
-	/* Add LBR ip from first entries.to */
-	ip = entries[0].to;
-	flags = &entries[0].flags;
-	*branch_from = entries[0].from;
-	err = add_callchain_ip(thread, cursor, parent,
-			       root_al, &cpumode, ip,
-			       true, flags, NULL,
-			       *branch_from);
-	if (err)
-		return err;
+	if (lbr_nr > 0) {
+		/* Add LBR ip from first entries.to */
+		ip = entries[0].to;
+		flags = &entries[0].flags;
+		*branch_from = entries[0].from;
+		err = add_callchain_ip(thread, cursor, parent,
+				root_al, &cpumode, ip,
+				true, flags, NULL,
+				*branch_from);
+		if (err)
+			return err;
+	}
 
 	return 0;
 }

From a83fc293acd5c5050a4828eced4a71d2b2fffdd3 Mon Sep 17 00:00:00 2001
From: Ian Rogers <irogers@google.com>
Date: Tue, 24 Oct 2023 15:23:08 -0700
Subject: [PATCH 0449/1043] perf hist: Add missing puts to hist__account_cycles

[ Upstream commit c1149037f65bcf0334886180ebe3d5efcf214912 ]

Caught using reference count checking on perf top with
"--call-graph=lbr". After this no memory leaks were detected.

Fixes: 57849998e2cd ("perf report: Add processing for cycle histograms")
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: K Prateek Nayak <kprateek.nayak@amd.com>
Cc: Ravi Bangoria <ravi.bangoria@amd.com>
Cc: Sandipan Das <sandipan.das@amd.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: German Gomez <german.gomez@arm.com>
Cc: James Clark <james.clark@arm.com>
Cc: Nick Terrell <terrelln@fb.com>
Cc: Sean Christopherson <seanjc@google.com>
Cc: Changbin Du <changbin.du@huawei.com>
Cc: liuwenyu <liuwenyu7@huawei.com>
Cc: Yang Jihong <yangjihong1@huawei.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Miguel Ojeda <ojeda@kernel.org>
Cc: Song Liu <song@kernel.org>
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Kajol Jain <kjain@linux.ibm.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Cc: Yanteng Si <siyanteng@loongson.cn>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20231024222353.3024098-6-irogers@google.com
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/hist.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 8a793e4c9400..c78d8813811c 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -2624,8 +2624,6 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al,
 
 	/* If we have branch cycles always annotate them. */
 	if (bs && bs->nr && entries[0].flags.cycles) {
-		int i;
-
 		bi = sample__resolve_bstack(sample, al);
 		if (bi) {
 			struct addr_map_symbol *prev = NULL;
@@ -2640,7 +2638,7 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al,
 			 * Note that perf stores branches reversed from
 			 * program order!
 			 */
-			for (i = bs->nr - 1; i >= 0; i--) {
+			for (int i = bs->nr - 1; i >= 0; i--) {
 				addr_map_symbol__account_cycles(&bi[i].from,
 					nonany_branch_mode ? NULL : prev,
 					bi[i].flags.cycles);
@@ -2649,6 +2647,12 @@ void hist__account_cycles(struct branch_stack *bs, struct addr_location *al,
 				if (total_cycles)
 					*total_cycles += bi[i].flags.cycles;
 			}
+			for (unsigned int i = 0; i < bs->nr; i++) {
+				map__put(bi[i].to.ms.map);
+				maps__put(bi[i].to.ms.maps);
+				map__put(bi[i].from.ms.map);
+				maps__put(bi[i].from.ms.maps);
+			}
 			free(bi);
 		}
 	}

From 1832ed55df45f4145335ad992fb83813cdc58b5d Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Thu, 21 Sep 2023 16:24:10 +0800
Subject: [PATCH 0450/1043] i3c: Fix potential refcount leak in
 i3c_master_register_new_i3c_devs

[ Upstream commit cab63f64887616e3c4e31cfd8103320be6ebc8d3 ]

put_device() needs to be called on failure of device_register()
to give up the reference initialized in it to avoid refcount leak.

Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Link: https://lore.kernel.org/r/20230921082410.25548-1-dinghao.liu@zju.edu.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i3c/master.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index 1c6b78ad5ade..828fb236a63a 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1509,9 +1509,11 @@ i3c_master_register_new_i3c_devs(struct i3c_master_controller *master)
 			desc->dev->dev.of_node = desc->boardinfo->of_node;
 
 		ret = device_register(&desc->dev->dev);
-		if (ret)
+		if (ret) {
 			dev_err(&master->dev,
 				"Failed to add I3C device (err = %d)\n", ret);
+			put_device(&desc->dev->dev);
+		}
 	}
 }
 

From 5e3c751586427c5d2dbea2340721b7c892aac3ca Mon Sep 17 00:00:00 2001
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Date: Fri, 13 Oct 2023 16:34:21 +0200
Subject: [PATCH 0451/1043] rtc: pcf85363: fix wrong mask/val parameters in
 regmap_update_bits call

[ Upstream commit 2be36c09b6b07306be33519e1aa70d2e2a2161bb ]

The current implementation passes PIN_IO_INTA_OUT (2) as a mask and
PIN_IO_INTAPM (GENMASK(1, 0)) as a value.
Swap the variables to assign mask and value the right way.

This error was first introduced with the alarm support. For better or
worse it worked as expected because 0x02 was applied as a mask to 0x03,
resulting 0x02 anyway. This will of course not work for any other value.

Fixes: e5aac267a10a ("rtc: pcf85363: add alarm support")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Link: https://lore.kernel.org/r/20231013-topic-pcf85363_regmap_update_bits-v1-1-c454f016f71f@gmail.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-pcf85363.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-pcf85363.c b/drivers/rtc/rtc-pcf85363.c
index 3450d615974d..bb962dce3ab2 100644
--- a/drivers/rtc/rtc-pcf85363.c
+++ b/drivers/rtc/rtc-pcf85363.c
@@ -407,7 +407,7 @@ static int pcf85363_probe(struct i2c_client *client,
 	if (client->irq > 0) {
 		regmap_write(pcf85363->regmap, CTRL_FLAGS, 0);
 		regmap_update_bits(pcf85363->regmap, CTRL_PIN_IO,
-				   PIN_IO_INTA_OUT, PIN_IO_INTAPM);
+				   PIN_IO_INTAPM, PIN_IO_INTA_OUT);
 		ret = devm_request_threaded_irq(&client->dev, client->irq,
 						NULL, pcf85363_rtc_handle_irq,
 						IRQF_TRIGGER_LOW | IRQF_ONESHOT,

From cd154225d41930733537c32f971083a3e1812aa1 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Sat, 12 Nov 2022 17:25:41 +0800
Subject: [PATCH 0452/1043] pcmcia: cs: fix possible hung task and memory leak
 pccardd()

[ Upstream commit e3ea1b4847e49234e691c0d66bf030bd65bb7f2b ]

If device_register() returns error in pccardd(), it leads two issues:

1. The socket_released has never been completed, it will block
   pcmcia_unregister_socket(), because of waiting for completion
   of socket_released.
2. The device name allocated by dev_set_name() is leaked.

Fix this two issues by calling put_device() when device_register() fails.
socket_released can be completed in pcmcia_release_socket(), the name can
be freed in kobject_cleanup().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pcmcia/cs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
index f70197154a36..820cce7c8b40 100644
--- a/drivers/pcmcia/cs.c
+++ b/drivers/pcmcia/cs.c
@@ -605,6 +605,7 @@ static int pccardd(void *__skt)
 		dev_warn(&skt->dev, "PCMCIA: unable to register socket\n");
 		skt->thread = NULL;
 		complete(&skt->thread_done);
+		put_device(&skt->dev);
 		return 0;
 	}
 	ret = pccard_sysfs_add_socket(&skt->dev);

From 84540ef92434f1de43aed44a20d14bee53c4915d Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Sat, 12 Nov 2022 17:29:23 +0800
Subject: [PATCH 0453/1043] pcmcia: ds: fix refcount leak in
 pcmcia_device_add()

[ Upstream commit 402ab979b29126068e0b596b641422ff7490214c ]

As the comment of device_register() says, it should use put_device()
to give up the reference in the error path. Then, insofar resources
will be freed in pcmcia_release_dev(), the error path is no longer
needed. In particular, this means that the (previously missing) dropping
of the reference to &p_dev->function_config->ref is now handled by
pcmcia_release_dev().

Fixes: 360b65b95bae ("[PATCH] pcmcia: make config_t independent, add reference counting")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
[linux@dominikbrodowski.net: simplification, commit message rewrite]
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pcmcia/ds.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 72114907c0e4..341305496b06 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -578,8 +578,14 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s,
 
 	pcmcia_device_query(p_dev);
 
-	if (device_register(&p_dev->dev))
-		goto err_unreg;
+	if (device_register(&p_dev->dev)) {
+		mutex_lock(&s->ops_mutex);
+		list_del(&p_dev->socket_device_list);
+		s->device_count--;
+		mutex_unlock(&s->ops_mutex);
+		put_device(&p_dev->dev);
+		return NULL;
+	}
 
 	return p_dev;
 

From c3e148aba95a05c90f8495a8bd339c4e348945a7 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Sat, 12 Nov 2022 17:29:24 +0800
Subject: [PATCH 0454/1043] pcmcia: ds: fix possible name leak in error path in
 pcmcia_device_add()

[ Upstream commit 99e1241049a92dd3e9a90a0f91e32ce390133278 ]

Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's
bus_id string array"), the name of device is allocated dynamically.
Therefore, it needs to be freed, which is done by the driver core for
us once all references to the device are gone. Therefore, move the
dev_set_name() call immediately before the call device_register(), which
either succeeds (then the freeing will be done upon subsequent remvoal),
or puts the reference in the error call. Also, it is not unusual that the
return value of dev_set_name is not checked.

Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
[linux@dominikbrodowski.net: simplification, commit message modified]
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pcmcia/ds.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 341305496b06..bf2e856f53e9 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -518,9 +518,6 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s,
 	/* by default don't allow DMA */
 	p_dev->dma_mask = 0;
 	p_dev->dev.dma_mask = &p_dev->dma_mask;
-	dev_set_name(&p_dev->dev, "%d.%d", p_dev->socket->sock, p_dev->device_no);
-	if (!dev_name(&p_dev->dev))
-		goto err_free;
 	p_dev->devname = kasprintf(GFP_KERNEL, "pcmcia%s", dev_name(&p_dev->dev));
 	if (!p_dev->devname)
 		goto err_free;
@@ -578,6 +575,7 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s,
 
 	pcmcia_device_query(p_dev);
 
+	dev_set_name(&p_dev->dev, "%d.%d", p_dev->socket->sock, p_dev->device_no);
 	if (device_register(&p_dev->dev)) {
 		mutex_lock(&s->ops_mutex);
 		list_del(&p_dev->socket_device_list);

From 0627e8623eb5dbcbd54a30b3d3fd140b8eb95a6e Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 26 Aug 2023 00:13:40 +0200
Subject: [PATCH 0455/1043] media: i2c: max9286: Fix some redundant
 of_node_put() calls

[ Upstream commit 0822315e46b400f611cba1193456ee6a5dc3e41d ]

This is odd to have a of_node_put() just after a for_each_child_of_node()
or a for_each_endpoint_of_node() loop. It should already be called
during the last iteration.

Remove these calls.

Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/max9286.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
index 62ce27552dd3..a358eb3fe0f4 100644
--- a/drivers/media/i2c/max9286.c
+++ b/drivers/media/i2c/max9286.c
@@ -1143,7 +1143,6 @@ static int max9286_parse_dt(struct max9286_priv *priv)
 
 		i2c_mux_mask |= BIT(id);
 	}
-	of_node_put(node);
 	of_node_put(i2c_mux);
 
 	/* Parse the endpoints */
@@ -1207,7 +1206,6 @@ static int max9286_parse_dt(struct max9286_priv *priv)
 		priv->source_mask |= BIT(ep.port);
 		priv->nsources++;
 	}
-	of_node_put(node);
 
 	priv->route_mask = priv->source_mask;
 

From 2f3d9198cdae1cb079ec8652f4defacd481eab2b Mon Sep 17 00:00:00 2001
From: Zheng Wang <zyytlz.wz@163.com>
Date: Thu, 13 Apr 2023 11:49:42 +0800
Subject: [PATCH 0456/1043] media: bttv: fix use after free error due to
 btv->timeout timer

[ Upstream commit bd5b50b329e850d467e7bcc07b2b6bde3752fbda ]

There may be some a race condition between timer function
bttv_irq_timeout and bttv_remove. The timer is setup in
probe and there is no timer_delete operation in remove
function. When it hit kfree btv, the function might still be
invoked, which will cause use after free bug.

This bug is found by static analysis, it may be false positive.

Fix it by adding del_timer_sync invoking to the remove function.

cpu0                cpu1
                  bttv_probe
                    ->timer_setup
                      ->bttv_set_dma
                        ->mod_timer;
bttv_remove
  ->kfree(btv);
                  ->bttv_irq_timeout
                    ->USE btv

Fixes: 162e6376ac58 ("media: pci: Convert timers to use timer_setup()")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/bt8xx/bttv-driver.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
index 1f0e4b913a05..5f1bd9b38e75 100644
--- a/drivers/media/pci/bt8xx/bttv-driver.c
+++ b/drivers/media/pci/bt8xx/bttv-driver.c
@@ -4258,6 +4258,7 @@ static void bttv_remove(struct pci_dev *pci_dev)
 
 	/* free resources */
 	free_irq(btv->c.pci->irq,btv);
+	del_timer_sync(&btv->timeout);
 	iounmap(btv->bt848_mmio);
 	release_mem_region(pci_resource_start(btv->c.pci,0),
 			   pci_resource_len(btv->c.pci,0));

From 62557ab73d3a541125c618cfe7caa687aea112e4 Mon Sep 17 00:00:00 2001
From: Katya Orlova <e.orlova@ispras.ru>
Date: Fri, 22 Sep 2023 14:55:06 +0300
Subject: [PATCH 0457/1043] media: s3c-camif: Avoid inappropriate kfree()

[ Upstream commit 61334819aca018c3416ee6c330a08a49c1524fc3 ]

s3c_camif_register_video_node() works with video_device structure stored
as a field of camif_vp, so it should not be kfreed.
But there is video_device_release() on error path that do it.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface")
Signed-off-by: Katya Orlova <e.orlova@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/s3c-camif/camif-capture.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/s3c-camif/camif-capture.c b/drivers/media/platform/s3c-camif/camif-capture.c
index 9ca49af29542..a3ba72a08dae 100644
--- a/drivers/media/platform/s3c-camif/camif-capture.c
+++ b/drivers/media/platform/s3c-camif/camif-capture.c
@@ -1132,12 +1132,12 @@ int s3c_camif_register_video_node(struct camif_dev *camif, int idx)
 
 	ret = vb2_queue_init(q);
 	if (ret)
-		goto err_vd_rel;
+		return ret;
 
 	vp->pad.flags = MEDIA_PAD_FL_SINK;
 	ret = media_entity_pads_init(&vfd->entity, 1, &vp->pad);
 	if (ret)
-		goto err_vd_rel;
+		return ret;
 
 	video_set_drvdata(vfd, vp);
 
@@ -1170,8 +1170,6 @@ int s3c_camif_register_video_node(struct camif_dev *camif, int idx)
 	v4l2_ctrl_handler_free(&vp->ctrl_handler);
 err_me_cleanup:
 	media_entity_cleanup(&vfd->entity);
-err_vd_rel:
-	video_device_release(vfd);
 	return ret;
 }
 

From 3387490c89b10aeb4e71d78b65dbc9ba4b2385b9 Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Date: Mon, 19 Jun 2023 16:12:01 +0800
Subject: [PATCH 0458/1043] media: vidtv: psi: Add check for kstrdup

[ Upstream commit 76a2c5df6ca8bd8ada45e953b8c72b746f42918d ]

Add check for the return value of kstrdup() and return the error
if it fails in order to avoid NULL pointer dereference.

Fixes: 7a7899f6f58e ("media: vidtv: psi: Implement an Event Information Table (EIT)")
Fixes: c2f78f0cb294 ("media: vidtv: psi: add a Network Information Table (NIT)")
Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vidtv/vidtv_psi.c | 45 +++++++++++++++++---
 1 file changed, 40 insertions(+), 5 deletions(-)

diff --git a/drivers/media/test-drivers/vidtv/vidtv_psi.c b/drivers/media/test-drivers/vidtv/vidtv_psi.c
index 1724bb485e67..1726e76f0106 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_psi.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_psi.c
@@ -308,16 +308,29 @@ struct vidtv_psi_desc_service *vidtv_psi_service_desc_init(struct vidtv_psi_desc
 
 	desc->service_name_len = service_name_len;
 
-	if (service_name && service_name_len)
+	if (service_name && service_name_len) {
 		desc->service_name = kstrdup(service_name, GFP_KERNEL);
+		if (!desc->service_name)
+			goto free_desc;
+	}
 
 	desc->provider_name_len = provider_name_len;
 
-	if (provider_name && provider_name_len)
+	if (provider_name && provider_name_len) {
 		desc->provider_name = kstrdup(provider_name, GFP_KERNEL);
+		if (!desc->provider_name)
+			goto free_desc_service_name;
+	}
 
 	vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);
 	return desc;
+
+free_desc_service_name:
+	if (service_name && service_name_len)
+		kfree(desc->service_name);
+free_desc:
+	kfree(desc);
+	return NULL;
 }
 
 struct vidtv_psi_desc_registration
@@ -362,8 +375,13 @@ struct vidtv_psi_desc_network_name
 
 	desc->length = network_name_len;
 
-	if (network_name && network_name_len)
+	if (network_name && network_name_len) {
 		desc->network_name = kstrdup(network_name, GFP_KERNEL);
+		if (!desc->network_name) {
+			kfree(desc);
+			return NULL;
+		}
+	}
 
 	vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);
 	return desc;
@@ -449,15 +467,32 @@ struct vidtv_psi_desc_short_event
 		iso_language_code = "eng";
 
 	desc->iso_language_code = kstrdup(iso_language_code, GFP_KERNEL);
+	if (!desc->iso_language_code)
+		goto free_desc;
 
-	if (event_name && event_name_len)
+	if (event_name && event_name_len) {
 		desc->event_name = kstrdup(event_name, GFP_KERNEL);
+		if (!desc->event_name)
+			goto free_desc_language_code;
+	}
 
-	if (text && text_len)
+	if (text && text_len) {
 		desc->text = kstrdup(text, GFP_KERNEL);
+		if (!desc->text)
+			goto free_desc_event_name;
+	}
 
 	vidtv_psi_desc_chain(head, (struct vidtv_psi_desc *)desc);
 	return desc;
+
+free_desc_event_name:
+	if (event_name && event_name_len)
+		kfree(desc->event_name);
+free_desc_language_code:
+	kfree(desc->iso_language_code);
+free_desc:
+	kfree(desc);
+	return NULL;
 }
 
 struct vidtv_psi_desc *vidtv_psi_desc_clone(struct vidtv_psi_desc *desc)

From 64863ba8e6b7651d994c6e6d506cc8aa2ac45edb Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Date: Mon, 19 Jun 2023 16:12:02 +0800
Subject: [PATCH 0459/1043] media: vidtv: mux: Add check and kfree for kstrdup

[ Upstream commit 1fd6eb12642e0c32692924ff359c07de4b781d78 ]

Add check for the return value of kstrdup() and return the error
if it fails in order to avoid NULL pointer dereference.
Moreover, use kfree() in the later error handling in order to avoid
memory leak.

Fixes: c2f78f0cb294 ("media: vidtv: psi: add a Network Information Table (NIT)")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vidtv/vidtv_mux.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/media/test-drivers/vidtv/vidtv_mux.c b/drivers/media/test-drivers/vidtv/vidtv_mux.c
index b51e6a3b8cbe..f99878eff7ac 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_mux.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_mux.c
@@ -504,13 +504,16 @@ struct vidtv_mux *vidtv_mux_init(struct dvb_frontend *fe,
 	m->priv = args->priv;
 	m->network_id = args->network_id;
 	m->network_name = kstrdup(args->network_name, GFP_KERNEL);
+	if (!m->network_name)
+		goto free_mux_buf;
+
 	m->timing.current_jiffies = get_jiffies_64();
 
 	if (args->channels)
 		m->channels = args->channels;
 	else
 		if (vidtv_channels_init(m) < 0)
-			goto free_mux_buf;
+			goto free_mux_network_name;
 
 	/* will alloc data for pmt_sections after initializing pat */
 	if (vidtv_channel_si_init(m) < 0)
@@ -527,6 +530,8 @@ struct vidtv_mux *vidtv_mux_init(struct dvb_frontend *fe,
 	vidtv_channel_si_destroy(m);
 free_channels:
 	vidtv_channels_destroy(m);
+free_mux_network_name:
+	kfree(m->network_name);
 free_mux_buf:
 	vfree(m->mux_buf);
 free_mux:

From 2e2efaed79c0666c98a4c101111fddd564418a1b Mon Sep 17 00:00:00 2001
From: Jernej Skrabec <jernej.skrabec@gmail.com>
Date: Mon, 11 Sep 2023 20:46:12 +0200
Subject: [PATCH 0460/1043] media: cedrus: Fix clock/reset sequence

[ Upstream commit 36fe515c1a3cd5eac148e8a591a82108d92d5522 ]

According to H6 user manual, resets should always be de-asserted before
clocks are enabled. This is also consistent with vendor driver.

Fixes: d5aecd289bab ("media: cedrus: Implement runtime PM")
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Acked-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../staging/media/sunxi/cedrus/cedrus_hw.c    | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_hw.c b/drivers/staging/media/sunxi/cedrus/cedrus_hw.c
index bcf050a04ffc..e782731f0a6a 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus_hw.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus_hw.c
@@ -145,12 +145,12 @@ int cedrus_hw_suspend(struct device *device)
 {
 	struct cedrus_dev *dev = dev_get_drvdata(device);
 
-	reset_control_assert(dev->rstc);
-
 	clk_disable_unprepare(dev->ram_clk);
 	clk_disable_unprepare(dev->mod_clk);
 	clk_disable_unprepare(dev->ahb_clk);
 
+	reset_control_assert(dev->rstc);
+
 	return 0;
 }
 
@@ -159,11 +159,18 @@ int cedrus_hw_resume(struct device *device)
 	struct cedrus_dev *dev = dev_get_drvdata(device);
 	int ret;
 
+	ret = reset_control_reset(dev->rstc);
+	if (ret) {
+		dev_err(dev->dev, "Failed to apply reset\n");
+
+		return ret;
+	}
+
 	ret = clk_prepare_enable(dev->ahb_clk);
 	if (ret) {
 		dev_err(dev->dev, "Failed to enable AHB clock\n");
 
-		return ret;
+		goto err_rst;
 	}
 
 	ret = clk_prepare_enable(dev->mod_clk);
@@ -180,21 +187,14 @@ int cedrus_hw_resume(struct device *device)
 		goto err_mod_clk;
 	}
 
-	ret = reset_control_reset(dev->rstc);
-	if (ret) {
-		dev_err(dev->dev, "Failed to apply reset\n");
-
-		goto err_ram_clk;
-	}
-
 	return 0;
 
-err_ram_clk:
-	clk_disable_unprepare(dev->ram_clk);
 err_mod_clk:
 	clk_disable_unprepare(dev->mod_clk);
 err_ahb_clk:
 	clk_disable_unprepare(dev->ahb_clk);
+err_rst:
+	reset_control_assert(dev->rstc);
 
 	return ret;
 }

From 1b86938925bdd618aea295f64874978d3b209e5f Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Date: Fri, 6 Oct 2023 12:08:45 +0200
Subject: [PATCH 0461/1043] media: dvb-usb-v2: af9035: fix missing unlock

[ Upstream commit f31b2cb85f0ee165d78e1c43f6d69f82cc3b2145 ]

Instead of returning an error, goto the mutex unlock at
the end of the function.

Fixes smatch warning:

drivers/media/usb/dvb-usb-v2/af9035.c:467 af9035_i2c_master_xfer() warn: inconsistent returns '&d->i2c_mutex'.
  Locked on  : 326,387
  Unlocked on: 465,467

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 7bf744f2de0a ("media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer")
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/dvb-usb-v2/af9035.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index 8cbaab9a6084..f0bc3e060ab8 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -322,8 +322,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
 			ret = -EOPNOTSUPP;
 		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
 			   (msg[0].addr == state->af9033_i2c_addr[1])) {
-			if (msg[0].len < 3 || msg[1].len < 1)
-				return -EOPNOTSUPP;
+			if (msg[0].len < 3 || msg[1].len < 1) {
+				ret = -EOPNOTSUPP;
+				goto unlock;
+			}
 			/* demod access via firmware interface */
 			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
 					msg[0].buf[2];
@@ -383,8 +385,10 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
 			ret = -EOPNOTSUPP;
 		} else if ((msg[0].addr == state->af9033_i2c_addr[0]) ||
 			   (msg[0].addr == state->af9033_i2c_addr[1])) {
-			if (msg[0].len < 3)
-				return -EOPNOTSUPP;
+			if (msg[0].len < 3) {
+				ret = -EOPNOTSUPP;
+				goto unlock;
+			}
 			/* demod access via firmware interface */
 			reg = msg[0].buf[0] << 16 | msg[0].buf[1] << 8 |
 					msg[0].buf[2];
@@ -459,6 +463,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,
 		ret = -EOPNOTSUPP;
 	}
 
+unlock:
 	mutex_unlock(&d->i2c_mutex);
 
 	if (ret < 0)

From 0bc796e66b5d2d336d2eb7e025216ca1584015b5 Mon Sep 17 00:00:00 2001
From: Ben Wolsieffer <ben.wolsieffer@hefring.com>
Date: Wed, 1 Nov 2023 10:29:27 -0400
Subject: [PATCH 0462/1043] regmap: prevent noinc writes from clobbering cache

[ Upstream commit 984a4afdc87a1fc226fd657b1cd8255c13d3fc1a ]

Currently, noinc writes are cached as if they were standard incrementing
writes, overwriting unrelated register values in the cache. Instead, we
want to cache the last value written to the register, as is done in the
accelerated noinc handler (regmap_noinc_readwrite).

Fixes: cdf6b11daa77 ("regmap: Add regmap_noinc_write API")
Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com>
Link: https://lore.kernel.org/r/20231101142926.2722603-2-ben.wolsieffer@hefring.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/regmap/regmap.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 3edff8606ac9..7bc603145bd9 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1643,17 +1643,19 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg,
 	}
 
 	if (!map->cache_bypass && map->format.parse_val) {
-		unsigned int ival;
+		unsigned int ival, offset;
 		int val_bytes = map->format.val_bytes;
-		for (i = 0; i < val_len / val_bytes; i++) {
-			ival = map->format.parse_val(val + (i * val_bytes));
-			ret = regcache_write(map,
-					     reg + regmap_get_offset(map, i),
-					     ival);
+
+		/* Cache the last written value for noinc writes */
+		i = noinc ? val_len - val_bytes : 0;
+		for (; i < val_len; i += val_bytes) {
+			ival = map->format.parse_val(val + i);
+			offset = noinc ? 0 : regmap_get_offset(map, i / val_bytes);
+			ret = regcache_write(map, reg + offset, ival);
 			if (ret) {
 				dev_err(map->dev,
 					"Error in caching of register: %x ret: %d\n",
-					reg + regmap_get_offset(map, i), ret);
+					reg + offset, ret);
 				return ret;
 			}
 		}

From ce5e0a3c9d39ee94cf379314c358df38a875c0b1 Mon Sep 17 00:00:00 2001
From: Thierry Reding <thierry.reding@gmail.com>
Date: Wed, 11 Nov 2020 19:24:29 +0100
Subject: [PATCH 0463/1043] pwm: sti: Avoid conditional gotos
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit fd3ae02bb66f091e55f363d32eca7b4039977bf5 ]

Using gotos for conditional code complicates this code significantly.
Convert the code to simple conditional blocks to increase readability.

Suggested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Stable-dep-of: 2d6812b41e0d ("pwm: sti: Reduce number of allocations and drop usage of chip_data")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-sti.c | 50 ++++++++++++++++++++-----------------------
 1 file changed, 23 insertions(+), 27 deletions(-)

diff --git a/drivers/pwm/pwm-sti.c b/drivers/pwm/pwm-sti.c
index 1508616d794c..973f76856a50 100644
--- a/drivers/pwm/pwm-sti.c
+++ b/drivers/pwm/pwm-sti.c
@@ -593,38 +593,34 @@ static int sti_pwm_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
-	if (!cdata->pwm_num_devs)
-		goto skip_pwm;
+	if (cdata->pwm_num_devs) {
+		pc->pwm_clk = of_clk_get_by_name(dev->of_node, "pwm");
+		if (IS_ERR(pc->pwm_clk)) {
+			dev_err(dev, "failed to get PWM clock\n");
+			return PTR_ERR(pc->pwm_clk);
+		}
 
-	pc->pwm_clk = of_clk_get_by_name(dev->of_node, "pwm");
-	if (IS_ERR(pc->pwm_clk)) {
-		dev_err(dev, "failed to get PWM clock\n");
-		return PTR_ERR(pc->pwm_clk);
+		ret = clk_prepare(pc->pwm_clk);
+		if (ret) {
+			dev_err(dev, "failed to prepare clock\n");
+			return ret;
+		}
 	}
 
-	ret = clk_prepare(pc->pwm_clk);
-	if (ret) {
-		dev_err(dev, "failed to prepare clock\n");
-		return ret;
+	if (cdata->cpt_num_devs) {
+		pc->cpt_clk = of_clk_get_by_name(dev->of_node, "capture");
+		if (IS_ERR(pc->cpt_clk)) {
+			dev_err(dev, "failed to get PWM capture clock\n");
+			return PTR_ERR(pc->cpt_clk);
+		}
+
+		ret = clk_prepare(pc->cpt_clk);
+		if (ret) {
+			dev_err(dev, "failed to prepare clock\n");
+			return ret;
+		}
 	}
 
-skip_pwm:
-	if (!cdata->cpt_num_devs)
-		goto skip_cpt;
-
-	pc->cpt_clk = of_clk_get_by_name(dev->of_node, "capture");
-	if (IS_ERR(pc->cpt_clk)) {
-		dev_err(dev, "failed to get PWM capture clock\n");
-		return PTR_ERR(pc->cpt_clk);
-	}
-
-	ret = clk_prepare(pc->cpt_clk);
-	if (ret) {
-		dev_err(dev, "failed to prepare clock\n");
-		return ret;
-	}
-
-skip_cpt:
 	pc->chip.dev = dev;
 	pc->chip.ops = &sti_pwm_ops;
 	pc->chip.base = -1;

From 005965cab108512924164792865f01ccf2e97756 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Wed, 5 Jul 2023 10:06:48 +0200
Subject: [PATCH 0464/1043] pwm: sti: Reduce number of allocations and drop
 usage of chip_data
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 2d6812b41e0d832919d72c72ebddf361df53ba1b ]

Instead of using one allocation per capture channel, use a single one. Also
store it in driver data instead of chip data.

This has several advantages:

 - driver data isn't cleared when pwm_put() is called
 - Reduces memory fragmentation

Also register the pwm chip only after the per capture channel data is
initialized as the capture callback relies on this initialization and it
might be called even before pwmchip_add() returns.

It would be still better to have struct sti_pwm_compat_data and the
per-channel data struct sti_cpt_ddata in a single memory chunk, but that's
not easily possible because the number of capture channels isn't known yet
when the driver data struct is allocated.

Fixes: e926b12c611c ("pwm: Clear chip_data in pwm_put()")
Reported-by: George Stark <gnstark@sberdevices.ru>
Fixes: c97267ae831d ("pwm: sti: Add PWM capture callback")
Link: https://lore.kernel.org/r/20230705080650.2353391-7-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-sti.c | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/drivers/pwm/pwm-sti.c b/drivers/pwm/pwm-sti.c
index 973f76856a50..9b2174adab3d 100644
--- a/drivers/pwm/pwm-sti.c
+++ b/drivers/pwm/pwm-sti.c
@@ -79,6 +79,7 @@ struct sti_pwm_compat_data {
 	unsigned int cpt_num_devs;
 	unsigned int max_pwm_cnt;
 	unsigned int max_prescale;
+	struct sti_cpt_ddata *ddata;
 };
 
 struct sti_pwm_chip {
@@ -314,7 +315,7 @@ static int sti_pwm_capture(struct pwm_chip *chip, struct pwm_device *pwm,
 {
 	struct sti_pwm_chip *pc = to_sti_pwmchip(chip);
 	struct sti_pwm_compat_data *cdata = pc->cdata;
-	struct sti_cpt_ddata *ddata = pwm_get_chip_data(pwm);
+	struct sti_cpt_ddata *ddata = &cdata->ddata[pwm->hwpwm];
 	struct device *dev = pc->dev;
 	unsigned int effective_ticks;
 	unsigned long long high, low;
@@ -417,7 +418,7 @@ static irqreturn_t sti_pwm_interrupt(int irq, void *data)
 	while (cpt_int_stat) {
 		devicenum = ffs(cpt_int_stat) - 1;
 
-		ddata = pwm_get_chip_data(&pc->chip.pwms[devicenum]);
+		ddata = &pc->cdata->ddata[devicenum];
 
 		/*
 		 * Capture input:
@@ -619,6 +620,10 @@ static int sti_pwm_probe(struct platform_device *pdev)
 			dev_err(dev, "failed to prepare clock\n");
 			return ret;
 		}
+
+		cdata->ddata = devm_kzalloc(dev, cdata->cpt_num_devs * sizeof(*cdata->ddata), GFP_KERNEL);
+		if (!cdata->ddata)
+			return -ENOMEM;
 	}
 
 	pc->chip.dev = dev;
@@ -626,6 +631,13 @@ static int sti_pwm_probe(struct platform_device *pdev)
 	pc->chip.base = -1;
 	pc->chip.npwm = pc->cdata->pwm_num_devs;
 
+	for (i = 0; i < cdata->cpt_num_devs; i++) {
+		struct sti_cpt_ddata *ddata = &cdata->ddata[i];
+
+		init_waitqueue_head(&ddata->wait);
+		mutex_init(&ddata->lock);
+	}
+
 	ret = pwmchip_add(&pc->chip);
 	if (ret < 0) {
 		clk_unprepare(pc->pwm_clk);
@@ -633,19 +645,6 @@ static int sti_pwm_probe(struct platform_device *pdev)
 		return ret;
 	}
 
-	for (i = 0; i < cdata->cpt_num_devs; i++) {
-		struct sti_cpt_ddata *ddata;
-
-		ddata = devm_kzalloc(dev, sizeof(*ddata), GFP_KERNEL);
-		if (!ddata)
-			return -ENOMEM;
-
-		init_waitqueue_head(&ddata->wait);
-		mutex_init(&ddata->lock);
-
-		pwm_set_chip_data(&pc->chip.pwms[i], ddata);
-	}
-
 	platform_set_drvdata(pdev, pc);
 
 	return 0;

From e5d481d9b6cf1c438de49171b3a24a01d97a4d10 Mon Sep 17 00:00:00 2001
From: Florian Fainelli <florian.fainelli@broadcom.com>
Date: Wed, 4 Oct 2023 10:54:14 -0700
Subject: [PATCH 0465/1043] pwm: brcmstb: Utilize appropriate clock APIs in
 suspend/resume
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit e9bc4411548aaa738905d37851a0146c16b3bb21 ]

The suspend/resume functions currently utilize
clk_disable()/clk_enable() respectively which may be no-ops with certain
clock providers such as SCMI. Fix this to use clk_disable_unprepare()
and clk_prepare_enable() respectively as we should.

Fixes: 3a9f5957020f ("pwm: Add Broadcom BCM7038 PWM controller support")
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-brcmstb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pwm/pwm-brcmstb.c b/drivers/pwm/pwm-brcmstb.c
index fea612c45f20..fd8479cd6771 100644
--- a/drivers/pwm/pwm-brcmstb.c
+++ b/drivers/pwm/pwm-brcmstb.c
@@ -298,7 +298,7 @@ static int brcmstb_pwm_suspend(struct device *dev)
 {
 	struct brcmstb_pwm *p = dev_get_drvdata(dev);
 
-	clk_disable(p->clk);
+	clk_disable_unprepare(p->clk);
 
 	return 0;
 }
@@ -307,7 +307,7 @@ static int brcmstb_pwm_resume(struct device *dev)
 {
 	struct brcmstb_pwm *p = dev_get_drvdata(dev);
 
-	clk_enable(p->clk);
+	clk_prepare_enable(p->clk);
 
 	return 0;
 }

From 6c71e065befb2fae8f1461559b940c04e1071bd5 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Sun, 29 Oct 2023 02:53:36 +0000
Subject: [PATCH 0466/1043] Input: synaptics-rmi4 - fix use after free in
 rmi_unregister_function()

[ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ]

The put_device() calls rmi_release_function() which frees "fn" so the
dereference on the next line "fn->num_of_irqs" is a use after free.
Move the put_device() to the end to fix this.

Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mountain
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/rmi4/rmi_bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c
index 47d1b97ed6cf..a1b2c86ef611 100644
--- a/drivers/input/rmi4/rmi_bus.c
+++ b/drivers/input/rmi4/rmi_bus.c
@@ -276,11 +276,11 @@ void rmi_unregister_function(struct rmi_function *fn)
 
 	device_del(&fn->dev);
 	of_node_put(fn->dev.of_node);
-	put_device(&fn->dev);
 
 	for (i = 0; i < fn->num_of_irqs; i++)
 		irq_dispose_mapping(fn->irq[i]);
 
+	put_device(&fn->dev);
 }
 
 /**

From 3a2653828ffc6101aef80bf58d5b77484239f779 Mon Sep 17 00:00:00 2001
From: Willem de Bruijn <willemb@google.com>
Date: Wed, 25 Oct 2023 19:42:38 -0400
Subject: [PATCH 0467/1043] llc: verify mac len before reading mac header

[ Upstream commit 7b3ba18703a63f6fd487183b9262b08e5632da1b ]

LLC reads the mac header with eth_hdr without verifying that the skb
has an Ethernet header.

Syzbot was able to enter llc_rcv on a tun device. Tun can insert
packets without mac len and with user configurable skb->protocol
(passing a tun_pi header when not configuring IFF_NO_PI).

    BUG: KMSAN: uninit-value in llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]
    BUG: KMSAN: uninit-value in llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111
    llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]
    llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111
    llc_rcv+0xc5d/0x14a0 net/llc/llc_input.c:218
    __netif_receive_skb_one_core net/core/dev.c:5523 [inline]
    __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637
    netif_receive_skb_internal net/core/dev.c:5723 [inline]
    netif_receive_skb+0x58/0x660 net/core/dev.c:5782
    tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555
    tun_get_user+0x54c5/0x69c0 drivers/net/tun.c:2002

Add a mac_len test before all three eth_hdr(skb) calls under net/llc.

There are further uses in include/net/llc_pdu.h. All these are
protected by a test skb->protocol == ETH_P_802_2. Which does not
protect against this tun scenario.

But the mac_len test added in this patch in llc_fixup_skb will
indirectly protect those too. That is called from llc_rcv before any
other LLC code.

It is tempting to just add a blanket mac_len check in llc_rcv, but
not sure whether that could break valid LLC paths that do not assume
an Ethernet header. 802.2 LLC may be used on top of non-802.3
protocols in principle. The below referenced commit shows that used
to, on top of Token Ring.

At least one of the three eth_hdr uses goes back to before the start
of git history. But the one that syzbot exercises is introduced in
this commit. That commit is old enough (2008), that effectively all
stable kernels should receive this.

Fixes: f83f1768f833 ("[LLC]: skb allocation size for responses")
Reported-by: syzbot+a8c7be6dee0de1b669cc@syzkaller.appspotmail.com
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20231025234251.3796495-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/llc/llc_input.c   | 10 ++++++++--
 net/llc/llc_s_ac.c    |  3 +++
 net/llc/llc_station.c |  3 +++
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 7cac441862e2..51bccfb00a9c 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -127,8 +127,14 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
 	skb->transport_header += llc_len;
 	skb_pull(skb, llc_len);
 	if (skb->protocol == htons(ETH_P_802_2)) {
-		__be16 pdulen = eth_hdr(skb)->h_proto;
-		s32 data_size = ntohs(pdulen) - llc_len;
+		__be16 pdulen;
+		s32 data_size;
+
+		if (skb->mac_len < ETH_HLEN)
+			return 0;
+
+		pdulen = eth_hdr(skb)->h_proto;
+		data_size = ntohs(pdulen) - llc_len;
 
 		if (data_size < 0 ||
 		    !pskb_may_pull(skb, data_size))
diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c
index 9fa3342c7a82..df26557a0244 100644
--- a/net/llc/llc_s_ac.c
+++ b/net/llc/llc_s_ac.c
@@ -153,6 +153,9 @@ int llc_sap_action_send_test_r(struct llc_sap *sap, struct sk_buff *skb)
 	int rc = 1;
 	u32 data_size;
 
+	if (skb->mac_len < ETH_HLEN)
+		return 1;
+
 	llc_pdu_decode_sa(skb, mac_da);
 	llc_pdu_decode_da(skb, mac_sa);
 	llc_pdu_decode_ssap(skb, &dsap);
diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
index c29170e767a8..64e2c67e16ba 100644
--- a/net/llc/llc_station.c
+++ b/net/llc/llc_station.c
@@ -77,6 +77,9 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb)
 	u32 data_size;
 	struct sk_buff *nskb;
 
+	if (skb->mac_len < ETH_HLEN)
+		goto out;
+
 	/* The test request command is type U (llc_len = 3) */
 	data_size = ntohs(eth_hdr(skb)->h_proto) - 3;
 	nskb = llc_alloc_frame(NULL, skb->dev, LLC_PDU_TYPE_U, data_size);

From ddf4e04e946aaa6c458b8b6829617cc44af2bffd Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Fri, 27 Oct 2023 15:19:01 +0300
Subject: [PATCH 0468/1043] hsr: Prevent use after free in
 prp_create_tagged_frame()

[ Upstream commit 876f8ab52363f649bcc74072157dfd7adfbabc0d ]

The prp_fill_rct() function can fail.  In that situation, it frees the
skb and returns NULL.  Meanwhile on the success path, it returns the
original skb.  So it's straight forward to fix bug by using the returned
value.

Fixes: 451d8123f897 ("net: prp: add packet handling support")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/r/57af1f28-7f57-4a96-bcd3-b7a0f2340845@moroto.mountain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/hsr/hsr_forward.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 2a02cb2edec2..0c115d8ded03 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -296,9 +296,7 @@ struct sk_buff *prp_create_tagged_frame(struct hsr_frame_info *frame,
 	skb = skb_copy_expand(frame->skb_std, 0,
 			      skb_tailroom(frame->skb_std) + HSR_HLEN,
 			      GFP_ATOMIC);
-	prp_fill_rct(skb, frame, port);
-
-	return skb;
+	return prp_fill_rct(skb, frame, port);
 }
 
 static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev,

From b33d130f07f1decd756b849ab03c23d11d4dd294 Mon Sep 17 00:00:00 2001
From: Shigeru Yoshida <syoshida@redhat.com>
Date: Mon, 30 Oct 2023 16:55:40 +0900
Subject: [PATCH 0469/1043] tipc: Change nla_policy for bearer-related names to
 NLA_NUL_STRING

[ Upstream commit 19b3f72a41a8751e26bffc093bb7e1cef29ad579 ]

syzbot reported the following uninit-value access issue [1]:

=====================================================
BUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline]
BUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756
 strlen lib/string.c:418 [inline]
 strstr+0xb8/0x2f0 lib/string.c:756
 tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595
 genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline]
 genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066
 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545
 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075
 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
 netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368
 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
 sock_sendmsg_nosec net/socket.c:730 [inline]
 sock_sendmsg net/socket.c:753 [inline]
 ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595
 __sys_sendmsg net/socket.c:2624 [inline]
 __do_sys_sendmsg net/socket.c:2633 [inline]
 __se_sys_sendmsg net/socket.c:2631 [inline]
 __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was created at:
 slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767
 slab_alloc_node mm/slub.c:3478 [inline]
 kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559
 __alloc_skb+0x318/0x740 net/core/skbuff.c:650
 alloc_skb include/linux/skbuff.h:1286 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline]
 netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885
 sock_sendmsg_nosec net/socket.c:730 [inline]
 sock_sendmsg net/socket.c:753 [inline]
 ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595
 __sys_sendmsg net/socket.c:2624 [inline]
 __do_sys_sendmsg net/socket.c:2633 [inline]
 __se_sys_sendmsg net/socket.c:2631 [inline]
 __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

TIPC bearer-related names including link names must be null-terminated
strings. If a link name which is not null-terminated is passed through
netlink, strstr() and similar functions can cause buffer overrun. This
causes the above issue.

This patch changes the nla_policy for bearer-related names from NLA_STRING
to NLA_NUL_STRING. This resolves the issue by ensuring that only
null-terminated strings are accepted as bearer-related names.

syzbot reported similar uninit-value issue related to bearer names [2]. The
root cause of this issue is that a non-null-terminated bearer name was
passed. This patch also resolved this issue.

Fixes: 7be57fc69184 ("tipc: add link get/dump to new netlink api")
Fixes: 0655f6a8635b ("tipc: add bearer disable/enable to new netlink api")
Reported-and-tested-by: syzbot+5138ca807af9d2b42574@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5138ca807af9d2b42574 [1]
Reported-and-tested-by: syzbot+9425c47dccbcb4c17d51@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9425c47dccbcb4c17d51 [2]
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20231030075540.3784537-1-syoshida@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/netlink.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index c447cb5f879e..f10ed873858f 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -88,7 +88,7 @@ const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = {
 
 const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {
 	[TIPC_NLA_LINK_UNSPEC]		= { .type = NLA_UNSPEC },
-	[TIPC_NLA_LINK_NAME]		= { .type = NLA_STRING,
+	[TIPC_NLA_LINK_NAME]		= { .type = NLA_NUL_STRING,
 					    .len = TIPC_MAX_LINK_NAME },
 	[TIPC_NLA_LINK_MTU]		= { .type = NLA_U32 },
 	[TIPC_NLA_LINK_BROADCAST]	= { .type = NLA_FLAG },
@@ -125,7 +125,7 @@ const struct nla_policy tipc_nl_prop_policy[TIPC_NLA_PROP_MAX + 1] = {
 
 const struct nla_policy tipc_nl_bearer_policy[TIPC_NLA_BEARER_MAX + 1]	= {
 	[TIPC_NLA_BEARER_UNSPEC]	= { .type = NLA_UNSPEC },
-	[TIPC_NLA_BEARER_NAME]		= { .type = NLA_STRING,
+	[TIPC_NLA_BEARER_NAME]		= { .type = NLA_NUL_STRING,
 					    .len = TIPC_MAX_BEARER_NAME },
 	[TIPC_NLA_BEARER_PROP]		= { .type = NLA_NESTED },
 	[TIPC_NLA_BEARER_DOMAIN]	= { .type = NLA_U32 }

From f830d4f6983587e6316050dbc9d94befefe4be36 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 25 Oct 2023 14:10:37 +0000
Subject: [PATCH 0470/1043] inet: shrink struct flowi_common

[ Upstream commit 1726483b79a72e0150734d5367e4a0238bf8fcff ]

I am looking at syzbot reports triggering kernel stack overflows
involving a cascade of ipvlan devices.

We can save 8 bytes in struct flowi_common.

This patch alone will not fix the issue, but is a start.

Fixes: 24ba14406c5c ("route: Add multipath_hash in flowi_common to make user-define hash")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: wenxu <wenxu@ucloud.cn>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20231025141037.3448203-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/flow.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/net/flow.h b/include/net/flow.h
index 236d0941c69f..7ffa1fe1107c 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -39,8 +39,8 @@ struct flowi_common {
 #define FLOWI_FLAG_SKIP_NH_OIF		0x04
 	__u32	flowic_secid;
 	kuid_t  flowic_uid;
-	struct flowi_tunnel flowic_tun_key;
 	__u32		flowic_multipath_hash;
+	struct flowi_tunnel flowic_tun_key;
 };
 
 union flowi_uli {

From 7827667989e1ea1be3846c6f4af18eee35c635ac Mon Sep 17 00:00:00 2001
From: Kuniyuki Iwashima <kuniyu@amazon.com>
Date: Mon, 30 Oct 2023 13:10:41 -0700
Subject: [PATCH 0471/1043] dccp: Call security_inet_conn_request() after
 setting IPv4 addresses.

[ Upstream commit fa2df45af13091f76b89adb84a28f13818d5d631 ]

Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of child
sockets") introduced security_inet_conn_request() in some functions
where reqsk is allocated.  The hook is added just after the allocation,
so reqsk's IPv4 remote address was not initialised then.

However, SELinux/Smack started to read it in netlbl_req_setattr()
after the cited commits.

This bug was partially fixed by commit 284904aa7946 ("lsm: Relocate
the IPv4 security_inet_conn_request() hooks").

This patch fixes the last bug in DCCPv4.

Fixes: 389fb800ac8b ("netlabel: Label incoming TCP connections correctly in SELinux")
Fixes: 07feee8f812f ("netlabel: Cleanup the Smack/NetLabel code to fix incoming TCP connections")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/dccp/ipv4.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index f2a0a4e6dd74..2c7c1bdd39e1 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -613,9 +613,6 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 	if (dccp_parse_options(sk, dreq, skb))
 		goto drop_and_free;
 
-	if (security_inet_conn_request(sk, skb, req))
-		goto drop_and_free;
-
 	ireq = inet_rsk(req);
 	sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr);
 	sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr);
@@ -623,6 +620,9 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 	ireq->ireq_family = AF_INET;
 	ireq->ir_iif = sk->sk_bound_dev_if;
 
+	if (security_inet_conn_request(sk, skb, req))
+		goto drop_and_free;
+
 	/*
 	 * Step 3: Process LISTEN state
 	 *

From 4969fcebe76d7e2486eac39d0a7643a9419f137d Mon Sep 17 00:00:00 2001
From: Kuniyuki Iwashima <kuniyu@amazon.com>
Date: Mon, 30 Oct 2023 13:10:42 -0700
Subject: [PATCH 0472/1043] dccp/tcp: Call security_inet_conn_request() after
 setting IPv6 addresses.

[ Upstream commit 23be1e0e2a83a8543214d2599a31d9a2185a796b ]

Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of child
sockets") introduced security_inet_conn_request() in some functions
where reqsk is allocated.  The hook is added just after the allocation,
so reqsk's IPv6 remote address was not initialised then.

However, SELinux/Smack started to read it in netlbl_req_setattr()
after commit e1adea927080 ("calipso: Allow request sockets to be
relabelled by the lsm.").

Commit 284904aa7946 ("lsm: Relocate the IPv4 security_inet_conn_request()
hooks") fixed that kind of issue only in TCPv4 because IPv6 labeling was
not supported at that time.  Finally, the same issue was introduced again
in IPv6.

Let's apply the same fix on DCCPv6 and TCPv6.

Fixes: e1adea927080 ("calipso: Allow request sockets to be relabelled by the lsm.")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/dccp/ipv6.c       | 6 +++---
 net/ipv6/syncookies.c | 7 ++++---
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 6d6bbd43a141..991ca2dc2c02 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -349,15 +349,15 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 	if (dccp_parse_options(sk, dreq, skb))
 		goto drop_and_free;
 
-	if (security_inet_conn_request(sk, skb, req))
-		goto drop_and_free;
-
 	ireq = inet_rsk(req);
 	ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 	ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 	ireq->ireq_family = AF_INET6;
 	ireq->ir_mark = inet_request_mark(sk, skb);
 
+	if (security_inet_conn_request(sk, skb, req))
+		goto drop_and_free;
+
 	if (ipv6_opt_accepted(sk, skb, IP6CB(skb)) ||
 	    np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
 	    np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 12ae817aaf2e..c10a68bb85de 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -180,14 +180,15 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 	treq = tcp_rsk(req);
 	treq->tfo_listener = false;
 
-	if (security_inet_conn_request(sk, skb, req))
-		goto out_free;
-
 	req->mss = mss;
 	ireq->ir_rmt_port = th->source;
 	ireq->ir_num = ntohs(th->dest);
 	ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 	ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
+
+	if (security_inet_conn_request(sk, skb, req))
+		goto out_free;
+
 	if (ipv6_opt_accepted(sk, skb, &TCP_SKB_CB(skb)->header.h6) ||
 	    np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
 	    np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {

From 0a84ffc72f1ec340332f867f95537cd3490607e8 Mon Sep 17 00:00:00 2001
From: Patrick Thompson <ptf@google.com>
Date: Mon, 30 Oct 2023 16:50:14 -0400
Subject: [PATCH 0473/1043] net: r8169: Disable multicast filter for RTL8168H
 and RTL8107E

[ Upstream commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df ]

RTL8168H and RTL8107E ethernet adapters erroneously filter unicast
eapol packets unless allmulti is enabled. These devices correspond to
RTL_GIGA_MAC_VER_46 and VER_48. Add an exception for VER_46 and VER_48
in the same way that VER_35 has an exception.

Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
Signed-off-by: Patrick Thompson <ptf@google.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/20231030205031.177855-1-ptf@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 9a920e0677e5..6886402add4c 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -2579,7 +2579,9 @@ static void rtl_set_rx_mode(struct net_device *dev)
 		rx_mode |= AcceptAllPhys;
 	} else if (netdev_mc_count(dev) > MC_FILTER_LIMIT ||
 		   dev->flags & IFF_ALLMULTI ||
-		   tp->mac_version == RTL_GIGA_MAC_VER_35) {
+		   tp->mac_version == RTL_GIGA_MAC_VER_35 ||
+		   tp->mac_version == RTL_GIGA_MAC_VER_46 ||
+		   tp->mac_version == RTL_GIGA_MAC_VER_48) {
 		/* accept all multicasts */
 	} else if (netdev_mc_empty(dev)) {
 		rx_mode &= ~AcceptMulticast;

From eafacef7eeeff3b0d8f383ea5d8472b3c2540cd3 Mon Sep 17 00:00:00 2001
From: NeilBrown <neilb@suse.de>
Date: Tue, 24 Oct 2023 09:53:33 +1100
Subject: [PATCH 0474/1043] Fix termination state for idr_for_each_entry_ul()

[ Upstream commit e8ae8ad479e2d037daa33756e5e72850a7bd37a9 ]

The comment for idr_for_each_entry_ul() states

  after normal termination @entry is left with the value NULL

This is not correct in the case where UINT_MAX has an entry in the idr.
In that case @entry will be non-NULL after termination.
No current code depends on the documentation being correct, but to
save future code we should fix it.

Also fix idr_for_each_entry_continue_ul().  While this is not documented
as leaving @entry as NULL, the mellanox driver appears to depend on
it doing so.  So make that explicit in the documentation as well as in
the code.

Fixes: e33d2b74d805 ("idr: fix overflow case for idr_for_each_entry_ul()")
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Chris Mi <chrism@mellanox.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/idr.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/linux/idr.h b/include/linux/idr.h
index a0dce14090a9..da5f5fa4a3a6 100644
--- a/include/linux/idr.h
+++ b/include/linux/idr.h
@@ -200,7 +200,7 @@ static inline void idr_preload_end(void)
  */
 #define idr_for_each_entry_ul(idr, entry, tmp, id)			\
 	for (tmp = 0, id = 0;						\
-	     tmp <= id && ((entry) = idr_get_next_ul(idr, &(id))) != NULL; \
+	     ((entry) = tmp <= id ? idr_get_next_ul(idr, &(id)) : NULL) != NULL; \
 	     tmp = id, ++id)
 
 /**
@@ -224,10 +224,12 @@ static inline void idr_preload_end(void)
  * @id: Entry ID.
  *
  * Continue to iterate over entries, continuing after the current position.
+ * After normal termination @entry is left with the value NULL.  This
+ * is convenient for a "not found" value.
  */
 #define idr_for_each_entry_continue_ul(idr, entry, tmp, id)		\
 	for (tmp = id;							\
-	     tmp <= id && ((entry) = idr_get_next_ul(idr, &(id))) != NULL; \
+	     ((entry) = tmp <= id ? idr_get_next_ul(idr, &(id)) : NULL) != NULL; \
 	     tmp = id, ++id)
 
 /*

From 13d6bc35deb1abb9f0e9e9fada8e6af0bdf8dfcc Mon Sep 17 00:00:00 2001
From: Furong Xu <0x1207@gmail.com>
Date: Tue, 31 Oct 2023 10:27:29 +0800
Subject: [PATCH 0475/1043] net: stmmac: xgmac: Enable support for multiple
 Flexible PPS outputs

[ Upstream commit db456d90a4c1b43b6251fa4348c8adc59b583274 ]

From XGMAC Core 3.20 and later, each Flexible PPS has individual PPSEN bit
to select Fixed mode or Flexible mode. The PPSEN must be set, or it stays
in Fixed PPS mode by default.
XGMAC Core prior 3.20, only PPSEN0(bit 4) is writable. PPSEN{1,2,3} are
read-only reserved, and they are already in Flexible mode by default, our
new code always set PPSEN{1,2,3} do not make things worse ;-)

Fixes: 95eaf3cd0a90 ("net: stmmac: dwxgmac: Add Flexible PPS support")
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Furong Xu <0x1207@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h     |  2 +-
 .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c    | 14 +++++++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
index 6c3b8a950f58..eee58e051387 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
@@ -222,7 +222,7 @@
 	((val) << XGMAC_PPS_MINIDX(x))
 #define XGMAC_PPSCMD_START		0x2
 #define XGMAC_PPSCMD_STOP		0x5
-#define XGMAC_PPSEN0			BIT(4)
+#define XGMAC_PPSENx(x)			BIT(4 + (x) * 8)
 #define XGMAC_PPSx_TARGET_TIME_SEC(x)	(0x00000d80 + (x) * 0x10)
 #define XGMAC_PPSx_TARGET_TIME_NSEC(x)	(0x00000d84 + (x) * 0x10)
 #define XGMAC_TRGTBUSY0			BIT(31)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
index ad4df9bddcf3..b06066746302 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
@@ -1132,7 +1132,19 @@ static int dwxgmac2_flex_pps_config(void __iomem *ioaddr, int index,
 
 	val |= XGMAC_PPSCMDx(index, XGMAC_PPSCMD_START);
 	val |= XGMAC_TRGTMODSELx(index, XGMAC_PPSCMD_START);
-	val |= XGMAC_PPSEN0;
+
+	/* XGMAC Core has 4 PPS outputs at most.
+	 *
+	 * Prior XGMAC Core 3.20, Fixed mode or Flexible mode are selectable for
+	 * PPS0 only via PPSEN0. PPS{1,2,3} are in Flexible mode by default,
+	 * and can not be switched to Fixed mode, since PPSEN{1,2,3} are
+	 * read-only reserved to 0.
+	 * But we always set PPSEN{1,2,3} do not make things worse ;-)
+	 *
+	 * From XGMAC Core 3.20 and later, PPSEN{0,1,2,3} are writable and must
+	 * be set, or the PPS outputs stay in Fixed PPS mode by default.
+	 */
+	val |= XGMAC_PPSENx(index);
 
 	writel(cfg->start.tv_sec, ioaddr + XGMAC_PPSx_TARGET_TIME_SEC(index));
 

From 4e7bad7301601290bfd3a60ddb6605e2d7b80dd6 Mon Sep 17 00:00:00 2001
From: "D. Wythe" <alibuda@linux.alibaba.com>
Date: Fri, 3 Nov 2023 14:07:38 +0800
Subject: [PATCH 0476/1043] net/smc: fix dangling sock under state
 SMC_APPFINCLOSEWAIT

[ Upstream commit 5211c9729484c923f8d2e06bd29f9322cc42bb8f ]

Considering scenario:

				smc_cdc_rx_handler
__smc_release
				sock_set_flag
smc_close_active()
sock_set_flag

__set_bit(DEAD)			__set_bit(DONE)

Dues to __set_bit is not atomic, the DEAD or DONE might be lost.
if the DEAD flag lost, the state SMC_CLOSED  will be never be reached
in smc_close_passive_work:

if (sock_flag(sk, SOCK_DEAD) &&
	smc_close_sent_any_close(conn)) {
	sk->sk_state = SMC_CLOSED;
} else {
	/* just shutdown, but not yet closed locally */
	sk->sk_state = SMC_APPFINCLOSEWAIT;
}

Replace sock_set_flags or __set_bit to set_bit will fix this problem.
Since set_bit is atomic.

Fixes: b38d732477e4 ("smc: socket closing and linkgroup cleanup")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/af_smc.c    | 4 ++--
 net/smc/smc.h       | 5 +++++
 net/smc/smc_cdc.c   | 2 +-
 net/smc/smc_close.c | 2 +-
 4 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 8ab84926816f..9fc47292b68d 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -143,7 +143,7 @@ static int __smc_release(struct smc_sock *smc)
 
 	if (!smc->use_fallback) {
 		rc = smc_close_active(smc);
-		sock_set_flag(sk, SOCK_DEAD);
+		smc_sock_set_flag(sk, SOCK_DEAD);
 		sk->sk_shutdown |= SHUTDOWN_MASK;
 	} else {
 		if (sk->sk_state != SMC_CLOSED) {
@@ -1169,7 +1169,7 @@ static int smc_clcsock_accept(struct smc_sock *lsmc, struct smc_sock **new_smc)
 		if (new_clcsock)
 			sock_release(new_clcsock);
 		new_sk->sk_state = SMC_CLOSED;
-		sock_set_flag(new_sk, SOCK_DEAD);
+		smc_sock_set_flag(new_sk, SOCK_DEAD);
 		sock_put(new_sk); /* final */
 		*new_smc = NULL;
 		goto out;
diff --git a/net/smc/smc.h b/net/smc/smc.h
index e6919fe31617..1eee40ec1d96 100644
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -297,4 +297,9 @@ static inline bool using_ipsec(struct smc_sock *smc)
 struct sock *smc_accept_dequeue(struct sock *parent, struct socket *new_sock);
 void smc_close_non_accepted(struct sock *sk);
 
+static inline void smc_sock_set_flag(struct sock *sk, enum sock_flags flag)
+{
+	set_bit(flag, &sk->sk_flags);
+}
+
 #endif	/* __SMC_H */
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index 9125d28d9ff5..78c212a7f617 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -370,7 +370,7 @@ static void smc_cdc_msg_recv_action(struct smc_sock *smc,
 		smc->sk.sk_shutdown |= RCV_SHUTDOWN;
 		if (smc->clcsock && smc->clcsock->sk)
 			smc->clcsock->sk->sk_shutdown |= RCV_SHUTDOWN;
-		sock_set_flag(&smc->sk, SOCK_DONE);
+		smc_sock_set_flag(&smc->sk, SOCK_DONE);
 		sock_hold(&smc->sk); /* sock_put in close_work */
 		if (!queue_work(smc_close_wq, &conn->close_work))
 			sock_put(&smc->sk);
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index 149a59ecd299..0790cac9ae3e 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -170,7 +170,7 @@ void smc_close_active_abort(struct smc_sock *smc)
 		break;
 	}
 
-	sock_set_flag(sk, SOCK_DEAD);
+	smc_sock_set_flag(sk, SOCK_DEAD);
 	sk->sk_state_change(sk);
 
 	if (release_clcsock) {

From f652ab15af0a05b7d1a413096d2bb40b6b1c86c9 Mon Sep 17 00:00:00 2001
From: "D. Wythe" <alibuda@linux.alibaba.com>
Date: Fri, 3 Nov 2023 14:07:39 +0800
Subject: [PATCH 0477/1043] net/smc: allow cdc msg send rather than drop it
 with NULL sndbuf_desc

[ Upstream commit c5bf605ba4f9d6fbbb120595ab95002f4716edcb ]

This patch re-fix the issues mentioned by commit 22a825c541d7
("net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()").

Blocking sending message do solve the issues though, but it also
prevents the peer to receive the final message. Besides, in logic,
whether the sndbuf_desc is NULL or not have no impact on the processing
of cdc message sending.

Hence that, this patch allows the cdc message sending but to check the
sndbuf_desc with care in smc_cdc_tx_handler().

Fixes: 22a825c541d7 ("net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/smc_cdc.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index 78c212a7f617..b92b2cee2079 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -28,13 +28,15 @@ static void smc_cdc_tx_handler(struct smc_wr_tx_pend_priv *pnd_snd,
 {
 	struct smc_cdc_tx_pend *cdcpend = (struct smc_cdc_tx_pend *)pnd_snd;
 	struct smc_connection *conn = cdcpend->conn;
+	struct smc_buf_desc *sndbuf_desc;
 	struct smc_sock *smc;
 	int diff;
 
+	sndbuf_desc = conn->sndbuf_desc;
 	smc = container_of(conn, struct smc_sock, conn);
 	bh_lock_sock(&smc->sk);
-	if (!wc_status) {
-		diff = smc_curs_diff(cdcpend->conn->sndbuf_desc->len,
+	if (!wc_status && sndbuf_desc) {
+		diff = smc_curs_diff(sndbuf_desc->len,
 				     &cdcpend->conn->tx_curs_fin,
 				     &cdcpend->cursor);
 		/* sndbuf_space is decreased in smc_sendmsg */
@@ -104,9 +106,6 @@ int smc_cdc_msg_send(struct smc_connection *conn,
 	union smc_host_cursor cfed;
 	int rc;
 
-	if (unlikely(!READ_ONCE(conn->sndbuf_desc)))
-		return -ENOBUFS;
-
 	smc_cdc_add_pending_send(conn, pend);
 
 	conn->tx_cdc_seq++;

From 34c5a24633bc16548ecd2acc57d17d00ff73fd0a Mon Sep 17 00:00:00 2001
From: "D. Wythe" <alibuda@linux.alibaba.com>
Date: Fri, 3 Nov 2023 14:07:40 +0800
Subject: [PATCH 0478/1043] net/smc: put sk reference if close work was
 canceled

[ Upstream commit aa96fbd6d78d9770323b21e2c92bd38821be8852 ]

Note that we always hold a reference to sock when attempting
to submit close_work. Therefore, if we have successfully
canceled close_work from pending, we MUST release that reference
to avoid potential leaks.

Fixes: 42bfba9eaa33 ("net/smc: immediate termination for SMCD link groups")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/smc_close.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index 0790cac9ae3e..bcd3ea894555 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -113,7 +113,8 @@ static void smc_close_cancel_work(struct smc_sock *smc)
 	struct sock *sk = &smc->sk;
 
 	release_sock(sk);
-	cancel_work_sync(&smc->conn.close_work);
+	if (cancel_work_sync(&smc->conn.close_work))
+		sock_put(sk);
 	cancel_delayed_work_sync(&smc->conn.tx_work);
 	lock_sock(sk);
 }

From e02824db7c43c93a67df195412f9cec1a9de0b40 Mon Sep 17 00:00:00 2001
From: George Shuklin <george.shuklin@gmail.com>
Date: Fri, 3 Nov 2023 13:50:29 +0200
Subject: [PATCH 0479/1043] tg3: power down device only on SYSTEM_POWER_OFF

[ Upstream commit 9fc3bc7643341dc5be7d269f3d3dbe441d8d7ac3 ]

Dell R650xs servers hangs on reboot if tg3 driver calls
tg3_power_down.

This happens only if network adapters (BCM5720 for R650xs) were
initialized using SNP (e.g. by booting ipxe.efi).

The actual problem is on Dell side, but this fix allows servers
to come back alive after reboot.

Signed-off-by: George Shuklin <george.shuklin@gmail.com>
Fixes: 2ca1c94ce0b6 ("tg3: Disable tg3 device on system reboot to avoid triggering AER")
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/20231103115029.83273-1-george.shuklin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/tg3.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index d14f37be1eb3..5647833303a4 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -18156,7 +18156,8 @@ static void tg3_shutdown(struct pci_dev *pdev)
 	if (netif_running(dev))
 		dev_close(dev);
 
-	tg3_power_down(tp);
+	if (system_state == SYSTEM_POWER_OFF)
+		tg3_power_down(tp);
 
 	rtnl_unlock();
 

From 00b1882091964592266477fa28ea2ae4a1051cc0 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Sun, 5 Nov 2023 23:43:36 +0100
Subject: [PATCH 0480/1043] r8169: respect userspace disabling IFF_MULTICAST

[ Upstream commit 8999ce4cfc87e61b4143ec2e7b93d8e92e11fa7f ]

So far we ignore the setting of IFF_MULTICAST. Fix this and clear bit
AcceptMulticast if IFF_MULTICAST isn't set.

Note: Based on the implementations I've seen it doesn't seem to be 100% clear
what a driver is supposed to do if IFF_ALLMULTI is set but IFF_MULTICAST
is not. This patch is based on the understanding that IFF_MULTICAST has
precedence.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/4a57ba02-d52d-4369-9f14-3565e6c1f7dc@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 6886402add4c..6e0fe77d1019 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -2577,6 +2577,8 @@ static void rtl_set_rx_mode(struct net_device *dev)
 
 	if (dev->flags & IFF_PROMISC) {
 		rx_mode |= AcceptAllPhys;
+	} else if (!(dev->flags & IFF_MULTICAST)) {
+		rx_mode &= ~AcceptMulticast;
 	} else if (netdev_mc_count(dev) > MC_FILTER_LIMIT ||
 		   dev->flags & IFF_ALLMULTI ||
 		   tp->mac_version == RTL_GIGA_MAC_VER_35 ||

From 7764290452d103e8a54dfb28f58ed13d2de3d589 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <zenczykowski@gmail.com>
Date: Sun, 5 Nov 2023 11:56:00 -0800
Subject: [PATCH 0481/1043] netfilter: xt_recent: fix (increase) ipv6 literal
 buffer length
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 7b308feb4fd2d1c06919445c65c8fbf8e9fd1781 ]

in6_pton() supports 'low-32-bit dot-decimal representation'
(this is useful with DNS64/NAT64 networks for example):

  # echo +aaaa:bbbb:cccc:dddd:eeee:ffff:1.2.3.4 > /proc/self/net/xt_recent/DEFAULT
  # cat /proc/self/net/xt_recent/DEFAULT
  src=aaaa:bbbb:cccc:dddd:eeee:ffff:0102:0304 ttl: 0 last_seen: 9733848829 oldest_pkt: 1 9733848829

but the provided buffer is too short:

  # echo +aaaa:bbbb:cccc:dddd:eeee:ffff:255.255.255.255 > /proc/self/net/xt_recent/DEFAULT
  -bash: echo: write error: Invalid argument

Fixes: 079aa88fe717 ("netfilter: xt_recent: IPv6 support")
Signed-off-by: Maciej Żenczykowski <zenczykowski@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/xt_recent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 0446307516cd..39937ff24527 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -561,7 +561,7 @@ recent_mt_proc_write(struct file *file, const char __user *input,
 {
 	struct recent_table *t = PDE_DATA(file_inode(file));
 	struct recent_entry *e;
-	char buf[sizeof("+b335:1d35:1e55:dead:c0de:1715:5afe:c0de")];
+	char buf[sizeof("+b335:1d35:1e55:dead:c0de:1715:255.255.255.255")];
 	const char *c = buf;
 	union nf_inet_addr addr = {};
 	u_int16_t family;

From b65d851b2eb071a2da88208d9622376a246dc27f Mon Sep 17 00:00:00 2001
From: Jeremy Sowden <jeremy@azazel.net>
Date: Wed, 15 Mar 2023 21:48:01 +0000
Subject: [PATCH 0482/1043] netfilter: nft_redir: use `struct nf_nat_range2`
 throughout and deduplicate eval call-backs

[ Upstream commit 6f56ad1b92328997e1b1792047099df6f8d7acb5 ]

`nf_nat_redirect_ipv4` takes a `struct nf_nat_ipv4_multi_range_compat`,
but converts it internally to a `struct nf_nat_range2`.  Change the
function to take the latter, factor out the code now shared with
`nf_nat_redirect_ipv6`, move the conversion to the xt_REDIRECT module,
and update the ipv4 range initialization in the nft_redir module.

Replace a bare hex constant for 127.0.0.1 with a macro.

Remove `WARN_ON`.  `nf_nat_setup_info` calls `nf_ct_is_confirmed`:

	/* Can't setup nat info for confirmed ct. */
	if (nf_ct_is_confirmed(ct))
		return NF_ACCEPT;

This means that `ct` cannot be null or the kernel will crash, and
implies that `ctinfo` is `IP_CT_NEW` or `IP_CT_RELATED`.

nft_redir has separate ipv4 and ipv6 call-backs which share much of
their code, and an inet one switch containing a switch that calls one of
the others based on the family of the packet.  Merge the ipv4 and ipv6
ones into the inet one in order to get rid of the duplicate code.

Const-qualify the `priv` pointer since we don't need to write through
it.

Assign `priv->flags` to the range instead of OR-ing it in.

Set the `NF_NAT_RANGE_PROTO_SPECIFIED` flag once during init, rather
than on every eval.

Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
Stable-dep-of: 80abbe8a8263 ("netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/netfilter/nf_nat_redirect.h |  3 +-
 net/netfilter/nf_nat_redirect.c         | 71 ++++++++++-----------
 net/netfilter/nft_redir.c               | 84 +++++++++----------------
 net/netfilter/xt_REDIRECT.c             | 10 ++-
 4 files changed, 72 insertions(+), 96 deletions(-)

diff --git a/include/net/netfilter/nf_nat_redirect.h b/include/net/netfilter/nf_nat_redirect.h
index 2418653a66db..279380de904c 100644
--- a/include/net/netfilter/nf_nat_redirect.h
+++ b/include/net/netfilter/nf_nat_redirect.h
@@ -6,8 +6,7 @@
 #include <uapi/linux/netfilter/nf_nat.h>
 
 unsigned int
-nf_nat_redirect_ipv4(struct sk_buff *skb,
-		     const struct nf_nat_ipv4_multi_range_compat *mr,
+nf_nat_redirect_ipv4(struct sk_buff *skb, const struct nf_nat_range2 *range,
 		     unsigned int hooknum);
 unsigned int
 nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c
index f91579c821e9..6616ba5d0b04 100644
--- a/net/netfilter/nf_nat_redirect.c
+++ b/net/netfilter/nf_nat_redirect.c
@@ -10,6 +10,7 @@
 
 #include <linux/if.h>
 #include <linux/inetdevice.h>
+#include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
@@ -24,54 +25,56 @@
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_redirect.h>
 
+static unsigned int
+nf_nat_redirect(struct sk_buff *skb, const struct nf_nat_range2 *range,
+		const union nf_inet_addr *newdst)
+{
+	struct nf_nat_range2 newrange;
+	enum ip_conntrack_info ctinfo;
+	struct nf_conn *ct;
+
+	ct = nf_ct_get(skb, &ctinfo);
+
+	memset(&newrange, 0, sizeof(newrange));
+
+	newrange.flags		= range->flags | NF_NAT_RANGE_MAP_IPS;
+	newrange.min_addr	= *newdst;
+	newrange.max_addr	= *newdst;
+	newrange.min_proto	= range->min_proto;
+	newrange.max_proto	= range->max_proto;
+
+	return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);
+}
+
 unsigned int
-nf_nat_redirect_ipv4(struct sk_buff *skb,
-		     const struct nf_nat_ipv4_multi_range_compat *mr,
+nf_nat_redirect_ipv4(struct sk_buff *skb, const struct nf_nat_range2 *range,
 		     unsigned int hooknum)
 {
-	struct nf_conn *ct;
-	enum ip_conntrack_info ctinfo;
-	__be32 newdst;
-	struct nf_nat_range2 newrange;
+	union nf_inet_addr newdst = {};
 
 	WARN_ON(hooknum != NF_INET_PRE_ROUTING &&
 		hooknum != NF_INET_LOCAL_OUT);
 
-	ct = nf_ct_get(skb, &ctinfo);
-	WARN_ON(!(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED)));
-
 	/* Local packets: make them go to loopback */
 	if (hooknum == NF_INET_LOCAL_OUT) {
-		newdst = htonl(0x7F000001);
+		newdst.ip = htonl(INADDR_LOOPBACK);
 	} else {
 		const struct in_device *indev;
 
-		newdst = 0;
-
 		indev = __in_dev_get_rcu(skb->dev);
 		if (indev) {
 			const struct in_ifaddr *ifa;
 
 			ifa = rcu_dereference(indev->ifa_list);
 			if (ifa)
-				newdst = ifa->ifa_local;
+				newdst.ip = ifa->ifa_local;
 		}
 
-		if (!newdst)
+		if (!newdst.ip)
 			return NF_DROP;
 	}
 
-	/* Transfer from original range. */
-	memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
-	memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
-	newrange.flags	     = mr->range[0].flags | NF_NAT_RANGE_MAP_IPS;
-	newrange.min_addr.ip = newdst;
-	newrange.max_addr.ip = newdst;
-	newrange.min_proto   = mr->range[0].min;
-	newrange.max_proto   = mr->range[0].max;
-
-	/* Hand modified range to generic setup. */
-	return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);
+	return nf_nat_redirect(skb, range, &newdst);
 }
 EXPORT_SYMBOL_GPL(nf_nat_redirect_ipv4);
 
@@ -81,14 +84,10 @@ unsigned int
 nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
 		     unsigned int hooknum)
 {
-	struct nf_nat_range2 newrange;
-	struct in6_addr newdst;
-	enum ip_conntrack_info ctinfo;
-	struct nf_conn *ct;
+	union nf_inet_addr newdst = {};
 
-	ct = nf_ct_get(skb, &ctinfo);
 	if (hooknum == NF_INET_LOCAL_OUT) {
-		newdst = loopback_addr;
+		newdst.in6 = loopback_addr;
 	} else {
 		struct inet6_dev *idev;
 		struct inet6_ifaddr *ifa;
@@ -98,7 +97,7 @@ nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
 		if (idev != NULL) {
 			read_lock_bh(&idev->lock);
 			list_for_each_entry(ifa, &idev->addr_list, if_list) {
-				newdst = ifa->addr;
+				newdst.in6 = ifa->addr;
 				addr = true;
 				break;
 			}
@@ -109,12 +108,6 @@ nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
 			return NF_DROP;
 	}
 
-	newrange.flags		= range->flags | NF_NAT_RANGE_MAP_IPS;
-	newrange.min_addr.in6	= newdst;
-	newrange.max_addr.in6	= newdst;
-	newrange.min_proto	= range->min_proto;
-	newrange.max_proto	= range->max_proto;
-
-	return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);
+	return nf_nat_redirect(skb, range, &newdst);
 }
 EXPORT_SYMBOL_GPL(nf_nat_redirect_ipv6);
diff --git a/net/netfilter/nft_redir.c b/net/netfilter/nft_redir.c
index e64f531d66cf..677ce4218369 100644
--- a/net/netfilter/nft_redir.c
+++ b/net/netfilter/nft_redir.c
@@ -64,6 +64,8 @@ static int nft_redir_init(const struct nft_ctx *ctx,
 		} else {
 			priv->sreg_proto_max = priv->sreg_proto_min;
 		}
+
+		priv->flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
 	}
 
 	if (tb[NFTA_REDIR_FLAGS]) {
@@ -98,25 +100,37 @@ static int nft_redir_dump(struct sk_buff *skb, const struct nft_expr *expr)
 	return -1;
 }
 
-static void nft_redir_ipv4_eval(const struct nft_expr *expr,
-				struct nft_regs *regs,
-				const struct nft_pktinfo *pkt)
+static void nft_redir_eval(const struct nft_expr *expr,
+			   struct nft_regs *regs,
+			   const struct nft_pktinfo *pkt)
 {
-	struct nft_redir *priv = nft_expr_priv(expr);
-	struct nf_nat_ipv4_multi_range_compat mr;
+	const struct nft_redir *priv = nft_expr_priv(expr);
+	struct nf_nat_range2 range;
 
-	memset(&mr, 0, sizeof(mr));
+	memset(&range, 0, sizeof(range));
+	range.flags = priv->flags;
 	if (priv->sreg_proto_min) {
-		mr.range[0].min.all = (__force __be16)nft_reg_load16(
-			&regs->data[priv->sreg_proto_min]);
-		mr.range[0].max.all = (__force __be16)nft_reg_load16(
-			&regs->data[priv->sreg_proto_max]);
-		mr.range[0].flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
+		range.min_proto.all = (__force __be16)
+			nft_reg_load16(&regs->data[priv->sreg_proto_min]);
+		range.max_proto.all = (__force __be16)
+			nft_reg_load16(&regs->data[priv->sreg_proto_max]);
 	}
 
-	mr.range[0].flags |= priv->flags;
-
-	regs->verdict.code = nf_nat_redirect_ipv4(pkt->skb, &mr, nft_hook(pkt));
+	switch (nft_pf(pkt)) {
+	case NFPROTO_IPV4:
+		regs->verdict.code = nf_nat_redirect_ipv4(pkt->skb, &range,
+							  nft_hook(pkt));
+		break;
+#ifdef CONFIG_NF_TABLES_IPV6
+	case NFPROTO_IPV6:
+		regs->verdict.code = nf_nat_redirect_ipv6(pkt->skb, &range,
+							  nft_hook(pkt));
+		break;
+#endif
+	default:
+		WARN_ON_ONCE(1);
+		break;
+	}
 }
 
 static void
@@ -129,7 +143,7 @@ static struct nft_expr_type nft_redir_ipv4_type;
 static const struct nft_expr_ops nft_redir_ipv4_ops = {
 	.type		= &nft_redir_ipv4_type,
 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_redir)),
-	.eval		= nft_redir_ipv4_eval,
+	.eval		= nft_redir_eval,
 	.init		= nft_redir_init,
 	.destroy	= nft_redir_ipv4_destroy,
 	.dump		= nft_redir_dump,
@@ -146,28 +160,6 @@ static struct nft_expr_type nft_redir_ipv4_type __read_mostly = {
 };
 
 #ifdef CONFIG_NF_TABLES_IPV6
-static void nft_redir_ipv6_eval(const struct nft_expr *expr,
-				struct nft_regs *regs,
-				const struct nft_pktinfo *pkt)
-{
-	struct nft_redir *priv = nft_expr_priv(expr);
-	struct nf_nat_range2 range;
-
-	memset(&range, 0, sizeof(range));
-	if (priv->sreg_proto_min) {
-		range.min_proto.all = (__force __be16)nft_reg_load16(
-			&regs->data[priv->sreg_proto_min]);
-		range.max_proto.all = (__force __be16)nft_reg_load16(
-			&regs->data[priv->sreg_proto_max]);
-		range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
-	}
-
-	range.flags |= priv->flags;
-
-	regs->verdict.code =
-		nf_nat_redirect_ipv6(pkt->skb, &range, nft_hook(pkt));
-}
-
 static void
 nft_redir_ipv6_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
@@ -178,7 +170,7 @@ static struct nft_expr_type nft_redir_ipv6_type;
 static const struct nft_expr_ops nft_redir_ipv6_ops = {
 	.type		= &nft_redir_ipv6_type,
 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_redir)),
-	.eval		= nft_redir_ipv6_eval,
+	.eval		= nft_redir_eval,
 	.init		= nft_redir_init,
 	.destroy	= nft_redir_ipv6_destroy,
 	.dump		= nft_redir_dump,
@@ -196,20 +188,6 @@ static struct nft_expr_type nft_redir_ipv6_type __read_mostly = {
 #endif
 
 #ifdef CONFIG_NF_TABLES_INET
-static void nft_redir_inet_eval(const struct nft_expr *expr,
-				struct nft_regs *regs,
-				const struct nft_pktinfo *pkt)
-{
-	switch (nft_pf(pkt)) {
-	case NFPROTO_IPV4:
-		return nft_redir_ipv4_eval(expr, regs, pkt);
-	case NFPROTO_IPV6:
-		return nft_redir_ipv6_eval(expr, regs, pkt);
-	}
-
-	WARN_ON_ONCE(1);
-}
-
 static void
 nft_redir_inet_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
@@ -220,7 +198,7 @@ static struct nft_expr_type nft_redir_inet_type;
 static const struct nft_expr_ops nft_redir_inet_ops = {
 	.type		= &nft_redir_inet_type,
 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_redir)),
-	.eval		= nft_redir_inet_eval,
+	.eval		= nft_redir_eval,
 	.init		= nft_redir_init,
 	.destroy	= nft_redir_inet_destroy,
 	.dump		= nft_redir_dump,
diff --git a/net/netfilter/xt_REDIRECT.c b/net/netfilter/xt_REDIRECT.c
index 353ca7801251..ff66b56a3f97 100644
--- a/net/netfilter/xt_REDIRECT.c
+++ b/net/netfilter/xt_REDIRECT.c
@@ -46,7 +46,6 @@ static void redirect_tg_destroy(const struct xt_tgdtor_param *par)
 	nf_ct_netns_put(par->net, par->family);
 }
 
-/* FIXME: Take multiple ranges --RR */
 static int redirect_tg4_check(const struct xt_tgchk_param *par)
 {
 	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
@@ -65,7 +64,14 @@ static int redirect_tg4_check(const struct xt_tgchk_param *par)
 static unsigned int
 redirect_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 {
-	return nf_nat_redirect_ipv4(skb, par->targinfo, xt_hooknum(par));
+	const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
+	struct nf_nat_range2 range = {
+		.flags       = mr->range[0].flags,
+		.min_proto   = mr->range[0].min,
+		.max_proto   = mr->range[0].max,
+	};
+
+	return nf_nat_redirect_ipv4(skb, &range, xt_hooknum(par));
 }
 
 static struct xt_target redirect_tg_reg[] __read_mostly = {

From bc794a667b1eb1557a09cc03984e5d3241e1b676 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Wed, 8 Nov 2023 13:18:53 +0100
Subject: [PATCH 0483/1043] netfilter: nat: fix ipv6 nat redirect with mapped
 and scoped addresses

[ Upstream commit 80abbe8a8263106fe45a4f293b92b5c74cc9cc8a ]

The ipv6 redirect target was derived from the ipv4 one, i.e. its
identical to a 'dnat' with the first (primary) address assigned to the
network interface.  The code has been moved around to make it usable
from nf_tables too, but its still the same as it was back when this
was added in 2012.

IPv6, however, has different types of addresses, if the 'wrong' address
comes first the redirection does not work.

In Daniels case, the addresses are:
  inet6 ::ffff:192 ...
  inet6 2a01: ...

... so the function attempts to redirect to the mapped address.

Add more checks before the address is deemed correct:
1. If the packets' daddr is scoped, search for a scoped address too
2. skip tentative addresses
3. skip mapped addresses

Use the first address that appears to match our needs.

Reported-by: Daniel Huhardeaux <tech@tootai.net>
Closes: https://lore.kernel.org/netfilter/71be06b8-6aa0-4cf9-9e0b-e2839b01b22f@tootai.net/
Fixes: 115e23ac78f8 ("netfilter: ip6tables: add REDIRECT target")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_nat_redirect.c | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c
index 6616ba5d0b04..5b37487d9d11 100644
--- a/net/netfilter/nf_nat_redirect.c
+++ b/net/netfilter/nf_nat_redirect.c
@@ -80,6 +80,26 @@ EXPORT_SYMBOL_GPL(nf_nat_redirect_ipv4);
 
 static const struct in6_addr loopback_addr = IN6ADDR_LOOPBACK_INIT;
 
+static bool nf_nat_redirect_ipv6_usable(const struct inet6_ifaddr *ifa, unsigned int scope)
+{
+	unsigned int ifa_addr_type = ipv6_addr_type(&ifa->addr);
+
+	if (ifa_addr_type & IPV6_ADDR_MAPPED)
+		return false;
+
+	if ((ifa->flags & IFA_F_TENTATIVE) && (!(ifa->flags & IFA_F_OPTIMISTIC)))
+		return false;
+
+	if (scope) {
+		unsigned int ifa_scope = ifa_addr_type & IPV6_ADDR_SCOPE_MASK;
+
+		if (!(scope & ifa_scope))
+			return false;
+	}
+
+	return true;
+}
+
 unsigned int
 nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
 		     unsigned int hooknum)
@@ -89,14 +109,19 @@ nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
 	if (hooknum == NF_INET_LOCAL_OUT) {
 		newdst.in6 = loopback_addr;
 	} else {
+		unsigned int scope = ipv6_addr_scope(&ipv6_hdr(skb)->daddr);
 		struct inet6_dev *idev;
-		struct inet6_ifaddr *ifa;
 		bool addr = false;
 
 		idev = __in6_dev_get(skb->dev);
 		if (idev != NULL) {
+			const struct inet6_ifaddr *ifa;
+
 			read_lock_bh(&idev->lock);
 			list_for_each_entry(ifa, &idev->addr_list, if_list) {
+				if (!nf_nat_redirect_ipv6_usable(ifa, scope))
+					continue;
+
 				newdst.in6 = ifa->addr;
 				addr = true;
 				break;

From 14042d6d80db5eb46077ead76c5a43b524cae66e Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Mon, 31 Jan 2022 09:24:50 +0200
Subject: [PATCH 0484/1043] x86: Share definition of __is_canonical_address()

[ Upstream commit 1fb85d06ad6754796cd1b920639ca9d8840abefd ]

Reduce code duplication by moving canonical address code to a common header
file.

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20220131072453.2839535-3-adrian.hunter@intel.com
Stable-dep-of: f79936545fb1 ("x86/sev-es: Allow copy_from_kernel_nofault() in earlier boot")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/intel/pt.c  | 14 ++------------
 arch/x86/include/asm/page.h | 10 ++++++++++
 arch/x86/kvm/emulate.c      |  4 ++--
 arch/x86/kvm/x86.c          |  2 +-
 arch/x86/kvm/x86.h          |  7 +------
 arch/x86/mm/maccess.c       |  7 +------
 6 files changed, 17 insertions(+), 27 deletions(-)

diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index d87421acddc3..5667b8b994e3 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -1360,20 +1360,10 @@ static void pt_addr_filters_fini(struct perf_event *event)
 }
 
 #ifdef CONFIG_X86_64
-static u64 canonical_address(u64 vaddr, u8 vaddr_bits)
-{
-	return ((s64)vaddr << (64 - vaddr_bits)) >> (64 - vaddr_bits);
-}
-
-static u64 is_canonical_address(u64 vaddr, u8 vaddr_bits)
-{
-	return canonical_address(vaddr, vaddr_bits) == vaddr;
-}
-
 /* Clamp to a canonical address greater-than-or-equal-to the address given */
 static u64 clamp_to_ge_canonical_addr(u64 vaddr, u8 vaddr_bits)
 {
-	return is_canonical_address(vaddr, vaddr_bits) ?
+	return __is_canonical_address(vaddr, vaddr_bits) ?
 	       vaddr :
 	       -BIT_ULL(vaddr_bits - 1);
 }
@@ -1381,7 +1371,7 @@ static u64 clamp_to_ge_canonical_addr(u64 vaddr, u8 vaddr_bits)
 /* Clamp to a canonical address less-than-or-equal-to the address given */
 static u64 clamp_to_le_canonical_addr(u64 vaddr, u8 vaddr_bits)
 {
-	return is_canonical_address(vaddr, vaddr_bits) ?
+	return __is_canonical_address(vaddr, vaddr_bits) ?
 	       vaddr :
 	       BIT_ULL(vaddr_bits - 1) - 1;
 }
diff --git a/arch/x86/include/asm/page.h b/arch/x86/include/asm/page.h
index 7555b48803a8..ffae5ea9fd4e 100644
--- a/arch/x86/include/asm/page.h
+++ b/arch/x86/include/asm/page.h
@@ -71,6 +71,16 @@ static inline void copy_user_page(void *to, void *from, unsigned long vaddr,
 extern bool __virt_addr_valid(unsigned long kaddr);
 #define virt_addr_valid(kaddr)	__virt_addr_valid((unsigned long) (kaddr))
 
+static __always_inline u64 __canonical_address(u64 vaddr, u8 vaddr_bits)
+{
+	return ((s64)vaddr << (64 - vaddr_bits)) >> (64 - vaddr_bits);
+}
+
+static __always_inline u64 __is_canonical_address(u64 vaddr, u8 vaddr_bits)
+{
+	return __canonical_address(vaddr, vaddr_bits) == vaddr;
+}
+
 #endif	/* __ASSEMBLY__ */
 
 #include <asm-generic/memory_model.h>
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 63efccc8f429..56750febf460 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -688,7 +688,7 @@ static inline u8 ctxt_virt_addr_bits(struct x86_emulate_ctxt *ctxt)
 static inline bool emul_is_noncanonical_address(u64 la,
 						struct x86_emulate_ctxt *ctxt)
 {
-	return get_canonical(la, ctxt_virt_addr_bits(ctxt)) != la;
+	return !__is_canonical_address(la, ctxt_virt_addr_bits(ctxt));
 }
 
 /*
@@ -738,7 +738,7 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt,
 	case X86EMUL_MODE_PROT64:
 		*linear = la;
 		va_bits = ctxt_virt_addr_bits(ctxt);
-		if (get_canonical(la, va_bits) != la)
+		if (!__is_canonical_address(la, va_bits))
 			goto bad;
 
 		*max_size = min_t(u64, ~0u, (1ull << va_bits) - la);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 9d3015863e58..c2899ff31a06 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1640,7 +1640,7 @@ static int __kvm_set_msr(struct kvm_vcpu *vcpu, u32 index, u64 data,
 		 * value, and that something deterministic happens if the guest
 		 * invokes 64-bit SYSENTER.
 		 */
-		data = get_canonical(data, vcpu_virt_addr_bits(vcpu));
+		data = __canonical_address(data, vcpu_virt_addr_bits(vcpu));
 	}
 
 	msr.data = data;
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 2bff44f1efec..4037b3cc704e 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -156,14 +156,9 @@ static inline u8 vcpu_virt_addr_bits(struct kvm_vcpu *vcpu)
 	return kvm_read_cr4_bits(vcpu, X86_CR4_LA57) ? 57 : 48;
 }
 
-static inline u64 get_canonical(u64 la, u8 vaddr_bits)
-{
-	return ((int64_t)la << (64 - vaddr_bits)) >> (64 - vaddr_bits);
-}
-
 static inline bool is_noncanonical_address(u64 la, struct kvm_vcpu *vcpu)
 {
-	return get_canonical(la, vcpu_virt_addr_bits(vcpu)) != la;
+	return !__is_canonical_address(la, vcpu_virt_addr_bits(vcpu));
 }
 
 static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu,
diff --git a/arch/x86/mm/maccess.c b/arch/x86/mm/maccess.c
index 92ec176a7293..5a53c2cc169c 100644
--- a/arch/x86/mm/maccess.c
+++ b/arch/x86/mm/maccess.c
@@ -4,11 +4,6 @@
 #include <linux/kernel.h>
 
 #ifdef CONFIG_X86_64
-static __always_inline u64 canonical_address(u64 vaddr, u8 vaddr_bits)
-{
-	return ((s64)vaddr << (64 - vaddr_bits)) >> (64 - vaddr_bits);
-}
-
 bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)
 {
 	unsigned long vaddr = (unsigned long)unsafe_src;
@@ -19,7 +14,7 @@ bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)
 	 * we also need to include the userspace guard page.
 	 */
 	return vaddr >= TASK_SIZE_MAX + PAGE_SIZE &&
-	       canonical_address(vaddr, boot_cpu_data.x86_virt_bits) == vaddr;
+	       __is_canonical_address(vaddr, boot_cpu_data.x86_virt_bits);
 }
 #else
 bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)

From b9bc1806b90772889d8ffc6f93efd87ee308c921 Mon Sep 17 00:00:00 2001
From: Adam Dunlap <acdunlap@google.com>
Date: Mon, 11 Sep 2023 17:27:02 -0700
Subject: [PATCH 0485/1043] x86/sev-es: Allow copy_from_kernel_nofault() in
 earlier boot

[ Upstream commit f79936545fb122856bd78b189d3c7ee59928c751 ]

Previously, if copy_from_kernel_nofault() was called before
boot_cpu_data.x86_virt_bits was set up, then it would trigger undefined
behavior due to a shift by 64.

This ended up causing boot failures in the latest version of ubuntu2204
in the gcp project when using SEV-SNP.

Specifically, this function is called during an early #VC handler which
is triggered by a CPUID to check if NX is implemented.

Fixes: 1aa9aa8ee517 ("x86/sev-es: Setup GHCB-based boot #VC handler")
Suggested-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Adam Dunlap <acdunlap@google.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Tested-by: Jacob Xu <jacobhxu@google.com>
Link: https://lore.kernel.org/r/20230912002703.3924521-2-acdunlap@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/mm/maccess.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/arch/x86/mm/maccess.c b/arch/x86/mm/maccess.c
index 5a53c2cc169c..6993f026adec 100644
--- a/arch/x86/mm/maccess.c
+++ b/arch/x86/mm/maccess.c
@@ -9,12 +9,21 @@ bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)
 	unsigned long vaddr = (unsigned long)unsafe_src;
 
 	/*
-	 * Range covering the highest possible canonical userspace address
-	 * as well as non-canonical address range. For the canonical range
-	 * we also need to include the userspace guard page.
+	 * Do not allow userspace addresses.  This disallows
+	 * normal userspace and the userspace guard page:
 	 */
-	return vaddr >= TASK_SIZE_MAX + PAGE_SIZE &&
-	       __is_canonical_address(vaddr, boot_cpu_data.x86_virt_bits);
+	if (vaddr < TASK_SIZE_MAX + PAGE_SIZE)
+		return false;
+
+	/*
+	 * Allow everything during early boot before 'x86_virt_bits'
+	 * is initialized.  Needed for instruction decoding in early
+	 * exception handlers.
+	 */
+	if (!boot_cpu_data.x86_virt_bits)
+		return true;
+
+	return __is_canonical_address(vaddr, boot_cpu_data.x86_virt_bits);
 }
 #else
 bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)

From 876a119790e530bf1f4f92ec08d1ff5b01041f58 Mon Sep 17 00:00:00 2001
From: Erik Kurzinger <ekurzinger@nvidia.com>
Date: Wed, 16 Aug 2023 09:26:05 -0700
Subject: [PATCH 0486/1043] drm/syncobj: fix
 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE

[ Upstream commit 101c9f637efa1655f55876644d4439e552267527 ]

If DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT is invoked with the
DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE flag set but no fence has yet been
submitted for the given timeline point the call will fail immediately
with EINVAL. This does not match the intended behavior where the call
should wait until the fence has been submitted (or the timeout expires).

The following small example program illustrates the issue. It should
wait for 5 seconds and then print ETIME, but instead it terminates right
away after printing EINVAL.

  #include <stdio.h>
  #include <fcntl.h>
  #include <time.h>
  #include <errno.h>
  #include <xf86drm.h>
  int main(void)
  {
      int fd = open("/dev/dri/card0", O_RDWR);
      uint32_t syncobj;
      drmSyncobjCreate(fd, 0, &syncobj);
      struct timespec ts;
      clock_gettime(CLOCK_MONOTONIC, &ts);
      uint64_t point = 1;
      if (drmSyncobjTimelineWait(fd, &syncobj, &point, 1,
                                 ts.tv_sec * 1000000000 + ts.tv_nsec + 5000000000, // 5s
                                 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE, NULL)) {
          printf("drmSyncobjTimelineWait failed %d\n", errno);
      }
  }

Fixes: 01d6c3578379 ("drm/syncobj: add support for timeline point wait v8")
Signed-off-by: Erik Kurzinger <ekurzinger@nvidia.com>
Reviewed by: Simon Ser <contact@emersion.fd>
Signed-off-by: Simon Ser <contact@emersion.fr>
Link: https://patchwork.freedesktop.org/patch/msgid/1fac96f1-2f3f-f9f9-4eb0-340f27a8f6c0@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_syncobj.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index 993898a2c779..738e60139db9 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -983,7 +983,8 @@ static signed long drm_syncobj_array_wait_timeout(struct drm_syncobj **syncobjs,
 		fence = drm_syncobj_fence_get(syncobjs[i]);
 		if (!fence || dma_fence_chain_find_seqno(&fence, points[i])) {
 			dma_fence_put(fence);
-			if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT) {
+			if (flags & (DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT |
+				     DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE)) {
 				continue;
 			} else {
 				timeout = -EINVAL;

From de721d7ef7ac1a9d43151e51130652543173d2ab Mon Sep 17 00:00:00 2001
From: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
Date: Sat, 4 Nov 2023 00:13:51 +0530
Subject: [PATCH 0487/1043] spi: spi-zynq-qspi: add spi-mem to driver kconfig
 dependencies

[ Upstream commit c2ded280a4b1b7bd93e53670528504be08d24967 ]

Zynq QSPI driver has been converted to use spi-mem framework so
add spi-mem to driver kconfig dependencies.

Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller")
Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://lore.kernel.org/r/1699037031-702858-1-git-send-email-radhey.shyam.pandey@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 4d98ce7571df..5fd9b515f6f1 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -949,6 +949,7 @@ config SPI_XTENSA_XTFPGA
 config SPI_ZYNQ_QSPI
 	tristate "Xilinx Zynq QSPI controller"
 	depends on ARCH_ZYNQ || COMPILE_TEST
+	depends on SPI_MEM
 	help
 	  This enables support for the Zynq Quad SPI controller
 	  in master mode.

From 9e8e731571e642d48bf298bca1ebb112fd13965a Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 27 May 2023 11:37:29 +0200
Subject: [PATCH 0488/1043] fbdev: imsttfb: Fix error path of imsttfb_probe()

[ Upstream commit 518ecb6a209f6ff678aeadf9f2bf870c0982ca85 ]

Release ressources when init_imstt() returns failure.

Signed-off-by: Helge Deller <deller@gmx.de>
Stable-dep-of: aba6ab57a910 ("fbdev: imsttfb: fix a resource leak in probe")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/imsttfb.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index 1b2fb8ed7623..876ddf05e133 100644
--- a/drivers/video/fbdev/imsttfb.c
+++ b/drivers/video/fbdev/imsttfb.c
@@ -1525,8 +1525,10 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		goto error;
 	info->pseudo_palette = par->palette;
 	ret = init_imstt(info);
-	if (!ret)
-		pci_set_drvdata(pdev, info);
+	if (ret)
+		goto error;
+
+	pci_set_drvdata(pdev, info);
 	return ret;
 
 error:

From a4dfebec32ec6d420a5506dd56a7834c91be28e4 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Fri, 27 Oct 2023 15:05:44 +0300
Subject: [PATCH 0489/1043] fbdev: imsttfb: fix a resource leak in probe

[ Upstream commit aba6ab57a910ad4b940c2024d15f2cdbf5b7f76b ]

I've re-written the error handling but the bug is that if init_imstt()
fails we need to call iounmap(par->cmap_regs).

Fixes: c75f5a550610 ("fbdev: imsttfb: Fix use after free bug in imsttfb_probe")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/imsttfb.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index 876ddf05e133..e559c844436b 100644
--- a/drivers/video/fbdev/imsttfb.c
+++ b/drivers/video/fbdev/imsttfb.c
@@ -1489,8 +1489,8 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 	if (!request_mem_region(addr, size, "imsttfb")) {
 		printk(KERN_ERR "imsttfb: Can't reserve memory region\n");
-		framebuffer_release(info);
-		return -ENODEV;
+		ret = -ENODEV;
+		goto release_info;
 	}
 
 	switch (pdev->device) {
@@ -1507,36 +1507,39 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 			printk(KERN_INFO "imsttfb: Device 0x%x unknown, "
 					 "contact maintainer.\n", pdev->device);
 			ret = -ENODEV;
-			goto error;
+			goto release_mem_region;
 	}
 
 	info->fix.smem_start = addr;
 	info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ?
 					    0x400000 : 0x800000);
 	if (!info->screen_base)
-		goto error;
+		goto release_mem_region;
 	info->fix.mmio_start = addr + 0x800000;
 	par->dc_regs = ioremap(addr + 0x800000, 0x1000);
 	if (!par->dc_regs)
-		goto error;
+		goto unmap_screen_base;
 	par->cmap_regs_phys = addr + 0x840000;
 	par->cmap_regs = (__u8 *)ioremap(addr + 0x840000, 0x1000);
 	if (!par->cmap_regs)
-		goto error;
+		goto unmap_dc_regs;
 	info->pseudo_palette = par->palette;
 	ret = init_imstt(info);
 	if (ret)
-		goto error;
+		goto unmap_cmap_regs;
 
 	pci_set_drvdata(pdev, info);
-	return ret;
+	return 0;
 
-error:
-	if (par->dc_regs)
-		iounmap(par->dc_regs);
-	if (info->screen_base)
-		iounmap(info->screen_base);
+unmap_cmap_regs:
+	iounmap(par->cmap_regs);
+unmap_dc_regs:
+	iounmap(par->dc_regs);
+unmap_screen_base:
+	iounmap(info->screen_base);
+release_mem_region:
 	release_mem_region(addr, size);
+release_info:
 	framebuffer_release(info);
 	return ret;
 }

From 3697fda1c67147b99eb73c26a18fa52d81f9b696 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Wed, 8 Nov 2023 13:58:42 +0100
Subject: [PATCH 0490/1043] fbdev: fsl-diu-fb: mark wr_reg_wa() static

[ Upstream commit a5035c81847430dfa3482807b07325f29e9e8c09 ]

wr_reg_wa() is not an appropriate name for a global function, and doesn't need
to be global anyway, so mark it static and avoid the warning:

drivers/video/fbdev/fsl-diu-fb.c:493:6: error: no previous prototype for 'wr_reg_wa' [-Werror=missing-prototypes]

Fixes: 0d9dab39fbbe ("powerpc/5121: fsl-diu-fb: fix issue with re-enabling DIU area descriptor")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/fsl-diu-fb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/fsl-diu-fb.c b/drivers/video/fbdev/fsl-diu-fb.c
index a547c21c7e92..5d564e8670c5 100644
--- a/drivers/video/fbdev/fsl-diu-fb.c
+++ b/drivers/video/fbdev/fsl-diu-fb.c
@@ -490,7 +490,7 @@ static enum fsl_diu_monitor_port fsl_diu_name_to_port(const char *s)
  * Workaround for failed writing desc register of planes.
  * Needed with MPC5121 DIU rev 2.0 silicon.
  */
-void wr_reg_wa(u32 *reg, u32 val)
+static void wr_reg_wa(u32 *reg, u32 val)
 {
 	do {
 		out_be32(reg, val);

From 3b092dfdabf21c4d580a2077d2a666d6e1e3fbd2 Mon Sep 17 00:00:00 2001
From: Yujie Liu <yujie.liu@intel.com>
Date: Tue, 31 Oct 2023 12:13:05 +0800
Subject: [PATCH 0491/1043] tracing/kprobes: Fix the order of argument
 descriptions

[ Upstream commit f032c53bea6d2057c14553832d846be2f151cfb2 ]

The order of descriptions should be consistent with the argument list of
the function, so "kretprobe" should be the second one.

int __kprobe_event_gen_cmd_start(struct dynevent_cmd *cmd, bool kretprobe,
                                 const char *name, const char *loc, ...)

Link: https://lore.kernel.org/all/20231031041305.3363712-1-yujie.liu@intel.com/

Fixes: 2a588dd1d5d6 ("tracing: Add kprobe event command generation functions")
Suggested-by: Mukesh Ojha <quic_mojha@quicinc.com>
Signed-off-by: Yujie Liu <yujie.liu@intel.com>
Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace_kprobe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 37e1ec1d3ee5..718357289899 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -949,9 +949,9 @@ EXPORT_SYMBOL_GPL(kprobe_event_cmd_init);
 /**
  * __kprobe_event_gen_cmd_start - Generate a kprobe event command from arg list
  * @cmd: A pointer to the dynevent_cmd struct representing the new event
+ * @kretprobe: Is this a return probe?
  * @name: The name of the kprobe event
  * @loc: The location of the kprobe event
- * @kretprobe: Is this a return probe?
  * @...: Variable number of arg (pairs), one pair for each field
  *
  * NOTE: Users normally won't want to call this function directly, but

From 2bbbb976faa1104764ffd0474738b0ee49ce51c2 Mon Sep 17 00:00:00 2001
From: Dominique Martinet <dominique.martinet@atmark-techno.com>
Date: Fri, 3 Nov 2023 09:42:20 +0900
Subject: [PATCH 0492/1043] Revert "mmc: core: Capture correct oemid-bits for
 eMMC cards"

commit 421b605edb1ce611dee06cf6fd9a1c1f2fd85ad0 upstream.

This reverts commit 84ee19bffc9306128cd0f1c650e89767079efeff.

The commit above made quirks with an OEMID fail to be applied, as they
were checking card->cid.oemid for the full 16 bits defined in MMC_FIXUP
macros but the field would only contain the bottom 8 bits.

eMMC v5.1A might have bogus values in OEMID's higher bits so another fix
will be made, but it has been decided to revert this until that is ready.

Fixes: 84ee19bffc93 ("mmc: core: Capture correct oemid-bits for eMMC cards")
Link: https://lkml.kernel.org/r/ZToJsSLHr8RnuTHz@codewreck.org
Link: https://lkml.kernel.org/r/CAPDyKFqkKibcXnwjnhc3+W1iJBHLeqQ9BpcZrSwhW2u9K2oUtg@mail.gmail.com
Signed-off-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
Cc: stable@vger.kernel.org
Cc: Alex Fetters <Alex.Fetters@garmin.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Link: https://lore.kernel.org/r/20231103004220.1666641-1-asmadeus@codewreck.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/mmc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 91c929bd69c0..87807ef010a9 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -95,7 +95,7 @@ static int mmc_decode_cid(struct mmc_card *card)
 	case 3: /* MMC v3.1 - v3.3 */
 	case 4: /* MMC v4 */
 		card->cid.manfid	= UNSTUFF_BITS(resp, 120, 8);
-		card->cid.oemid		= UNSTUFF_BITS(resp, 104, 8);
+		card->cid.oemid		= UNSTUFF_BITS(resp, 104, 16);
 		card->cid.prod_name[0]	= UNSTUFF_BITS(resp, 96, 8);
 		card->cid.prod_name[1]	= UNSTUFF_BITS(resp, 88, 8);
 		card->cid.prod_name[2]	= UNSTUFF_BITS(resp, 80, 8);

From 4be0407ffcf6db5bf520aac6e950e9488c96456b Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Fri, 13 Oct 2023 10:05:48 +0100
Subject: [PATCH 0493/1043] btrfs: use u64 for buffer sizes in the tree search
 ioctls

[ Upstream commit dec96fc2dcb59723e041416b8dc53e011b4bfc2e ]

In the tree search v2 ioctl we use the type size_t, which is an unsigned
long, to track the buffer size in the local variable 'buf_size'. An
unsigned long is 32 bits wide on a 32 bits architecture. The buffer size
defined in struct btrfs_ioctl_search_args_v2 is a u64, so when we later
try to copy the local variable 'buf_size' to the argument struct, when
the search returns -EOVERFLOW, we copy only 32 bits which will be a
problem on big endian systems.

Fix this by using a u64 type for the buffer sizes, not only at
btrfs_ioctl_tree_search_v2(), but also everywhere down the call chain
so that we can use the u64 at btrfs_ioctl_tree_search_v2().

Fixes: cc68a8a5a433 ("btrfs: new ioctl TREE_SEARCH_V2")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/linux-btrfs/ce6f4bd6-9453-4ffe-ba00-cee35495e10f@moroto.mountain/
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/ioctl.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index cffd149faf63..6da8587e2ae3 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2104,7 +2104,7 @@ static noinline int key_in_sk(struct btrfs_key *key,
 static noinline int copy_to_sk(struct btrfs_path *path,
 			       struct btrfs_key *key,
 			       struct btrfs_ioctl_search_key *sk,
-			       size_t *buf_size,
+			       u64 *buf_size,
 			       char __user *ubuf,
 			       unsigned long *sk_offset,
 			       int *num_found)
@@ -2236,7 +2236,7 @@ static noinline int copy_to_sk(struct btrfs_path *path,
 
 static noinline int search_ioctl(struct inode *inode,
 				 struct btrfs_ioctl_search_key *sk,
-				 size_t *buf_size,
+				 u64 *buf_size,
 				 char __user *ubuf)
 {
 	struct btrfs_fs_info *info = btrfs_sb(inode->i_sb);
@@ -2306,7 +2306,7 @@ static noinline int btrfs_ioctl_tree_search(struct file *file,
 	struct btrfs_ioctl_search_key sk;
 	struct inode *inode;
 	int ret;
-	size_t buf_size;
+	u64 buf_size;
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
@@ -2340,8 +2340,8 @@ static noinline int btrfs_ioctl_tree_search_v2(struct file *file,
 	struct btrfs_ioctl_search_args_v2 args;
 	struct inode *inode;
 	int ret;
-	size_t buf_size;
-	const size_t buf_limit = SZ_16M;
+	u64 buf_size;
+	const u64 buf_limit = SZ_16M;
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;

From 6db6caba87efcfbcf57d68b540a1f0a4c0a5539b Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 20 Nov 2023 11:06:57 +0100
Subject: [PATCH 0494/1043] Linux 5.10.201

Link: https://lore.kernel.org/r/20231115204644.490636297@linuxfoundation.org
Tested-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index da4a3de444cf..7ef22771de76 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 200
+SUBLEVEL = 201
 EXTRAVERSION =
 NAME = Dare mighty things
 

From bdc373d18535abbe93d7712b943f63c6def9519f Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Fri, 3 Nov 2023 13:28:27 +0000
Subject: [PATCH 0495/1043] Revert "kasan: print the original fault addr when
 access invalid shadow"

This reverts commit 632c2199e52d0e957dd47d4c931d60b82cd5ff29 which is
commit babddbfb7d7d70ae7f10fedd75a45d8ad75fdddf upstream.

It just flat out breaks the build for KASAN builds, so revert it.  Odd.

Fixes: 1684909df3f4 ("kasan: print the original fault addr when access invalid shadow")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ida71f61b6ea32f2682091407144032928891c83e
---
 include/linux/kasan.h | 6 +++---
 mm/kasan/report.c     | 4 +++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 8681eec1c2ca..99dc14b5ad44 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -456,10 +456,10 @@ static inline void kasan_free_shadow(const struct vm_struct *vm) {}
 
 #endif /* (CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS) && !CONFIG_KASAN_VMALLOC */
 
-#ifdef CONFIG_KASAN
+#ifdef CONFIG_KASAN_INLINE
 void kasan_non_canonical_hook(unsigned long addr);
-#else /* CONFIG_KASAN */
+#else /* CONFIG_KASAN_INLINE */
 static inline void kasan_non_canonical_hook(unsigned long addr) { }
-#endif /* CONFIG_KASAN */
+#endif /* CONFIG_KASAN_INLINE */
 
 #endif /* LINUX_KASAN_H */
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index d60342d18a8a..13bdaaccccb2 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -434,8 +434,9 @@ bool kasan_report(unsigned long addr, size_t size, bool is_write,
 	return ret;
 }
 
+#ifdef CONFIG_KASAN_INLINE
 /*
- * With CONFIG_KASAN, accesses to bogus pointers (outside the high
+ * With CONFIG_KASAN_INLINE, accesses to bogus pointers (outside the high
  * canonical half of the address space) cause out-of-bounds shadow memory reads
  * before the actual access. For addresses in the low canonical half of the
  * address space, as well as most non-canonical addresses, that out-of-bounds
@@ -471,3 +472,4 @@ void kasan_non_canonical_hook(unsigned long addr)
 	pr_alert("KASAN: %s in range [0x%016lx-0x%016lx]\n", bug_type,
 		 orig_addr, orig_addr + KASAN_GRANULE_SIZE - 1);
 }
+#endif

From ef7075076a46936712aab4476f16417ed8e90d07 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sat, 25 Nov 2023 18:15:03 +0000
Subject: [PATCH 0496/1043] ANDROID: fix up platform_device ABI break

In commit da369d3996cc ("driver: platform: Add helper for safer setting
of driver_override"), a pointer was changed to const, which messes with
the CRC and ABI checks.  As the code is fine if this is left as
not-const, just put it back to preserve the abi.

Bug: 161946584
Fixes: da369d3996cc ("driver: platform: Add helper for safer setting of driver_override")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ieb4a730a6a5767d31fbec2f1ba683617f5cda7a9
---
 drivers/base/platform.c         | 2 +-
 include/linux/platform_device.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 647066229fec..e7749a9f061a 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -1048,7 +1048,7 @@ static ssize_t driver_override_store(struct device *dev,
 	struct platform_device *pdev = to_platform_device(dev);
 	int ret;
 
-	ret = driver_set_override(dev, &pdev->driver_override, buf, count);
+	ret = driver_set_override(dev, (const char **)&pdev->driver_override, buf, count);
 	if (ret)
 		return ret;
 
diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
index 43976e8901c4..a829a769296a 100644
--- a/include/linux/platform_device.h
+++ b/include/linux/platform_device.h
@@ -35,7 +35,7 @@ struct platform_device {
 	 * Driver name to force a match.  Do not set directly, because core
 	 * frees it.  Use driver_set_override() to set or clear it.
 	 */
-	const char *driver_override;
+	char *driver_override;
 
 	/* MFD cell pointer */
 	struct mfd_cell *mfd_cell;

From 0f780c28f995fdaf5a7beda3727d99f3e976976e Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sun, 26 Nov 2023 12:55:14 +0000
Subject: [PATCH 0497/1043] ANDROID: fix up rpmsg_device ABI break

In commit 5bbd3469a4b6 ("rpmsg: Fix kfree() of static memory on setting
driver_override") a pointer was changed to const, which messes with the
CRC and ABI checks.  As the code is fine if this is left as not-const,
just put it back to preserve the abi.

Bug: 161946584
Fixes: 5bbd3469a4b6 ("rpmsg: Fix kfree() of static memory on setting driver_override")
Change-Id: I9a87b9cf412191d9872b48f1f876a81df6701de0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/rpmsg/rpmsg_core.c | 2 +-
 include/linux/rpmsg.h      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
index 66d1157c6475..3c6fd032919f 100644
--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -586,7 +586,7 @@ int rpmsg_register_device_override(struct rpmsg_device *rpdev,
 
 	device_initialize(dev);
 	if (driver_override) {
-		ret = driver_set_override(dev, &rpdev->driver_override,
+		ret = driver_set_override(dev, (const char **)&rpdev->driver_override,
 					  driver_override,
 					  strlen(driver_override));
 		if (ret) {
diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h
index 5c2420b6a734..7e2a4f24fda1 100644
--- a/include/linux/rpmsg.h
+++ b/include/linux/rpmsg.h
@@ -53,7 +53,7 @@ struct rpmsg_channel_info {
 struct rpmsg_device {
 	struct device dev;
 	struct rpmsg_device_id id;
-	const char *driver_override;
+	char *driver_override;
 	u32 src;
 	u32 dst;
 	struct rpmsg_endpoint *ept;

From 9ed2d68b3925145f5f51c46559484881d6082f75 Mon Sep 17 00:00:00 2001
From: John Stultz <jstultz@google.com>
Date: Fri, 22 Sep 2023 04:36:00 +0000
Subject: [PATCH 0498/1043] locking/ww_mutex/test: Fix potential workqueue
 corruption

[ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ]

In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.

Often this would cause strange crashes as the mutexes would be
freed while they were being used.

Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.

Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the work
thread returns and while flush_workqueue is waiting.

It seems like a better idea to have the controlling thread
both allocate and free the stress structures, so that we can
be sure we don't corrupt the workqueue by freeing the structure
prematurely.

So this patch reworks the test to do so, and with this change
I no longer see the early flush_workqueue returns.

Signed-off-by: John Stultz <jstultz@google.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/locking/test-ww_mutex.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index 3e82f449b4ff..da36997d8742 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -426,7 +426,6 @@ static void stress_inorder_work(struct work_struct *work)
 	} while (!time_after(jiffies, stress->timeout));
 
 	kfree(order);
-	kfree(stress);
 }
 
 struct reorder_lock {
@@ -491,7 +490,6 @@ static void stress_reorder_work(struct work_struct *work)
 	list_for_each_entry_safe(ll, ln, &locks, link)
 		kfree(ll);
 	kfree(order);
-	kfree(stress);
 }
 
 static void stress_one_work(struct work_struct *work)
@@ -512,8 +510,6 @@ static void stress_one_work(struct work_struct *work)
 			break;
 		}
 	} while (!time_after(jiffies, stress->timeout));
-
-	kfree(stress);
 }
 
 #define STRESS_INORDER BIT(0)
@@ -524,15 +520,24 @@ static void stress_one_work(struct work_struct *work)
 static int stress(int nlocks, int nthreads, unsigned int flags)
 {
 	struct ww_mutex *locks;
-	int n;
+	struct stress *stress_array;
+	int n, count;
 
 	locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL);
 	if (!locks)
 		return -ENOMEM;
 
+	stress_array = kmalloc_array(nthreads, sizeof(*stress_array),
+				     GFP_KERNEL);
+	if (!stress_array) {
+		kfree(locks);
+		return -ENOMEM;
+	}
+
 	for (n = 0; n < nlocks; n++)
 		ww_mutex_init(&locks[n], &ww_class);
 
+	count = 0;
 	for (n = 0; nthreads; n++) {
 		struct stress *stress;
 		void (*fn)(struct work_struct *work);
@@ -556,9 +561,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
 		if (!fn)
 			continue;
 
-		stress = kmalloc(sizeof(*stress), GFP_KERNEL);
-		if (!stress)
-			break;
+		stress = &stress_array[count++];
 
 		INIT_WORK(&stress->work, fn);
 		stress->locks = locks;
@@ -573,6 +576,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)
 
 	for (n = 0; n < nlocks; n++)
 		ww_mutex_destroy(&locks[n]);
+	kfree(stress_array);
 	kfree(locks);
 
 	return 0;

From 1a2a4202c60fcdffbf04f259002ce9bff39edece Mon Sep 17 00:00:00 2001
From: Shuai Xue <xueshuai@linux.alibaba.com>
Date: Thu, 7 Sep 2023 08:43:07 +0800
Subject: [PATCH 0499/1043] perf/core: Bail out early if the request AUX area
 is out of bound

[ Upstream commit 54aee5f15b83437f23b2b2469bcf21bdd9823916 ]

When perf-record with a large AUX area, e.g 4GB, it fails with:

    #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
    failed to mmap with 12 (Cannot allocate memory)

and it reveals a WARNING with __alloc_pages():

	------------[ cut here ]------------
	WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
	Call trace:
	 __alloc_pages+0x1ec/0x248
	 __kmalloc_large_node+0xc0/0x1f8
	 __kmalloc_node+0x134/0x1e8
	 rb_alloc_aux+0xe0/0x298
	 perf_mmap+0x440/0x660
	 mmap_region+0x308/0x8a8
	 do_mmap+0x3c0/0x528
	 vm_mmap_pgoff+0xf4/0x1b8
	 ksys_mmap_pgoff+0x18c/0x218
	 __arm64_sys_mmap+0x38/0x58
	 invoke_syscall+0x50/0x128
	 el0_svc_common.constprop.0+0x58/0x188
	 do_el0_svc+0x34/0x50
	 el0_svc+0x34/0x108
	 el0t_64_sync_handler+0xb8/0xc0
	 el0t_64_sync+0x1a4/0x1a8

'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to
maintains AUX trace pages. The allocated page for this array is physically
contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the
size of pointer array crosses the limitation set by MAX_ORDER, it reveals a
WARNING.

So bail out early with -ENOMEM if the request AUX area is out of bound,
e.g.:

    #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
    failed to mmap with 12 (Cannot allocate memory)

Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/ring_buffer.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 4032cd475000..01351e7e2543 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -691,6 +691,12 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,
 		max_order--;
 	}
 
+	/*
+	 * kcalloc_node() is unable to allocate buffer if the size is larger
+	 * than: PAGE_SIZE << MAX_ORDER; directly bail out in this case.
+	 */
+	if (get_order((unsigned long)nr_pages * sizeof(void *)) > MAX_ORDER)
+		return -ENOMEM;
 	rb->aux_pages = kcalloc_node(nr_pages, sizeof(void *), GFP_KERNEL,
 				     node);
 	if (!rb->aux_pages)

From 1b8687ed3cf3d44c14fa6a51f1c070a859faeab4 Mon Sep 17 00:00:00 2001
From: Jacky Bai <ping.bai@nxp.com>
Date: Mon, 9 Oct 2023 16:39:22 +0800
Subject: [PATCH 0500/1043] clocksource/drivers/timer-imx-gpt: Fix potential
 memory leak

[ Upstream commit 8051a993ce222a5158bccc6ac22ace9253dd71cb ]

Fix coverity Issue CID 250382:  Resource leak (RESOURCE_LEAK).
Add kfree when error return.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20231009083922.1942971-1-ping.bai@nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-imx-gpt.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/clocksource/timer-imx-gpt.c b/drivers/clocksource/timer-imx-gpt.c
index 7b2c70f2f353..fabff69e52e5 100644
--- a/drivers/clocksource/timer-imx-gpt.c
+++ b/drivers/clocksource/timer-imx-gpt.c
@@ -454,12 +454,16 @@ static int __init mxc_timer_init_dt(struct device_node *np,  enum imx_gpt_type t
 		return -ENOMEM;
 
 	imxtm->base = of_iomap(np, 0);
-	if (!imxtm->base)
-		return -ENXIO;
+	if (!imxtm->base) {
+		ret = -ENXIO;
+		goto err_kfree;
+	}
 
 	imxtm->irq = irq_of_parse_and_map(np, 0);
-	if (imxtm->irq <= 0)
-		return -EINVAL;
+	if (imxtm->irq <= 0) {
+		ret = -EINVAL;
+		goto err_kfree;
+	}
 
 	imxtm->clk_ipg = of_clk_get_by_name(np, "ipg");
 
@@ -472,11 +476,15 @@ static int __init mxc_timer_init_dt(struct device_node *np,  enum imx_gpt_type t
 
 	ret = _mxc_timer_init(imxtm);
 	if (ret)
-		return ret;
+		goto err_kfree;
 
 	initialized = 1;
 
 	return 0;
+
+err_kfree:
+	kfree(imxtm);
+	return ret;
 }
 
 static int __init imx1_timer_init_dt(struct device_node *np)

From 89356bee8edae240c63446b9f4d6b42f522c292f Mon Sep 17 00:00:00 2001
From: Ronald Wahl <ronald.wahl@raritan.com>
Date: Sat, 7 Oct 2023 18:17:13 +0200
Subject: [PATCH 0501/1043] clocksource/drivers/timer-atmel-tcb: Fix
 initialization on SAM9 hardware

[ Upstream commit 6d3bc4c02d59996d1d3180d8ed409a9d7d5900e0 ]

On SAM9 hardware two cascaded 16 bit timers are used to form a 32 bit
high resolution timer that is used as scheduler clock when the kernel
has been configured that way (CONFIG_ATMEL_CLOCKSOURCE_TCB).

The driver initially triggers a reset-to-zero of the two timers but this
reset is only performed on the next rising clock. For the first timer
this is ok - it will be in the next 60ns (16MHz clock). For the chained
second timer this will only happen after the first timer overflows, i.e.
after 2^16 clocks (~4ms with a 16MHz clock). So with other words the
scheduler clock resets to 0 after the first 2^16 clock cycles.

It looks like that the scheduler does not like this and behaves wrongly
over its lifetime, e.g. some tasks are scheduled with a long delay. Why
that is and if there are additional requirements for this behaviour has
not been further analysed.

There is a simple fix for resetting the second timer as well when the
first timer is reset and this is to set the ATMEL_TC_ASWTRG_SET bit in
the Channel Mode register (CMR) of the first timer. This will also rise
the TIOA line (clock input of the second timer) when a software trigger
respective SYNC is issued.

Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20231007161803.31342-1-rwahl@gmx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/timer-atmel-tcb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clocksource/timer-atmel-tcb.c b/drivers/clocksource/timer-atmel-tcb.c
index 787dbebbb432..5ea1efd87f58 100644
--- a/drivers/clocksource/timer-atmel-tcb.c
+++ b/drivers/clocksource/timer-atmel-tcb.c
@@ -315,6 +315,7 @@ static void __init tcb_setup_dual_chan(struct atmel_tc *tc, int mck_divisor_idx)
 	writel(mck_divisor_idx			/* likely divide-by-8 */
 			| ATMEL_TC_WAVE
 			| ATMEL_TC_WAVESEL_UP		/* free-run */
+			| ATMEL_TC_ASWTRG_SET		/* TIOA0 rises at software trigger */
 			| ATMEL_TC_ACPA_SET		/* TIOA0 rises at 0 */
 			| ATMEL_TC_ACPC_CLEAR,		/* (duty cycle 50%) */
 			tcaddr + ATMEL_TC_REG(0, CMR));

From a7aa2f1ca85564a1a1f15da6d7438036694ced45 Mon Sep 17 00:00:00 2001
From: "Mike Rapoport (IBM)" <rppt@kernel.org>
Date: Wed, 18 Oct 2023 12:42:50 +0200
Subject: [PATCH 0502/1043] x86/mm: Drop the 4 MB restriction on minimal NUMA
 node memory size

[ Upstream commit a1e2b8b36820d8c91275f207e77e91645b7c6836 ]

Qi Zheng reported crashes in a production environment and provided a
simplified example as a reproducer:

 |  For example, if we use Qemu to start a two NUMA node kernel,
 |  one of the nodes has 2M memory (less than NODE_MIN_SIZE),
 |  and the other node has 2G, then we will encounter the
 |  following panic:
 |
 |    BUG: kernel NULL pointer dereference, address: 0000000000000000
 |    <...>
 |    RIP: 0010:_raw_spin_lock_irqsave+0x22/0x40
 |    <...>
 |    Call Trace:
 |      <TASK>
 |      deactivate_slab()
 |      bootstrap()
 |      kmem_cache_init()
 |      start_kernel()
 |      secondary_startup_64_no_verify()

The crashes happen because of inconsistency between the nodemask that
has nodes with less than 4MB as memoryless, and the actual memory fed
into the core mm.

The commit:

  9391a3f9c7f1 ("[PATCH] x86_64: Clear more state when ignoring empty node in SRAT parsing")

... that introduced minimal size of a NUMA node does not explain why
a node size cannot be less than 4MB and what boot failures this
restriction might fix.

Fixes have been submitted to the core MM code to tighten up the
memory topologies it accepts and to not crash on weird input:

  mm: page_alloc: skip memoryless nodes entirely
  mm: memory_hotplug: drop memoryless node from fallback lists

Andrew has accepted them into the -mm tree, but there are no
stable SHA1's yet.

This patch drops the limitation for minimal node size on x86:

  - which works around the crash without the fixes to the core MM.
  - makes x86 topologies less weird,
  - removes an arbitrary and undocumented limitation on NUMA topologies.

[ mingo: Improved changelog clarity. ]

Reported-by: Qi Zheng <zhengqi.arch@bytedance.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Rik van Riel <riel@surriel.com>
Link: https://lore.kernel.org/r/ZS+2qqjEO5/867br@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/numa.h | 7 -------
 arch/x86/mm/numa.c          | 7 -------
 2 files changed, 14 deletions(-)

diff --git a/arch/x86/include/asm/numa.h b/arch/x86/include/asm/numa.h
index e3bae2b60a0d..ef2844d69173 100644
--- a/arch/x86/include/asm/numa.h
+++ b/arch/x86/include/asm/numa.h
@@ -12,13 +12,6 @@
 
 #define NR_NODE_MEMBLKS		(MAX_NUMNODES*2)
 
-/*
- * Too small node sizes may confuse the VM badly. Usually they
- * result from BIOS bugs. So dont recognize nodes as standalone
- * NUMA entities that have less than this amount of RAM listed:
- */
-#define NODE_MIN_SIZE (4*1024*1024)
-
 extern int numa_off;
 
 /*
diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
index 9dc31996c7ed..62a119170376 100644
--- a/arch/x86/mm/numa.c
+++ b/arch/x86/mm/numa.c
@@ -602,13 +602,6 @@ static int __init numa_register_memblks(struct numa_meminfo *mi)
 		if (start >= end)
 			continue;
 
-		/*
-		 * Don't confuse VM with a node that doesn't have the
-		 * minimum amount of memory:
-		 */
-		if (end && (end - start) < NODE_MIN_SIZE)
-			continue;
-
 		alloc_node_data(nid);
 	}
 

From cdfc689e10e63b92b4020f1f961ab15c9811d8d6 Mon Sep 17 00:00:00 2001
From: Dmitry Antipov <dmantipov@yandex.ru>
Date: Tue, 29 Aug 2023 12:41:01 +0300
Subject: [PATCH 0503/1043] wifi: mac80211_hwsim: fix clang-specific fortify
 warning

[ Upstream commit cbaccdc42483c65016f1bae89128c08dc17cfb2a ]

When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've
noticed the following (somewhat confusing due to absence of an actual
source code location):

In file included from drivers/net/wireless/virtual/mac80211_hwsim.c:18:
In file included from ./include/linux/slab.h:16:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:56:
In file included from ./include/linux/preempt.h:79:
In file included from ./arch/x86/include/asm/preempt.h:9:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:
./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field'
declared with 'warning' attribute: detected read beyond size of field (2nd
parameter); maybe use struct_group()? [-Wattribute-warning]
                        __read_overflow2_field(q_size_field, size);

The compiler actually complains on 'mac80211_hwsim_get_et_strings()' where
fortification logic inteprets call to 'memcpy()' as an attempt to copy the
whole 'mac80211_hwsim_gstrings_stats' array from its first member and so
issues an overread warning. This warning may be silenced by passing
an address of the whole array and not the first member to 'memcpy()'.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://lore.kernel.org/r/20230829094140.234636-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mac80211_hwsim.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 0d41f172a1dc..037358606a51 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2543,7 +2543,7 @@ static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw,
 					  u32 sset, u8 *data)
 {
 	if (sset == ETH_SS_STATS)
-		memcpy(data, *mac80211_hwsim_gstrings_stats,
+		memcpy(data, mac80211_hwsim_gstrings_stats,
 		       sizeof(mac80211_hwsim_gstrings_stats));
 }
 

From 717de20abdcd1d4993fa450e28b8086a352620ea Mon Sep 17 00:00:00 2001
From: Ping-Ke Shih <pkshih@realtek.com>
Date: Fri, 3 Feb 2023 10:36:36 +0800
Subject: [PATCH 0504/1043] wifi: mac80211: don't return unset power in
 ieee80211_get_tx_power()

[ Upstream commit e160ab85166e77347d0cbe5149045cb25e83937f ]

We can get a UBSAN warning if ieee80211_get_tx_power() returns the
INT_MIN value mac80211 internally uses for "unset power level".

 UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5
 -2147483648 * 100 cannot be represented in type 'int'
 CPU: 0 PID: 20433 Comm: insmod Tainted: G        WC OE
 Call Trace:
  dump_stack+0x74/0x92
  ubsan_epilogue+0x9/0x50
  handle_overflow+0x8d/0xd0
  __ubsan_handle_mul_overflow+0xe/0x10
  nl80211_send_iface+0x688/0x6b0 [cfg80211]
  [...]
  cfg80211_register_wdev+0x78/0xb0 [cfg80211]
  cfg80211_netdev_notifier_call+0x200/0x620 [cfg80211]
  [...]
  ieee80211_if_add+0x60e/0x8f0 [mac80211]
  ieee80211_register_hw+0xda5/0x1170 [mac80211]

In this case, simply return an error instead, to indicate
that no data is available.

Cc: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://lore.kernel.org/r/20230203023636.4418-1-pkshih@realtek.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/cfg.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index c6a7f1c99abc..45bb6f275598 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2726,6 +2726,10 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy,
 	else
 		*dbm = sdata->vif.bss_conf.txpower;
 
+	/* INT_MIN indicates no power level was set yet */
+	if (*dbm == INT_MIN)
+		return -EINVAL;
+
 	return 0;
 }
 

From 6058e4829696412457729a00734969acc6fd1d18 Mon Sep 17 00:00:00 2001
From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Date: Wed, 13 Sep 2023 01:32:08 +0200
Subject: [PATCH 0505/1043] bpf: Detect IP == ksym.end as part of BPF program

[ Upstream commit 66d9111f3517f85ef2af0337ece02683ce0faf21 ]

Now that bpf_throw kfunc is the first such call instruction that has
noreturn semantics within the verifier, this also kicks in dead code
elimination in unprecedented ways. For one, any instruction following
a bpf_throw call will never be marked as seen. Moreover, if a callchain
ends up throwing, any instructions after the call instruction to the
eventually throwing subprog in callers will also never be marked as
seen.

The tempting way to fix this would be to emit extra 'int3' instructions
which bump the jited_len of a program, and ensure that during runtime
when a program throws, we can discover its boundaries even if the call
instruction to bpf_throw (or to subprogs that always throw) is emitted
as the final instruction in the program.

An example of such a program would be this:

do_something():
	...
	r0 = 0
	exit

foo():
	r1 = 0
	call bpf_throw
	r0 = 0
	exit

bar(cond):
	if r1 != 0 goto pc+2
	call do_something
	exit
	call foo
	r0 = 0  // Never seen by verifier
	exit	//

main(ctx):
	r1 = ...
	call bar
	r0 = 0
	exit

Here, if we do end up throwing, the stacktrace would be the following:

bpf_throw
foo
bar
main

In bar, the final instruction emitted will be the call to foo, as such,
the return address will be the subsequent instruction (which the JIT
emits as int3 on x86). This will end up lying outside the jited_len of
the program, thus, when unwinding, we will fail to discover the return
address as belonging to any program and end up in a panic due to the
unreliable stack unwinding of BPF programs that we never expect.

To remedy this case, make bpf_prog_ksym_find treat IP == ksym.end as
part of the BPF program, so that is_bpf_text_address returns true when
such a case occurs, and we are able to unwind reliably when the final
instruction ends up being a call instruction.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20230912233214.1518551-12-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index d3f6a070875c..33ea6ab12f47 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -602,7 +602,11 @@ static __always_inline int bpf_tree_comp(void *key, struct latch_tree_node *n)
 
 	if (val < ksym->start)
 		return -1;
-	if (val >= ksym->end)
+	/* Ensure that we detect return addresses as part of the program, when
+	 * the final instruction is a call for a program part of the stack
+	 * trace. Therefore, do val > ksym->end instead of val >= ksym->end.
+	 */
+	if (val > ksym->end)
 		return  1;
 
 	return 0;

From 2d6303cafb7cfcc1a072478316e03fe433634304 Mon Sep 17 00:00:00 2001
From: Dmitry Antipov <dmantipov@yandex.ru>
Date: Tue, 29 Aug 2023 12:38:12 +0300
Subject: [PATCH 0506/1043] wifi: ath9k: fix clang-specific fortify warnings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 95f97fe0ac974467ab4da215985a32b2fdf48af0 ]

When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've
noticed the following (somewhat confusing due to absence of an actual
source code location):

In file included from drivers/net/wireless/ath/ath9k/debug.c:17:
In file included from ./include/linux/slab.h:16:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:56:
In file included from ./include/linux/preempt.h:79:
In file included from ./arch/x86/include/asm/preempt.h:9:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:
./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field'
declared with 'warning' attribute: detected read beyond size of field (2nd
parameter); maybe use struct_group()? [-Wattribute-warning]
                        __read_overflow2_field(q_size_field, size);

In file included from drivers/net/wireless/ath/ath9k/htc_drv_debug.c:17:
In file included from drivers/net/wireless/ath/ath9k/htc.h:20:
In file included from ./include/linux/module.h:13:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/x86/include/asm/timex.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:
./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field'
declared with 'warning' attribute: detected read beyond size of field (2nd
parameter); maybe use struct_group()? [-Wattribute-warning]
                        __read_overflow2_field(q_size_field, size);

The compiler actually complains on 'ath9k_get_et_strings()' and
'ath9k_htc_get_et_strings()' due to the same reason: fortification logic
inteprets call to 'memcpy()' as an attempt to copy the whole array from
it's first member and so issues an overread warning. These warnings may
be silenced by passing an address of the whole array and not the first
member to 'memcpy()'.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230829093856.234584-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/debug.c         | 2 +-
 drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 859a865c5995..8d98347e0ddf 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -1284,7 +1284,7 @@ void ath9k_get_et_strings(struct ieee80211_hw *hw,
 			  u32 sset, u8 *data)
 {
 	if (sset == ETH_SS_STATS)
-		memcpy(data, *ath9k_gstrings_stats,
+		memcpy(data, ath9k_gstrings_stats,
 		       sizeof(ath9k_gstrings_stats));
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
index c55aab01fff5..e79bbcd3279a 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -428,7 +428,7 @@ void ath9k_htc_get_et_strings(struct ieee80211_hw *hw,
 			      u32 sset, u8 *data)
 {
 	if (sset == ETH_SS_STATS)
-		memcpy(data, *ath9k_htc_gstrings_stats,
+		memcpy(data, ath9k_htc_gstrings_stats,
 		       sizeof(ath9k_htc_gstrings_stats));
 }
 

From beb75dccba9d1d46ec632d6d90fc737df93b9b74 Mon Sep 17 00:00:00 2001
From: Dmitry Antipov <dmantipov@yandex.ru>
Date: Tue, 29 Aug 2023 12:36:02 +0300
Subject: [PATCH 0507/1043] wifi: ath10k: fix clang-specific fortify warning

[ Upstream commit cb4c132ebfeac5962f7258ffc831caa0c4dada1a ]

When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've
noticed the following (somewhat confusing due to absence of an actual
source code location):

In file included from drivers/net/wireless/ath/ath10k/debug.c:8:
In file included from ./include/linux/module.h:13:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/x86/include/asm/timex.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:
./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field'
declared with 'warning' attribute: detected read beyond size of field (2nd
parameter); maybe use struct_group()? [-Wattribute-warning]
                        __read_overflow2_field(q_size_field, size);

The compiler actually complains on 'ath10k_debug_get_et_strings()' where
fortification logic inteprets call to 'memcpy()' as an attempt to copy
the whole 'ath10k_gstrings_stats' array from it's first member and so
issues an overread warning. This warning may be silenced by passing
an address of the whole array and not the first member to 'memcpy()'.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230829093652.234537-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/debug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index e8250a665433..ab737177a86b 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -1139,7 +1139,7 @@ void ath10k_debug_get_et_strings(struct ieee80211_hw *hw,
 				 u32 sset, u8 *data)
 {
 	if (sset == ETH_SS_STATS)
-		memcpy(data, *ath10k_gstrings_stats,
+		memcpy(data, ath10k_gstrings_stats,
 		       sizeof(ath10k_gstrings_stats));
 }
 

From 67b7de95d1e3c9dd31a49cc3a968c497f5d7829a Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 21 Sep 2023 20:28:17 +0000
Subject: [PATCH 0508/1043] net: annotate data-races around
 sk->sk_tx_queue_mapping

[ Upstream commit 0bb4d124d34044179b42a769a0c76f389ae973b6 ]

This field can be read or written without socket lock being held.

Add annotations to avoid load-store tearing.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/sock.h | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/include/net/sock.h b/include/net/sock.h
index 234196d90423..9d5e603a10f5 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1853,21 +1853,33 @@ static inline void sk_tx_queue_set(struct sock *sk, int tx_queue)
 	/* sk_tx_queue_mapping accept only upto a 16-bit value */
 	if (WARN_ON_ONCE((unsigned short)tx_queue >= USHRT_MAX))
 		return;
-	sk->sk_tx_queue_mapping = tx_queue;
+	/* Paired with READ_ONCE() in sk_tx_queue_get() and
+	 * other WRITE_ONCE() because socket lock might be not held.
+	 */
+	WRITE_ONCE(sk->sk_tx_queue_mapping, tx_queue);
 }
 
 #define NO_QUEUE_MAPPING	USHRT_MAX
 
 static inline void sk_tx_queue_clear(struct sock *sk)
 {
-	sk->sk_tx_queue_mapping = NO_QUEUE_MAPPING;
+	/* Paired with READ_ONCE() in sk_tx_queue_get() and
+	 * other WRITE_ONCE() because socket lock might be not held.
+	 */
+	WRITE_ONCE(sk->sk_tx_queue_mapping, NO_QUEUE_MAPPING);
 }
 
 static inline int sk_tx_queue_get(const struct sock *sk)
 {
-	if (sk && sk->sk_tx_queue_mapping != NO_QUEUE_MAPPING)
-		return sk->sk_tx_queue_mapping;
+	if (sk) {
+		/* Paired with WRITE_ONCE() in sk_tx_queue_clear()
+		 * and sk_tx_queue_set().
+		 */
+		int val = READ_ONCE(sk->sk_tx_queue_mapping);
 
+		if (val != NO_QUEUE_MAPPING)
+			return val;
+	}
 	return -1;
 }
 

From 22fa35ded3ec67add6db4abeeadf0b8d800816d9 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 21 Sep 2023 20:28:18 +0000
Subject: [PATCH 0509/1043] net: annotate data-races around
 sk->sk_dst_pending_confirm

[ Upstream commit eb44ad4e635132754bfbcb18103f1dcb7058aedd ]

This field can be read or written without socket lock being held.

Add annotations to avoid load-store tearing.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/sock.h    | 6 +++---
 net/core/sock.c       | 2 +-
 net/ipv4/tcp_output.c | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/net/sock.h b/include/net/sock.h
index 9d5e603a10f5..87ee284ea9cb 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2013,7 +2013,7 @@ static inline void __dst_negative_advice(struct sock *sk)
 		if (ndst != dst) {
 			rcu_assign_pointer(sk->sk_dst_cache, ndst);
 			sk_tx_queue_clear(sk);
-			sk->sk_dst_pending_confirm = 0;
+			WRITE_ONCE(sk->sk_dst_pending_confirm, 0);
 		}
 	}
 }
@@ -2030,7 +2030,7 @@ __sk_dst_set(struct sock *sk, struct dst_entry *dst)
 	struct dst_entry *old_dst;
 
 	sk_tx_queue_clear(sk);
-	sk->sk_dst_pending_confirm = 0;
+	WRITE_ONCE(sk->sk_dst_pending_confirm, 0);
 	old_dst = rcu_dereference_protected(sk->sk_dst_cache,
 					    lockdep_sock_is_held(sk));
 	rcu_assign_pointer(sk->sk_dst_cache, dst);
@@ -2043,7 +2043,7 @@ sk_dst_set(struct sock *sk, struct dst_entry *dst)
 	struct dst_entry *old_dst;
 
 	sk_tx_queue_clear(sk);
-	sk->sk_dst_pending_confirm = 0;
+	WRITE_ONCE(sk->sk_dst_pending_confirm, 0);
 	old_dst = xchg((__force struct dst_entry **)&sk->sk_dst_cache, dst);
 	dst_release(old_dst);
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index fcb998dc2dc6..a069b5476df4 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -532,7 +532,7 @@ struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie)
 
 	if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
 		sk_tx_queue_clear(sk);
-		sk->sk_dst_pending_confirm = 0;
+		WRITE_ONCE(sk->sk_dst_pending_confirm, 0);
 		RCU_INIT_POINTER(sk->sk_dst_cache, NULL);
 		dst_release(dst);
 		return NULL;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 4df287885dd7..f8ad8465f76c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1320,7 +1320,7 @@ static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb,
 	skb_set_hash_from_sk(skb, sk);
 	refcount_add(skb->truesize, &sk->sk_wmem_alloc);
 
-	skb_set_dst_pending_confirm(skb, sk->sk_dst_pending_confirm);
+	skb_set_dst_pending_confirm(skb, READ_ONCE(sk->sk_dst_pending_confirm));
 
 	/* Build TCP header and checksum it. */
 	th = (struct tcphdr *)skb->data;

From bba97f5e8ff341f51de55e1612b7dbf966edc38c Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Sat, 30 Sep 2023 07:54:48 +0300
Subject: [PATCH 0510/1043] wifi: ath10k: Don't touch the CE interrupt
 registers after power up

[ Upstream commit 170c75d43a77dc937c58f07ecf847ba1b42ab74e ]

As talked about in commit d66d24ac300c ("ath10k: Keep track of which
interrupts fired, don't poll them"), if we access the copy engine
register at a bad time then ath10k can go boom. However, it's not
necessarily easy to know when it's safe to access them.

The ChromeOS test labs saw a crash that looked like this at
shutdown/reboot time (on a chromeos-5.15 kernel, but likely the
problem could also reproduce upstream):

Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP
...
CPU: 4 PID: 6168 Comm: reboot Not tainted 5.15.111-lockdep-19350-g1d624fe6758f #1 010b9b233ab055c27c6dc88efb0be2f4e9e86f51
Hardware name: Google Kingoftown (DT)
...
pc : ath10k_snoc_read32+0x50/0x74 [ath10k_snoc]
lr : ath10k_snoc_read32+0x24/0x74 [ath10k_snoc]
...
Call trace:
ath10k_snoc_read32+0x50/0x74 [ath10k_snoc ...]
ath10k_ce_disable_interrupt+0x190/0x65c [ath10k_core ...]
ath10k_ce_disable_interrupts+0x8c/0x120 [ath10k_core ...]
ath10k_snoc_hif_stop+0x78/0x660 [ath10k_snoc ...]
ath10k_core_stop+0x13c/0x1ec [ath10k_core ...]
ath10k_halt+0x398/0x5b0 [ath10k_core ...]
ath10k_stop+0xfc/0x1a8 [ath10k_core ...]
drv_stop+0x148/0x6b4 [mac80211 ...]
ieee80211_stop_device+0x70/0x80 [mac80211 ...]
ieee80211_do_stop+0x10d8/0x15b0 [mac80211 ...]
ieee80211_stop+0x144/0x1a0 [mac80211 ...]
__dev_close_many+0x1e8/0x2c0
dev_close_many+0x198/0x33c
dev_close+0x140/0x210
cfg80211_shutdown_all_interfaces+0xc8/0x1e0 [cfg80211 ...]
ieee80211_remove_interfaces+0x118/0x5c4 [mac80211 ...]
ieee80211_unregister_hw+0x64/0x1f4 [mac80211 ...]
ath10k_mac_unregister+0x4c/0xf0 [ath10k_core ...]
ath10k_core_unregister+0x80/0xb0 [ath10k_core ...]
ath10k_snoc_free_resources+0xb8/0x1ec [ath10k_snoc ...]
ath10k_snoc_shutdown+0x98/0xd0 [ath10k_snoc ...]
platform_shutdown+0x7c/0xa0
device_shutdown+0x3e0/0x58c
kernel_restart_prepare+0x68/0xa0
kernel_restart+0x28/0x7c

Though there's no known way to reproduce the problem, it makes sense
that it would be the same issue where we're trying to access copy
engine registers when it's not allowed.

Let's fix this by changing how we "disable" the interrupts. Instead of
tweaking the copy engine registers we'll just use disable_irq() and
enable_irq(). Then we'll configure the interrupts once at power up
time.

Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2.c10-00754-QCAHLSWMTPL-1

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230630151842.1.If764ede23c4e09a43a842771c2ddf99608f25f8e@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/snoc.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c
index 4870a3dab0de..f7ee1032b172 100644
--- a/drivers/net/wireless/ath/ath10k/snoc.c
+++ b/drivers/net/wireless/ath/ath10k/snoc.c
@@ -827,12 +827,20 @@ static void ath10k_snoc_hif_get_default_pipe(struct ath10k *ar,
 
 static inline void ath10k_snoc_irq_disable(struct ath10k *ar)
 {
-	ath10k_ce_disable_interrupts(ar);
+	struct ath10k_snoc *ar_snoc = ath10k_snoc_priv(ar);
+	int id;
+
+	for (id = 0; id < CE_COUNT_MAX; id++)
+		disable_irq(ar_snoc->ce_irqs[id].irq_line);
 }
 
 static inline void ath10k_snoc_irq_enable(struct ath10k *ar)
 {
-	ath10k_ce_enable_interrupts(ar);
+	struct ath10k_snoc *ar_snoc = ath10k_snoc_priv(ar);
+	int id;
+
+	for (id = 0; id < CE_COUNT_MAX; id++)
+		enable_irq(ar_snoc->ce_irqs[id].irq_line);
 }
 
 static void ath10k_snoc_rx_pipe_cleanup(struct ath10k_snoc_pipe *snoc_pipe)
@@ -1048,6 +1056,8 @@ static int ath10k_snoc_hif_power_up(struct ath10k *ar,
 		goto err_free_rri;
 	}
 
+	ath10k_ce_enable_interrupts(ar);
+
 	return 0;
 
 err_free_rri:
@@ -1209,8 +1219,8 @@ static int ath10k_snoc_request_irq(struct ath10k *ar)
 
 	for (id = 0; id < CE_COUNT_MAX; id++) {
 		ret = request_irq(ar_snoc->ce_irqs[id].irq_line,
-				  ath10k_snoc_per_engine_handler, 0,
-				  ce_name[id], ar);
+				  ath10k_snoc_per_engine_handler,
+				  IRQF_NO_AUTOEN, ce_name[id], ar);
 		if (ret) {
 			ath10k_err(ar,
 				   "failed to register IRQ handler for CE %d: %d\n",

From 9f8e4d1a4ca1179aaeb43f91f3e2a386e7e616b3 Mon Sep 17 00:00:00 2001
From: youwan Wang <wangyouwan@126.com>
Date: Wed, 11 Oct 2023 13:14:47 +0800
Subject: [PATCH 0511/1043] Bluetooth: btusb: Add date->evt_skb is NULL check

[ Upstream commit 624820f7c8826dd010e8b1963303c145f99816e9 ]

fix crash because of null pointers

[ 6104.969662] BUG: kernel NULL pointer dereference, address: 00000000000000c8
[ 6104.969667] #PF: supervisor read access in kernel mode
[ 6104.969668] #PF: error_code(0x0000) - not-present page
[ 6104.969670] PGD 0 P4D 0
[ 6104.969673] Oops: 0000 [#1] SMP NOPTI
[ 6104.969684] RIP: 0010:btusb_mtk_hci_wmt_sync+0x144/0x220 [btusb]
[ 6104.969688] RSP: 0018:ffffb8d681533d48 EFLAGS: 00010246
[ 6104.969689] RAX: 0000000000000000 RBX: ffff8ad560bb2000 RCX: 0000000000000006
[ 6104.969691] RDX: 0000000000000000 RSI: ffffb8d681533d08 RDI: 0000000000000000
[ 6104.969692] RBP: ffffb8d681533d70 R08: 0000000000000001 R09: 0000000000000001
[ 6104.969694] R10: 0000000000000001 R11: 00000000fa83b2da R12: ffff8ad461d1d7c0
[ 6104.969695] R13: 0000000000000000 R14: ffff8ad459618c18 R15: ffffb8d681533d90
[ 6104.969697] FS:  00007f5a1cab9d40(0000) GS:ffff8ad578200000(0000) knlGS:00000
[ 6104.969699] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6104.969700] CR2: 00000000000000c8 CR3: 000000018620c001 CR4: 0000000000760ef0
[ 6104.969701] PKRU: 55555554
[ 6104.969702] Call Trace:
[ 6104.969708]  btusb_mtk_shutdown+0x44/0x80 [btusb]
[ 6104.969732]  hci_dev_do_close+0x470/0x5c0 [bluetooth]
[ 6104.969748]  hci_rfkill_set_block+0x56/0xa0 [bluetooth]
[ 6104.969753]  rfkill_set_block+0x92/0x160
[ 6104.969755]  rfkill_fop_write+0x136/0x1e0
[ 6104.969759]  __vfs_write+0x18/0x40
[ 6104.969761]  vfs_write+0xdf/0x1c0
[ 6104.969763]  ksys_write+0xb1/0xe0
[ 6104.969765]  __x64_sys_write+0x1a/0x20
[ 6104.969769]  do_syscall_64+0x51/0x180
[ 6104.969771]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 6104.969773] RIP: 0033:0x7f5a21f18fef
[ 6104.9] RSP: 002b:00007ffeefe39010 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
[ 6104.969780] RAX: ffffffffffffffda RBX: 000055c10a7560a0 RCX: 00007f5a21f18fef
[ 6104.969781] RDX: 0000000000000008 RSI: 00007ffeefe39060 RDI: 0000000000000012
[ 6104.969782] RBP: 00007ffeefe39060 R08: 0000000000000000 R09: 0000000000000017
[ 6104.969784] R10: 00007ffeefe38d97 R11: 0000000000000293 R12: 0000000000000002
[ 6104.969785] R13: 00007ffeefe39220 R14: 00007ffeefe391a0 R15: 000055c10a72acf0

Signed-off-by: youwan Wang <wangyouwan@126.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f99d19077020..cc210fb790d8 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3095,6 +3095,9 @@ static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev,
 		goto err_free_wc;
 	}
 
+	if (data->evt_skb == NULL)
+		goto err_free_wc;
+
 	/* Parse and handle the return WMT event */
 	wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
 	if (wmt_evt->whdr.op != hdr->op) {

From 53d61daf35b1bbf3ae06e852ee107aa2f05b3776 Mon Sep 17 00:00:00 2001
From: ZhengHan Wang <wzhmmmmm@gmail.com>
Date: Wed, 18 Oct 2023 12:30:55 +0200
Subject: [PATCH 0512/1043] Bluetooth: Fix double free in hci_conn_cleanup

[ Upstream commit a85fb91e3d728bdfc80833167e8162cce8bc7004 ]

syzbot reports a slab use-after-free in hci_conn_hash_flush [1].
After releasing an object using hci_conn_del_sysfs in the
hci_conn_cleanup function, releasing the same object again
using the hci_dev_put and hci_conn_put functions causes a double free.
Here's a simplified flow:

hci_conn_del_sysfs:
  hci_dev_put
    put_device
      kobject_put
        kref_put
          kobject_release
            kobject_cleanup
              kfree_const
                kfree(name)

hci_dev_put:
  ...
    kfree(name)

hci_conn_put:
  put_device
    ...
      kfree(name)

This patch drop the hci_dev_put and hci_conn_put function
call in hci_conn_cleanup function, because the object is
freed in hci_conn_del_sysfs function.

This patch also fixes the refcounting in hci_conn_add_sysfs() and
hci_conn_del_sysfs() to take into account device_add() failures.

This fixes CVE-2023-28464.

Link: https://syzkaller.appspot.com/bug?id=1bb51491ca5df96a5f724899d1dbb87afda61419 [1]

Signed-off-by: ZhengHan Wang <wzhmmmmm@gmail.com>
Co-developed-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_conn.c  |  6 ++----
 net/bluetooth/hci_sysfs.c | 23 ++++++++++++-----------
 2 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index a9f6089a2ae2..74721c3e49b3 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -135,13 +135,11 @@ static void hci_conn_cleanup(struct hci_conn *conn)
 			hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
 	}
 
-	hci_conn_del_sysfs(conn);
-
 	debugfs_remove_recursive(conn->debugfs);
 
-	hci_dev_put(hdev);
+	hci_conn_del_sysfs(conn);
 
-	hci_conn_put(conn);
+	hci_dev_put(hdev);
 }
 
 static void le_scan_cleanup(struct work_struct *work)
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index ccd2c377bf83..266112c960ee 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -33,7 +33,7 @@ void hci_conn_init_sysfs(struct hci_conn *conn)
 {
 	struct hci_dev *hdev = conn->hdev;
 
-	BT_DBG("conn %p", conn);
+	bt_dev_dbg(hdev, "conn %p", conn);
 
 	conn->dev.type = &bt_link;
 	conn->dev.class = bt_class;
@@ -46,27 +46,30 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
 {
 	struct hci_dev *hdev = conn->hdev;
 
-	BT_DBG("conn %p", conn);
+	bt_dev_dbg(hdev, "conn %p", conn);
 
 	if (device_is_registered(&conn->dev))
 		return;
 
 	dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
 
-	if (device_add(&conn->dev) < 0) {
+	if (device_add(&conn->dev) < 0)
 		bt_dev_err(hdev, "failed to register connection device");
-		return;
-	}
-
-	hci_dev_hold(hdev);
 }
 
 void hci_conn_del_sysfs(struct hci_conn *conn)
 {
 	struct hci_dev *hdev = conn->hdev;
 
-	if (!device_is_registered(&conn->dev))
+	bt_dev_dbg(hdev, "conn %p", conn);
+
+	if (!device_is_registered(&conn->dev)) {
+		/* If device_add() has *not* succeeded, use *only* put_device()
+		 * to drop the reference count.
+		 */
+		put_device(&conn->dev);
 		return;
+	}
 
 	while (1) {
 		struct device *dev;
@@ -78,9 +81,7 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
 		put_device(dev);
 	}
 
-	device_del(&conn->dev);
-
-	hci_dev_put(hdev);
+	device_unregister(&conn->dev);
 }
 
 static void bt_host_release(struct device *dev)

From a70457f181d65d94fc1897dc979895422103889c Mon Sep 17 00:00:00 2001
From: Olli Asikainen <olli.asikainen@gmail.com>
Date: Tue, 24 Oct 2023 22:09:21 +0300
Subject: [PATCH 0513/1043] platform/x86: thinkpad_acpi: Add battery quirk for
 Thinkpad X120e
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 916646758aea81a143ce89103910f715ed923346 ]

Thinkpad X120e also needs this battery quirk.

Signed-off-by: Olli Asikainen <olli.asikainen@gmail.com>
Link: https://lore.kernel.org/r/20231024190922.2742-1-olli.asikainen@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/thinkpad_acpi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index d8d241344d22..00ca996b4d4b 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -9718,6 +9718,7 @@ static const struct tpacpi_quirk battery_quirk_table[] __initconst = {
 	 * Individual addressing is broken on models that expose the
 	 * primary battery as BAT1.
 	 */
+	TPACPI_Q_LNV('8', 'F', true),       /* Thinkpad X120e */
 	TPACPI_Q_LNV('J', '7', true),       /* B5400 */
 	TPACPI_Q_LNV('J', 'I', true),       /* Thinkpad 11e */
 	TPACPI_Q_LNV3('R', '0', 'B', true), /* Thinkpad 11e gen 3 */

From 2810a9c40b6fff590c92c9f5e1fc8cc137662581 Mon Sep 17 00:00:00 2001
From: "baozhu.liu" <lucas.liu@siengine.com>
Date: Fri, 4 Aug 2023 10:05:53 +0800
Subject: [PATCH 0514/1043] drm/komeda: drop all currently held locks if
 deadlock happens

[ Upstream commit 19ecbe8325a2a7ffda5ff4790955b84eaccba49f ]

If komeda_pipeline_unbound_components() returns -EDEADLK,
it means that a deadlock happened in the locking context.
Currently, komeda is not dealing with the deadlock properly,producing the
following output when CONFIG_DEBUG_WW_MUTEX_SLOWPATH is enabled:

 ------------[ cut here ]------------
[   26.103984] WARNING: CPU: 2 PID: 345 at drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c:1248
	       komeda_release_unclaimed_resources+0x13c/0x170
[   26.117453] Modules linked in:
[   26.120511] CPU: 2 PID: 345 Comm: composer@2.1-se Kdump: loaded Tainted: G   W  5.10.110-SE-SDK1.8-dirty #16
[   26.131374] Hardware name: Siengine Se1000 Evaluation board (DT)
[   26.137379] pstate: 20400009 (nzCv daif +PAN -UAO -TCO BTYPE=--)
[   26.143385] pc : komeda_release_unclaimed_resources+0x13c/0x170
[   26.149301] lr : komeda_release_unclaimed_resources+0xbc/0x170
[   26.155130] sp : ffff800017b8b8d0
[   26.158442] pmr_save: 000000e0
[   26.161493] x29: ffff800017b8b8d0 x28: ffff000cf2f96200
[   26.166805] x27: ffff000c8f5a8800 x26: 0000000000000000
[   26.172116] x25: 0000000000000038 x24: ffff8000116a0140
[   26.177428] x23: 0000000000000038 x22: ffff000cf2f96200
[   26.182739] x21: ffff000cfc300300 x20: ffff000c8ab77080
[   26.188051] x19: 0000000000000003 x18: 0000000000000000
[   26.193362] x17: 0000000000000000 x16: 0000000000000000
[   26.198672] x15: b400e638f738ba38 x14: 0000000000000000
[   26.203983] x13: 0000000106400a00 x12: 0000000000000000
[   26.209294] x11: 0000000000000000 x10: 0000000000000000
[   26.214604] x9 : ffff800012f80000 x8 : ffff000ca3308000
[   26.219915] x7 : 0000000ff3000000 x6 : ffff80001084034c
[   26.225226] x5 : ffff800017b8bc40 x4 : 000000000000000f
[   26.230536] x3 : ffff000ca3308000 x2 : 0000000000000000
[   26.235847] x1 : 0000000000000000 x0 : ffffffffffffffdd
[   26.241158] Call trace:
[   26.243604] komeda_release_unclaimed_resources+0x13c/0x170
[   26.249175] komeda_crtc_atomic_check+0x68/0xf0
[   26.253706] drm_atomic_helper_check_planes+0x138/0x1f4
[   26.258929] komeda_kms_check+0x284/0x36c
[   26.262939] drm_atomic_check_only+0x40c/0x714
[   26.267381] drm_atomic_nonblocking_commit+0x1c/0x60
[   26.272344] drm_mode_atomic_ioctl+0xa3c/0xb8c
[   26.276787] drm_ioctl_kernel+0xc4/0x120
[   26.280708] drm_ioctl+0x268/0x534
[   26.284109] __arm64_sys_ioctl+0xa8/0xf0
[   26.288030] el0_svc_common.constprop.0+0x80/0x240
[   26.292817] do_el0_svc+0x24/0x90
[   26.296132] el0_svc+0x20/0x30
[   26.299185] el0_sync_handler+0xe8/0xf0
[   26.303018] el0_sync+0x1a4/0x1c0
[   26.306330] irq event stamp: 0
[   26.309384] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
[   26.315650] hardirqs last disabled at (0): [<ffff800010056d34>] copy_process+0x5d0/0x183c
[   26.323825] softirqs last  enabled at (0): [<ffff800010056d34>] copy_process+0x5d0/0x183c
[   26.331997] softirqs last disabled at (0): [<0000000000000000>] 0x0
[   26.338261] ---[ end trace 20ae984fa860184a ]---
[   26.343021] ------------[ cut here ]------------
[   26.347646] WARNING: CPU: 3 PID: 345 at drivers/gpu/drm/drm_modeset_lock.c:228 drm_modeset_drop_locks+0x84/0x90
[   26.357727] Modules linked in:
[   26.360783] CPU: 3 PID: 345 Comm: composer@2.1-se Kdump: loaded Tainted: G   W  5.10.110-SE-SDK1.8-dirty #16
[   26.371645] Hardware name: Siengine Se1000 Evaluation board (DT)
[   26.377647] pstate: 20400009 (nzCv daif +PAN -UAO -TCO BTYPE=--)
[   26.383649] pc : drm_modeset_drop_locks+0x84/0x90
[   26.388351] lr : drm_mode_atomic_ioctl+0x860/0xb8c
[   26.393137] sp : ffff800017b8bb10
[   26.396447] pmr_save: 000000e0
[   26.399497] x29: ffff800017b8bb10 x28: 0000000000000001
[   26.404807] x27: 0000000000000038 x26: 0000000000000002
[   26.410115] x25: ffff000cecbefa00 x24: ffff000cf2f96200
[   26.415423] x23: 0000000000000001 x22: 0000000000000018
[   26.420731] x21: 0000000000000001 x20: ffff800017b8bc10
[   26.426039] x19: 0000000000000000 x18: 0000000000000000
[   26.431347] x17: 0000000002e8bf2c x16: 0000000002e94c6b
[   26.436655] x15: 0000000002ea48b9 x14: ffff8000121f0300
[   26.441963] x13: 0000000002ee2ca8 x12: ffff80001129cae0
[   26.447272] x11: ffff800012435000 x10: ffff000ed46b5e88
[   26.452580] x9 : ffff000c9935e600 x8 : 0000000000000000
[   26.457888] x7 : 000000008020001e x6 : 000000008020001f
[   26.463196] x5 : ffff80001085fbe0 x4 : fffffe0033a59f20
[   26.468504] x3 : 000000008020001e x2 : 0000000000000000
[   26.473813] x1 : 0000000000000000 x0 : ffff000c8f596090
[   26.479122] Call trace:
[   26.481566] drm_modeset_drop_locks+0x84/0x90
[   26.485918] drm_mode_atomic_ioctl+0x860/0xb8c
[   26.490359] drm_ioctl_kernel+0xc4/0x120
[   26.494278] drm_ioctl+0x268/0x534
[   26.497677] __arm64_sys_ioctl+0xa8/0xf0
[   26.501598] el0_svc_common.constprop.0+0x80/0x240
[   26.506384] do_el0_svc+0x24/0x90
[   26.509697] el0_svc+0x20/0x30
[   26.512748] el0_sync_handler+0xe8/0xf0
[   26.516580] el0_sync+0x1a4/0x1c0
[   26.519891] irq event stamp: 0
[   26.522943] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
[   26.529207] hardirqs last disabled at (0): [<ffff800010056d34>] copy_process+0x5d0/0x183c
[   26.537379] softirqs last  enabled at (0): [<ffff800010056d34>] copy_process+0x5d0/0x183c
[   26.545550] softirqs last disabled at (0): [<0000000000000000>] 0x0
[   26.551812] ---[ end trace 20ae984fa860184b ]---

According to the call trace information,it can be located to be
WARN_ON(IS_ERR(c_st)) in the komeda_pipeline_unbound_components function;
Then follow the function.
komeda_pipeline_unbound_components
-> komeda_component_get_state_and_set_user
  -> komeda_pipeline_get_state_and_set_crtc
    -> komeda_pipeline_get_state
      ->drm_atomic_get_private_obj_state
        -> drm_atomic_get_private_obj_state
          -> drm_modeset_lock

komeda_pipeline_unbound_components
-> komeda_component_get_state_and_set_user
  -> komeda_component_get_state
    -> drm_atomic_get_private_obj_state
     -> drm_modeset_lock

ret = drm_modeset_lock(&obj->lock, state->acquire_ctx); if (ret)
	return ERR_PTR(ret);
Here it return -EDEADLK.

deal with the deadlock as suggested by [1], using the
function drm_modeset_backoff().
[1] https://docs.kernel.org/gpu/drm-kms.html?highlight=kms#kms-locking

Therefore, handling this problem can be solved
by adding return -EDEADLK back to the drm_modeset_backoff processing flow
in the drm_mode_atomic_ioctl function.

Signed-off-by: baozhu.liu <lucas.liu@siengine.com>
Signed-off-by: menghui.huang <menghui.huang@siengine.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230804013117.6870-1-menghui.huang@siengine.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../gpu/drm/arm/display/komeda/komeda_pipeline_state.c   | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c b/drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c
index c3cdf283ecef..1e922703e26b 100644
--- a/drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c
+++ b/drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c
@@ -1223,7 +1223,7 @@ int komeda_build_display_data_flow(struct komeda_crtc *kcrtc,
 	return 0;
 }
 
-static void
+static int
 komeda_pipeline_unbound_components(struct komeda_pipeline *pipe,
 				   struct komeda_pipeline_state *new)
 {
@@ -1243,8 +1243,12 @@ komeda_pipeline_unbound_components(struct komeda_pipeline *pipe,
 		c = komeda_pipeline_get_component(pipe, id);
 		c_st = komeda_component_get_state_and_set_user(c,
 				drm_st, NULL, new->crtc);
+		if (PTR_ERR(c_st) == -EDEADLK)
+			return -EDEADLK;
 		WARN_ON(IS_ERR(c_st));
 	}
+
+	return 0;
 }
 
 /* release unclaimed pipeline resource */
@@ -1266,9 +1270,8 @@ int komeda_release_unclaimed_resources(struct komeda_pipeline *pipe,
 	if (WARN_ON(IS_ERR_OR_NULL(st)))
 		return -EINVAL;
 
-	komeda_pipeline_unbound_components(pipe, st);
+	return komeda_pipeline_unbound_components(pipe, st);
 
-	return 0;
 }
 
 /* Since standalong disabled components must be disabled separately and in the

From 4ffb2b0e48c0d4e70e3e34a091416f6aa246b140 Mon Sep 17 00:00:00 2001
From: Jani Nikula <jani.nikula@intel.com>
Date: Fri, 1 Sep 2023 17:20:34 +0300
Subject: [PATCH 0515/1043] drm/msm/dp: skip validity check for DP CTS EDID
 checksum

[ Upstream commit a251c9d8e30833b260101edb9383b176ee2b7cb1 ]

The DP CTS test for EDID last block checksum expects the checksum for
the last block, invalid or not. Skip the validity check.

For the most part (*), the EDIDs returned by drm_get_edid() will be
valid anyway, and there's the CTS workaround to get the checksum for
completely invalid EDIDs. See commit 7948fe12d47a ("drm/msm/dp: return
correct edid checksum after corrupted edid checksum read").

This lets us remove one user of drm_edid_block_valid() with hopes the
function can be removed altogether in the future.

(*) drm_get_edid() ignores checksum errors on CTA extensions.

Cc: Abhinav Kumar <quic_abhinavk@quicinc.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Cc: Kuogee Hsieh <khsieh@codeaurora.org>
Cc: Marijn Suijten <marijn.suijten@somainline.org>
Cc: Rob Clark <robdclark@gmail.com>
Cc: Sean Paul <sean@poorly.run>
Cc: Stephen Boyd <swboyd@chromium.org>
Cc: linux-arm-msm@vger.kernel.org
Cc: freedreno@lists.freedesktop.org
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/555361/
Link: https://lore.kernel.org/r/20230901142034.580802-1-jani.nikula@intel.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dp/dp_panel.c | 21 ++-------------------
 1 file changed, 2 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c b/drivers/gpu/drm/msm/dp/dp_panel.c
index 4e8a19114e87..93a2ee0f772f 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.c
+++ b/drivers/gpu/drm/msm/dp/dp_panel.c
@@ -264,26 +264,9 @@ int dp_panel_get_modes(struct dp_panel *dp_panel,
 
 static u8 dp_panel_get_edid_checksum(struct edid *edid)
 {
-	struct edid *last_block;
-	u8 *raw_edid;
-	bool is_edid_corrupt = false;
+	edid += edid->extensions;
 
-	if (!edid) {
-		DRM_ERROR("invalid edid input\n");
-		return 0;
-	}
-
-	raw_edid = (u8 *)edid;
-	raw_edid += (edid->extensions * EDID_LENGTH);
-	last_block = (struct edid *)raw_edid;
-
-	/* block type extension */
-	drm_edid_block_valid(raw_edid, 1, false, &is_edid_corrupt);
-	if (!is_edid_corrupt)
-		return last_block->checksum;
-
-	DRM_ERROR("Invalid block, no checksum\n");
-	return 0;
+	return edid->checksum;
 }
 
 void dp_panel_handle_sink_request(struct dp_panel *dp_panel)

From 8af28ae3acb736ada4ce3457662fa446cc913bb4 Mon Sep 17 00:00:00 2001
From: Mario Limonciello <mario.limonciello@amd.com>
Date: Wed, 4 Oct 2023 15:22:52 -0500
Subject: [PATCH 0516/1043] drm/amd: Fix UBSAN array-index-out-of-bounds for
 SMU7

[ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Suggested-by: Felix Held <felix.held@amd.com>
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/include/pptable.h                 | 4 ++--
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/include/pptable.h b/drivers/gpu/drm/amd/include/pptable.h
index 0b6a057e0a4c..5aac8d545bdc 100644
--- a/drivers/gpu/drm/amd/include/pptable.h
+++ b/drivers/gpu/drm/amd/include/pptable.h
@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER
 typedef struct _ATOM_PPLIB_STATE
 {
     UCHAR ucNonClockStateIndex;
-    UCHAR ucClockStateIndices[1]; // variable-sized
+    UCHAR ucClockStateIndices[]; // variable-sized
 } ATOM_PPLIB_STATE;
 
 
@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2
       /**
       * Driver will read the first ucNumDPMLevels in this array
       */
-      UCHAR clockInfoIndex[1];
+      UCHAR clockInfoIndex[];
 } ATOM_PPLIB_STATE_V2;
 
 typedef struct _StateArray{
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index 1e870f58dd12..d5a4a08c6d39 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_MCLK_Dependency_Table {
 	UCHAR ucRevId;
 	UCHAR ucNumEntries; 										/* Number of entries. */
-	ATOM_Tonga_MCLK_Dependency_Record entries[1];				/* Dynamically allocate entries. */
+	ATOM_Tonga_MCLK_Dependency_Record entries[];				/* Dynamically allocate entries. */
 } ATOM_Tonga_MCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
 typedef struct _ATOM_Tonga_SCLK_Dependency_Table {
 	UCHAR ucRevId;
 	UCHAR ucNumEntries; 										/* Number of entries. */
-	ATOM_Tonga_SCLK_Dependency_Record entries[1];				 /* Dynamically allocate entries. */
+	ATOM_Tonga_SCLK_Dependency_Record entries[];				 /* Dynamically allocate entries. */
 } ATOM_Tonga_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Polaris_SCLK_Dependency_Record {

From 8c1dbddbfcb051e82cea0c197c620f9dcdc38e92 Mon Sep 17 00:00:00 2001
From: Mario Limonciello <mario.limonciello@amd.com>
Date: Wed, 4 Oct 2023 15:46:44 -0500
Subject: [PATCH 0517/1043] drm/amd: Fix UBSAN array-index-out-of-bounds for
 Polaris and Tonga

[ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ]

For pptable structs that use flexible array sizes, use flexible arrays.

Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h    | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
index d5a4a08c6d39..0c61e2bc14cd 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h
@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State {
 typedef struct _ATOM_Tonga_State_Array {
 	UCHAR ucRevId;
 	UCHAR ucNumEntries;		/* Number of entries. */
-	ATOM_Tonga_State entries[1];	/* Dynamically allocate entries. */
+	ATOM_Tonga_State entries[];	/* Dynamically allocate entries. */
 } ATOM_Tonga_State_Array;
 
 typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
 typedef struct _ATOM_Polaris_SCLK_Dependency_Table {
 	UCHAR ucRevId;
 	UCHAR ucNumEntries;							/* Number of entries. */
-	ATOM_Polaris_SCLK_Dependency_Record entries[1];				 /* Dynamically allocate entries. */
+	ATOM_Polaris_SCLK_Dependency_Record entries[];				 /* Dynamically allocate entries. */
 } ATOM_Polaris_SCLK_Dependency_Table;
 
 typedef struct _ATOM_Tonga_PCIE_Record {
@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record {
 typedef struct _ATOM_Tonga_PCIE_Table {
 	UCHAR ucRevId;
 	UCHAR ucNumEntries; 										/* Number of entries. */
-	ATOM_Tonga_PCIE_Record entries[1];							/* Dynamically allocate entries. */
+	ATOM_Tonga_PCIE_Record entries[];							/* Dynamically allocate entries. */
 } ATOM_Tonga_PCIE_Table;
 
 typedef struct _ATOM_Polaris10_PCIE_Record {
@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record {
 typedef struct _ATOM_Polaris10_PCIE_Table {
 	UCHAR ucRevId;
 	UCHAR ucNumEntries;                                         /* Number of entries. */
-	ATOM_Polaris10_PCIE_Record entries[1];                      /* Dynamically allocate entries. */
+	ATOM_Polaris10_PCIE_Record entries[];                      /* Dynamically allocate entries. */
 } ATOM_Polaris10_PCIE_Table;
 
 
@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record {
 typedef struct _ATOM_Tonga_MM_Dependency_Table {
 	UCHAR ucRevId;
 	UCHAR ucNumEntries; 										/* Number of entries. */
-	ATOM_Tonga_MM_Dependency_Record entries[1]; 			   /* Dynamically allocate entries. */
+	ATOM_Tonga_MM_Dependency_Record entries[]; 			   /* Dynamically allocate entries. */
 } ATOM_Tonga_MM_Dependency_Table;
 
 typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
 typedef struct _ATOM_Tonga_Voltage_Lookup_Table {
 	UCHAR ucRevId;
 	UCHAR ucNumEntries; 										/* Number of entries. */
-	ATOM_Tonga_Voltage_Lookup_Record entries[1];				/* Dynamically allocate entries. */
+	ATOM_Tonga_Voltage_Lookup_Record entries[];				/* Dynamically allocate entries. */
 } ATOM_Tonga_Voltage_Lookup_Table;
 
 typedef struct _ATOM_Tonga_Fan_Table {

From b93a25de28af153312f0fc979b0663fc4bd3442b Mon Sep 17 00:00:00 2001
From: "Stanley.Yang" <Stanley.Yang@amd.com>
Date: Wed, 27 Sep 2023 16:22:29 +0800
Subject: [PATCH 0518/1043] drm/amdgpu: Fix potential null pointer derefernce

[ Upstream commit 80285ae1ec8717b597b20de38866c29d84d321a1 ]

The amdgpu_ras_get_context may return NULL if device
not support ras feature, so add check before using.

Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index f0db9724ca85..a093f1b27724 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4530,7 +4530,8 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
 	 * Flush RAM to disk so that after reboot
 	 * the user can read log and see why the system rebooted.
 	 */
-	if (need_emergency_restart && amdgpu_ras_get_context(adev)->reboot) {
+	if (need_emergency_restart && amdgpu_ras_get_context(adev) &&
+		amdgpu_ras_get_context(adev)->reboot) {
 		DRM_WARN("Emergency reboot.");
 
 		ksys_sync_helper();

From c7dc0aca5962fb37dbea9769dd26ec37813faae1 Mon Sep 17 00:00:00 2001
From: Ma Ke <make_ruc2021@163.com>
Date: Sat, 7 Oct 2023 11:31:05 +0800
Subject: [PATCH 0519/1043] drm/panel: fix a possible null pointer dereference

[ Upstream commit 924e5814d1f84e6fa5cb19c6eceb69f066225229 ]

In versatile_panel_get_modes(), the return value of drm_mode_duplicate()
is assigned to mode, which will lead to a NULL pointer dereference
on failure of drm_mode_duplicate(). Add a check to avoid npd.

Signed-off-by: Ma Ke <make_ruc2021@163.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20231007033105.3997998-1-make_ruc2021@163.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231007033105.3997998-1-make_ruc2021@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-arm-versatile.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/panel/panel-arm-versatile.c b/drivers/gpu/drm/panel/panel-arm-versatile.c
index abb0788843c6..503ecea72c5e 100644
--- a/drivers/gpu/drm/panel/panel-arm-versatile.c
+++ b/drivers/gpu/drm/panel/panel-arm-versatile.c
@@ -267,6 +267,8 @@ static int versatile_panel_get_modes(struct drm_panel *panel,
 	connector->display_info.bus_flags = vpanel->panel_type->bus_flags;
 
 	mode = drm_mode_duplicate(connector->dev, &vpanel->panel_type->mode);
+	if (!mode)
+		return -ENOMEM;
 	drm_mode_set_name(mode);
 	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
 

From 9acc2bc00135e9ecd13a70ce1140e2673e504cdc Mon Sep 17 00:00:00 2001
From: Ma Ke <make_ruc2021@163.com>
Date: Mon, 9 Oct 2023 17:04:46 +0800
Subject: [PATCH 0520/1043] drm/panel/panel-tpo-tpg110: fix a possible null
 pointer dereference

[ Upstream commit f22def5970c423ea7f87d5247bd0ef91416b0658 ]

In tpg110_get_modes(), the return value of drm_mode_duplicate() is
assigned to mode, which will lead to a NULL pointer dereference on
failure of drm_mode_duplicate(). Add a check to avoid npd.

Signed-off-by: Ma Ke <make_ruc2021@163.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20231009090446.4043798-1-make_ruc2021@163.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231009090446.4043798-1-make_ruc2021@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-tpo-tpg110.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/panel/panel-tpo-tpg110.c b/drivers/gpu/drm/panel/panel-tpo-tpg110.c
index d57ed75a977c..494cec50a682 100644
--- a/drivers/gpu/drm/panel/panel-tpo-tpg110.c
+++ b/drivers/gpu/drm/panel/panel-tpo-tpg110.c
@@ -378,6 +378,8 @@ static int tpg110_get_modes(struct drm_panel *panel,
 	connector->display_info.bus_flags = tpg->panel_mode->bus_flags;
 
 	mode = drm_mode_duplicate(connector->dev, &tpg->panel_mode->mode);
+	if (!mode)
+		return -ENOMEM;
 	drm_mode_set_name(mode);
 	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
 

From da1409ea0845e801f6e5a62b59545134f23c118f Mon Sep 17 00:00:00 2001
From: Ondrej Jirman <megi@xff.cz>
Date: Sat, 11 Feb 2023 18:17:48 +0100
Subject: [PATCH 0521/1043] drm/panel: st7703: Pick different reset sequence
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d12d635bb03c7cb4830acb641eb176ee9ff2aa89 ]

Switching to a different reset sequence, enabling IOVCC before enabling
VCC.

There also needs to be a delay after enabling the supplies and before
deasserting the reset. The datasheet specifies 1ms after the supplies
reach the required voltage. Use 10-20ms to also give the power supplies
some time to reach the required voltage, too.

This fixes intermittent panel initialization failures and screen
corruption during resume from sleep on panel xingbangda,xbd599 (e.g.
used in PinePhone).

Signed-off-by: Ondrej Jirman <megi@xff.cz>
Signed-off-by: Frank Oltmanns <frank@oltmanns.dev>
Reported-by: Samuel Holland <samuel@sholland.org>
Reviewed-by: Guido Günther <agx@sigxcpu.org>
Tested-by: Guido Günther <agx@sigxcpu.org>
Signed-off-by: Guido Günther <agx@sigxcpu.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230211171748.36692-2-frank@oltmanns.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-sitronix-st7703.c | 27 ++++++++++---------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7703.c b/drivers/gpu/drm/panel/panel-sitronix-st7703.c
index c22e7c49e077..67e1da0a7db5 100644
--- a/drivers/gpu/drm/panel/panel-sitronix-st7703.c
+++ b/drivers/gpu/drm/panel/panel-sitronix-st7703.c
@@ -428,29 +428,30 @@ static int st7703_prepare(struct drm_panel *panel)
 		return 0;
 
 	dev_dbg(ctx->dev, "Resetting the panel\n");
-	ret = regulator_enable(ctx->vcc);
-	if (ret < 0) {
-		dev_err(ctx->dev, "Failed to enable vcc supply: %d\n", ret);
-		return ret;
-	}
+	gpiod_set_value_cansleep(ctx->reset_gpio, 1);
+
 	ret = regulator_enable(ctx->iovcc);
 	if (ret < 0) {
 		dev_err(ctx->dev, "Failed to enable iovcc supply: %d\n", ret);
-		goto disable_vcc;
+		return ret;
 	}
 
-	gpiod_set_value_cansleep(ctx->reset_gpio, 1);
-	usleep_range(20, 40);
+	ret = regulator_enable(ctx->vcc);
+	if (ret < 0) {
+		dev_err(ctx->dev, "Failed to enable vcc supply: %d\n", ret);
+		regulator_disable(ctx->iovcc);
+		return ret;
+	}
+
+	/* Give power supplies time to stabilize before deasserting reset. */
+	usleep_range(10000, 20000);
+
 	gpiod_set_value_cansleep(ctx->reset_gpio, 0);
-	msleep(20);
+	usleep_range(15000, 20000);
 
 	ctx->prepared = true;
 
 	return 0;
-
-disable_vcc:
-	regulator_disable(ctx->vcc);
-	return ret;
 }
 
 static int st7703_get_modes(struct drm_panel *panel,

From f475d5502f33a6c5b149b0afe96316ad1962a64a Mon Sep 17 00:00:00 2001
From: Qu Huang <qu.huang@linux.dev>
Date: Mon, 23 Oct 2023 12:56:37 +0000
Subject: [PATCH 0522/1043] drm/amdgpu: Fix a null pointer access when the
 smc_rreg pointer is NULL

[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ]

In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresponding exception log:

1. Navigate to the directory: /sys/kernel/debug/dri/0
2. Execute command: cat amdgpu_regs_smc
3. Exception Log::
[4005007.702554] BUG: kernel NULL pointer dereference, address: 0000000000000000
[4005007.702562] #PF: supervisor instruction fetch in kernel mode
[4005007.702567] #PF: error_code(0x0010) - not-present page
[4005007.702570] PGD 0 P4D 0
[4005007.702576] Oops: 0010 [#1] SMP NOPTI
[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G           OE     5.15.0-43-generic #46-Ubunt       u
[4005007.702590] RIP: 0010:0x0
[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
[4005007.702600] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206
[4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68
[4005007.702609] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000
[4005007.702612] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980
[4005007.702615] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000
[4005007.702618] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000
[4005007.702622] FS:  00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000
[4005007.702626] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0
[4005007.702633] Call Trace:
[4005007.702636]  <TASK>
[4005007.702640]  amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]
[4005007.703002]  full_proxy_read+0x5c/0x80
[4005007.703011]  vfs_read+0x9f/0x1a0
[4005007.703019]  ksys_read+0x67/0xe0
[4005007.703023]  __x64_sys_read+0x19/0x20
[4005007.703028]  do_syscall_64+0x5c/0xc0
[4005007.703034]  ? do_user_addr_fault+0x1e3/0x670
[4005007.703040]  ? exit_to_user_mode_prepare+0x37/0xb0
[4005007.703047]  ? irqentry_exit_to_user_mode+0x9/0x20
[4005007.703052]  ? irqentry_exit+0x19/0x30
[4005007.703057]  ? exc_page_fault+0x89/0x160
[4005007.703062]  ? asm_exc_page_fault+0x8/0x30
[4005007.703068]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[4005007.703075] RIP: 0033:0x7f5e07672992
[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f        1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e       c 28 48 89 54 24
[4005007.703083] RSP: 002b:00007ffe03097898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[4005007.703088] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5e07672992
[4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 0000000000000003
[4005007.703094] RBP: 00007f5e06753000 R08: 00007f5e06752010 R09: 00007f5e06752010
[4005007.703096] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000
[4005007.703099] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[4005007.703105]  </TASK>
[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash af_alg binfmt_misc nls_       iso8859_1 ipmi_ssif ast intel_rapl_msr intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t       tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_devintf ipm       i_msghandler msr parport_pc ppdev lp parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo       mon ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) iommu_v       2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core        drm igb ahci xhci_pci libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca
[4005007.703184] CR2: 0000000000000000
[4005007.703188] ---[ end trace ac65a538d240da39 ]---
[4005007.800865] RIP: 0010:0x0
[4005007.800871] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
[4005007.800874] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206
[4005007.800878] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68
[4005007.800881] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000
[4005007.800883] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980
[4005007.800886] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000
[4005007.800888] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000
[4005007.800891] FS:  00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000
[4005007.800895] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[4005007.800898] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0

Signed-off-by: Qu Huang <qu.huang@linux.dev>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index 00a190929b55..48df32dd352e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -575,6 +575,9 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf,
 	ssize_t result = 0;
 	int r;
 
+	if (!adev->smc_rreg)
+		return -EPERM;
+
 	if (size & 0x3 || *pos & 0x3)
 		return -EINVAL;
 
@@ -634,6 +637,9 @@ static ssize_t amdgpu_debugfs_regs_smc_write(struct file *f, const char __user *
 	ssize_t result = 0;
 	int r;
 
+	if (!adev->smc_wreg)
+		return -EPERM;
+
 	if (size & 0x3 || *pos & 0x3)
 		return -EINVAL;
 

From f161a6b11ae7b87aa720eb8636f52f28791ebee9 Mon Sep 17 00:00:00 2001
From: zhujun2 <zhujun2@cmss.chinamobile.com>
Date: Tue, 17 Oct 2023 18:59:21 -0700
Subject: [PATCH 0523/1043] selftests/efivarfs: create-read: fix a resource
 leak

[ Upstream commit 3f6f8a8c5e11a9b384a36df4f40f0c9a653b6975 ]

The opened file should be closed in main(), otherwise resource
leak will occur that this problem was discovered by code reading

Signed-off-by: zhujun2 <zhujun2@cmss.chinamobile.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/efivarfs/create-read.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/testing/selftests/efivarfs/create-read.c b/tools/testing/selftests/efivarfs/create-read.c
index 9674a19396a3..7bc7af4eb2c1 100644
--- a/tools/testing/selftests/efivarfs/create-read.c
+++ b/tools/testing/selftests/efivarfs/create-read.c
@@ -32,8 +32,10 @@ int main(int argc, char **argv)
 	rc = read(fd, buf, sizeof(buf));
 	if (rc != 0) {
 		fprintf(stderr, "Reading a new var should return EOF\n");
+		close(fd);
 		return EXIT_FAILURE;
 	}
 
+	close(fd);
 	return EXIT_SUCCESS;
 }

From 98fa52d89a4f492b1dfd6527b68ca5ae6dc1fc23 Mon Sep 17 00:00:00 2001
From: Richard Fitzgerald <rf@opensource.cirrus.com>
Date: Tue, 12 Sep 2023 17:32:04 +0100
Subject: [PATCH 0524/1043] ASoC: soc-card: Add storage for PCI SSID

[ Upstream commit 47f56e38a199bd45514b8e0142399cba4feeaf1a ]

Add members to struct snd_soc_card to store the PCI subsystem ID (SSID)
of the soundcard.

The PCI specification provides two registers to store a vendor-specific
SSID that can be read by drivers to uniquely identify a particular
"soundcard". This is defined in the PCI specification to distinguish
products that use the same silicon (and therefore have the same silicon
ID) so that product-specific differences can be applied.

PCI only defines 0xFFFF as an invalid value. 0x0000 is not defined as
invalid. So the usual pattern of zero-filling the struct and then
assuming a zero value unset will not work. A flag is included to
indicate when the SSID information has been filled in.

Unlike DMI information, which has a free-format entirely up to the vendor,
the PCI SSID has a strictly defined format and a registry of vendor IDs.

It is usual in Windows drivers that the SSID is used as the sole identifier
of the specific end-product and the Windows driver contains tables mapping
that to information about the hardware setup, rather than using ACPI
properties.

This SSID is important information for ASoC components that need to apply
hardware-specific configuration on PCI-based systems.

As the SSID is a generic part of the PCI specification and is treated as
identifying the "soundcard", it is reasonable to include this information
in struct snd_soc_card, instead of components inventing their own custom
ways to pass this information around.

Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20230912163207.3498161-2-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/sound/soc-card.h | 37 +++++++++++++++++++++++++++++++++++++
 include/sound/soc.h      | 11 +++++++++++
 2 files changed, 48 insertions(+)

diff --git a/include/sound/soc-card.h b/include/sound/soc-card.h
index 4f2cc4fb56b7..9a5429260ece 100644
--- a/include/sound/soc-card.h
+++ b/include/sound/soc-card.h
@@ -40,6 +40,43 @@ int snd_soc_card_add_dai_link(struct snd_soc_card *card,
 void snd_soc_card_remove_dai_link(struct snd_soc_card *card,
 				  struct snd_soc_dai_link *dai_link);
 
+#ifdef CONFIG_PCI
+static inline void snd_soc_card_set_pci_ssid(struct snd_soc_card *card,
+					     unsigned short vendor,
+					     unsigned short device)
+{
+	card->pci_subsystem_vendor = vendor;
+	card->pci_subsystem_device = device;
+	card->pci_subsystem_set = true;
+}
+
+static inline int snd_soc_card_get_pci_ssid(struct snd_soc_card *card,
+					    unsigned short *vendor,
+					    unsigned short *device)
+{
+	if (!card->pci_subsystem_set)
+		return -ENOENT;
+
+	*vendor = card->pci_subsystem_vendor;
+	*device = card->pci_subsystem_device;
+
+	return 0;
+}
+#else /* !CONFIG_PCI */
+static inline void snd_soc_card_set_pci_ssid(struct snd_soc_card *card,
+					     unsigned short vendor,
+					     unsigned short device)
+{
+}
+
+static inline int snd_soc_card_get_pci_ssid(struct snd_soc_card *card,
+					    unsigned short *vendor,
+					    unsigned short *device)
+{
+	return -ENOENT;
+}
+#endif /* CONFIG_PCI */
+
 /* device driver data */
 static inline void snd_soc_card_set_drvdata(struct snd_soc_card *card,
 					    void *data)
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 3b038c563ae1..e973044143bc 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -977,6 +977,17 @@ struct snd_soc_card {
 #ifdef CONFIG_DMI
 	char dmi_longname[80];
 #endif /* CONFIG_DMI */
+
+#ifdef CONFIG_PCI
+	/*
+	 * PCI does not define 0 as invalid, so pci_subsystem_set indicates
+	 * whether a value has been written to these fields.
+	 */
+	unsigned short pci_subsystem_vendor;
+	unsigned short pci_subsystem_device;
+	bool pci_subsystem_set;
+#endif /* CONFIG_PCI */
+
 	char topology_shortname[32];
 
 	struct device *dev;

From e97bf4ada7dddacd184c3e196bd063b0dc71b41d Mon Sep 17 00:00:00 2001
From: Lu Jialin <lujialin4@huawei.com>
Date: Mon, 4 Sep 2023 13:33:41 +0000
Subject: [PATCH 0525/1043] crypto: pcrypt - Fix hungtask for PADATA_RESET

[ Upstream commit 8f4f68e788c3a7a696546291258bfa5fdb215523 ]

We found a hungtask bug in test_aead_vec_cfg as follows:

INFO: task cryptomgr_test:391009 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Call trace:
 __switch_to+0x98/0xe0
 __schedule+0x6c4/0xf40
 schedule+0xd8/0x1b4
 schedule_timeout+0x474/0x560
 wait_for_common+0x368/0x4e0
 wait_for_completion+0x20/0x30
 wait_for_completion+0x20/0x30
 test_aead_vec_cfg+0xab4/0xd50
 test_aead+0x144/0x1f0
 alg_test_aead+0xd8/0x1e0
 alg_test+0x634/0x890
 cryptomgr_test+0x40/0x70
 kthread+0x1e0/0x220
 ret_from_fork+0x10/0x18
 Kernel panic - not syncing: hung_task: blocked tasks

For padata_do_parallel, when the return err is 0 or -EBUSY, it will call
wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal
case, aead_request_complete() will be called in pcrypt_aead_serial and the
return err is 0 for padata_do_parallel. But, when pinst->flags is
PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it
won't call aead_request_complete(). Therefore, test_aead_vec_cfg will
hung at wait_for_completion(&wait->completion), which will cause
hungtask.

The problem comes as following:
(padata_do_parallel)                 |
    rcu_read_lock_bh();              |
    err = -EINVAL;                   |   (padata_replace)
                                     |     pinst->flags |= PADATA_RESET;
    err = -EBUSY                     |
    if (pinst->flags & PADATA_RESET) |
        rcu_read_unlock_bh()         |
        return err

In order to resolve the problem, we replace the return err -EBUSY with
-EAGAIN, which means parallel_data is changing, and the caller should call
it again.

v3:
remove retry and just change the return err.
v2:
introduce padata_try_do_parallel() in pcrypt_aead_encrypt and
pcrypt_aead_decrypt to solve the hungtask.

Signed-off-by: Lu Jialin <lujialin4@huawei.com>
Signed-off-by: Guo Zihua <guozihua@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/pcrypt.c | 4 ++++
 kernel/padata.c | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index 9d10b846ccf7..005a36cb21bc 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -117,6 +117,8 @@ static int pcrypt_aead_encrypt(struct aead_request *req)
 	err = padata_do_parallel(ictx->psenc, padata, &ctx->cb_cpu);
 	if (!err)
 		return -EINPROGRESS;
+	if (err == -EBUSY)
+		return -EAGAIN;
 
 	return err;
 }
@@ -164,6 +166,8 @@ static int pcrypt_aead_decrypt(struct aead_request *req)
 	err = padata_do_parallel(ictx->psdec, padata, &ctx->cb_cpu);
 	if (!err)
 		return -EINPROGRESS;
+	if (err == -EBUSY)
+		return -EAGAIN;
 
 	return err;
 }
diff --git a/kernel/padata.c b/kernel/padata.c
index 7d500219f96b..fdcd78302cd7 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -207,7 +207,7 @@ int padata_do_parallel(struct padata_shell *ps,
 		*cb_cpu = cpu;
 	}
 
-	err =  -EBUSY;
+	err = -EBUSY;
 	if ((pinst->flags & PADATA_RESET))
 		goto out;
 

From 885824a44d35c57669d3e434ec5554b86e5017ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
Date: Tue, 19 Sep 2023 15:56:41 +0300
Subject: [PATCH 0526/1043] RDMA/hfi1: Use FIELD_GET() to extract Link Width
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 8bf7187d978610b9e327a3d92728c8864a575ebd ]

Use FIELD_GET() to extract PCIe Negotiated Link Width field instead of
custom masking and shifting, and remove extract_width() which only
wraps that FIELD_GET().

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://lore.kernel.org/r/20230919125648.1920-2-ilpo.jarvinen@linux.intel.com
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Dean Luick <dean.luick@cornelisnetworks.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hfi1/pcie.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 18d32f053d26..3aa0215fca41 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -45,6 +45,7 @@
  *
  */
 
+#include <linux/bitfield.h>
 #include <linux/pci.h>
 #include <linux/io.h>
 #include <linux/delay.h>
@@ -261,12 +262,6 @@ static u32 extract_speed(u16 linkstat)
 	return speed;
 }
 
-/* return the PCIe link speed from the given link status */
-static u32 extract_width(u16 linkstat)
-{
-	return (linkstat & PCI_EXP_LNKSTA_NLW) >> PCI_EXP_LNKSTA_NLW_SHIFT;
-}
-
 /* read the link status and set dd->{lbus_width,lbus_speed,lbus_info} */
 static void update_lbus_info(struct hfi1_devdata *dd)
 {
@@ -279,7 +274,7 @@ static void update_lbus_info(struct hfi1_devdata *dd)
 		return;
 	}
 
-	dd->lbus_width = extract_width(linkstat);
+	dd->lbus_width = FIELD_GET(PCI_EXP_LNKSTA_NLW, linkstat);
 	dd->lbus_speed = extract_speed(linkstat);
 	snprintf(dd->lbus_info, sizeof(dd->lbus_info),
 		 "PCIe,%uMHz,x%u", dd->lbus_speed, dd->lbus_width);

From 524b4f203afcf87accfe387e846f33f916f0c907 Mon Sep 17 00:00:00 2001
From: Juntong Deng <juntong.deng@outlook.com>
Date: Mon, 2 Oct 2023 17:56:58 +0800
Subject: [PATCH 0527/1043] fs/jfs: Add check for negative db_l2nbperpage

[ Upstream commit 525b861a008143048535011f3816d407940f4bfa ]

l2nbperpage is log2(number of blks per page), and the minimum legal
value should be 0, not negative.

In the case of l2nbperpage being negative, an error will occur
when subsequently used as shift exponent.

Syzbot reported this bug:

UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:799:12
shift exponent -16777216 is negative

Reported-by: syzbot+debee9ab7ae2b34b0307@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=debee9ab7ae2b34b0307
Signed-off-by: Juntong Deng <juntong.deng@outlook.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_dmap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index a9c078fc2302..06dda2c7a6e2 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -180,7 +180,8 @@ int dbMount(struct inode *ipbmap)
 	bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree);
 
 	bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage);
-	if (bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE) {
+	if (bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE ||
+		bmp->db_l2nbperpage < 0) {
 		err = -EINVAL;
 		goto err_release_metapage;
 	}

From c6c8863fb3f57700ab583d875adda04caaf2278a Mon Sep 17 00:00:00 2001
From: Juntong Deng <juntong.deng@outlook.com>
Date: Wed, 4 Oct 2023 02:06:41 +0800
Subject: [PATCH 0528/1043] fs/jfs: Add validity check for db_maxag and
 db_agpref

[ Upstream commit 64933ab7b04881c6c18b21ff206c12278341c72e ]

Both db_maxag and db_agpref are used as the index of the
db_agfree array, but there is currently no validity check for
db_maxag and db_agpref, which can lead to errors.

The following is related bug reported by Syzbot:

UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:639:20
index 7936 is out of range for type 'atomic_t[128]'

Add checking that the values of db_maxag and db_agpref are valid
indexes for the db_agfree array.

Reported-by: syzbot+38e876a8aa44b7115c76@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=38e876a8aa44b7115c76
Signed-off-by: Juntong Deng <juntong.deng@outlook.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_dmap.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 06dda2c7a6e2..2ccb52371ceb 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -195,6 +195,12 @@ int dbMount(struct inode *ipbmap)
 	bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel);
 	bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag);
 	bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref);
+	if (bmp->db_maxag >= MAXAG || bmp->db_maxag < 0 ||
+		bmp->db_agpref >= MAXAG || bmp->db_agpref < 0) {
+		err = -EINVAL;
+		goto err_release_metapage;
+	}
+
 	bmp->db_aglevel = le32_to_cpu(dbmp_le->dn_aglevel);
 	bmp->db_agheight = le32_to_cpu(dbmp_le->dn_agheight);
 	bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth);

From 81aa58cd8495b8c3b527f58ccbe19478d8087f61 Mon Sep 17 00:00:00 2001
From: Manas Ghandat <ghandatmanas@gmail.com>
Date: Wed, 4 Oct 2023 11:17:18 +0530
Subject: [PATCH 0529/1043] jfs: fix array-index-out-of-bounds in dbFindLeaf

[ Upstream commit 22cad8bc1d36547cdae0eef316c47d917ce3147c ]

Currently while searching for dmtree_t for sufficient free blocks there
is an array out of bounds while getting element in tp->dm_stree. To add
the required check for out of bound we first need to determine the type
of dmtree. Thus added an extra parameter to dbFindLeaf so that the type
of tree can be determined and the required check can be applied.

Reported-by: syzbot+aea1ad91e854d0a83e04@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=aea1ad91e854d0a83e04
Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_dmap.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 2ccb52371ceb..72eb5ed54c2a 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -87,7 +87,7 @@ static int dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno,
 static int dbExtend(struct inode *ip, s64 blkno, s64 nblocks, s64 addnblocks);
 static int dbFindBits(u32 word, int l2nb);
 static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno);
-static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx);
+static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl);
 static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
 		      int nblocks);
 static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno,
@@ -1785,7 +1785,7 @@ static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno)
 		 * dbFindLeaf() returns the index of the leaf at which
 		 * free space was found.
 		 */
-		rc = dbFindLeaf((dmtree_t *) dcp, l2nb, &leafidx);
+		rc = dbFindLeaf((dmtree_t *) dcp, l2nb, &leafidx, true);
 
 		/* release the buffer.
 		 */
@@ -2032,7 +2032,7 @@ dbAllocDmapLev(struct bmap * bmp,
 	 * free space.  if sufficient free space is found, dbFindLeaf()
 	 * returns the index of the leaf at which free space was found.
 	 */
-	if (dbFindLeaf((dmtree_t *) & dp->tree, l2nb, &leafidx))
+	if (dbFindLeaf((dmtree_t *) &dp->tree, l2nb, &leafidx, false))
 		return -ENOSPC;
 
 	if (leafidx < 0)
@@ -2992,14 +2992,18 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval)
  *	leafidx	- return pointer to be set to the index of the leaf
  *		  describing at least l2nb free blocks if sufficient
  *		  free blocks are found.
+ *	is_ctl	- determines if the tree is of type ctl
  *
  * RETURN VALUES:
  *	0	- success
  *	-ENOSPC	- insufficient free blocks.
  */
-static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx)
+static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
 {
 	int ti, n = 0, k, x = 0;
+	int max_size;
+
+	max_size = is_ctl ? CTLTREESIZE : TREESIZE;
 
 	/* first check the root of the tree to see if there is
 	 * sufficient free space.
@@ -3020,6 +3024,8 @@ static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx)
 			/* sufficient free space found.  move to the next
 			 * level (or quit if this is the last level).
 			 */
+			if (x + n > max_size)
+				return -ENOSPC;
 			if (l2nb <= tp->dmt_stree[x + n])
 				break;
 		}

From 1ba7df5457dc1c1071c5f92ac11323533a6430e1 Mon Sep 17 00:00:00 2001
From: Manas Ghandat <ghandatmanas@gmail.com>
Date: Wed, 4 Oct 2023 13:10:40 +0530
Subject: [PATCH 0530/1043] jfs: fix array-index-out-of-bounds in diAlloc

[ Upstream commit 05d9ea1ceb62a55af6727a69269a4fd310edf483 ]

Currently there is not check against the agno of the iag while
allocating new inodes to avoid fragmentation problem. Added the check
which is required.

Reported-by: syzbot+79d792676d8ac050949f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=79d792676d8ac050949f
Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_imap.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 67c67604b8c8..14f918a4831d 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -1322,7 +1322,7 @@ diInitInode(struct inode *ip, int iagno, int ino, int extno, struct iag * iagp)
 int diAlloc(struct inode *pip, bool dir, struct inode *ip)
 {
 	int rc, ino, iagno, addext, extno, bitno, sword;
-	int nwords, rem, i, agno;
+	int nwords, rem, i, agno, dn_numag;
 	u32 mask, inosmap, extsmap;
 	struct inode *ipimap;
 	struct metapage *mp;
@@ -1358,6 +1358,9 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
 
 	/* get the ag number of this iag */
 	agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
+	dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
+	if (agno < 0 || agno > dn_numag)
+		return -EIO;
 
 	if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
 		/*

From 62d21f9df46d265469a0ffd203326f692805cc98 Mon Sep 17 00:00:00 2001
From: Mikhail Khvainitski <me@khvoinitsky.org>
Date: Sun, 24 Sep 2023 01:58:30 +0300
Subject: [PATCH 0531/1043] HID: lenovo: Detect quirk-free fw on cptkbd and
 stop applying workaround

[ Upstream commit 46a0a2c96f0f47628190f122c2e3d879e590bcbe ]

Built-in firmware of cptkbd handles scrolling by itself (when middle
button is pressed) but with issues: it does not support horizontal and
hi-res scrolling and upon middle button release it sends middle button
click even if there was a scrolling event. Commit 3cb5ff0220e3 ("HID:
lenovo: Hide middle-button press until release") workarounds last
issue but it's impossible to workaround scrolling-related issues
without firmware modification.

Likely, Dennis Schneider has reverse engineered the firmware and
provided an instruction on how to patch it [1]. However,
aforementioned workaround prevents userspace (libinput) from knowing
exact moment when middle button has been pressed down and performing
"On-Button scrolling". This commit detects correctly-behaving patched
firmware if cursor movement events has been received during middle
button being pressed and stops applying workaround for this device.

Link: https://hohlerde.org/rauch/en/elektronik/projekte/tpkbd-fix/ [1]

Signed-off-by: Mikhail Khvainitski <me@khvoinitsky.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-lenovo.c | 72 ++++++++++++++++++++++++++--------------
 1 file changed, 47 insertions(+), 25 deletions(-)

diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
index 0ff03fed9770..71f7b0d539df 100644
--- a/drivers/hid/hid-lenovo.c
+++ b/drivers/hid/hid-lenovo.c
@@ -50,7 +50,12 @@ struct lenovo_drvdata {
 	int select_right;
 	int sensitivity;
 	int press_speed;
-	u8 middlebutton_state; /* 0:Up, 1:Down (undecided), 2:Scrolling */
+	/* 0: Up
+	 * 1: Down (undecided)
+	 * 2: Scrolling
+	 * 3: Patched firmware, disable workaround
+	 */
+	u8 middlebutton_state;
 	bool fn_lock;
 };
 
@@ -478,31 +483,48 @@ static int lenovo_event_cptkbd(struct hid_device *hdev,
 {
 	struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev);
 
-	/* "wheel" scroll events */
-	if (usage->type == EV_REL && (usage->code == REL_WHEEL ||
-			usage->code == REL_HWHEEL)) {
-		/* Scroll events disable middle-click event */
-		cptkbd_data->middlebutton_state = 2;
-		return 0;
-	}
-
-	/* Middle click events */
-	if (usage->type == EV_KEY && usage->code == BTN_MIDDLE) {
-		if (value == 1) {
-			cptkbd_data->middlebutton_state = 1;
-		} else if (value == 0) {
-			if (cptkbd_data->middlebutton_state == 1) {
-				/* No scrolling inbetween, send middle-click */
-				input_event(field->hidinput->input,
-					EV_KEY, BTN_MIDDLE, 1);
-				input_sync(field->hidinput->input);
-				input_event(field->hidinput->input,
-					EV_KEY, BTN_MIDDLE, 0);
-				input_sync(field->hidinput->input);
-			}
-			cptkbd_data->middlebutton_state = 0;
+	if (cptkbd_data->middlebutton_state != 3) {
+		/* REL_X and REL_Y events during middle button pressed
+		 * are only possible on patched, bug-free firmware
+		 * so set middlebutton_state to 3
+		 * to never apply workaround anymore
+		 */
+		if (cptkbd_data->middlebutton_state == 1 &&
+				usage->type == EV_REL &&
+				(usage->code == REL_X || usage->code == REL_Y)) {
+			cptkbd_data->middlebutton_state = 3;
+			/* send middle button press which was hold before */
+			input_event(field->hidinput->input,
+				EV_KEY, BTN_MIDDLE, 1);
+			input_sync(field->hidinput->input);
+		}
+
+		/* "wheel" scroll events */
+		if (usage->type == EV_REL && (usage->code == REL_WHEEL ||
+				usage->code == REL_HWHEEL)) {
+			/* Scroll events disable middle-click event */
+			cptkbd_data->middlebutton_state = 2;
+			return 0;
+		}
+
+		/* Middle click events */
+		if (usage->type == EV_KEY && usage->code == BTN_MIDDLE) {
+			if (value == 1) {
+				cptkbd_data->middlebutton_state = 1;
+			} else if (value == 0) {
+				if (cptkbd_data->middlebutton_state == 1) {
+					/* No scrolling inbetween, send middle-click */
+					input_event(field->hidinput->input,
+						EV_KEY, BTN_MIDDLE, 1);
+					input_sync(field->hidinput->input);
+					input_event(field->hidinput->input,
+						EV_KEY, BTN_MIDDLE, 0);
+					input_sync(field->hidinput->input);
+				}
+				cptkbd_data->middlebutton_state = 0;
+			}
+			return 1;
 		}
-		return 1;
 	}
 
 	return 0;

From e0d739e66bc1607609da9ba2fd277b4b52ca0b7b Mon Sep 17 00:00:00 2001
From: Vincent Whitchurch <vincent.whitchurch@axis.com>
Date: Mon, 21 Aug 2023 08:45:21 +0100
Subject: [PATCH 0532/1043] ARM: 9320/1: fix stack depot IRQ stack filter

[ Upstream commit b0150014878c32197cfa66e3e2f79e57f66babc0 ]

Place IRQ handlers such as gic_handle_irq() in the irqentry section even
if FUNCTION_GRAPH_TRACER is not enabled.  Without this, the stack
depot's filter_irq_stacks() does not correctly filter out IRQ stacks in
those configurations, which hampers deduplication and eventually leads
to "Stack depot reached limit capacity" splats with KASAN.

A similar fix was done for arm64 in commit f6794950f0e5ba37e3bbed
("arm64: set __exception_irq_entry with __irq_entry as a default").

Link: https://lore.kernel.org/r/20230803-arm-irqentry-v1-1-8aad8e260b1c@axis.com

Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/include/asm/exception.h | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/arch/arm/include/asm/exception.h b/arch/arm/include/asm/exception.h
index 58e039a851af..3c82975d46db 100644
--- a/arch/arm/include/asm/exception.h
+++ b/arch/arm/include/asm/exception.h
@@ -10,10 +10,6 @@
 
 #include <linux/interrupt.h>
 
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
 #define __exception_irq_entry	__irq_entry
-#else
-#define __exception_irq_entry
-#endif
 
 #endif /* __ASM_ARM_EXCEPTION_H */

From 25354bae4fc310c3928e8a42fda2d486f67745d7 Mon Sep 17 00:00:00 2001
From: Cezary Rojewski <cezary.rojewski@intel.com>
Date: Fri, 6 Oct 2023 12:28:55 +0200
Subject: [PATCH 0533/1043] ALSA: hda: Fix possible null-ptr-deref when
 assigning a stream

[ Upstream commit f93dc90c2e8ed664985e366aa6459ac83cdab236 ]

While AudioDSP drivers assign streams exclusively of HOST or LINK type,
nothing blocks a user to attempt to assign a COUPLED stream. As
supplied substream instance may be a stub, what is the case when
code-loading, such scenario ends with null-ptr-deref.

Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://lore.kernel.org/r/20231006102857.749143-2-cezary.rojewski@intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/hdac_stream.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sound/hda/hdac_stream.c b/sound/hda/hdac_stream.c
index 1e0f61affd97..5570722458ca 100644
--- a/sound/hda/hdac_stream.c
+++ b/sound/hda/hdac_stream.c
@@ -320,8 +320,10 @@ struct hdac_stream *snd_hdac_stream_assign(struct hdac_bus *bus,
 	struct hdac_stream *res = NULL;
 
 	/* make a non-zero unique key for the substream */
-	int key = (substream->pcm->device << 16) | (substream->number << 2) |
-		(substream->stream + 1);
+	int key = (substream->number << 2) | (substream->stream + 1);
+
+	if (substream->pcm)
+		key |= (substream->pcm->device << 16);
 
 	spin_lock_irq(&bus->reg_lock);
 	list_for_each_entry(azx_dev, &bus->stream_list, list) {

From 65491968365c096c7f36dbae2d6ea5ded40d2db0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
Date: Tue, 19 Sep 2023 15:56:44 +0300
Subject: [PATCH 0534/1043] PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with
 Link Width fields
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 759574abd78e3b47ec45bbd31a64e8832cf73f97 ]

Use FIELD_GET() to extract PCIe Negotiated Link Width field instead of
custom masking and shifting.

Similarly, change custom code that misleadingly used
PCI_EXP_LNKSTA_NLW_SHIFT to prepare value for PCI_EXP_LNKCAP write
to use FIELD_PREP() with correct field define (PCI_EXP_LNKCAP_MLW).

Link: https://lore.kernel.org/r/20230919125648.1920-5-ilpo.jarvinen@linux.intel.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/dwc/pcie-tegra194.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
index a215777df96c..80c2015b49d8 100644
--- a/drivers/pci/controller/dwc/pcie-tegra194.c
+++ b/drivers/pci/controller/dwc/pcie-tegra194.c
@@ -7,6 +7,7 @@
  * Author: Vidya Sagar <vidyas@nvidia.com>
  */
 
+#include <linux/bitfield.h>
 #include <linux/clk.h>
 #include <linux/debugfs.h>
 #include <linux/delay.h>
@@ -346,8 +347,7 @@ static void apply_bad_link_workaround(struct pcie_port *pp)
 	 */
 	val = dw_pcie_readw_dbi(pci, pcie->pcie_cap_base + PCI_EXP_LNKSTA);
 	if (val & PCI_EXP_LNKSTA_LBMS) {
-		current_link_width = (val & PCI_EXP_LNKSTA_NLW) >>
-				     PCI_EXP_LNKSTA_NLW_SHIFT;
+		current_link_width = FIELD_GET(PCI_EXP_LNKSTA_NLW, val);
 		if (pcie->init_link_width > current_link_width) {
 			dev_warn(pci->dev, "PCIe link is bad, width reduced\n");
 			val = dw_pcie_readw_dbi(pci, pcie->pcie_cap_base +
@@ -731,8 +731,7 @@ static void tegra_pcie_enable_system_interrupts(struct pcie_port *pp)
 
 	val_w = dw_pcie_readw_dbi(&pcie->pci, pcie->pcie_cap_base +
 				  PCI_EXP_LNKSTA);
-	pcie->init_link_width = (val_w & PCI_EXP_LNKSTA_NLW) >>
-				PCI_EXP_LNKSTA_NLW_SHIFT;
+	pcie->init_link_width = FIELD_GET(PCI_EXP_LNKSTA_NLW, val_w);
 
 	val_w = dw_pcie_readw_dbi(&pcie->pci, pcie->pcie_cap_base +
 				  PCI_EXP_LNKCTL);
@@ -885,7 +884,7 @@ static void tegra_pcie_prepare_host(struct pcie_port *pp)
 	/* Configure Max lane width from DT */
 	val = dw_pcie_readl_dbi(pci, pcie->pcie_cap_base + PCI_EXP_LNKCAP);
 	val &= ~PCI_EXP_LNKCAP_MLW;
-	val |= (pcie->num_lanes << PCI_EXP_LNKSTA_NLW_SHIFT);
+	val |= FIELD_PREP(PCI_EXP_LNKCAP_MLW, pcie->num_lanes);
 	dw_pcie_writel_dbi(pci, pcie->pcie_cap_base + PCI_EXP_LNKCAP, val);
 
 	config_gen3_gen4_eq_presets(pcie);

From 5cebe796eaaa899599005684eef3ccdd993323e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
Date: Mon, 11 Sep 2023 15:53:51 +0300
Subject: [PATCH 0535/1043] atm: iphase: Do PCI error checks on own line
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c28742447ca9879b52fbaf022ad844f0ffcd749c ]

In get_esi() PCI errors are checked inside line-split "if" conditions (in
addition to the file not following the coding style). To make the code in
get_esi() more readable, fix the coding style and use the usual error
handling pattern with a separate variable.

In addition, initialization of 'error' variable at declaration is not
needed.

No functional changes intended.

Link: https://lore.kernel.org/r/20230911125354.25501-4-ilpo.jarvinen@linux.intel.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/iphase.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index a59554e5b8b0..cc90f550ab75 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -2290,19 +2290,21 @@ static int get_esi(struct atm_dev *dev)
 static int reset_sar(struct atm_dev *dev)  
 {  
 	IADEV *iadev;  
-	int i, error = 1;  
+	int i, error;
 	unsigned int pci[64];  
 	  
 	iadev = INPH_IA_DEV(dev);  
-	for(i=0; i<64; i++)  
-	  if ((error = pci_read_config_dword(iadev->pci,  
-				i*4, &pci[i])) != PCIBIOS_SUCCESSFUL)  
-  	      return error;  
+	for (i = 0; i < 64; i++) {
+		error = pci_read_config_dword(iadev->pci, i * 4, &pci[i]);
+		if (error != PCIBIOS_SUCCESSFUL)
+			return error;
+	}
 	writel(0, iadev->reg+IPHASE5575_EXT_RESET);  
-	for(i=0; i<64; i++)  
-	  if ((error = pci_write_config_dword(iadev->pci,  
-					i*4, pci[i])) != PCIBIOS_SUCCESSFUL)  
-	    return error;  
+	for (i = 0; i < 64; i++) {
+		error = pci_write_config_dword(iadev->pci, i * 4, pci[i]);
+		if (error != PCIBIOS_SUCCESSFUL)
+			return error;
+	}
 	udelay(5);  
 	return 0;  
 }  

From bb83f79f90e92f46466adcfd4fd264a7ae0f0f01 Mon Sep 17 00:00:00 2001
From: Wenchao Hao <haowenchao2@huawei.com>
Date: Wed, 11 Oct 2023 21:03:50 +0800
Subject: [PATCH 0536/1043] scsi: libfc: Fix potential NULL pointer dereference
 in fc_lport_ptp_setup()

[ Upstream commit 4df105f0ce9f6f30cda4e99f577150d23f0c9c5f ]

fc_lport_ptp_setup() did not check the return value of fc_rport_create()
which can return NULL and would cause a NULL pointer dereference. Address
this issue by checking return value of fc_rport_create() and log error
message on fc_rport_create() failed.

Signed-off-by: Wenchao Hao <haowenchao2@huawei.com>
Link: https://lore.kernel.org/r/20231011130350.819571-1-haowenchao2@huawei.com
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/libfc/fc_lport.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index abb14b206be0..82b8477c7d73 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -238,6 +238,12 @@ static void fc_lport_ptp_setup(struct fc_lport *lport,
 	}
 	mutex_lock(&lport->disc.disc_mutex);
 	lport->ptp_rdata = fc_rport_create(lport, remote_fid);
+	if (!lport->ptp_rdata) {
+		printk(KERN_WARNING "libfc: Failed to setup lport 0x%x\n",
+			lport->port_id);
+		mutex_unlock(&lport->disc.disc_mutex);
+		return;
+	}
 	kref_get(&lport->ptp_rdata->kref);
 	lport->ptp_rdata->ids.port_name = remote_wwpn;
 	lport->ptp_rdata->ids.node_name = remote_wwnn;

From 65d78d54e4e5946633b072744aad3a6f4119350a Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Wed, 18 Oct 2023 17:56:31 +0900
Subject: [PATCH 0537/1043] misc: pci_endpoint_test: Add Device ID for R-Car
 S4-8 PCIe controller
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6c4b39937f4e65688ea294725ae432b2565821ff ]

Add Renesas R8A779F0 in pci_device_id table so that pci-epf-test
can be used for testing PCIe EP on R-Car S4-8.

Link: https://lore.kernel.org/linux-pci/20231018085631.1121289-16-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Acked-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/pci_endpoint_test.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index 6c4c85eb7147..b4a07a166605 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -79,6 +79,7 @@
 #define PCI_DEVICE_ID_RENESAS_R8A774B1		0x002b
 #define PCI_DEVICE_ID_RENESAS_R8A774C0		0x002d
 #define PCI_DEVICE_ID_RENESAS_R8A774E1		0x0025
+#define PCI_DEVICE_ID_RENESAS_R8A779F0		0x0031
 
 static DEFINE_IDA(pci_endpoint_test_ida);
 
@@ -993,6 +994,9 @@ static const struct pci_device_id pci_endpoint_test_tbl[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_RENESAS, PCI_DEVICE_ID_RENESAS_R8A774B1),},
 	{ PCI_DEVICE(PCI_VENDOR_ID_RENESAS, PCI_DEVICE_ID_RENESAS_R8A774C0),},
 	{ PCI_DEVICE(PCI_VENDOR_ID_RENESAS, PCI_DEVICE_ID_RENESAS_R8A774E1),},
+	{ PCI_DEVICE(PCI_VENDOR_ID_RENESAS, PCI_DEVICE_ID_RENESAS_R8A779F0),
+	  .driver_data = (kernel_ulong_t)&default_data,
+	},
 	{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E),
 	  .driver_data = (kernel_ulong_t)&j721e_data,
 	},

From 491529d383b795ec5ccfdccc6f5c4ea924e07af5 Mon Sep 17 00:00:00 2001
From: Jiri Kosina <jkosina@suse.cz>
Date: Fri, 27 Oct 2023 15:32:09 +0200
Subject: [PATCH 0538/1043] HID: Add quirk for Dell Pro Wireless Keyboard and
 Mouse KM5221W

[ Upstream commit 62cc9c3cb3ec1bf31cc116146185ed97b450836a ]

This device needs ALWAYS_POLL quirk, otherwise it keeps reconnecting
indefinitely.

Reported-by: Robert Ayrapetyan <robert.ayrapetyan@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-ids.h    | 1 +
 drivers/hid/hid-quirks.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 6712d99ad80d..7c688d7f8ccf 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -345,6 +345,7 @@
 
 #define USB_VENDOR_ID_DELL				0x413c
 #define USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE	0x301a
+#define USB_DEVICE_ID_DELL_PRO_WIRELESS_KM5221W		0x4503
 
 #define USB_VENDOR_ID_DELORME		0x1163
 #define USB_DEVICE_ID_DELORME_EARTHMATE	0x0100
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 4229e5de0674..787349f2de01 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -66,6 +66,7 @@ static const struct hid_device_id hid_quirks[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_STRAFE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51), HID_QUIRK_NOGET },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_PRO_WIRELESS_KM5221W), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC), HID_QUIRK_NOGET },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_2NES2SNES), HID_QUIRK_MULTI_INPUT },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_4NES4SNES), HID_QUIRK_MULTI_INPUT },

From 484cc536a3a2ec3ae7dd28b175c4fde3f6573722 Mon Sep 17 00:00:00 2001
From: Yuezhang Mo <Yuezhang.Mo@sony.com>
Date: Thu, 20 Jul 2023 14:23:08 +0800
Subject: [PATCH 0539/1043] exfat: support handle zero-size directory

[ Upstream commit dab48b8f2fe7264d51ec9eed0adea0fe3c78830a ]

After repairing a corrupted file system with exfatprogs' fsck.exfat,
zero-size directories may result. It is also possible to create
zero-size directories in other exFAT implementation, such as Paragon
ufsd dirver.

As described in the specification, the lower directory size limits
is 0 bytes.

Without this commit, sub-directories and files cannot be created
under a zero-size directory, and it cannot be removed.

Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Andy Wu <Andy.Wu@sony.com>
Reviewed-by: Aoyama Wataru <wataru.aoyama@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/exfat/namei.c | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
index bd00afc5e4c1..d62d961e278d 100644
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -330,14 +330,20 @@ static int exfat_find_empty_entry(struct inode *inode,
 		if (exfat_check_max_dentries(inode))
 			return -ENOSPC;
 
-		/* we trust p_dir->size regardless of FAT type */
-		if (exfat_find_last_cluster(sb, p_dir, &last_clu))
-			return -EIO;
-
 		/*
 		 * Allocate new cluster to this directory
 		 */
-		exfat_chain_set(&clu, last_clu + 1, 0, p_dir->flags);
+		if (ei->start_clu != EXFAT_EOF_CLUSTER) {
+			/* we trust p_dir->size regardless of FAT type */
+			if (exfat_find_last_cluster(sb, p_dir, &last_clu))
+				return -EIO;
+
+			exfat_chain_set(&clu, last_clu + 1, 0, p_dir->flags);
+		} else {
+			/* This directory is empty */
+			exfat_chain_set(&clu, EXFAT_EOF_CLUSTER, 0,
+					ALLOC_NO_FAT_CHAIN);
+		}
 
 		/* allocate a cluster */
 		ret = exfat_alloc_cluster(inode, 1, &clu);
@@ -347,6 +353,11 @@ static int exfat_find_empty_entry(struct inode *inode,
 		if (exfat_zeroed_cluster(inode, clu.dir))
 			return -EIO;
 
+		if (ei->start_clu == EXFAT_EOF_CLUSTER) {
+			ei->start_clu = clu.dir;
+			p_dir->dir = clu.dir;
+		}
+
 		/* append to the FAT chain */
 		if (clu.flags != p_dir->flags) {
 			/* no-fat-chain bit is disabled,
@@ -644,7 +655,7 @@ static int exfat_find(struct inode *dir, struct qstr *qname,
 	info->type = exfat_get_entry_type(ep);
 	info->attr = le16_to_cpu(ep->dentry.file.attr);
 	info->size = le64_to_cpu(ep2->dentry.stream.valid_size);
-	if ((info->type == TYPE_FILE) && (info->size == 0)) {
+	if (info->size == 0) {
 		info->flags = ALLOC_NO_FAT_CHAIN;
 		info->start_clu = EXFAT_EOF_CLUSTER;
 	} else {
@@ -890,6 +901,9 @@ static int exfat_check_dir_empty(struct super_block *sb,
 
 	dentries_per_clu = sbi->dentries_per_clu;
 
+	if (p_dir->dir == EXFAT_EOF_CLUSTER)
+		return 0;
+
 	exfat_chain_dup(&clu, p_dir);
 
 	while (clu.dir != EXFAT_EOF_CLUSTER) {
@@ -1296,7 +1310,8 @@ static int __exfat_rename(struct inode *old_parent_inode,
 		}
 
 		/* Free the clusters if new_inode is a dir(as if exfat_rmdir) */
-		if (new_entry_type == TYPE_DIR) {
+		if (new_entry_type == TYPE_DIR &&
+		    new_ei->start_clu != EXFAT_EOF_CLUSTER) {
 			/* new_ei, new_clu_to_free */
 			struct exfat_chain new_clu_to_free;
 

From 4ef41a7f33ffe1a335e7db7e1564ddc6afad47cc Mon Sep 17 00:00:00 2001
From: Yi Yang <yiyang13@huawei.com>
Date: Mon, 4 Sep 2023 11:52:20 +0800
Subject: [PATCH 0540/1043] tty: vcc: Add check for kstrdup() in vcc_probe()

[ Upstream commit d81ffb87aaa75f842cd7aa57091810353755b3e6 ]

Add check for the return value of kstrdup() and return the error, if it
fails in order to avoid NULL pointer dereference.

Signed-off-by: Yi Yang <yiyang13@huawei.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Link: https://lore.kernel.org/r/20230904035220.48164-1-yiyang13@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/vcc.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c
index 9ffd42e333b8..6b2d35ac6e3b 100644
--- a/drivers/tty/vcc.c
+++ b/drivers/tty/vcc.c
@@ -587,18 +587,22 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 		return -ENOMEM;
 
 	name = kstrdup(dev_name(&vdev->dev), GFP_KERNEL);
+	if (!name) {
+		rv = -ENOMEM;
+		goto free_port;
+	}
 
 	rv = vio_driver_init(&port->vio, vdev, VDEV_CONSOLE_CON, vcc_versions,
 			     ARRAY_SIZE(vcc_versions), NULL, name);
 	if (rv)
-		goto free_port;
+		goto free_name;
 
 	port->vio.debug = vcc_dbg_vio;
 	vcc_ldc_cfg.debug = vcc_dbg_ldc;
 
 	rv = vio_ldc_alloc(&port->vio, &vcc_ldc_cfg, port);
 	if (rv)
-		goto free_port;
+		goto free_name;
 
 	spin_lock_init(&port->lock);
 
@@ -632,6 +636,11 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 		goto unreg_tty;
 	}
 	port->domain = kstrdup(domain, GFP_KERNEL);
+	if (!port->domain) {
+		rv = -ENOMEM;
+		goto unreg_tty;
+	}
+
 
 	mdesc_release(hp);
 
@@ -661,8 +670,9 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 	vcc_table_remove(port->index);
 free_ldc:
 	vio_ldc_free(&port->vio);
-free_port:
+free_name:
 	kfree(name);
+free_port:
 	kfree(port);
 
 	return rv;

From 76716a7604b28d9b77c7c4cb332ad221bb81ede6 Mon Sep 17 00:00:00 2001
From: Hardik Gajjar <hgajjar@de.adit-jv.com>
Date: Fri, 20 Oct 2023 17:33:24 +0200
Subject: [PATCH 0541/1043] usb: gadget: f_ncm: Always set current gadget in
 ncm_bind()

[ Upstream commit a04224da1f3424b2c607b12a3bd1f0e302fb8231 ]

Previously, gadget assignment to the net device occurred exclusively
during the initial binding attempt.

Nevertheless, the gadget pointer could change during bind/unbind
cycles due to various conditions, including the unloading/loading
of the UDC device driver or the detachment/reconnection of an
OTG-capable USB hub device.

This patch relocates the gether_set_gadget() function out from
ncm_opts->bound condition check, ensuring that the correct gadget
is assigned during each bind request.

The provided logs demonstrate the consistency of ncm_opts throughout
the power cycle, while the gadget may change.

* OTG hub connected during boot up and assignment of gadget and
  ncm_opts pointer

[    2.366301] usb 2-1.5: New USB device found, idVendor=2996, idProduct=0105
[    2.366304] usb 2-1.5: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[    2.366306] usb 2-1.5: Product: H2H Bridge
[    2.366308] usb 2-1.5: Manufacturer: Aptiv
[    2.366309] usb 2-1.5: SerialNumber: 13FEB2021
[    2.427989] usb 2-1.5: New USB device found, VID=2996, PID=0105
[    2.428959] dabridge 2-1.5:1.0: dabridge 2-4 total endpoints=5, 0000000093a8d681
[    2.429710] dabridge 2-1.5:1.0: P(0105) D(22.06.22) F(17.3.16) H(1.1) high-speed
[    2.429714] dabridge 2-1.5:1.0: Hub 2-2 P(0151) V(06.87)
[    2.429956] dabridge 2-1.5:1.0: All downstream ports in host mode

[    2.430093] gadget 000000003c414d59 ------> gadget pointer

* NCM opts and associated gadget pointer during First ncm_bind

[   34.763929] NCM opts 00000000aa304ac9
[   34.763930] NCM gadget 000000003c414d59

* OTG capable hub disconnecte or assume driver unload.

[   97.203114] usb 2-1: USB disconnect, device number 2
[   97.203118] usb 2-1.1: USB disconnect, device number 3
[   97.209217] usb 2-1.5: USB disconnect, device number 4
[   97.230990] dabr_udc deleted

* Reconnect the OTG hub or load driver assaign new gadget pointer.

[  111.534035] usb 2-1.1: New USB device found, idVendor=2996, idProduct=0120, bcdDevice= 6.87
[  111.534038] usb 2-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  111.534040] usb 2-1.1: Product: Vendor
[  111.534041] usb 2-1.1: Manufacturer: Aptiv
[  111.534042] usb 2-1.1: SerialNumber: Superior
[  111.535175] usb 2-1.1: New USB device found, VID=2996, PID=0120
[  111.610995] usb 2-1.5: new high-speed USB device number 8 using xhci-hcd
[  111.630052] usb 2-1.5: New USB device found, idVendor=2996, idProduct=0105, bcdDevice=21.02
[  111.630055] usb 2-1.5: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  111.630057] usb 2-1.5: Product: H2H Bridge
[  111.630058] usb 2-1.5: Manufacturer: Aptiv
[  111.630059] usb 2-1.5: SerialNumber: 13FEB2021
[  111.687464] usb 2-1.5: New USB device found, VID=2996, PID=0105
[  111.690375] dabridge 2-1.5:1.0: dabridge 2-8 total endpoints=5, 000000000d87c961
[  111.691172] dabridge 2-1.5:1.0: P(0105) D(22.06.22) F(17.3.16) H(1.1) high-speed
[  111.691176] dabridge 2-1.5:1.0: Hub 2-6 P(0151) V(06.87)
[  111.691646] dabridge 2-1.5:1.0: All downstream ports in host mode

[  111.692298] gadget 00000000dc72f7a9 --------> new gadget ptr on connect

* NCM opts and associated gadget pointer during second ncm_bind

[  113.271786] NCM opts 00000000aa304ac9 -----> same opts ptr used during first bind
[  113.271788] NCM gadget 00000000dc72f7a9 ----> however new gaget ptr, that will not set
                                                 in net_device due to ncm_opts->bound = true

Signed-off-by: Hardik Gajjar <hgajjar@de.adit-jv.com>
Link: https://lore.kernel.org/r/20231020153324.82794-1-hgajjar@de.adit-jv.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/function/f_ncm.c | 27 +++++++++++----------------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index 00aea45a04e9..d42cd1d036bd 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1435,7 +1435,7 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
 	struct usb_composite_dev *cdev = c->cdev;
 	struct f_ncm		*ncm = func_to_ncm(f);
 	struct usb_string	*us;
-	int			status;
+	int			status = 0;
 	struct usb_ep		*ep;
 	struct f_ncm_opts	*ncm_opts;
 
@@ -1453,22 +1453,17 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
 		f->os_desc_table[0].os_desc = &ncm_opts->ncm_os_desc;
 	}
 
-	/*
-	 * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
-	 * configurations are bound in sequence with list_for_each_entry,
-	 * in each configuration its functions are bound in sequence
-	 * with list_for_each_entry, so we assume no race condition
-	 * with regard to ncm_opts->bound access
-	 */
-	if (!ncm_opts->bound) {
-		mutex_lock(&ncm_opts->lock);
-		gether_set_gadget(ncm_opts->net, cdev->gadget);
+	mutex_lock(&ncm_opts->lock);
+	gether_set_gadget(ncm_opts->net, cdev->gadget);
+	if (!ncm_opts->bound)
 		status = gether_register_netdev(ncm_opts->net);
-		mutex_unlock(&ncm_opts->lock);
-		if (status)
-			goto fail;
-		ncm_opts->bound = true;
-	}
+	mutex_unlock(&ncm_opts->lock);
+
+	if (status)
+		goto fail;
+
+	ncm_opts->bound = true;
+
 	us = usb_gstrings_attach(cdev, ncm_strings,
 				 ARRAY_SIZE(ncm_string_defs));
 	if (IS_ERR(us)) {

From 18fa7a30cd0cd7a06e8d477121fbfcc96e5803c6 Mon Sep 17 00:00:00 2001
From: Marco Elver <elver@google.com>
Date: Wed, 25 Oct 2023 19:34:43 +0900
Subject: [PATCH 0542/1043] 9p/trans_fd: Annotate data-racy writes to
 file::f_flags

[ Upstream commit 355f074609dbf3042900ea9d30fcd2b0c323a365 ]

syzbot reported:

 | BUG: KCSAN: data-race in p9_fd_create / p9_fd_create
 |
 | read-write to 0xffff888130fb3d48 of 4 bytes by task 15599 on cpu 0:
 |  p9_fd_open net/9p/trans_fd.c:842 [inline]
 |  p9_fd_create+0x210/0x250 net/9p/trans_fd.c:1092
 |  p9_client_create+0x595/0xa70 net/9p/client.c:1010
 |  v9fs_session_init+0xf9/0xd90 fs/9p/v9fs.c:410
 |  v9fs_mount+0x69/0x630 fs/9p/vfs_super.c:123
 |  legacy_get_tree+0x74/0xd0 fs/fs_context.c:611
 |  vfs_get_tree+0x51/0x190 fs/super.c:1519
 |  do_new_mount+0x203/0x660 fs/namespace.c:3335
 |  path_mount+0x496/0xb30 fs/namespace.c:3662
 |  do_mount fs/namespace.c:3675 [inline]
 |  __do_sys_mount fs/namespace.c:3884 [inline]
 |  [...]
 |
 | read-write to 0xffff888130fb3d48 of 4 bytes by task 15563 on cpu 1:
 |  p9_fd_open net/9p/trans_fd.c:842 [inline]
 |  p9_fd_create+0x210/0x250 net/9p/trans_fd.c:1092
 |  p9_client_create+0x595/0xa70 net/9p/client.c:1010
 |  v9fs_session_init+0xf9/0xd90 fs/9p/v9fs.c:410
 |  v9fs_mount+0x69/0x630 fs/9p/vfs_super.c:123
 |  legacy_get_tree+0x74/0xd0 fs/fs_context.c:611
 |  vfs_get_tree+0x51/0x190 fs/super.c:1519
 |  do_new_mount+0x203/0x660 fs/namespace.c:3335
 |  path_mount+0x496/0xb30 fs/namespace.c:3662
 |  do_mount fs/namespace.c:3675 [inline]
 |  __do_sys_mount fs/namespace.c:3884 [inline]
 |  [...]
 |
 | value changed: 0x00008002 -> 0x00008802

Within p9_fd_open(), O_NONBLOCK is added to f_flags of the read and
write files. This may happen concurrently if e.g. mounting process
modifies the fd in another thread.

Mark the plain read-modify-writes as intentional data-races, with the
assumption that the result of executing the accesses concurrently will
always result in the same result despite the accesses themselves not
being atomic.

Reported-by: syzbot+e441aeeb422763cc5511@syzkaller.appspotmail.com
Signed-off-by: Marco Elver <elver@google.com>
Link: https://lore.kernel.org/r/ZO38mqkS0TYUlpFp@elver.google.com
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Message-ID: <20231025103445.1248103-1-asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/9p/trans_fd.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index e070a0b8e5ca..63f4d2067059 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -823,14 +823,21 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
 		goto out_free_ts;
 	if (!(ts->rd->f_mode & FMODE_READ))
 		goto out_put_rd;
-	/* prevent workers from hanging on IO when fd is a pipe */
-	ts->rd->f_flags |= O_NONBLOCK;
+	/* Prevent workers from hanging on IO when fd is a pipe.
+	 * It's technically possible for userspace or concurrent mounts to
+	 * modify this flag concurrently, which will likely result in a
+	 * broken filesystem. However, just having bad flags here should
+	 * not crash the kernel or cause any other sort of bug, so mark this
+	 * particular data race as intentional so that tooling (like KCSAN)
+	 * can allow it and detect further problems.
+	 */
+	data_race(ts->rd->f_flags |= O_NONBLOCK);
 	ts->wr = fget(wfd);
 	if (!ts->wr)
 		goto out_put_rd;
 	if (!(ts->wr->f_mode & FMODE_WRITE))
 		goto out_put_wr;
-	ts->wr->f_flags |= O_NONBLOCK;
+	data_race(ts->wr->f_flags |= O_NONBLOCK);
 
 	client->trans = ts;
 	client->status = Connected;

From 90e3c3dd930684d6411610b4e83a61d728603c01 Mon Sep 17 00:00:00 2001
From: Axel Lin <axel.lin@ingics.com>
Date: Wed, 13 Apr 2016 08:54:30 +0800
Subject: [PATCH 0543/1043] i2c: sun6i-p2wi: Prevent potential division by zero

[ Upstream commit 5ac61d26b8baff5b2e5a9f3dc1ef63297e4b53e7 ]

Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The
variable set here is later used as a divisor.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c
index 2f6f6468214d..4f7a4f5a1150 100644
--- a/drivers/i2c/busses/i2c-sun6i-p2wi.c
+++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c
@@ -201,6 +201,11 @@ static int p2wi_probe(struct platform_device *pdev)
 		return -EINVAL;
 	}
 
+	if (clk_freq == 0) {
+		dev_err(dev, "clock-frequency is set to 0 in DT\n");
+		return -EINVAL;
+	}
+
 	if (of_get_child_count(np) > 1) {
 		dev_err(dev, "P2WI only supports one slave device\n");
 		return -EINVAL;

From c6b6b8692218da73b33b310d7c1df90f115bdd9a Mon Sep 17 00:00:00 2001
From: Rajeshwar R Shinde <coolrrsh@gmail.com>
Date: Wed, 30 Aug 2023 13:14:01 +0530
Subject: [PATCH 0544/1043] media: gspca: cpia1: shift-out-of-bounds in
 set_flicker

[ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ]

Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'

When the value of the variable "sd->params.exposure.gain" exceeds the
number of bits in an integer, a shift-out-of-bounds error is reported. It
is triggered because the variable "currentexp" cannot be left-shifted by
more than the number of bits in an integer. In order to avoid invalid
range during left-shift, the conditional expression is added.

Reported-by: syzbot+e27f3dbdab04e43b9f73@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73
Signed-off-by: Rajeshwar R Shinde <coolrrsh@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/gspca/cpia1.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c
index d93d384286c1..de945e13c7c6 100644
--- a/drivers/media/usb/gspca/cpia1.c
+++ b/drivers/media/usb/gspca/cpia1.c
@@ -18,6 +18,7 @@
 
 #include <linux/input.h>
 #include <linux/sched/signal.h>
+#include <linux/bitops.h>
 
 #include "gspca.h"
 
@@ -1027,6 +1028,8 @@ static int set_flicker(struct gspca_dev *gspca_dev, int on, int apply)
 			sd->params.exposure.expMode = 2;
 			sd->exposure_status = EXPOSURE_NORMAL;
 		}
+		if (sd->params.exposure.gain >= BITS_PER_TYPE(currentexp))
+			return -EINVAL;
 		currentexp = currentexp << sd->params.exposure.gain;
 		sd->params.exposure.gain = 0;
 		/* round down current exposure to nearest value */

From 0ac2652b9674c1f7b69477255e7e4c4ee40889e5 Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Date: Sat, 23 Sep 2023 17:20:48 +0200
Subject: [PATCH 0545/1043] media: vivid: avoid integer overflow

[ Upstream commit 4567ebf8e8f9546b373e78e3b7d584cc30b62028 ]

Fixes these compiler warnings:

drivers/media/test-drivers/vivid/vivid-rds-gen.c: In function 'vivid_rds_gen_fill':
drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:56: warning: '.' directive output may be truncated writing 1 byte into a region of size between 0 and 3 [-Wformat-truncation=]
  147 |         snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d",
      |                                                        ^
drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:52: note: directive argument in the range [0, 9]
  147 |         snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d",
      |                                                    ^~~~~~~~~
drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:9: note: 'snprintf' output between 9 and 12 bytes into a destination of size 9
  147 |         snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d",
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  148 |                  freq / 16, ((freq & 0xf) * 10) / 16);
      |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/test-drivers/vivid/vivid-rds-gen.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/test-drivers/vivid/vivid-rds-gen.c b/drivers/media/test-drivers/vivid/vivid-rds-gen.c
index b5b104ee64c9..c57771119a34 100644
--- a/drivers/media/test-drivers/vivid/vivid-rds-gen.c
+++ b/drivers/media/test-drivers/vivid/vivid-rds-gen.c
@@ -145,7 +145,7 @@ void vivid_rds_gen_fill(struct vivid_rds_gen *rds, unsigned freq,
 	rds->ta = alt;
 	rds->ms = true;
 	snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d",
-		 freq / 16, ((freq & 0xf) * 10) / 16);
+		 (freq / 16) % 1000000, (((freq & 0xf) * 10) / 16) % 10);
 	if (alt)
 		strscpy(rds->radiotext,
 			" The Radio Data System can switch between different Radio Texts ",

From 2a054b87a1b799b391e578597a42ee6e57a987ae Mon Sep 17 00:00:00 2001
From: Bob Peterson <rpeterso@redhat.com>
Date: Thu, 21 Sep 2023 08:46:43 -0500
Subject: [PATCH 0546/1043] gfs2: ignore negated quota changes

[ Upstream commit 4c6a08125f2249531ec01783a5f4317d7342add5 ]

When lots of quota changes are made, there may be cases in which an
inode's quota information is increased and then decreased, such as when
blocks are added to a file, then deleted from it. If the timing is
right, function do_qc can add pending quota changes to a transaction,
then later, another call to do_qc can negate those changes, resulting
in a net gain of 0. The quota_change information is recorded in the qc
buffer (and qd element of the inode as well). The buffer is added to the
transaction by the first call to do_qc, but a subsequent call changes
the value from non-zero back to zero. At that point it's too late to
remove the buffer_head from the transaction. Later, when the quota sync
code is called, the zero-change qd element is discovered and flagged as
an assert warning. If the fs is mounted with errors=panic, the kernel
will panic.

This is usually seen when files are truncated and the quota changes are
negated by punch_hole/truncate which uses gfs2_quota_hold and
gfs2_quota_unhold rather than block allocations that use gfs2_quota_lock
and gfs2_quota_unlock which automatically do quota sync.

This patch solves the problem by adding a check to qd_check_sync such
that net-zero quota changes already added to the transaction are no
longer deemed necessary to be synced, and skipped.

In this case references are taken for the qd and the slot from do_qc
so those need to be put. The normal sequence of events for a normal
non-zero quota change is as follows:

gfs2_quota_change
   do_qc
      qd_hold
      slot_hold

Later, when the changes are to be synced:

gfs2_quota_sync
   qd_fish
      qd_check_sync
         gets qd ref via lockref_get_not_dead
   do_sync
      do_qc(QC_SYNC)
         qd_put
	    lockref_put_or_lock
   qd_unlock
      qd_put
         lockref_put_or_lock

In the net-zero change case, we add a check to qd_check_sync so it puts
the qd and slot references acquired in gfs2_quota_change and skip the
unneeded sync.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/quota.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index ad953ecb5853..8c226aa28633 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -431,6 +431,17 @@ static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd,
 	    (sync_gen && (qd->qd_sync_gen >= *sync_gen)))
 		return 0;
 
+	/*
+	 * If qd_change is 0 it means a pending quota change was negated.
+	 * We should not sync it, but we still have a qd reference and slot
+	 * reference taken by gfs2_quota_change -> do_qc that need to be put.
+	 */
+	if (!qd->qd_change && test_and_clear_bit(QDF_CHANGE, &qd->qd_flags)) {
+		slot_put(qd);
+		qd_put(qd);
+		return 0;
+	}
+
 	if (!lockref_get_not_dead(&qd->qd_lockref))
 		return 0;
 

From 5f8d51a04baf4e87f5844749f244ecbab8be946c Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Mon, 2 Oct 2023 03:33:44 +0100
Subject: [PATCH 0547/1043] gfs2: fix an oops in gfs2_permission

[ Upstream commit 0abd1557e21c617bd13fc18f7725fc6363c05913 ]

In RCU mode, we might race with gfs2_evict_inode(), which zeroes
->i_gl.  Freeing of the object it points to is RCU-delayed, so
if we manage to fetch the pointer before it's been replaced with
NULL, we are fine.  Check if we'd fetched NULL and treat that
as "bail out and tell the caller to get out of RCU mode".

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/inode.c | 11 +++++++++--
 fs/gfs2/super.c |  2 +-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 74a6b0800e05..963dc72e7155 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -1837,14 +1837,21 @@ int gfs2_permission(struct inode *inode, int mask)
 {
 	struct gfs2_inode *ip;
 	struct gfs2_holder i_gh;
+	struct gfs2_glock *gl;
 	int error;
 
 	gfs2_holder_mark_uninitialized(&i_gh);
 	ip = GFS2_I(inode);
-	if (gfs2_glock_is_locked_by_me(ip->i_gl) == NULL) {
+	gl = rcu_dereference(ip->i_gl);
+	if (unlikely(!gl)) {
+		/* inode is getting torn down, must be RCU mode */
+		WARN_ON_ONCE(!(mask & MAY_NOT_BLOCK));
+		return -ECHILD;
+        }
+	if (gfs2_glock_is_locked_by_me(gl) == NULL) {
 		if (mask & MAY_NOT_BLOCK)
 			return -ECHILD;
-		error = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh);
+		error = gfs2_glock_nq_init(gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh);
 		if (error)
 			return error;
 	}
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index b61de8dab51a..8cf4ef61cdc4 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1471,7 +1471,7 @@ static void gfs2_evict_inode(struct inode *inode)
 		wait_on_bit_io(&ip->i_flags, GIF_GLOP_PENDING, TASK_UNINTERRUPTIBLE);
 		gfs2_glock_add_to_lru(ip->i_gl);
 		gfs2_glock_put_eventually(ip->i_gl);
-		ip->i_gl = NULL;
+		rcu_assign_pointer(ip->i_gl, NULL);
 	}
 }
 

From cf8519f40ce30a66f7bf05ea31a4fab7253580bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
Date: Wed, 13 Sep 2023 15:27:40 +0300
Subject: [PATCH 0548/1043] media: cobalt: Use FIELD_GET() to extract Link
 Width
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f301fedbeecfdce91cb898d6fa5e62f269801fee ]

Use FIELD_GET() to extract PCIe Negotiated and Maximum Link Width fields
instead of custom masking and shifting.

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cobalt/cobalt-driver.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/media/pci/cobalt/cobalt-driver.c b/drivers/media/pci/cobalt/cobalt-driver.c
index 1bd8bbe57a30..1f230b14cbfd 100644
--- a/drivers/media/pci/cobalt/cobalt-driver.c
+++ b/drivers/media/pci/cobalt/cobalt-driver.c
@@ -8,6 +8,7 @@
  *  All rights reserved.
  */
 
+#include <linux/bitfield.h>
 #include <linux/delay.h>
 #include <media/i2c/adv7604.h>
 #include <media/i2c/adv7842.h>
@@ -210,17 +211,17 @@ void cobalt_pcie_status_show(struct cobalt *cobalt)
 	pcie_capability_read_word(pci_dev, PCI_EXP_LNKSTA, &stat);
 	cobalt_info("PCIe link capability 0x%08x: %s per lane and %u lanes\n",
 			capa, get_link_speed(capa),
-			(capa & PCI_EXP_LNKCAP_MLW) >> 4);
+			FIELD_GET(PCI_EXP_LNKCAP_MLW, capa));
 	cobalt_info("PCIe link control 0x%04x\n", ctrl);
 	cobalt_info("PCIe link status 0x%04x: %s per lane and %u lanes\n",
 		    stat, get_link_speed(stat),
-		    (stat & PCI_EXP_LNKSTA_NLW) >> 4);
+		    FIELD_GET(PCI_EXP_LNKSTA_NLW, stat));
 
 	/* Bus */
 	pcie_capability_read_dword(pci_bus_dev, PCI_EXP_LNKCAP, &capa);
 	cobalt_info("PCIe bus link capability 0x%08x: %s per lane and %u lanes\n",
 			capa, get_link_speed(capa),
-			(capa & PCI_EXP_LNKCAP_MLW) >> 4);
+			FIELD_GET(PCI_EXP_LNKCAP_MLW, capa));
 
 	/* Slot */
 	pcie_capability_read_dword(pci_dev, PCI_EXP_SLTCAP, &capa);
@@ -239,7 +240,7 @@ static unsigned pcie_link_get_lanes(struct cobalt *cobalt)
 	if (!pci_is_pcie(pci_dev))
 		return 0;
 	pcie_capability_read_word(pci_dev, PCI_EXP_LNKSTA, &link);
-	return (link & PCI_EXP_LNKSTA_NLW) >> 4;
+	return FIELD_GET(PCI_EXP_LNKSTA_NLW, link);
 }
 
 static unsigned pcie_bus_link_get_lanes(struct cobalt *cobalt)
@@ -250,7 +251,7 @@ static unsigned pcie_bus_link_get_lanes(struct cobalt *cobalt)
 	if (!pci_is_pcie(pci_dev))
 		return 0;
 	pcie_capability_read_dword(pci_dev, PCI_EXP_LNKCAP, &link);
-	return (link & PCI_EXP_LNKCAP_MLW) >> 4;
+	return FIELD_GET(PCI_EXP_LNKCAP_MLW, link);
 }
 
 static void msi_config_show(struct cobalt *cobalt, struct pci_dev *pci_dev)

From 0f5068519f89d928d6c51100e4b274479123829f Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 22 Sep 2023 14:38:07 +0200
Subject: [PATCH 0549/1043] media: imon: fix access to invalid resource for the
 second interface

[ Upstream commit a1766a4fd83befa0b34d932d532e7ebb7fab1fa7 ]

imon driver probes two USB interfaces, and at the probe of the second
interface, the driver assumes blindly that the first interface got
bound with the same imon driver.  It's usually true, but it's still
possible that the first interface is bound with another driver via a
malformed descriptor.  Then it may lead to a memory corruption, as
spotted by syzkaller; imon driver accesses the data from drvdata as
struct imon_context object although it's a completely different one
that was assigned by another driver.

This patch adds a sanity check -- whether the first interface is
really bound with the imon driver or not -- for avoiding the problem
above at the probe time.

Reported-by: syzbot+59875ffef5cb9c9b29e9@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000a838aa0603cc74d6@google.com/
Tested-by: Ricardo B. Marliere <ricardo@marliere.net>
Link: https://lore.kernel.org/r/20230922005152.163640-1-ricardo@marliere.net
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/imon.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 98a38755c694..253a1d1a840a 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -2430,6 +2430,12 @@ static int imon_probe(struct usb_interface *interface,
 		goto fail;
 	}
 
+	if (first_if->dev.driver != interface->dev.driver) {
+		dev_err(&interface->dev, "inconsistent driver matching\n");
+		ret = -EINVAL;
+		goto fail;
+	}
+
 	if (ifnum == 0) {
 		ictx = imon_init_intf0(interface, id);
 		if (!ictx) {

From 79b6a90f4f2433312154cd68452b0ba501fa74db Mon Sep 17 00:00:00 2001
From: Wayne Lin <wayne.lin@amd.com>
Date: Fri, 8 Sep 2023 10:14:49 +0800
Subject: [PATCH 0550/1043] drm/amd/display: Avoid NULL dereference of timing
 generator

[ Upstream commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 ]

[Why & How]
Check whether assigned timing generator is NULL or not before
accessing its funcs to prevent NULL dereference.

Reviewed-by: Jun Lei <jun.lei@amd.com>
Acked-by: Hersen Wu <hersenxs.wu@amd.com>
Signed-off-by: Wayne Lin <wayne.lin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index d48fd87d3b95..8206c6edba74 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -534,7 +534,7 @@ uint32_t dc_stream_get_vblank_counter(const struct dc_stream_state *stream)
 	for (i = 0; i < MAX_PIPES; i++) {
 		struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg;
 
-		if (res_ctx->pipe_ctx[i].stream != stream)
+		if (res_ctx->pipe_ctx[i].stream != stream || !tg)
 			continue;
 
 		return tg->funcs->get_frame_count(tg);
@@ -593,7 +593,7 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state *stream,
 	for (i = 0; i < MAX_PIPES; i++) {
 		struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg;
 
-		if (res_ctx->pipe_ctx[i].stream != stream)
+		if (res_ctx->pipe_ctx[i].stream != stream || !tg)
 			continue;
 
 		tg->funcs->get_scanoutpos(tg,

From 3cfacacb9caa3c5ec332d06fc8106da84e47cd4b Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Tue, 22 Aug 2023 13:19:46 -0700
Subject: [PATCH 0551/1043] kgdb: Flush console before entering kgdb on panic

[ Upstream commit dd712d3d45807db9fcae28a522deee85c1f2fde6 ]

When entering kdb/kgdb on a kernel panic, it was be observed that the
console isn't flushed before the `kdb` prompt came up. Specifically,
when using the buddy lockup detector on arm64 and running:
  echo HARDLOCKUP > /sys/kernel/debug/provoke-crash/DIRECT

I could see:
  [   26.161099] lkdtm: Performing direct entry HARDLOCKUP
  [   32.499881] watchdog: Watchdog detected hard LOCKUP on cpu 6
  [   32.552865] Sending NMI from CPU 5 to CPUs 6:
  [   32.557359] NMI backtrace for cpu 6
  ... [backtrace for cpu 6] ...
  [   32.558353] NMI backtrace for cpu 5
  ... [backtrace for cpu 5] ...
  [   32.867471] Sending NMI from CPU 5 to CPUs 0-4,7:
  [   32.872321] NMI backtrace forP cpuANC: Hard LOCKUP

  Entering kdb (current=..., pid 0) on processor 5 due to Keyboard Entry
  [5]kdb>

As you can see, backtraces for the other CPUs start printing and get
interleaved with the kdb PANIC print.

Let's replicate the commands to flush the console in the kdb panic
entry point to avoid this.

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20230822131945.1.I5b460ae8f954e4c4f628a373d6e74713c06dd26f@changeid
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/debug/debug_core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
index 0f31b22abe8d..ef54254a5dd1 100644
--- a/kernel/debug/debug_core.c
+++ b/kernel/debug/debug_core.c
@@ -1022,6 +1022,9 @@ void kgdb_panic(const char *msg)
 	if (panic_timeout)
 		return;
 
+	debug_locks_off();
+	console_flush_on_panic(CONSOLE_FLUSH_PENDING);
+
 	if (dbg_kdb_mode)
 		kdb_printf("PANIC: %s\n", msg);
 

From f1ea84696ea5e7a5a2fb6f60e1716664e01578ab Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Mon, 30 Oct 2023 07:23:38 +0200
Subject: [PATCH 0552/1043] ASoC: ti: omap-mcbsp: Fix runtime PM underflow
 warnings

[ Upstream commit fbb74e56378d8306f214658e3d525a8b3f000c5a ]

We need to check for an active device as otherwise we get warnings
for some mcbsp instances for "Runtime PM usage count underflow!".

Reported-by: Andreas Kemnade <andreas@kemnade.info>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20231030052340.13415-1-tony@atomide.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/ti/omap-mcbsp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sound/soc/ti/omap-mcbsp.c b/sound/soc/ti/omap-mcbsp.c
index 6025b30bbe77..9a88992ac5f3 100644
--- a/sound/soc/ti/omap-mcbsp.c
+++ b/sound/soc/ti/omap-mcbsp.c
@@ -74,14 +74,16 @@ static int omap2_mcbsp_set_clks_src(struct omap_mcbsp *mcbsp, u8 fck_src_id)
 		return -EINVAL;
 	}
 
-	pm_runtime_put_sync(mcbsp->dev);
+	if (mcbsp->active)
+		pm_runtime_put_sync(mcbsp->dev);
 
 	r = clk_set_parent(mcbsp->fclk, fck_src);
 	if (r)
 		dev_err(mcbsp->dev, "CLKS: could not clk_set_parent() to %s\n",
 			src);
 
-	pm_runtime_get_sync(mcbsp->dev);
+	if (mcbsp->active)
+		pm_runtime_get_sync(mcbsp->dev);
 
 	clk_put(fck_src);
 

From 53b2393eeba7c215c69de77c12c0c5fcead7fa15 Mon Sep 17 00:00:00 2001
From: Vitaly Prosyak <vitaly.prosyak@amd.com>
Date: Wed, 11 Oct 2023 19:31:48 -0400
Subject: [PATCH 0553/1043] drm/amdgpu: fix software pci_unplug on some chips

[ Upstream commit 4638e0c29a3f2294d5de0d052a4b8c9f33ccb957 ]

When software 'pci unplug' using IGT is executed we got a sysfs directory
entry is NULL for differant ras blocks like hdp, umc, etc.
Before call 'sysfs_remove_file_from_group' and 'sysfs_remove_group'
check that 'sd' is  not NULL.

[  +0.000001] RIP: 0010:sysfs_remove_group+0x83/0x90
[  +0.000002] Code: 31 c0 31 d2 31 f6 31 ff e9 9a a8 b4 00 4c 89 e7 e8 f2 a2 ff ff eb c2 49 8b 55 00 48 8b 33 48 c7 c7 80 65 94 82 e8 cd 82 bb ff <0f> 0b eb cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90
[  +0.000001] RSP: 0018:ffffc90002067c90 EFLAGS: 00010246
[  +0.000002] RAX: 0000000000000000 RBX: ffffffff824ea180 RCX: 0000000000000000
[  +0.000001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  +0.000001] RBP: ffffc90002067ca8 R08: 0000000000000000 R09: 0000000000000000
[  +0.000001] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  +0.000001] R13: ffff88810a395f48 R14: ffff888101aab0d0 R15: 0000000000000000
[  +0.000001] FS:  00007f5ddaa43a00(0000) GS:ffff88841e800000(0000) knlGS:0000000000000000
[  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  +0.000001] CR2: 00007f8ffa61ba50 CR3: 0000000106432000 CR4: 0000000000350ef0
[  +0.000001] Call Trace:
[  +0.000001]  <TASK>
[  +0.000001]  ? show_regs+0x72/0x90
[  +0.000002]  ? sysfs_remove_group+0x83/0x90
[  +0.000002]  ? __warn+0x8d/0x160
[  +0.000001]  ? sysfs_remove_group+0x83/0x90
[  +0.000001]  ? report_bug+0x1bb/0x1d0
[  +0.000003]  ? handle_bug+0x46/0x90
[  +0.000001]  ? exc_invalid_op+0x19/0x80
[  +0.000002]  ? asm_exc_invalid_op+0x1b/0x20
[  +0.000003]  ? sysfs_remove_group+0x83/0x90
[  +0.000001]  dpm_sysfs_remove+0x61/0x70
[  +0.000002]  device_del+0xa3/0x3d0
[  +0.000002]  ? ktime_get_mono_fast_ns+0x46/0xb0
[  +0.000002]  device_unregister+0x18/0x70
[  +0.000001]  i2c_del_adapter+0x26d/0x330
[  +0.000002]  arcturus_i2c_control_fini+0x25/0x50 [amdgpu]
[  +0.000236]  smu_sw_fini+0x38/0x260 [amdgpu]
[  +0.000241]  amdgpu_device_fini_sw+0x116/0x670 [amdgpu]
[  +0.000186]  ? mutex_lock+0x13/0x50
[  +0.000003]  amdgpu_driver_release_kms+0x16/0x40 [amdgpu]
[  +0.000192]  drm_minor_release+0x4f/0x80 [drm]
[  +0.000025]  drm_release+0xfe/0x150 [drm]
[  +0.000027]  __fput+0x9f/0x290
[  +0.000002]  ____fput+0xe/0x20
[  +0.000002]  task_work_run+0x61/0xa0
[  +0.000002]  exit_to_user_mode_prepare+0x150/0x170
[  +0.000002]  syscall_exit_to_user_mode+0x2a/0x50

Cc: Hawking Zhang <hawking.zhang@amd.com>
Cc: Luben Tuikov <luben.tuikov@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian Koenig <christian.koenig@amd.com>
Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
Reviewed-by: Luben Tuikov <luben.tuikov@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 3638f0e12a2b..a8f1c4969fac 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -1031,7 +1031,8 @@ static void amdgpu_ras_sysfs_remove_bad_page_node(struct amdgpu_device *adev)
 {
 	struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
 
-	sysfs_remove_file_from_group(&adev->dev->kobj,
+	if (adev->dev->kobj.sd)
+		sysfs_remove_file_from_group(&adev->dev->kobj,
 				&con->badpages_attr.attr,
 				RAS_FS_NAME);
 }
@@ -1048,7 +1049,8 @@ static int amdgpu_ras_sysfs_remove_feature_node(struct amdgpu_device *adev)
 		.attrs = attrs,
 	};
 
-	sysfs_remove_group(&adev->dev->kobj, &group);
+	if (adev->dev->kobj.sd)
+		sysfs_remove_group(&adev->dev->kobj, &group);
 
 	return 0;
 }
@@ -1096,7 +1098,8 @@ int amdgpu_ras_sysfs_remove(struct amdgpu_device *adev,
 	if (!obj || !obj->attr_inuse)
 		return -EINVAL;
 
-	sysfs_remove_file_from_group(&adev->dev->kobj,
+	if (adev->dev->kobj.sd)
+		sysfs_remove_file_from_group(&adev->dev->kobj,
 				&obj->sysfs_attr.attr,
 				RAS_FS_NAME);
 	obj->attr_inuse = 0;

From e52518b9cb9fc98fc043c8fb2b8cfc619ca8a88b Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Wed, 25 Oct 2023 14:58:18 +0300
Subject: [PATCH 0554/1043] pwm: Fix double shift bug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d27abbfd4888d79dd24baf50e774631046ac4732 ]

These enums are passed to set/test_bit().  The set/test_bit() functions
take a bit number instead of a shifted value.  Passing a shifted value
is a double shift bug like doing BIT(BIT(1)).  The double shift bug
doesn't cause a problem here because we are only checking 0 and 1 but
if the value was 5 or above then it can lead to a buffer overflow.

Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/pwm.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/pwm.h b/include/linux/pwm.h
index a13ff383fa1d..c0cf6613373f 100644
--- a/include/linux/pwm.h
+++ b/include/linux/pwm.h
@@ -44,8 +44,8 @@ struct pwm_args {
 };
 
 enum {
-	PWMF_REQUESTED = 1 << 0,
-	PWMF_EXPORTED = 1 << 1,
+	PWMF_REQUESTED = 0,
+	PWMF_EXPORTED = 1,
 };
 
 /*

From 6ebd42a7b713c2497d8e438868d61f0b6514824a Mon Sep 17 00:00:00 2001
From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Date: Wed, 13 Sep 2023 14:56:45 +0300
Subject: [PATCH 0555/1043] wifi: iwlwifi: Use FW rate for non-data frames

[ Upstream commit 499d02790495958506a64f37ceda7e97345a50a8 ]

Currently we are setting the rate in the tx cmd for
mgmt frames (e.g. during connection establishment).
This was problematic when sending mgmt frames in eSR mode,
as we don't know what link this frame will be sent on
(This is decided by the FW), so we don't know what is the
lowest rate.
Fix this by not setting the rate in tx cmd and rely
on FW to choose the right one.
Set rate only for injected frames with fixed rate,
or when no sta is given.
Also set for important frames (EAPOL etc.) the High Priority flag.

Fixes: 055b22e770dd ("iwlwifi: mvm: Set Tx rate and flags when there is not station")
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230913145231.6c7e59620ee0.I6eaed3ccdd6dd62b9e664facc484081fc5275843@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index d310337b1625..99150fec151b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -532,16 +532,20 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb,
 			flags |= IWL_TX_FLAGS_ENCRYPT_DIS;
 
 		/*
-		 * For data packets rate info comes from the fw. Only
-		 * set rate/antenna during connection establishment or in case
-		 * no station is given.
+		 * For data and mgmt packets rate info comes from the fw. Only
+		 * set rate/antenna for injected frames with fixed rate, or
+		 * when no sta is given.
 		 */
-		if (!sta || !ieee80211_is_data(hdr->frame_control) ||
-		    mvmsta->sta_state < IEEE80211_STA_AUTHORIZED) {
+		if (unlikely(!sta ||
+			     info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)) {
 			flags |= IWL_TX_FLAGS_CMD_RATE;
 			rate_n_flags =
 				iwl_mvm_get_tx_rate_n_flags(mvm, info, sta,
 							    hdr->frame_control);
+		} else if (!ieee80211_is_data(hdr->frame_control) ||
+			   mvmsta->sta_state < IEEE80211_STA_AUTHORIZED) {
+			/* These are important frames */
+			flags |= IWL_TX_FLAGS_HIGH_PRI;
 		}
 
 		if (mvm->trans->trans_cfg->device_family >=

From 4ea3b98fa6a17e46fc73fa473cd2bf512693931d Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Fri, 29 Jan 2021 15:00:36 +0200
Subject: [PATCH 0556/1043] xhci: turn cancelled td cleanup to its own function

[ Upstream commit 4db356924a50f72a00834ae04f11202d9703faeb ]

Refactor handler for stop endpoint command completion. Yank out the part
that invalidates cancelled TDs and turn it into a separate function.

Invalidating cancelled TDs should be done while the ring is stopped,
but not exclusively in the stop endpoint command completeion handler.

We will need to invalidate TDs after resetting endpoints as well.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20210129130044.206855-20-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: a5f928db5951 ("usb: host: xhci-plat: fix possible kernel oops while resuming")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci-ring.c | 108 +++++++++++++++++------------------
 1 file changed, 53 insertions(+), 55 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5ee095a5d38a..eb70f07e3623 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -868,6 +868,58 @@ static void xhci_handle_halted_endpoint(struct xhci_hcd *xhci,
 	xhci_ring_cmd_db(xhci);
 }
 
+/*
+ * Fix up the ep ring first, so HW stops executing cancelled TDs.
+ * We have the xHCI lock, so nothing can modify this list until we drop it.
+ * We're also in the event handler, so we can't get re-interrupted if another
+ * Stop Endpoint command completes.
+ */
+
+static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep,
+					 struct xhci_dequeue_state *deq_state)
+{
+	struct xhci_hcd		*xhci;
+	struct xhci_td		*td = NULL;
+	struct xhci_td		*tmp_td = NULL;
+	struct xhci_ring	*ring;
+	u64			hw_deq;
+
+	xhci = ep->xhci;
+
+	list_for_each_entry_safe(td, tmp_td, &ep->cancelled_td_list, cancelled_td_list) {
+		xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+				"Removing canceled TD starting at 0x%llx (dma).",
+				(unsigned long long)xhci_trb_virt_to_dma(
+					td->start_seg, td->first_trb));
+		list_del_init(&td->td_list);
+		ring = xhci_urb_to_transfer_ring(xhci, td->urb);
+		if (!ring) {
+			xhci_warn(xhci, "WARN Cancelled URB %p has invalid stream ID %u.\n",
+				  td->urb, td->urb->stream_id);
+			continue;
+		}
+		/*
+		 * If ring stopped on the TD we need to cancel, then we have to
+		 * move the xHC endpoint ring dequeue pointer past this TD.
+		 */
+		hw_deq = xhci_get_hw_deq(xhci, ep->vdev, ep->ep_index,
+					 td->urb->stream_id);
+		hw_deq &= ~0xf;
+
+		if (trb_in_td(xhci, td->start_seg, td->first_trb,
+			      td->last_trb, hw_deq, false)) {
+			xhci_find_new_dequeue_state(xhci, ep->vdev->slot_id,
+						    ep->ep_index,
+						    td->urb->stream_id,
+						    td, deq_state);
+		} else {
+			td_to_noop(xhci, ring, td, false);
+		}
+
+	}
+	return 0;
+}
+
 /*
  * When we get a command completion for a Stop Endpoint Command, we need to
  * unlink any cancelled TDs from the ring.  There are two ways to do that:
@@ -888,7 +940,6 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
 	struct xhci_td *last_unlinked_td;
 	struct xhci_ep_ctx *ep_ctx;
 	struct xhci_virt_device *vdev;
-	u64 hw_deq;
 	struct xhci_dequeue_state deq_state;
 
 	if (unlikely(TRB_TO_SUSPEND_PORT(le32_to_cpu(trb->generic.field[3])))) {
@@ -919,60 +970,7 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
 		return;
 	}
 
-	/* Fix up the ep ring first, so HW stops executing cancelled TDs.
-	 * We have the xHCI lock, so nothing can modify this list until we drop
-	 * it.  We're also in the event handler, so we can't get re-interrupted
-	 * if another Stop Endpoint command completes
-	 */
-	list_for_each_entry(cur_td, &ep->cancelled_td_list, cancelled_td_list) {
-		xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
-				"Removing canceled TD starting at 0x%llx (dma).",
-				(unsigned long long)xhci_trb_virt_to_dma(
-					cur_td->start_seg, cur_td->first_trb));
-		ep_ring = xhci_urb_to_transfer_ring(xhci, cur_td->urb);
-		if (!ep_ring) {
-			/* This shouldn't happen unless a driver is mucking
-			 * with the stream ID after submission.  This will
-			 * leave the TD on the hardware ring, and the hardware
-			 * will try to execute it, and may access a buffer
-			 * that has already been freed.  In the best case, the
-			 * hardware will execute it, and the event handler will
-			 * ignore the completion event for that TD, since it was
-			 * removed from the td_list for that endpoint.  In
-			 * short, don't muck with the stream ID after
-			 * submission.
-			 */
-			xhci_warn(xhci, "WARN Cancelled URB %p "
-					"has invalid stream ID %u.\n",
-					cur_td->urb,
-					cur_td->urb->stream_id);
-			goto remove_finished_td;
-		}
-		/*
-		 * If we stopped on the TD we need to cancel, then we have to
-		 * move the xHC endpoint ring dequeue pointer past this TD.
-		 */
-		hw_deq = xhci_get_hw_deq(xhci, vdev, ep_index,
-					 cur_td->urb->stream_id);
-		hw_deq &= ~0xf;
-
-		if (trb_in_td(xhci, cur_td->start_seg, cur_td->first_trb,
-			      cur_td->last_trb, hw_deq, false)) {
-			xhci_find_new_dequeue_state(xhci, slot_id, ep_index,
-						    cur_td->urb->stream_id,
-						    cur_td, &deq_state);
-		} else {
-			td_to_noop(xhci, ep_ring, cur_td, false);
-		}
-
-remove_finished_td:
-		/*
-		 * The event handler won't see a completion for this TD anymore,
-		 * so remove it from the endpoint ring's TD list.  Keep it in
-		 * the cancelled TD list for URB completion later.
-		 */
-		list_del_init(&cur_td->td_list);
-	}
+	xhci_invalidate_cancelled_tds(ep, &deq_state);
 
 	xhci_stop_watchdog_timer_in_irq(xhci, ep);
 

From c7eacf01ddb1156ebbfee2916cf1b38ba7fc1e05 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Sun, 17 Sep 2023 09:06:05 -0400
Subject: [PATCH 0557/1043] SUNRPC: ECONNRESET might require a rebind

[ Upstream commit 4b09ca1508a60be30b2e3940264e93d7aeb5c97e ]

If connect() is returning ECONNRESET, it usually means that nothing is
listening on that port. If so, a rebind might be required in order to
obtain the new port on which the RPC service is listening.

Fixes: fd01b2597941 ("SUNRPC: ECONNREFUSED should cause a rebind.")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/clnt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index c7c1754f8744..da34b23a66db 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -2074,6 +2074,7 @@ call_connect_status(struct rpc_task *task)
 	task->tk_status = 0;
 	switch (status) {
 	case -ECONNREFUSED:
+	case -ECONNRESET:
 		/* A positive refusal suggests a rebind is needed. */
 		if (RPC_IS_SOFTCONN(task))
 			break;
@@ -2082,7 +2083,6 @@ call_connect_status(struct rpc_task *task)
 			goto out_retry;
 		}
 		fallthrough;
-	case -ECONNRESET:
 	case -ECONNABORTED:
 	case -ENETDOWN:
 	case -ENETUNREACH:

From 37f3aaf7945e3d3fdb8514835e68e8e789c226b6 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Wed, 11 Oct 2023 11:00:22 +0300
Subject: [PATCH 0558/1043] SUNRPC: Add an IS_ERR() check back to where it was

[ Upstream commit 4f3ed837186fc0d2722ba8d2457a594322e9c2ef ]

This IS_ERR() check was deleted during in a cleanup because, at the time,
the rpcb_call_async() function could not return an error pointer.  That
changed in commit 25cf32ad5dba ("SUNRPC: Handle allocation failure in
rpc_new_task()") and now it can return an error pointer.  Put the check
back.

A related revert was done in commit 13bd90141804 ("Revert "SUNRPC:
Remove unreachable error condition"").

Fixes: 037e910b52b0 ("SUNRPC: Remove unreachable error condition in rpcb_getport_async()")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/rpcb_clnt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 38fe2ce8a5aa..8fad45320e1b 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -743,6 +743,10 @@ void rpcb_getport_async(struct rpc_task *task)
 
 	child = rpcb_call_async(rpcb_clnt, map, proc);
 	rpc_release_client(rpcb_clnt);
+	if (IS_ERR(child)) {
+		/* rpcb_map_release() has freed the arguments */
+		return;
+	}
 
 	xprt->stat.bind_count++;
 	rpc_put_task(child);

From 39b2bf0405105617bd8be9162c48e5013fe5a1d8 Mon Sep 17 00:00:00 2001
From: Olga Kornievskaia <kolga@netapp.com>
Date: Fri, 13 Oct 2023 11:04:10 -0400
Subject: [PATCH 0559/1043] NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO

[ Upstream commit 5cc7688bae7f0757c39c1d3dfdd827b724061067 ]

If the client is doing pnfs IO and Kerberos is configured and EXCHANGEID
successfully negotiated SP4_MACH_CRED and WRITE/COMMIT are on the
list of state protected operations, then we need to make sure to
choose the DS's rpc_client structure instead of the MDS's one.

Fixes: fb91fb0ee7b2 ("NFS: Move call to nfs4_state_protect_write() to nfs4_write_setup()")
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4proc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 1c2ed14bccef..f3f41027f697 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -5508,7 +5508,7 @@ static void nfs4_proc_write_setup(struct nfs_pgio_header *hdr,
 
 	msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_WRITE];
 	nfs4_init_sequence(&hdr->args.seq_args, &hdr->res.seq_res, 0, 0);
-	nfs4_state_protect_write(server->nfs_client, clnt, msg, hdr);
+	nfs4_state_protect_write(hdr->ds_clp ? hdr->ds_clp : server->nfs_client, clnt, msg, hdr);
 }
 
 static void nfs4_proc_commit_rpc_prepare(struct rpc_task *task, struct nfs_commit_data *data)
@@ -5549,7 +5549,8 @@ static void nfs4_proc_commit_setup(struct nfs_commit_data *data, struct rpc_mess
 	data->res.server = server;
 	msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_COMMIT];
 	nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 1, 0);
-	nfs4_state_protect(server->nfs_client, NFS_SP4_MACH_CRED_COMMIT, clnt, msg);
+	nfs4_state_protect(data->ds_clp ? data->ds_clp : server->nfs_client,
+			NFS_SP4_MACH_CRED_COMMIT, clnt, msg);
 }
 
 static int _nfs4_proc_commit(struct file *dst, struct nfs_commitargs *args,

From dedf2a0eb9448ae73b270743e6ea9b108189df46 Mon Sep 17 00:00:00 2001
From: felix <fuzhen5@huawei.com>
Date: Mon, 23 Oct 2023 09:40:19 +0800
Subject: [PATCH 0560/1043] SUNRPC: Fix RPC client cleaned up the freed pipefs
 dentries

[ Upstream commit bfca5fb4e97c46503ddfc582335917b0cc228264 ]

RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()
workqueue,which takes care about pipefs superblock locking.
In some special scenarios, when kernel frees the pipefs sb of the
current client and immediately alloctes a new pipefs sb,
rpc_remove_pipedir function would misjudge the existence of pipefs
sb which is not the one it used to hold. As a result,
the rpc_remove_pipedir would clean the released freed pipefs dentries.

To fix this issue, rpc_remove_pipedir should check whether the
current pipefs sb is consistent with the original pipefs sb.

This error can be catched by KASAN:
=========================================================
[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200
[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503
[  250.500549] Workqueue: events rpc_free_client_work
[  250.501001] Call Trace:
[  250.502880]  kasan_report+0xb6/0xf0
[  250.503209]  ? dget_parent+0x195/0x200
[  250.503561]  dget_parent+0x195/0x200
[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10
[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90
[  250.504781]  rpc_remove_client_dir+0xf5/0x150
[  250.505195]  rpc_free_client_work+0xe4/0x230
[  250.505598]  process_one_work+0x8ee/0x13b0
...
[   22.039056] Allocated by task 244:
[   22.039390]  kasan_save_stack+0x22/0x50
[   22.039758]  kasan_set_track+0x25/0x30
[   22.040109]  __kasan_slab_alloc+0x59/0x70
[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240
[   22.040889]  __d_alloc+0x31/0x8e0
[   22.041207]  d_alloc+0x44/0x1f0
[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140
[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110
[   22.042459]  rpc_create_client_dir+0x34/0x150
[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0
[   22.043284]  rpc_client_register+0x136/0x4e0
[   22.043689]  rpc_new_client+0x911/0x1020
[   22.044057]  rpc_create_xprt+0xcb/0x370
[   22.044417]  rpc_create+0x36b/0x6c0
...
[   22.049524] Freed by task 0:
[   22.049803]  kasan_save_stack+0x22/0x50
[   22.050165]  kasan_set_track+0x25/0x30
[   22.050520]  kasan_save_free_info+0x2b/0x50
[   22.050921]  __kasan_slab_free+0x10e/0x1a0
[   22.051306]  kmem_cache_free+0xa5/0x390
[   22.051667]  rcu_core+0x62c/0x1930
[   22.051995]  __do_softirq+0x165/0x52a
[   22.052347]
[   22.052503] Last potentially related work creation:
[   22.052952]  kasan_save_stack+0x22/0x50
[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0
[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0
[   22.054209]  dentry_free+0xb2/0x140
[   22.054540]  __dentry_kill+0x3be/0x540
[   22.054900]  shrink_dentry_list+0x199/0x510
[   22.055293]  shrink_dcache_parent+0x190/0x240
[   22.055703]  do_one_tree+0x11/0x40
[   22.056028]  shrink_dcache_for_umount+0x61/0x140
[   22.056461]  generic_shutdown_super+0x70/0x590
[   22.056879]  kill_anon_super+0x3a/0x60
[   22.057234]  rpc_kill_sb+0x121/0x200

Fixes: 0157d021d23a ("SUNRPC: handle RPC client pipefs dentries by network namespace aware routines")
Signed-off-by: felix <fuzhen5@huawei.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sunrpc/clnt.h | 1 +
 net/sunrpc/clnt.c           | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
index 02e7a5863d28..41ed614e6920 100644
--- a/include/linux/sunrpc/clnt.h
+++ b/include/linux/sunrpc/clnt.h
@@ -79,6 +79,7 @@ struct rpc_clnt {
 		struct work_struct	cl_work;
 	};
 	const struct cred	*cl_cred;
+	struct super_block *pipefs_sb;
 };
 
 /*
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index da34b23a66db..360a3bcd91fe 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -109,7 +109,8 @@ static void rpc_clnt_remove_pipedir(struct rpc_clnt *clnt)
 
 	pipefs_sb = rpc_get_sb_net(net);
 	if (pipefs_sb) {
-		__rpc_clnt_remove_pipedir(clnt);
+		if (pipefs_sb == clnt->pipefs_sb)
+			__rpc_clnt_remove_pipedir(clnt);
 		rpc_put_sb_net(net);
 	}
 }
@@ -149,6 +150,8 @@ rpc_setup_pipedir(struct super_block *pipefs_sb, struct rpc_clnt *clnt)
 {
 	struct dentry *dentry;
 
+	clnt->pipefs_sb = pipefs_sb;
+
 	if (clnt->cl_program->pipe_dir_name != NULL) {
 		dentry = rpc_setup_pipedir_sb(pipefs_sb, clnt);
 		if (IS_ERR(dentry))

From 59fadfa99bcb46f6f5afc64d2ce2125d52e77444 Mon Sep 17 00:00:00 2001
From: Andreas Gruenbacher <agruenba@redhat.com>
Date: Mon, 30 Oct 2023 22:06:05 +0100
Subject: [PATCH 0561/1043] gfs2: Silence "suspicious RCU usage in
 gfs2_permission" warning

[ Upstream commit 074d7306a4fe22fcac0b53f699f92757ab1cee99 ]

Commit 0abd1557e21c added rcu_dereference() for dereferencing ip->i_gl
in gfs2_permission.  This now causes lockdep to complain when
gfs2_permission is called in non-RCU context:

    WARNING: suspicious RCU usage in gfs2_permission

Switch to rcu_dereference_check() and check for the MAY_NOT_BLOCK flag
to shut up lockdep when we know that dereferencing ip->i_gl is safe.

Fixes: 0abd1557e21c ("gfs2: fix an oops in gfs2_permission")
Reported-by: syzbot+3e5130844b0c0e2b4948@syzkaller.appspotmail.com
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/inode.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 963dc72e7155..d75d56d9ea0c 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -1835,6 +1835,7 @@ static const char *gfs2_get_link(struct dentry *dentry,
 
 int gfs2_permission(struct inode *inode, int mask)
 {
+	int may_not_block = mask & MAY_NOT_BLOCK;
 	struct gfs2_inode *ip;
 	struct gfs2_holder i_gh;
 	struct gfs2_glock *gl;
@@ -1842,14 +1843,14 @@ int gfs2_permission(struct inode *inode, int mask)
 
 	gfs2_holder_mark_uninitialized(&i_gh);
 	ip = GFS2_I(inode);
-	gl = rcu_dereference(ip->i_gl);
+	gl = rcu_dereference_check(ip->i_gl, !may_not_block);
 	if (unlikely(!gl)) {
 		/* inode is getting torn down, must be RCU mode */
-		WARN_ON_ONCE(!(mask & MAY_NOT_BLOCK));
+		WARN_ON_ONCE(!may_not_block);
 		return -ECHILD;
         }
 	if (gfs2_glock_is_locked_by_me(gl) == NULL) {
-		if (mask & MAY_NOT_BLOCK)
+		if (may_not_block)
 			return -ECHILD;
 		error = gfs2_glock_nq_init(gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh);
 		if (error)

From 43b781e7cb5cd0b435de276111953bf2bacd1f02 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 9 Nov 2023 15:22:41 +0000
Subject: [PATCH 0562/1043] ipvlan: add ipvlan_route_v6_outbound() helper

[ Upstream commit 18f039428c7df183b09c69ebf10ffd4e521035d2 ]

Inspired by syzbot reports using a stack of multiple ipvlan devices.

Reduce stack size needed in ipvlan_process_v6_outbound() by moving
the flowi6 struct used for the route lookup in an non inlined
helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack,
immediately reclaimed.

Also make sure ipvlan_process_v4_outbound() is not inlined.

We might also have to lower MAX_NEST_DEV, because only syzbot uses
setups with more than four stacked devices.

BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000)
stack guard page: 0000 [#1] SMP KASAN
CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188
Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89
RSP: 0018:ffffc9000e804000 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568
RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c
R13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000
FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<#DF>
</#DF>
<TASK>
[<ffffffff81f281d1>] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31
[<ffffffff817e5bf2>] instrument_atomic_read include/linux/instrumented.h:72 [inline]
[<ffffffff817e5bf2>] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
[<ffffffff817e5bf2>] cpumask_test_cpu include/linux/cpumask.h:506 [inline]
[<ffffffff817e5bf2>] cpu_online include/linux/cpumask.h:1092 [inline]
[<ffffffff817e5bf2>] trace_lock_acquire include/trace/events/lock.h:24 [inline]
[<ffffffff817e5bf2>] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632
[<ffffffff8563221e>] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306
[<ffffffff8561464d>] rcu_read_lock include/linux/rcupdate.h:747 [inline]
[<ffffffff8561464d>] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221
[<ffffffff85618120>] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606
[<ffffffff856f65b5>] pol_lookup_func include/net/ip6_fib.h:584 [inline]
[<ffffffff856f65b5>] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116
[<ffffffff85618009>] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638
[<ffffffff8561821a>] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651
[<ffffffff838bd5a3>] ip6_route_output include/net/ip6_route.h:100 [inline]
[<ffffffff838bd5a3>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline]
[<ffffffff838bd5a3>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline]
[<ffffffff838bd5a3>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]
[<ffffffff838bd5a3>] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677
[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229
[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline]
[<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline]
[<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660
[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324
[<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline]
[<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline]
[<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline]
[<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139
[<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline]
[<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211
[<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline]
[<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232
[<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline]
[<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161
[<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline]
[<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline]
[<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]
[<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677
[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229
[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline]
[<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline]
[<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660
[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324
[<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline]
[<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline]
[<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline]
[<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139
[<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline]
[<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211
[<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline]
[<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232
[<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline]
[<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161
[<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline]
[<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline]
[<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]
[<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677
[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229
[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline]
[<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline]
[<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660
[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324
[<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline]
[<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline]
[<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline]
[<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139
[<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline]
[<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211
[<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline]
[<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232
[<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline]
[<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161
[<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline]
[<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline]
[<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]
[<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677
[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229
[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline]
[<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline]
[<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660
[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324
[<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline]
[<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline]
[<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline]
[<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139
[<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline]
[<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211
[<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline]
[<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232
[<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline]
[<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161
[<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline]
[<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline]
[<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]
[<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677
[<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229
[<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline]
[<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline]
[<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660
[<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324
[<ffffffff84d4a65e>] dev_queue_xmit include/linux/netdevice.h:3067 [inline]
[<ffffffff84d4a65e>] neigh_resolve_output+0x64e/0x750 net/core/neighbour.c:1560
[<ffffffff855ce503>] neigh_output include/net/neighbour.h:545 [inline]
[<ffffffff855ce503>] ip6_finish_output2+0x1643/0x1ae0 net/ipv6/ip6_output.c:139
[<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline]
[<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211
[<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline]
[<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232
[<ffffffff855b9ce4>] dst_output include/net/dst.h:444 [inline]
[<ffffffff855b9ce4>] NF_HOOK include/linux/netfilter.h:309 [inline]
[<ffffffff855b9ce4>] ip6_xmit+0x11a4/0x1b20 net/ipv6/ip6_output.c:352
[<ffffffff8597984e>] sctp_v6_xmit+0x9ae/0x1230 net/sctp/ipv6.c:250
[<ffffffff8594623e>] sctp_packet_transmit+0x25de/0x2bc0 net/sctp/output.c:653
[<ffffffff858f5142>] sctp_packet_singleton+0x202/0x310 net/sctp/outqueue.c:783
[<ffffffff858ea411>] sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline]
[<ffffffff858ea411>] sctp_outq_flush+0x661/0x3d40 net/sctp/outqueue.c:1212
[<ffffffff858f02f9>] sctp_outq_uncork+0x79/0xb0 net/sctp/outqueue.c:764
[<ffffffff8589f060>] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline]
[<ffffffff8589f060>] sctp_do_sm+0x55c0/0x5c30 net/sctp/sm_sideeffect.c:1170
[<ffffffff85941567>] sctp_primitive_ASSOCIATE+0x97/0xc0 net/sctp/primitive.c:73
[<ffffffff859408b2>] sctp_sendmsg_to_asoc+0xf62/0x17b0 net/sctp/socket.c:1839
[<ffffffff85910b5e>] sctp_sendmsg+0x212e/0x33b0 net/sctp/socket.c:2029
[<ffffffff8544d559>] inet_sendmsg+0x149/0x310 net/ipv4/af_inet.c:849
[<ffffffff84c6c4d2>] sock_sendmsg_nosec net/socket.c:716 [inline]
[<ffffffff84c6c4d2>] sock_sendmsg net/socket.c:736 [inline]
[<ffffffff84c6c4d2>] ____sys_sendmsg+0x572/0x8c0 net/socket.c:2504
[<ffffffff84c6ca91>] ___sys_sendmsg net/socket.c:2558 [inline]
[<ffffffff84c6ca91>] __sys_sendmsg+0x271/0x360 net/socket.c:2587
[<ffffffff84c6cbff>] __do_sys_sendmsg net/socket.c:2596 [inline]
[<ffffffff84c6cbff>] __se_sys_sendmsg net/socket.c:2594 [inline]
[<ffffffff84c6cbff>] __x64_sys_sendmsg+0x7f/0x90 net/socket.c:2594
[<ffffffff85b32553>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
[<ffffffff85b32553>] do_syscall_64+0x53/0x80 arch/x86/entry/common.c:84
[<ffffffff85c00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Mahesh Bandewar <maheshb@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ipvlan/ipvlan_core.c | 41 +++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 16 deletions(-)

diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index b5a61b16a7ea..bfea28bd4502 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -412,7 +412,7 @@ struct ipvl_addr *ipvlan_addr_lookup(struct ipvl_port *port, void *lyr3h,
 	return addr;
 }
 
-static int ipvlan_process_v4_outbound(struct sk_buff *skb)
+static noinline_for_stack int ipvlan_process_v4_outbound(struct sk_buff *skb)
 {
 	const struct iphdr *ip4h = ip_hdr(skb);
 	struct net_device *dev = skb->dev;
@@ -454,13 +454,11 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb)
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
-static int ipvlan_process_v6_outbound(struct sk_buff *skb)
+
+static noinline_for_stack int
+ipvlan_route_v6_outbound(struct net_device *dev, struct sk_buff *skb)
 {
 	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
-	struct net_device *dev = skb->dev;
-	struct net *net = dev_net(dev);
-	struct dst_entry *dst;
-	int err, ret = NET_XMIT_DROP;
 	struct flowi6 fl6 = {
 		.flowi6_oif = dev->ifindex,
 		.daddr = ip6h->daddr,
@@ -470,27 +468,38 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
 		.flowi6_mark = skb->mark,
 		.flowi6_proto = ip6h->nexthdr,
 	};
+	struct dst_entry *dst;
+	int err;
 
-	dst = ip6_route_output(net, NULL, &fl6);
-	if (dst->error) {
-		ret = dst->error;
+	dst = ip6_route_output(dev_net(dev), NULL, &fl6);
+	err = dst->error;
+	if (err) {
 		dst_release(dst);
-		goto err;
+		return err;
 	}
 	skb_dst_set(skb, dst);
+	return 0;
+}
+
+static int ipvlan_process_v6_outbound(struct sk_buff *skb)
+{
+	struct net_device *dev = skb->dev;
+	int err, ret = NET_XMIT_DROP;
+
+	err = ipvlan_route_v6_outbound(dev, skb);
+	if (unlikely(err)) {
+		DEV_STATS_INC(dev, tx_errors);
+		kfree_skb(skb);
+		return err;
+	}
 
 	memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
 
-	err = ip6_local_out(net, skb->sk, skb);
+	err = ip6_local_out(dev_net(dev), skb->sk, skb);
 	if (unlikely(net_xmit_eval(err)))
 		DEV_STATS_INC(dev, tx_errors);
 	else
 		ret = NET_XMIT_SUCCESS;
-	goto out;
-err:
-	DEV_STATS_INC(dev, tx_errors);
-	kfree_skb(skb);
-out:
 	return ret;
 }
 #else

From 48fa8a85f8f5820e6e9318e03528307b18c8d4b7 Mon Sep 17 00:00:00 2001
From: Shigeru Yoshida <syoshida@redhat.com>
Date: Thu, 9 Nov 2023 00:44:20 +0900
Subject: [PATCH 0563/1043] tty: Fix uninit-value access in ppp_sync_receive()

[ Upstream commit 719639853d88071dfdfd8d9971eca9c283ff314c ]

KMSAN reported the following uninit-value access issue:

=====================================================
BUG: KMSAN: uninit-value in ppp_sync_input drivers/net/ppp/ppp_synctty.c:690 [inline]
BUG: KMSAN: uninit-value in ppp_sync_receive+0xdc9/0xe70 drivers/net/ppp/ppp_synctty.c:334
 ppp_sync_input drivers/net/ppp/ppp_synctty.c:690 [inline]
 ppp_sync_receive+0xdc9/0xe70 drivers/net/ppp/ppp_synctty.c:334
 tiocsti+0x328/0x450 drivers/tty/tty_io.c:2295
 tty_ioctl+0x808/0x1920 drivers/tty/tty_io.c:2694
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl+0x211/0x400 fs/ioctl.c:857
 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:857
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Uninit was created at:
 __alloc_pages+0x75d/0xe80 mm/page_alloc.c:4591
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 __page_frag_cache_refill+0x9a/0x2c0 mm/page_alloc.c:4691
 page_frag_alloc_align+0x91/0x5d0 mm/page_alloc.c:4722
 page_frag_alloc include/linux/gfp.h:322 [inline]
 __netdev_alloc_skb+0x215/0x6d0 net/core/skbuff.c:728
 netdev_alloc_skb include/linux/skbuff.h:3225 [inline]
 dev_alloc_skb include/linux/skbuff.h:3238 [inline]
 ppp_sync_input drivers/net/ppp/ppp_synctty.c:669 [inline]
 ppp_sync_receive+0x237/0xe70 drivers/net/ppp/ppp_synctty.c:334
 tiocsti+0x328/0x450 drivers/tty/tty_io.c:2295
 tty_ioctl+0x808/0x1920 drivers/tty/tty_io.c:2694
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl+0x211/0x400 fs/ioctl.c:857
 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:857
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

CPU: 0 PID: 12950 Comm: syz-executor.1 Not tainted 6.6.0-14500-g1c41041124bd #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014
=====================================================

ppp_sync_input() checks the first 2 bytes of the data are PPP_ALLSTATIONS
and PPP_UI. However, if the data length is 1 and the first byte is
PPP_ALLSTATIONS, an access to an uninitialized value occurs when checking
PPP_UI. This patch resolves this issue by checking the data length.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ppp/ppp_synctty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c
index f774b7e52da4..e37d9a05f307 100644
--- a/drivers/net/ppp/ppp_synctty.c
+++ b/drivers/net/ppp/ppp_synctty.c
@@ -699,7 +699,7 @@ ppp_sync_input(struct syncppp *ap, const unsigned char *buf,
 
 	/* strip address/control field if present */
 	p = skb->data;
-	if (p[0] == PPP_ALLSTATIONS && p[1] == PPP_UI) {
+	if (skb->len >= 2 && p[0] == PPP_ALLSTATIONS && p[1] == PPP_UI) {
 		/* chop off address/control */
 		if (skb->len < 3)
 			goto err;

From b0eac93bae4227e2210eadd303f6486025fc9e92 Mon Sep 17 00:00:00 2001
From: Yonglong Liu <liuyonglong@huawei.com>
Date: Fri, 10 Nov 2023 17:37:11 +0800
Subject: [PATCH 0564/1043] net: hns3: fix variable may not initialized problem
 in hns3_init_mac_addr()

[ Upstream commit dbd2f3b20c6ae425665b6975d766e3653d453e73 ]

When a VF is calling hns3_init_mac_addr(), get_mac_addr() may
return fail, then the value of mac_addr_temp is not initialized.

Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index ae7cd73c823b..4df5e91e86ce 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -3974,7 +3974,7 @@ static int hns3_init_mac_addr(struct net_device *netdev)
 {
 	struct hns3_nic_priv *priv = netdev_priv(netdev);
 	struct hnae3_handle *h = priv->ae_handle;
-	u8 mac_addr_temp[ETH_ALEN];
+	u8 mac_addr_temp[ETH_ALEN] = {0};
 	int ret = 0;
 
 	if (h->ae_algo->ops->get_mac_addr)

From 072f0eb962c963eab6652b24b54bfeae15c2950c Mon Sep 17 00:00:00 2001
From: Jijie Shao <shaojijie@huawei.com>
Date: Fri, 10 Nov 2023 17:37:12 +0800
Subject: [PATCH 0565/1043] net: hns3: fix VF reset fail issue

[ Upstream commit 65e98bb56fa3ce2edb400930c05238c9b380500e ]

Currently the reset process in hns3 and firmware watchdog init process is
asynchronous. We think firmware watchdog initialization is completed
before VF clear the interrupt source. However, firmware initialization
may not complete early. So VF will receive multiple reset interrupts
and fail to reset.

So we add delay before VF interrupt source and 5 ms delay
is enough to avoid second reset interrupt.

Fixes: 427900d27d86 ("net: hns3: fix the timing issue of VF clearing interrupt sources")
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c  | 14 +++++++++++++-
 .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h  |  1 +
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
index 7d05915c35e3..2bb0ce1761fb 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -2363,8 +2363,18 @@ static enum hclgevf_evt_cause hclgevf_check_evt_cause(struct hclgevf_dev *hdev,
 	return HCLGEVF_VECTOR0_EVENT_OTHER;
 }
 
+static void hclgevf_reset_timer(struct timer_list *t)
+{
+	struct hclgevf_dev *hdev = from_timer(hdev, t, reset_timer);
+
+	hclgevf_clear_event_cause(hdev, HCLGEVF_VECTOR0_EVENT_RST);
+	hclgevf_reset_task_schedule(hdev);
+}
+
 static irqreturn_t hclgevf_misc_irq_handle(int irq, void *data)
 {
+#define HCLGEVF_RESET_DELAY	5
+
 	enum hclgevf_evt_cause event_cause;
 	struct hclgevf_dev *hdev = data;
 	u32 clearval;
@@ -2376,7 +2386,8 @@ static irqreturn_t hclgevf_misc_irq_handle(int irq, void *data)
 
 	switch (event_cause) {
 	case HCLGEVF_VECTOR0_EVENT_RST:
-		hclgevf_reset_task_schedule(hdev);
+		mod_timer(&hdev->reset_timer,
+			  jiffies + msecs_to_jiffies(HCLGEVF_RESET_DELAY));
 		break;
 	case HCLGEVF_VECTOR0_EVENT_MBX:
 		hclgevf_mbx_handler(hdev);
@@ -3269,6 +3280,7 @@ static int hclgevf_init_hdev(struct hclgevf_dev *hdev)
 		 HCLGEVF_DRIVER_NAME);
 
 	hclgevf_task_schedule(hdev, round_jiffies_relative(HZ));
+	timer_setup(&hdev->reset_timer, hclgevf_reset_timer, 0);
 
 	return 0;
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
index c9b0fa5e8589..9469af8c49ac 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
@@ -274,6 +274,7 @@ struct hclgevf_dev {
 	enum hnae3_reset_type reset_level;
 	unsigned long reset_pending;
 	enum hnae3_reset_type reset_type;
+	struct timer_list reset_timer;
 
 #define HCLGEVF_RESET_REQUESTED		0
 #define HCLGEVF_RESET_PENDING		1

From 3ee249a3b9931245e6183ed49db0309b699a1205 Mon Sep 17 00:00:00 2001
From: Shigeru Yoshida <syoshida@redhat.com>
Date: Sat, 11 Nov 2023 01:39:47 +0900
Subject: [PATCH 0566/1043] tipc: Fix kernel-infoleak due to uninitialized TLV
 value

[ Upstream commit fb317eb23b5ee4c37b0656a9a52a3db58d9dd072 ]

KMSAN reported the following kernel-infoleak issue:

=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]
BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x4ec/0x2bc0 lib/iov_iter.c:186
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 copy_to_user_iter lib/iov_iter.c:24 [inline]
 iterate_ubuf include/linux/iov_iter.h:29 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
 iterate_and_advance include/linux/iov_iter.h:271 [inline]
 _copy_to_iter+0x4ec/0x2bc0 lib/iov_iter.c:186
 copy_to_iter include/linux/uio.h:197 [inline]
 simple_copy_to_iter net/core/datagram.c:532 [inline]
 __skb_datagram_iter.5+0x148/0xe30 net/core/datagram.c:420
 skb_copy_datagram_iter+0x52/0x210 net/core/datagram.c:546
 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]
 netlink_recvmsg+0x43d/0x1630 net/netlink/af_netlink.c:1967
 sock_recvmsg_nosec net/socket.c:1044 [inline]
 sock_recvmsg net/socket.c:1066 [inline]
 __sys_recvfrom+0x476/0x860 net/socket.c:2246
 __do_sys_recvfrom net/socket.c:2264 [inline]
 __se_sys_recvfrom net/socket.c:2260 [inline]
 __x64_sys_recvfrom+0x130/0x200 net/socket.c:2260
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Uninit was created at:
 slab_post_alloc_hook+0x103/0x9e0 mm/slab.h:768
 slab_alloc_node mm/slub.c:3478 [inline]
 kmem_cache_alloc_node+0x5f7/0xb50 mm/slub.c:3523
 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:560
 __alloc_skb+0x2fd/0x770 net/core/skbuff.c:651
 alloc_skb include/linux/skbuff.h:1286 [inline]
 tipc_tlv_alloc net/tipc/netlink_compat.c:156 [inline]
 tipc_get_err_tlv+0x90/0x5d0 net/tipc/netlink_compat.c:170
 tipc_nl_compat_recv+0x1042/0x15d0 net/tipc/netlink_compat.c:1324
 genl_family_rcv_msg_doit net/netlink/genetlink.c:972 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]
 genl_rcv_msg+0x1220/0x12c0 net/netlink/genetlink.c:1067
 netlink_rcv_skb+0x4a4/0x6a0 net/netlink/af_netlink.c:2545
 genl_rcv+0x41/0x60 net/netlink/genetlink.c:1076
 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
 netlink_unicast+0xf4b/0x1230 net/netlink/af_netlink.c:1368
 netlink_sendmsg+0x1242/0x1420 net/netlink/af_netlink.c:1910
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x997/0xd60 net/socket.c:2588
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2642
 __sys_sendmsg net/socket.c:2671 [inline]
 __do_sys_sendmsg net/socket.c:2680 [inline]
 __se_sys_sendmsg net/socket.c:2678 [inline]
 __x64_sys_sendmsg+0x2fa/0x4a0 net/socket.c:2678
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Bytes 34-35 of 36 are uninitialized
Memory access of size 36 starts at ffff88802d464a00
Data copied to user address 00007ff55033c0a0

CPU: 0 PID: 30322 Comm: syz-executor.0 Not tainted 6.6.0-14500-g1c41041124bd #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014
=====================================================

tipc_add_tlv() puts TLV descriptor and value onto `skb`. This size is
calculated with TLV_SPACE() macro. It adds the size of struct tlv_desc and
the length of TLV value passed as an argument, and aligns the result to a
multiple of TLV_ALIGNTO, i.e., a multiple of 4 bytes.

If the size of struct tlv_desc plus the length of TLV value is not aligned,
the current implementation leaves the remaining bytes uninitialized. This
is the cause of the above kernel-infoleak issue.

This patch resolves this issue by clearing data up to an aligned size.

Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/netlink_compat.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 2d62932b5987..6f0c09b6a153 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -101,6 +101,7 @@ static int tipc_add_tlv(struct sk_buff *skb, u16 type, void *data, u16 len)
 		return -EMSGSIZE;
 
 	skb_put(skb, TLV_SPACE(len));
+	memset(tlv, 0, TLV_SPACE(len));
 	tlv->tlv_type = htons(type);
 	tlv->tlv_len = htons(TLV_LENGTH(len));
 	if (len && data)

From 144a80ef40a6fddba69635b310d1b4ed297b1e2e Mon Sep 17 00:00:00 2001
From: Willem de Bruijn <willemb@google.com>
Date: Sun, 12 Nov 2023 22:16:32 -0500
Subject: [PATCH 0567/1043] ppp: limit MRU to 64K

[ Upstream commit c0a2a1b0d631fc460d830f52d06211838874d655 ]

ppp_sync_ioctl allows setting device MRU, but does not sanity check
this input.

Limit to a sane upper bound of 64KB.

No implementation I could find generates larger than 64KB frames.
RFC 2823 mentions an upper bound of PPP over SDL of 64KB based on the
16-bit length field. Other protocols will be smaller, such as PPPoE
(9KB jumbo frame) and PPPoA (18190 maximum CPCS-SDU size, RFC 2364).
PPTP and L2TP encapsulate in IP.

Syzbot managed to trigger alloc warning in __alloc_pages:

	if (WARN_ON_ONCE_GFP(order > MAX_ORDER, gfp))

    WARNING: CPU: 1 PID: 37 at mm/page_alloc.c:4544 __alloc_pages+0x3ab/0x4a0 mm/page_alloc.c:4544

    __alloc_skb+0x12b/0x330 net/core/skbuff.c:651
    __netdev_alloc_skb+0x72/0x3f0 net/core/skbuff.c:715
    netdev_alloc_skb include/linux/skbuff.h:3225 [inline]
    dev_alloc_skb include/linux/skbuff.h:3238 [inline]
    ppp_sync_input drivers/net/ppp/ppp_synctty.c:669 [inline]
    ppp_sync_receive+0xff/0x680 drivers/net/ppp/ppp_synctty.c:334
    tty_ldisc_receive_buf+0x14c/0x180 drivers/tty/tty_buffer.c:390
    tty_port_default_receive_buf+0x70/0xb0 drivers/tty/tty_port.c:37
    receive_buf drivers/tty/tty_buffer.c:444 [inline]
    flush_to_ldisc+0x261/0x780 drivers/tty/tty_buffer.c:494
    process_one_work+0x884/0x15c0 kernel/workqueue.c:2630

With call

    ioctl$PPPIOCSMRU1(r1, 0x40047452, &(0x7f0000000100)=0x5e6417a8)

Similar code exists in other drivers that implement ppp_channel_ops
ioctl PPPIOCSMRU. Those might also be in scope. Notably excluded from
this are pppol2tp_ioctl and pppoe_ioctl.

This code goes back to the start of git history.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+6177e1f90d92583bcc58@syzkaller.appspotmail.com
Signed-off-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ppp/ppp_synctty.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c
index e37d9a05f307..717431636275 100644
--- a/drivers/net/ppp/ppp_synctty.c
+++ b/drivers/net/ppp/ppp_synctty.c
@@ -464,6 +464,10 @@ ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)
 	case PPPIOCSMRU:
 		if (get_user(val, (int __user *) argp))
 			break;
+		if (val > U16_MAX) {
+			err = -EINVAL;
+			break;
+		}
 		if (val < PPP_MRU)
 			val = PPP_MRU;
 		ap->mru = val;

From ecc74e7acb6d4fd53cd042a391fd38f09de3d84a Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Mon, 25 Sep 2023 17:54:13 +0200
Subject: [PATCH 0568/1043] xen/events: fix delayed eoi list handling

[ Upstream commit 47d970204054f859f35a2237baa75c2d84fcf436 ]

When delaying eoi handling of events, the related elements are queued
into the percpu lateeoi list. In case the list isn't empty, the
elements should be sorted by the time when eoi handling is to happen.

Unfortunately a new element will never be queued at the start of the
list, even if it has a handling time lower than all other list
elements.

Fix that by handling that case the same way as for an empty list.

Fixes: e99502f76271 ("xen/events: defer eoi in case of excessive number of events")
Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/events/events_base.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 52891546e697..24e39984914f 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -551,7 +551,9 @@ static void lateeoi_list_add(struct irq_info *info)
 
 	spin_lock_irqsave(&eoi->eoi_list_lock, flags);
 
-	if (list_empty(&eoi->eoi_list)) {
+	elem = list_first_entry_or_null(&eoi->eoi_list, struct irq_info,
+					eoi_list);
+	if (!elem || info->eoi_time < elem->eoi_time) {
 		list_add(&info->eoi_list, &eoi->eoi_list);
 		mod_delayed_work_on(info->eoi_cpu, system_wq,
 				    &eoi->delayed, delay);

From 1f368fd6122345767f0ecae7d3255f2fb25df221 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 9 Nov 2023 17:48:59 +0000
Subject: [PATCH 0569/1043] ptp: annotate data-race around q->head and q->tail

[ Upstream commit 73bde5a3294853947252cd9092a3517c7cb0cd2d ]

As I was working on a syzbot report, I found that KCSAN would
probably complain that reading q->head or q->tail without
barriers could lead to invalid results.

Add corresponding READ_ONCE() and WRITE_ONCE() to avoid
load-store tearing.

Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Link: https://lore.kernel.org/r/20231109174859.3995880-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ptp/ptp_chardev.c | 3 ++-
 drivers/ptp/ptp_clock.c   | 5 +++--
 drivers/ptp/ptp_private.h | 8 ++++++--
 drivers/ptp/ptp_sysfs.c   | 3 ++-
 4 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index af3bc65c4595..9311f3d09c8f 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -487,7 +487,8 @@ ssize_t ptp_read(struct posix_clock *pc,
 
 	for (i = 0; i < cnt; i++) {
 		event[i] = queue->buf[queue->head];
-		queue->head = (queue->head + 1) % PTP_MAX_TIMESTAMPS;
+		/* Paired with READ_ONCE() in queue_cnt() */
+		WRITE_ONCE(queue->head, (queue->head + 1) % PTP_MAX_TIMESTAMPS);
 	}
 
 	spin_unlock_irqrestore(&queue->lock, flags);
diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
index 21c4c34c52d8..ed766943a356 100644
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -55,10 +55,11 @@ static void enqueue_external_timestamp(struct timestamp_event_queue *queue,
 	dst->t.sec = seconds;
 	dst->t.nsec = remainder;
 
+	/* Both WRITE_ONCE() are paired with READ_ONCE() in queue_cnt() */
 	if (!queue_free(queue))
-		queue->head = (queue->head + 1) % PTP_MAX_TIMESTAMPS;
+		WRITE_ONCE(queue->head, (queue->head + 1) % PTP_MAX_TIMESTAMPS);
 
-	queue->tail = (queue->tail + 1) % PTP_MAX_TIMESTAMPS;
+	WRITE_ONCE(queue->tail, (queue->tail + 1) % PTP_MAX_TIMESTAMPS);
 
 	spin_unlock_irqrestore(&queue->lock, flags);
 }
diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
index 6b97155148f1..d2cb95670676 100644
--- a/drivers/ptp/ptp_private.h
+++ b/drivers/ptp/ptp_private.h
@@ -55,9 +55,13 @@ struct ptp_clock {
  * that a writer might concurrently increment the tail does not
  * matter, since the queue remains nonempty nonetheless.
  */
-static inline int queue_cnt(struct timestamp_event_queue *q)
+static inline int queue_cnt(const struct timestamp_event_queue *q)
 {
-	int cnt = q->tail - q->head;
+	/*
+	 * Paired with WRITE_ONCE() in enqueue_external_timestamp(),
+	 * ptp_read(), extts_fifo_show().
+	 */
+	int cnt = READ_ONCE(q->tail) - READ_ONCE(q->head);
 	return cnt < 0 ? PTP_MAX_TIMESTAMPS + cnt : cnt;
 }
 
diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c
index 8cd59e848163..8d52815e05b3 100644
--- a/drivers/ptp/ptp_sysfs.c
+++ b/drivers/ptp/ptp_sysfs.c
@@ -78,7 +78,8 @@ static ssize_t extts_fifo_show(struct device *dev,
 	qcnt = queue_cnt(queue);
 	if (qcnt) {
 		event = queue->buf[queue->head];
-		queue->head = (queue->head + 1) % PTP_MAX_TIMESTAMPS;
+		/* Paired with READ_ONCE() in queue_cnt() */
+		WRITE_ONCE(queue->head, (queue->head + 1) % PTP_MAX_TIMESTAMPS);
 	}
 	spin_unlock_irqrestore(&queue->lock, flags);
 

From 396baca6683f415b5bc2b380289387bef1406edc Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 9 Nov 2023 18:01:02 +0000
Subject: [PATCH 0570/1043] bonding: stop the device in bond_setup_by_slave()

[ Upstream commit 3cffa2ddc4d3fcf70cde361236f5a614f81a09b2 ]

Commit 9eed321cde22 ("net: lapbether: only support ethernet devices")
has been able to keep syzbot away from net/lapb, until today.

In the following splat [1], the issue is that a lapbether device has
been created on a bonding device without members. Then adding a non
ARPHRD_ETHER member forced the bonding master to change its type.

The fix is to make sure we call dev_close() in bond_setup_by_slave()
so that the potential linked lapbether devices (or any other devices
having assumptions on the physical device) are removed.

A similar bug has been addressed in commit 40baec225765
("bonding: fix panic on non-ARPHRD_ETHER enslave failure")

[1]
skbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea tail:0x16 end:0x140 dev:bond0
kernel BUG at net/core/skbuff.c:192 !
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : skb_panic net/core/skbuff.c:188 [inline]
pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202
lr : skb_panic net/core/skbuff.c:188 [inline]
lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202
sp : ffff800096a06aa0
x29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000
x26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea
x23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140
x20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100
x17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001
x14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00
x8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c
x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086
Call trace:
skb_panic net/core/skbuff.c:188 [inline]
skb_under_panic+0x13c/0x140 net/core/skbuff.c:202
skb_push+0xf0/0x108 net/core/skbuff.c:2446
ip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1384
dev_hard_header include/linux/netdevice.h:3136 [inline]
lapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257
lapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447
lapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149
lapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251
__lapb_disconnect_request+0x9c/0x17c net/lapb/lapb_iface.c:326
lapb_device_event+0x288/0x4e0 net/lapb/lapb_iface.c:492
notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461
call_netdevice_notifiers_info net/core/dev.c:1970 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2008 [inline]
call_netdevice_notifiers net/core/dev.c:2022 [inline]
__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508
dev_close_many+0x1e0/0x470 net/core/dev.c:1559
dev_close+0x174/0x250 net/core/dev.c:1585
lapbeth_device_event+0x2e4/0x958 drivers/net/wan/lapbether.c:466
notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461
call_netdevice_notifiers_info net/core/dev.c:1970 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2008 [inline]
call_netdevice_notifiers net/core/dev.c:2022 [inline]
__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508
dev_close_many+0x1e0/0x470 net/core/dev.c:1559
dev_close+0x174/0x250 net/core/dev.c:1585
bond_enslave+0x2298/0x30cc drivers/net/bonding/bond_main.c:2332
bond_do_ioctl+0x268/0xc64 drivers/net/bonding/bond_main.c:4539
dev_ifsioc+0x754/0x9ac
dev_ioctl+0x4d8/0xd34 net/core/dev_ioctl.c:786
sock_do_ioctl+0x1d4/0x2d0 net/socket.c:1217
sock_ioctl+0x4e8/0x834 net/socket.c:1322
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:857
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
Code: aa1803e6 aa1903e7 a90023f5 94785b8b (d4210000)

Fixes: 872254dd6b1f ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://lore.kernel.org/r/20231109180102.4085183-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/bonding/bond_main.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index bcb019121d83..50fabba04248 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1433,6 +1433,10 @@ static void bond_compute_features(struct bonding *bond)
 static void bond_setup_by_slave(struct net_device *bond_dev,
 				struct net_device *slave_dev)
 {
+	bool was_up = !!(bond_dev->flags & IFF_UP);
+
+	dev_close(bond_dev);
+
 	bond_dev->header_ops	    = slave_dev->header_ops;
 
 	bond_dev->type		    = slave_dev->type;
@@ -1447,6 +1451,8 @@ static void bond_setup_by_slave(struct net_device *bond_dev,
 		bond_dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST);
 		bond_dev->flags |= (IFF_POINTOPOINT | IFF_NOARP);
 	}
+	if (was_up)
+		dev_open(bond_dev, NULL);
 }
 
 /* On bonding slaves other than the currently active slave, suppress

From f0d9b80f76240c0f5f395294858f69680eeaf5da Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Thu, 9 Nov 2023 10:03:12 +0100
Subject: [PATCH 0571/1043] net: ethernet: cortina: Fix max RX frame define

[ Upstream commit 510e35fb931ffc3b100e5d5ae4595cd3beca9f1a ]

Enumerator 3 is 1548 bytes according to the datasheet.
Not 1542.

Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://lore.kernel.org/r/20231109-gemini-largeframe-fix-v4-1-6e611528db08@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/cortina/gemini.c | 4 ++--
 drivers/net/ethernet/cortina/gemini.h | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index 85ea073b742f..6c735e0d1950 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -433,8 +433,8 @@ static const struct gmac_max_framelen gmac_maxlens[] = {
 		.val = CONFIG0_MAXLEN_1536,
 	},
 	{
-		.max_l3_len = 1542,
-		.val = CONFIG0_MAXLEN_1542,
+		.max_l3_len = 1548,
+		.val = CONFIG0_MAXLEN_1548,
 	},
 	{
 		.max_l3_len = 9212,
diff --git a/drivers/net/ethernet/cortina/gemini.h b/drivers/net/ethernet/cortina/gemini.h
index 9fdf77d5eb37..99efb1155743 100644
--- a/drivers/net/ethernet/cortina/gemini.h
+++ b/drivers/net/ethernet/cortina/gemini.h
@@ -787,7 +787,7 @@ union gmac_config0 {
 #define  CONFIG0_MAXLEN_1536	0
 #define  CONFIG0_MAXLEN_1518	1
 #define  CONFIG0_MAXLEN_1522	2
-#define  CONFIG0_MAXLEN_1542	3
+#define  CONFIG0_MAXLEN_1548	3
 #define  CONFIG0_MAXLEN_9k	4	/* 9212 */
 #define  CONFIG0_MAXLEN_10k	5	/* 10236 */
 #define  CONFIG0_MAXLEN_1518__6	6

From eac9ef50d6f3328602313462a3b452d3649d3ca7 Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Thu, 9 Nov 2023 10:03:13 +0100
Subject: [PATCH 0572/1043] net: ethernet: cortina: Handle large frames

[ Upstream commit d4d0c5b4d279bfe3585fbd806efefd3e51c82afa ]

The Gemini ethernet controller provides hardware checksumming
for frames up to 1514 bytes including ethernet headers but not
FCS.

If we start sending bigger frames (after first bumping up the MTU
on both interfaces sending and receiving the frames), truncated
packets start to appear on the target such as in this tcpdump
resulting from ping -s 1474:

23:34:17.241983 14:d6:4d:a8:3c:4f (oui Unknown) > bc:ae:c5:6b:a8:3d (oui Unknown),
ethertype IPv4 (0x0800), length 1514: truncated-ip - 2 bytes missing!
(tos 0x0, ttl 64, id 32653, offset 0, flags [DF], proto ICMP (1), length 1502)
OpenWrt.lan > Fecusia: ICMP echo request, id 1672, seq 50, length 1482

If we bypass the hardware checksumming and provide a software
fallback, everything starts working fine up to the max TX MTU
of 2047 bytes, for example ping -s2000 192.168.1.2:

00:44:29.587598 bc:ae:c5:6b:a8:3d (oui Unknown) > 14:d6:4d:a8:3c:4f (oui Unknown),
ethertype IPv4 (0x0800), length 2042:
(tos 0x0, ttl 64, id 51828, offset 0, flags [none], proto ICMP (1), length 2028)
Fecusia > OpenWrt.lan: ICMP echo reply, id 1683, seq 4, length 2008

The bit enabling to bypass hardware checksum (or any of the
"TSS" bits) are undocumented in the hardware reference manual.
The entire hardware checksum unit appears undocumented. The
conclusion that we need to use the "bypass" bit was found by
trial-and-error.

Since no hardware checksum will happen, we slot in a software
checksum fallback.

Check for the condition where we need to compute checksum on the
skb with either hardware or software using == CHECKSUM_PARTIAL instead
of != CHECKSUM_NONE which is an incomplete check according to
<linux/skbuff.h>.

On the D-Link DIR-685 router this fixes a bug on the conduit
interface to the RTL8366RB DSA switch: as the switch needs to add
space for its tag it increases the MTU on the conduit interface
to 1504 and that means that when the router sends packages
of 1500 bytes these get an extra 4 bytes of DSA tag and the
transfer fails because of the erroneous hardware checksumming,
affecting such basic functionality as the LuCI web interface.

Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://lore.kernel.org/r/20231109-gemini-largeframe-fix-v4-2-6e611528db08@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/cortina/gemini.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index 6c735e0d1950..9ed883e8155e 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -1146,6 +1146,7 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb,
 	dma_addr_t mapping;
 	unsigned short mtu;
 	void *buffer;
+	int ret;
 
 	mtu  = ETH_HLEN;
 	mtu += netdev->mtu;
@@ -1160,9 +1161,30 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb,
 		word3 |= mtu;
 	}
 
-	if (skb->ip_summed != CHECKSUM_NONE) {
+	if (skb->len >= ETH_FRAME_LEN) {
+		/* Hardware offloaded checksumming isn't working on frames
+		 * bigger than 1514 bytes. A hypothesis about this is that the
+		 * checksum buffer is only 1518 bytes, so when the frames get
+		 * bigger they get truncated, or the last few bytes get
+		 * overwritten by the FCS.
+		 *
+		 * Just use software checksumming and bypass on bigger frames.
+		 */
+		if (skb->ip_summed == CHECKSUM_PARTIAL) {
+			ret = skb_checksum_help(skb);
+			if (ret)
+				return ret;
+		}
+		word1 |= TSS_BYPASS_BIT;
+	} else if (skb->ip_summed == CHECKSUM_PARTIAL) {
 		int tcp = 0;
 
+		/* We do not switch off the checksumming on non TCP/UDP
+		 * frames: as is shown from tests, the checksumming engine
+		 * is smart enough to see that a frame is not actually TCP
+		 * or UDP and then just pass it through without any changes
+		 * to the frame.
+		 */
 		if (skb->protocol == htons(ETH_P_IP)) {
 			word1 |= TSS_IP_CHKSUM_BIT;
 			tcp = ip_hdr(skb)->protocol == IPPROTO_TCP;

From 3f643150563c89bba77be410900f4eaf1cf00299 Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Thu, 9 Nov 2023 10:03:14 +0100
Subject: [PATCH 0573/1043] net: ethernet: cortina: Fix MTU max setting

[ Upstream commit dc6c0bfbaa947dd7976e30e8c29b10c868b6fa42 ]

The RX max frame size is over 10000 for the Gemini ethernet,
but the TX max frame size is actually just 2047 (0x7ff after
checking the datasheet). Reflect this in what we offer to Linux,
cap the MTU at the TX max frame minus ethernet headers.

We delete the code disabling the hardware checksum for large
MTUs as netdev->mtu can no longer be larger than
netdev->max_mtu meaning the if()-clause in gmac_fix_features()
is never true.

Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://lore.kernel.org/r/20231109-gemini-largeframe-fix-v4-3-6e611528db08@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/cortina/gemini.c | 17 ++++-------------
 drivers/net/ethernet/cortina/gemini.h |  2 +-
 2 files changed, 5 insertions(+), 14 deletions(-)

diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index 9ed883e8155e..c78587ddb32f 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -2001,15 +2001,6 @@ static int gmac_change_mtu(struct net_device *netdev, int new_mtu)
 	return 0;
 }
 
-static netdev_features_t gmac_fix_features(struct net_device *netdev,
-					   netdev_features_t features)
-{
-	if (netdev->mtu + ETH_HLEN + VLAN_HLEN > MTU_SIZE_BIT_MASK)
-		features &= ~GMAC_OFFLOAD_FEATURES;
-
-	return features;
-}
-
 static int gmac_set_features(struct net_device *netdev,
 			     netdev_features_t features)
 {
@@ -2227,7 +2218,6 @@ static const struct net_device_ops gmac_351x_ops = {
 	.ndo_set_mac_address	= gmac_set_mac_address,
 	.ndo_get_stats64	= gmac_get_stats64,
 	.ndo_change_mtu		= gmac_change_mtu,
-	.ndo_fix_features	= gmac_fix_features,
 	.ndo_set_features	= gmac_set_features,
 };
 
@@ -2485,11 +2475,12 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
 
 	netdev->hw_features = GMAC_OFFLOAD_FEATURES;
 	netdev->features |= GMAC_OFFLOAD_FEATURES | NETIF_F_GRO;
-	/* We can handle jumbo frames up to 10236 bytes so, let's accept
-	 * payloads of 10236 bytes minus VLAN and ethernet header
+	/* We can receive jumbo frames up to 10236 bytes but only
+	 * transmit 2047 bytes so, let's accept payloads of 2047
+	 * bytes minus VLAN and ethernet header
 	 */
 	netdev->min_mtu = ETH_MIN_MTU;
-	netdev->max_mtu = 10236 - VLAN_ETH_HLEN;
+	netdev->max_mtu = MTU_SIZE_BIT_MASK - VLAN_ETH_HLEN;
 
 	port->freeq_refill = 0;
 	netif_napi_add(netdev, &port->napi, gmac_napi_poll,
diff --git a/drivers/net/ethernet/cortina/gemini.h b/drivers/net/ethernet/cortina/gemini.h
index 99efb1155743..24bb989981f2 100644
--- a/drivers/net/ethernet/cortina/gemini.h
+++ b/drivers/net/ethernet/cortina/gemini.h
@@ -502,7 +502,7 @@ union gmac_txdesc_3 {
 #define SOF_BIT			0x80000000
 #define EOF_BIT			0x40000000
 #define EOFIE_BIT		BIT(29)
-#define MTU_SIZE_BIT_MASK	0x1fff
+#define MTU_SIZE_BIT_MASK	0x7ff /* Max MTU 2047 bytes */
 
 /* GMAC Tx Descriptor */
 struct gmac_txdesc {

From 66dbaa2eecf1c4404d22a362ecd100f219875601 Mon Sep 17 00:00:00 2001
From: Linkui Xiao <xiaolinkui@kylinos.cn>
Date: Wed, 1 Nov 2023 11:20:18 +0800
Subject: [PATCH 0574/1043] netfilter: nf_conntrack_bridge: initialize err to 0

[ Upstream commit a44af08e3d4d7566eeea98d7a29fe06e7b9de944 ]

K2CI reported a problem:

	consume_skb(skb);
	return err;
[nf_br_ip_fragment() error]  uninitialized symbol 'err'.

err is not initialized, because returning 0 is expected, initialize err
to 0.

Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system")
Reported-by: k2ci <kernel-bot@kylinos.cn>
Signed-off-by: Linkui Xiao <xiaolinkui@kylinos.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bridge/netfilter/nf_conntrack_bridge.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index fdbed3158555..d14b2dbbd1df 100644
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -36,7 +36,7 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk,
 	ktime_t tstamp = skb->tstamp;
 	struct ip_frag_state state;
 	struct iphdr *iph;
-	int err;
+	int err = 0;
 
 	/* for offloaded checksums cleanup checksum before fragmentation */
 	if (skb->ip_summed == CHECKSUM_PARTIAL &&

From 541fece7caa464bd9ef90d5149cb185b6cbb003d Mon Sep 17 00:00:00 2001
From: Baruch Siach <baruch@tkos.co.il>
Date: Mon, 13 Nov 2023 19:42:49 +0200
Subject: [PATCH 0575/1043] net: stmmac: fix rx budget limit check

[ Upstream commit fa02de9e75889915b554eda1964a631fd019973b ]

The while loop condition verifies 'count < limit'. Neither value change
before the 'count >= limit' check. As is this check is dead code. But
code inspection reveals a code path that modifies 'count' and then goto
'drain_data' and back to 'read_again'. So there is a need to verify
count value sanity after 'read_again'.

Move 'read_again' up to fix the count limit check.

Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Link: https://lore.kernel.org/r/d9486296c3b6b12ab3a0515fcd47d56447a07bfc.1699897370.git.baruch@tkos.co.il
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 83e9a4d019c1..59a07a01e80c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3858,10 +3858,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
 			len = 0;
 		}
 
+read_again:
 		if (count >= limit)
 			break;
 
-read_again:
 		buf1_len = 0;
 		buf2_len = 0;
 		entry = next_entry;

From 0eaec8126b46bb79db1afec3cebf161d26efdba1 Mon Sep 17 00:00:00 2001
From: Dust Li <dust.li@linux.alibaba.com>
Date: Tue, 14 Nov 2023 13:58:36 -0800
Subject: [PATCH 0576/1043] net/mlx5e: fix double free of encap_header

[ Upstream commit 6f9b1a0731662648949a1c0587f6acb3b7f8acf1 ]

When mlx5_packet_reformat_alloc() fails, the encap_header allocated in
mlx5e_tc_tun_create_header_ipv4{6} will be released within it. However,
e->encap_header is already set to the previously freed encap_header
before mlx5_packet_reformat_alloc(). As a result, the later
mlx5e_encap_put() will free e->encap_header again, causing a double free
issue.

mlx5e_encap_put()
    --> mlx5e_encap_dealloc()
        --> kfree(e->encap_header)

This happens when cmd: MLX5_CMD_OP_ALLOC_PACKET_REFORMAT_CONTEXT fail.

This patch fix it by not setting e->encap_header until
mlx5_packet_reformat_alloc() success.

Fixes: d589e785baf5e ("net/mlx5e: Allow concurrent creation of encap entries")
Reported-by: Cruz Zhao <cruzzhao@linux.alibaba.com>
Reported-by: Tianchen Ding <dtcccc@linux.alibaba.com>
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
index 90930e54b6f2..05bcd69994ec 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
@@ -267,9 +267,6 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv,
 	if (err)
 		goto destroy_neigh_entry;
 
-	e->encap_size = ipv4_encap_size;
-	e->encap_header = encap_header;
-
 	if (!(nud_state & NUD_VALID)) {
 		neigh_event_send(n, NULL);
 		/* the encap entry will be made valid on neigh update event
@@ -286,6 +283,8 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv,
 		goto destroy_neigh_entry;
 	}
 
+	e->encap_size = ipv4_encap_size;
+	e->encap_header = encap_header;
 	e->flags |= MLX5_ENCAP_ENTRY_VALID;
 	mlx5e_rep_queue_neigh_stats_work(netdev_priv(out_dev));
 	mlx5e_route_lookup_ipv4_put(route_dev, n);
@@ -431,9 +430,6 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv,
 	if (err)
 		goto destroy_neigh_entry;
 
-	e->encap_size = ipv6_encap_size;
-	e->encap_header = encap_header;
-
 	if (!(nud_state & NUD_VALID)) {
 		neigh_event_send(n, NULL);
 		/* the encap entry will be made valid on neigh update event
@@ -451,6 +447,8 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv,
 		goto destroy_neigh_entry;
 	}
 
+	e->encap_size = ipv6_encap_size;
+	e->encap_header = encap_header;
 	e->flags |= MLX5_ENCAP_ENTRY_VALID;
 	mlx5e_rep_queue_neigh_stats_work(netdev_priv(out_dev));
 	mlx5e_route_lookup_ipv6_put(route_dev, n);

From a3ce491b17380b1fc9431a3cbb3eecca3d9acab4 Mon Sep 17 00:00:00 2001
From: Leon Romanovsky <leonro@nvidia.com>
Date: Sun, 4 Oct 2020 14:30:58 +0300
Subject: [PATCH 0577/1043] net/mlx5_core: Clean driver version and name

[ Upstream commit 17a7612b99e66d2539341ab4f888f970c2c7f76d ]

Remove exposed driver version as it was done in other drivers,
so module version will work correctly by displaying the kernel
version for which it is compiled.

And move mlx5_core module name to general include, so auxiliary drivers
will be able to use it as a basis for a name in their device ID tables.

Reviewed-by: Parav Pandit <parav@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Stable-dep-of: 1b2bd0c0264f ("net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/devlink.c      |  2 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c   |  4 +---
 drivers/net/ethernet/mellanox/mlx5/core/en_rep.c       |  1 -
 .../net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c    |  2 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c         | 10 ++++++----
 drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h    |  3 ---
 include/linux/mlx5/driver.h                            |  2 ++
 7 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
index 0e699330ae77..060561f63311 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
@@ -52,7 +52,7 @@ mlx5_devlink_info_get(struct devlink *devlink, struct devlink_info_req *req,
 	u32 running_fw, stored_fw;
 	int err;
 
-	err = devlink_info_driver_name_put(req, DRIVER_NAME);
+	err = devlink_info_driver_name_put(req, KBUILD_MODNAME);
 	if (err)
 		return err;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 6a1b1363ac16..d3817dd07e3d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -40,9 +40,7 @@ void mlx5e_ethtool_get_drvinfo(struct mlx5e_priv *priv,
 {
 	struct mlx5_core_dev *mdev = priv->mdev;
 
-	strlcpy(drvinfo->driver, DRIVER_NAME, sizeof(drvinfo->driver));
-	strlcpy(drvinfo->version, DRIVER_VERSION,
-		sizeof(drvinfo->version));
+	strlcpy(drvinfo->driver, KBUILD_MODNAME, sizeof(drvinfo->driver));
 	snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
 		 "%d.%d.%04d (%.16s)",
 		 fw_rev_maj(mdev), fw_rev_min(mdev), fw_rev_sub(mdev),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index b991f03c7e99..5a13d47d2c09 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -64,7 +64,6 @@ static void mlx5e_rep_get_drvinfo(struct net_device *dev,
 
 	strlcpy(drvinfo->driver, mlx5e_rep_driver_name,
 		sizeof(drvinfo->driver));
-	strlcpy(drvinfo->version, UTS_RELEASE, sizeof(drvinfo->version));
 	snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
 		 "%d.%d.%04d (%.16s)",
 		 fw_rev_maj(mdev), fw_rev_min(mdev),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
index 2cf7f0fc170b..d7bda7650767 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c
@@ -39,7 +39,7 @@ static void mlx5i_get_drvinfo(struct net_device *dev,
 	struct mlx5e_priv *priv = mlx5i_epriv(dev);
 
 	mlx5e_ethtool_get_drvinfo(priv, drvinfo);
-	strlcpy(drvinfo->driver, DRIVER_NAME "[ib_ipoib]",
+	strlcpy(drvinfo->driver, KBUILD_MODNAME "[ib_ipoib]",
 		sizeof(drvinfo->driver));
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 22907f6364f5..35e11cb883c9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -77,7 +77,6 @@
 MODULE_AUTHOR("Eli Cohen <eli@mellanox.com>");
 MODULE_DESCRIPTION("Mellanox 5th generation network adapters (ConnectX series) core driver");
 MODULE_LICENSE("Dual BSD/GPL");
-MODULE_VERSION(DRIVER_VERSION);
 
 unsigned int mlx5_core_debug_mask;
 module_param_named(debug_mask, mlx5_core_debug_mask, uint, 0644);
@@ -228,7 +227,7 @@ static void mlx5_set_driver_version(struct mlx5_core_dev *dev)
 	strncat(string, ",", remaining_size);
 
 	remaining_size = max_t(int, 0, driver_ver_sz - strlen(string));
-	strncat(string, DRIVER_NAME, remaining_size);
+	strncat(string, KBUILD_MODNAME, remaining_size);
 
 	remaining_size = max_t(int, 0, driver_ver_sz - strlen(string));
 	strncat(string, ",", remaining_size);
@@ -313,7 +312,7 @@ static int request_bar(struct pci_dev *pdev)
 		return -ENODEV;
 	}
 
-	err = pci_request_regions(pdev, DRIVER_NAME);
+	err = pci_request_regions(pdev, KBUILD_MODNAME);
 	if (err)
 		dev_err(&pdev->dev, "Couldn't get PCI resources, aborting\n");
 
@@ -1620,7 +1619,7 @@ void mlx5_recover_device(struct mlx5_core_dev *dev)
 }
 
 static struct pci_driver mlx5_core_driver = {
-	.name           = DRIVER_NAME,
+	.name           = KBUILD_MODNAME,
 	.id_table       = mlx5_core_pci_table,
 	.probe          = init_one,
 	.remove         = remove_one,
@@ -1646,6 +1645,9 @@ static int __init mlx5_init(void)
 {
 	int err;
 
+	WARN_ONCE(strcmp(MLX5_ADEV_NAME, KBUILD_MODNAME),
+		  "mlx5_core name not in sync with kernel module name");
+
 	get_random_bytes(&sw_owner_id, sizeof(sw_owner_id));
 
 	mlx5_core_verify_params();
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index 8cec85ab419d..b285f1515e4e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -42,9 +42,6 @@
 #include <linux/mlx5/fs.h>
 #include <linux/mlx5/driver.h>
 
-#define DRIVER_NAME "mlx5_core"
-#define DRIVER_VERSION "5.0-0"
-
 extern uint mlx5_core_debug_mask;
 
 #define mlx5_core_dbg(__dev, format, ...)				\
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 4f95b98215d8..2cd89af4dbf6 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -56,6 +56,8 @@
 #include <linux/ptp_clock_kernel.h>
 #include <net/devlink.h>
 
+#define MLX5_ADEV_NAME "mlx5_core"
+
 enum {
 	MLX5_BOARD_ID_LEN = 64,
 };

From ac4979dbd9b66ab599511186425094a1804ee2a7 Mon Sep 17 00:00:00 2001
From: Rahul Rameshbabu <rrameshbabu@nvidia.com>
Date: Tue, 14 Nov 2023 13:58:46 -0800
Subject: [PATCH 0578/1043] net/mlx5e: Check return value of snprintf writing
 to fw_version buffer for representors

[ Upstream commit 1b2bd0c0264febcd8d47209079a6671c38e6558b ]

Treat the operation as an error case when the return value is equivalent to
the size of the name buffer. Failed to write null terminator to the name
buffer, making the string malformed and should not be used. Provide a
string with only the firmware version when forming the string with the
board id fails. This logic for representors is identical to normal flow
with ethtool.

Without check, will trigger -Wformat-truncation with W=1.

    drivers/net/ethernet/mellanox/mlx5/core/en_rep.c: In function 'mlx5e_rep_get_drvinfo':
    drivers/net/ethernet/mellanox/mlx5/core/en_rep.c:78:31: warning: '%.16s' directive output may be truncated writing up to 16 bytes into a region of size between 13 and 22 [-Wformat-truncation=]
      78 |                  "%d.%d.%04d (%.16s)",
         |                               ^~~~~
    drivers/net/ethernet/mellanox/mlx5/core/en_rep.c:77:9: note: 'snprintf' output between 12 and 37 bytes into a destination of size 32
      77 |         snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
         |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      78 |                  "%d.%d.%04d (%.16s)",
         |                  ~~~~~~~~~~~~~~~~~~~~~
      79 |                  fw_rev_maj(mdev), fw_rev_min(mdev),
         |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      80 |                  fw_rev_sub(mdev), mdev->board_id);
         |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fixes: cf83c8fdcd47 ("net/mlx5e: Add missing ethtool driver info for representors")
Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d4ab2e97dcfbcd748ae71761a9d8e5e41cc732c
Signed-off-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Link: https://lore.kernel.org/r/20231114215846.5902-16-saeed@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 5a13d47d2c09..f9f1a79d6bdd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -61,13 +61,17 @@ static void mlx5e_rep_get_drvinfo(struct net_device *dev,
 {
 	struct mlx5e_priv *priv = netdev_priv(dev);
 	struct mlx5_core_dev *mdev = priv->mdev;
+	int count;
 
 	strlcpy(drvinfo->driver, mlx5e_rep_driver_name,
 		sizeof(drvinfo->driver));
-	snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
-		 "%d.%d.%04d (%.16s)",
-		 fw_rev_maj(mdev), fw_rev_min(mdev),
-		 fw_rev_sub(mdev), mdev->board_id);
+	count = snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
+			 "%d.%d.%04d (%.16s)", fw_rev_maj(mdev),
+			 fw_rev_min(mdev), fw_rev_sub(mdev), mdev->board_id);
+	if (count == sizeof(drvinfo->fw_version))
+		snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
+			 "%d.%d.%04d", fw_rev_maj(mdev),
+			 fw_rev_min(mdev), fw_rev_sub(mdev));
 }
 
 static void mlx5e_uplink_rep_get_drvinfo(struct net_device *dev,

From f56e228d67fc766cc4ee8d2e9479efb1baf60714 Mon Sep 17 00:00:00 2001
From: Vlad Buslov <vladbu@nvidia.com>
Date: Tue, 14 Nov 2023 18:59:15 +0100
Subject: [PATCH 0579/1043] macvlan: Don't propagate promisc change to lower
 dev in passthru

[ Upstream commit 7e1caeace0418381f36b3aa8403dfd82fc57fc53 ]

Macvlan device in passthru mode sets its lower device promiscuous mode
according to its MACVLAN_FLAG_NOPROMISC flag instead of synchronizing it to
its own promiscuity setting. However, macvlan_change_rx_flags() function
doesn't check the mode before propagating such changes to the lower device
which can cause net_device->promiscuity counter overflow as illustrated by
reproduction example [0] and resulting dmesg log [1]. Fix the issue by
first verifying the mode in macvlan_change_rx_flags() function before
propagating promiscuous mode change to the lower device.

[0]:
ip link add macvlan1 link enp8s0f0 type macvlan mode passthru
ip link set macvlan1 promisc on
ip l set dev macvlan1 up
ip link set macvlan1 promisc off
ip l set dev macvlan1 down
ip l set dev macvlan1 up

[1]:
[ 5156.281724] macvlan1: entered promiscuous mode
[ 5156.285467] mlx5_core 0000:08:00.0 enp8s0f0: entered promiscuous mode
[ 5156.287639] macvlan1: left promiscuous mode
[ 5156.288339] mlx5_core 0000:08:00.0 enp8s0f0: left promiscuous mode
[ 5156.290907] mlx5_core 0000:08:00.0 enp8s0f0: entered promiscuous mode
[ 5156.317197] mlx5_core 0000:08:00.0 enp8s0f0: promiscuity touches roof, set promiscuity failed. promiscuity feature of device might be broken.

Fixes: efdbd2b30caa ("macvlan: Propagate promiscuity setting to lower devices.")
Reviewed-by: Gal Pressman <gal@nvidia.com>
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20231114175915.1649154-1-vladbu@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/macvlan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 5869bc2c3aa7..9c77e6ab2b30 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -765,7 +765,7 @@ static void macvlan_change_rx_flags(struct net_device *dev, int change)
 	if (dev->flags & IFF_UP) {
 		if (change & IFF_ALLMULTI)
 			dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
-		if (change & IFF_PROMISC)
+		if (!macvlan_passthru(vlan->port) && change & IFF_PROMISC)
 			dev_set_promiscuity(lowerdev,
 					    dev->flags & IFF_PROMISC ? 1 : -1);
 

From 6d388b641c8fbd59dfb44ee5603b428ebd7a7625 Mon Sep 17 00:00:00 2001
From: Zhang Rui <rui.zhang@intel.com>
Date: Sat, 25 Mar 2023 21:57:07 +0800
Subject: [PATCH 0580/1043] tools/power/turbostat: Fix a knl bug

[ Upstream commit 137f01b3529d292a68d22e9681e2f903c768f790 ]

MSR_KNL_CORE_C6_RESIDENCY should be evaluated only if
1. this is KNL platform
AND
2. need to get C6 residency or need to calculate C1 residency

Fix the broken logic introduced by commit 1e9042b9c8d4 ("tools/power
turbostat: Fix CPU%C1 display value").

Fixes: 1e9042b9c8d4 ("tools/power turbostat: Fix CPU%C1 display value")
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Reviewed-by: Len Brown <len.brown@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/power/x86/turbostat/turbostat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index d33c9d427e57..9d4a249cc98b 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -1995,7 +1995,7 @@ int get_counters(struct thread_data *t, struct core_data *c, struct pkg_data *p)
 	if ((DO_BIC(BIC_CPU_c6) || soft_c1_residency_display(BIC_CPU_c6)) && !do_knl_cstates) {
 		if (get_msr(cpu, MSR_CORE_C6_RESIDENCY, &c->c6))
 			return -7;
-	} else if (do_knl_cstates || soft_c1_residency_display(BIC_CPU_c6)) {
+	} else if (do_knl_cstates && soft_c1_residency_display(BIC_CPU_c6)) {
 		if (get_msr(cpu, MSR_KNL_CORE_C6_RESIDENCY, &c->c6))
 			return -7;
 	}

From e5a0ef02829d88a3f8c098e75f336fbfbd8b61c7 Mon Sep 17 00:00:00 2001
From: Anastasia Belova <abelova@astralinux.ru>
Date: Mon, 13 Nov 2023 17:52:32 +0300
Subject: [PATCH 0581/1043] cifs: spnego: add ';' in HOST_KEY_LEN

[ Upstream commit ff31ba19d732efb9aca3633935d71085e68d5076 ]

"host=" should start with ';' (as in cifs_get_spnego_key)
So its length should be 6.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Fixes: 7c9c3760b3a5 ("[CIFS] add constants for string lengths of keynames in SPNEGO upcall string")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Co-developed-by: Ekaterina Esina <eesina@astralinux.ru>
Signed-off-by: Ekaterina Esina <eesina@astralinux.ru>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/cifs_spnego.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 7b9b876b513b..4f9d08ac9dde 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -76,8 +76,8 @@ struct key_type cifs_spnego_key_type = {
  * strlen(";sec=ntlmsspi") */
 #define MAX_MECH_STR_LEN	13
 
-/* strlen of "host=" */
-#define HOST_KEY_LEN		5
+/* strlen of ";host=" */
+#define HOST_KEY_LEN		6
 
 /* strlen of ";ip4=" or ";ip6=" */
 #define IP_KEY_LEN		5

From 99dbc39c22cea32b3906211cda5d17b1449ce0ec Mon Sep 17 00:00:00 2001
From: Ekaterina Esina <eesina@astralinux.ru>
Date: Mon, 13 Nov 2023 19:42:41 +0300
Subject: [PATCH 0582/1043] cifs: fix check of rc in function
 generate_smb3signingkey

[ Upstream commit 181724fc72486dec2bec8803459be05b5162aaa8 ]

Remove extra check after condition, add check after generating key
for encryption. The check is needed to return non zero rc before
rewriting it with generating key for decryption.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Fixes: d70e9fa55884 ("cifs: try opening channels after mounting")
Signed-off-by: Ekaterina Esina <eesina@astralinux.ru>
Co-developed-by: Anastasia Belova <abelova@astralinux.ru>
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/smb2transport.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
index e6fa76ab70be..d659eb70df76 100644
--- a/fs/cifs/smb2transport.c
+++ b/fs/cifs/smb2transport.c
@@ -433,6 +433,8 @@ generate_smb3signingkey(struct cifs_ses *ses,
 				  ptriplet->encryption.context,
 				  ses->smb3encryptionkey,
 				  SMB3_ENC_DEC_KEY_SIZE);
+		if (rc)
+			return rc;
 		rc = generate_key(ses, ptriplet->decryption.label,
 				  ptriplet->decryption.context,
 				  ses->smb3decryptionkey,
@@ -441,9 +443,6 @@ generate_smb3signingkey(struct cifs_ses *ses,
 			return rc;
 	}
 
-	if (rc)
-		return rc;
-
 #ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS
 	cifs_dbg(VFS, "%s: dumping generated AES session keys\n", __func__);
 	/*

From e7de8ffbbbc792c0bd6207279b3d91bf029e4132 Mon Sep 17 00:00:00 2001
From: Vikash Garodia <quic_vgarodia@quicinc.com>
Date: Thu, 10 Aug 2023 07:55:01 +0530
Subject: [PATCH 0583/1043] media: venus: hfi: add checks to perform sanity on
 queue pointers

commit 5e538fce33589da6d7cb2de1445b84d3a8a692f7 upstream.

Read and write pointers are used to track the packet index in the memory
shared between video driver and firmware. There is a possibility of OOB
access if the read or write pointer goes beyond the queue memory size.
Add checks for the read and write pointer to avoid OOB access.

Cc: stable@vger.kernel.org
Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files")
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/qcom/venus/hfi_venus.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c
index 9d939f63d16f..8b1375c97c81 100644
--- a/drivers/media/platform/qcom/venus/hfi_venus.c
+++ b/drivers/media/platform/qcom/venus/hfi_venus.c
@@ -206,6 +206,11 @@ static int venus_write_queue(struct venus_hfi_device *hdev,
 
 	new_wr_idx = wr_idx + dwords;
 	wr_ptr = (u32 *)(queue->qmem.kva + (wr_idx << 2));
+
+	if (wr_ptr < (u32 *)queue->qmem.kva ||
+	    wr_ptr > (u32 *)(queue->qmem.kva + queue->qmem.size - sizeof(*wr_ptr)))
+		return -EINVAL;
+
 	if (new_wr_idx < qsize) {
 		memcpy(wr_ptr, packet, dwords << 2);
 	} else {
@@ -273,6 +278,11 @@ static int venus_read_queue(struct venus_hfi_device *hdev,
 	}
 
 	rd_ptr = (u32 *)(queue->qmem.kva + (rd_idx << 2));
+
+	if (rd_ptr < (u32 *)queue->qmem.kva ||
+	    rd_ptr > (u32 *)(queue->qmem.kva + queue->qmem.size - sizeof(*rd_ptr)))
+		return -EINVAL;
+
 	dwords = *rd_ptr >> 2;
 	if (!dwords)
 		return -EINVAL;

From d83f4bc0a4db02397c5205cd2407c2a12a696769 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 19 Oct 2023 01:34:23 +1000
Subject: [PATCH 0584/1043] powerpc/perf: Fix disabling BHRB and instruction
 sampling

commit ea142e590aec55ba40c5affb4d49e68c713c63dc upstream.

When the PMU is disabled, MMCRA is not updated to disable BHRB and
instruction sampling. This can lead to those features remaining enabled,
which can slow down a real or emulated CPU.

Fixes: 1cade527f6e9 ("powerpc/perf: BHRB control to disable BHRB logic when not used")
Cc: stable@vger.kernel.org # v5.9+
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231018153423.298373-1-npiggin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/perf/core-book3s.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 6e3e50614353..1dc98e2fce2e 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -1289,8 +1289,7 @@ static void power_pmu_disable(struct pmu *pmu)
 		/*
 		 * Disable instruction sampling if it was enabled
 		 */
-		if (cpuhw->mmcr.mmcra & MMCRA_SAMPLE_ENABLE)
-			val &= ~MMCRA_SAMPLE_ENABLE;
+		val &= ~MMCRA_SAMPLE_ENABLE;
 
 		/* Disable BHRB via mmcra (BHRBRD) for p10 */
 		if (ppmu->flags & PPMU_ARCH_31)
@@ -1301,7 +1300,7 @@ static void power_pmu_disable(struct pmu *pmu)
 		 * instruction sampling or BHRB.
 		 */
 		if (val != mmcra) {
-			mtspr(SPRN_MMCRA, mmcra);
+			mtspr(SPRN_MMCRA, val);
 			mb();
 			isync();
 		}

From 7975f7b2a6fcd57c1d39ea2c4f55b281920ac8cd Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Fri, 6 Oct 2023 21:09:28 -0700
Subject: [PATCH 0585/1043] randstruct: Fix gcc-plugin performance mode to stay
 in group

commit 381fdb73d1e2a48244de7260550e453d1003bb8e upstream.

The performance mode of the gcc-plugin randstruct was shuffling struct
members outside of the cache-line groups. Limit the range to the
specified group indexes.

Cc: linux-hardening@vger.kernel.org
Cc: stable@vger.kernel.org
Reported-by: Lukas Loidolt <e1634039@student.tuwien.ac.at>
Closes: https://lore.kernel.org/all/f3ca77f0-e414-4065-83a5-ae4c4d25545d@student.tuwien.ac.at
Fixes: 313dd1b62921 ("gcc-plugins: Add the randstruct plugin")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/gcc-plugins/randomize_layout_plugin.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/scripts/gcc-plugins/randomize_layout_plugin.c b/scripts/gcc-plugins/randomize_layout_plugin.c
index bd29e4e7a524..c7ff92b4189c 100644
--- a/scripts/gcc-plugins/randomize_layout_plugin.c
+++ b/scripts/gcc-plugins/randomize_layout_plugin.c
@@ -209,12 +209,14 @@ static void partition_struct(tree *fields, unsigned long length, struct partitio
 
 static void performance_shuffle(tree *newtree, unsigned long length, ranctx *prng_state)
 {
-	unsigned long i, x;
+	unsigned long i, x, index;
 	struct partition_group size_group[length];
 	unsigned long num_groups = 0;
 	unsigned long randnum;
 
 	partition_struct(newtree, length, (struct partition_group *)&size_group, &num_groups);
+
+	/* FIXME: this group shuffle is currently a no-op. */
 	for (i = num_groups - 1; i > 0; i--) {
 		struct partition_group tmp;
 		randnum = ranval(prng_state) % (i + 1);
@@ -224,11 +226,14 @@ static void performance_shuffle(tree *newtree, unsigned long length, ranctx *prn
 	}
 
 	for (x = 0; x < num_groups; x++) {
-		for (i = size_group[x].start + size_group[x].length - 1; i > size_group[x].start; i--) {
+		for (index = size_group[x].length - 1; index > 0; index--) {
 			tree tmp;
+
+			i = size_group[x].start + index;
 			if (DECL_BIT_FIELD_TYPE(newtree[i]))
 				continue;
-			randnum = ranval(prng_state) % (i + 1);
+			randnum = ranval(prng_state) % (index + 1);
+			randnum += size_group[x].start;
 			// we could handle this case differently if desired
 			if (DECL_BIT_FIELD_TYPE(newtree[randnum]))
 				continue;

From 9617a9fe4f41e0efddbd8ed10cf5269cceaa34eb Mon Sep 17 00:00:00 2001
From: Hao Sun <sunhao.th@gmail.com>
Date: Wed, 1 Nov 2023 13:33:51 +0100
Subject: [PATCH 0586/1043] bpf: Fix check_stack_write_fixed_off() to correctly
 spill imm

commit 811c363645b33e6e22658634329e95f383dfc705 upstream.

In check_stack_write_fixed_off(), imm value is cast to u32 before being
spilled to the stack. Therefore, the sign information is lost, and the
range information is incorrect when load from the stack again.

For the following prog:
0: r2 = r10
1: *(u64*)(r2 -40) = -44
2: r0 = *(u64*)(r2 - 40)
3: if r0 s<= 0xa goto +2
4: r0 = 1
5: exit
6: r0  = 0
7: exit

The verifier gives:
func#0 @0
0: R1=ctx(off=0,imm=0) R10=fp0
0: (bf) r2 = r10                      ; R2_w=fp0 R10=fp0
1: (7a) *(u64 *)(r2 -40) = -44        ; R2_w=fp0 fp-40_w=4294967252
2: (79) r0 = *(u64 *)(r2 -40)         ; R0_w=4294967252 R2_w=fp0
fp-40_w=4294967252
3: (c5) if r0 s< 0xa goto pc+2
mark_precise: frame0: last_idx 3 first_idx 0 subseq_idx -1
mark_precise: frame0: regs=r0 stack= before 2: (79) r0 = *(u64 *)(r2 -40)
3: R0_w=4294967252
4: (b7) r0 = 1                        ; R0_w=1
5: (95) exit
verification time 7971 usec
stack depth 40
processed 6 insns (limit 1000000) max_states_per_insn 0 total_states 0
peak_states 0 mark_read 0

So remove the incorrect cast, since imm field is declared as s32, and
__mark_reg_known() takes u64, so imm would be correctly sign extended
by compiler.

Fixes: ecdf985d7615 ("bpf: track immediate values written to stack by BPF_ST instruction")
Cc: stable@vger.kernel.org
Signed-off-by: Hao Sun <sunhao.th@gmail.com>
Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20231101-fix-check-stack-write-v3-1-f05c2b1473d5@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/bpf/verifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8f1e43df8c5f..c3a8b3e16528 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2534,7 +2534,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,
 		   insn->imm != 0 && env->bpf_capable) {
 		struct bpf_reg_state fake_reg = {};
 
-		__mark_reg_known(&fake_reg, (u32)insn->imm);
+		__mark_reg_known(&fake_reg, insn->imm);
 		fake_reg.type = SCALAR_VALUE;
 		save_register_state(state, spi, &fake_reg, size);
 	} else if (reg && is_spillable_regtype(reg->type)) {

From 5fb8ec5943b179e7486badf96a92c17fef16941b Mon Sep 17 00:00:00 2001
From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Date: Thu, 2 Nov 2023 13:39:03 +0800
Subject: [PATCH 0587/1043] bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE
 | BPF_END
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 291d044fd51f8484066300ee42afecf8c8db7b3a upstream.

BPF_END and BPF_NEG has a different specification for the source bit in
the opcode compared to other ALU/ALU64 instructions, and is either
reserved or use to specify the byte swap endianness. In both cases the
source bit does not encode source operand location, and src_reg is a
reserved field.

backtrack_insn() currently does not differentiate BPF_END and BPF_NEG
from other ALU/ALU64 instructions, which leads to r0 being incorrectly
marked as precise when processing BPF_ALU | BPF_TO_BE | BPF_END
instructions. This commit teaches backtrack_insn() to correctly mark
precision for such case.

While precise tracking of BPF_NEG and other BPF_END instructions are
correct and does not need fixing, this commit opt to process all BPF_NEG
and BPF_END instructions within the same if-clause to better align with
current convention used in the verifier (e.g. check_alu_op).

Fixes: b5dc0163d8fd ("bpf: precise scalar_value tracking")
Cc: stable@vger.kernel.org
Reported-by: Mohamed Mahmoud <mmahmoud@redhat.com>
Closes: https://lore.kernel.org/r/87jzrrwptf.fsf@toke.dk
Tested-by: Toke Høiland-Jørgensen <toke@redhat.com>
Tested-by: Tao Lyu <tao.lyu@epfl.ch>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Link: https://lore.kernel.org/r/20231102053913.12004-2-shung-hsi.yu@suse.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/bpf/verifier.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c3a8b3e16528..45c50ee9b037 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1841,7 +1841,12 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx,
 	if (class == BPF_ALU || class == BPF_ALU64) {
 		if (!(*reg_mask & dreg))
 			return 0;
-		if (opcode == BPF_MOV) {
+		if (opcode == BPF_END || opcode == BPF_NEG) {
+			/* sreg is reserved and unused
+			 * dreg still need precision before this insn
+			 */
+			return 0;
+		} else if (opcode == BPF_MOV) {
 			if (BPF_SRC(insn->code) == BPF_X) {
 				/* dreg = sreg
 				 * dreg needs precision after this insn

From 697bc325b9775d355942f1c6687f99dafd597566 Mon Sep 17 00:00:00 2001
From: Ranjan Kumar <ranjan.kumar@broadcom.com>
Date: Fri, 20 Oct 2023 16:28:49 +0530
Subject: [PATCH 0588/1043] scsi: mpt3sas: Fix loop logic

commit 3c978492c333f0c08248a8d51cecbe5eb5f617c9 upstream.

The retry loop continues to iterate until the count reaches 30, even after
receiving the correct value. Exit loop when a non-zero value is read.

Fixes: 4ca10f3e3174 ("scsi: mpt3sas: Perform additional retries if doorbell read returns 0")
Cc: stable@vger.kernel.org
Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Link: https://lore.kernel.org/r/20231020105849.6350-1-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/mpt3sas/mpt3sas_base.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 3728e4cf6e05..814ac2523805 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -216,8 +216,8 @@ _base_readl_ext_retry(const volatile void __iomem *addr)
 
 	for (i = 0 ; i < 30 ; i++) {
 		ret_val = readl(addr);
-		if (ret_val == 0)
-			continue;
+		if (ret_val != 0)
+			break;
 	}
 
 	return ret_val;

From 243c4833f345122819129a8a3724cd6bb179b989 Mon Sep 17 00:00:00 2001
From: Chandrakanth patil <chandrakanth.patil@broadcom.com>
Date: Tue, 3 Oct 2023 16:30:18 +0530
Subject: [PATCH 0589/1043] scsi: megaraid_sas: Increase register read retry
 rount from 3 to 30 for selected registers

commit 8e3ed9e786511ad800c33605ed904b9de49323cf upstream.

In BMC environments with concurrent access to multiple registers, certain
registers occasionally yield a value of 0 even after 3 retries due to
hardware errata. As a fix, we have extended the retry count from 3 to 30.

The same errata applies to the mpt3sas driver, and a similar patch has
been accepted. Please find more details in the mpt3sas patch reference
link.

Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com
Fixes: 272652fcbf1a ("scsi: megaraid_sas: add retry logic in megasas_readl")
Cc: stable@vger.kernel.org
Signed-off-by: Chandrakanth patil <chandrakanth.patil@broadcom.com>
Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
Link: https://lore.kernel.org/r/20231003110021.168862-2-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/megaraid/megaraid_sas_base.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index ec9a19d94855..365279d7c982 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -248,13 +248,13 @@ u32 megasas_readl(struct megasas_instance *instance,
 	 * Fusion registers could intermittently return all zeroes.
 	 * This behavior is transient in nature and subsequent reads will
 	 * return valid value. As a workaround in driver, retry readl for
-	 * upto three times until a non-zero value is read.
+	 * up to thirty times until a non-zero value is read.
 	 */
 	if (instance->adapter_type == AERO_SERIES) {
 		do {
 			ret_val = readl(addr);
 			i++;
-		} while (ret_val == 0 && i < 3);
+		} while (ret_val == 0 && i < 30);
 		return ret_val;
 	} else {
 		return readl(addr);

From 8cf6b6658541f3a7aacce59ded98a0b01259b1c2 Mon Sep 17 00:00:00 2001
From: Pu Wen <puwen@hygon.cn>
Date: Mon, 14 Aug 2023 10:18:26 +0200
Subject: [PATCH 0590/1043] x86/cpu/hygon: Fix the CPU topology evaluation for
 real

commit ee545b94d39a00c93dc98b1dbcbcf731d2eadeb4 upstream.

Hygon processors with a model ID > 3 have CPUID leaf 0xB correctly
populated and don't need the fixed package ID shift workaround. The fixup
is also incorrect when running in a guest.

Fixes: e0ceeae708ce ("x86/CPU/hygon: Fix phys_proc_id calculation logic for multi-die processors")
Signed-off-by: Pu Wen <puwen@hygon.cn>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/tencent_594804A808BD93A4EBF50A994F228E3A7F07@qq.com
Link: https://lore.kernel.org/r/20230814085112.089607918@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/hygon.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/hygon.c b/arch/x86/kernel/cpu/hygon.c
index 205fa420ee7c..3f5c00b15e2c 100644
--- a/arch/x86/kernel/cpu/hygon.c
+++ b/arch/x86/kernel/cpu/hygon.c
@@ -89,8 +89,12 @@ static void hygon_get_topology(struct cpuinfo_x86 *c)
 		if (!err)
 			c->x86_coreid_bits = get_count_order(c->x86_max_cores);
 
-		/* Socket ID is ApicId[6] for these processors. */
-		c->phys_proc_id = c->apicid >> APICID_SOCKET_ID_BIT;
+		/*
+		 * Socket ID is ApicId[6] for the processors with model <= 0x3
+		 * when running on host.
+		 */
+		if (!boot_cpu_has(X86_FEATURE_HYPERVISOR) && c->x86_model <= 0x3)
+			c->phys_proc_id = c->apicid >> APICID_SOCKET_ID_BIT;
 
 		cacheinfo_hygon_init_llc_id(c, cpu);
 	} else if (cpu_has(c, X86_FEATURE_NODEID_MSR)) {

From 66406d49ac14d20a5aa34ce2390f26a02d5e5ac0 Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenz@amazon.com>
Date: Tue, 17 Oct 2023 15:51:02 +0000
Subject: [PATCH 0591/1043] KVM: x86: hyper-v: Don't auto-enable stimer on
 write from user-space

commit d6800af51c76b6dae20e6023bbdc9b3da3ab5121 upstream.

Don't apply the stimer's counter side effects when modifying its
value from user-space, as this may trigger spurious interrupts.

For example:
 - The stimer is configured in auto-enable mode.
 - The stimer's count is set and the timer enabled.
 - The stimer expires, an interrupt is injected.
 - The VM is live migrated.
 - The stimer config and count are deserialized, auto-enable is ON, the
   stimer is re-enabled.
 - The stimer expires right away, and injects an unwarranted interrupt.

Cc: stable@vger.kernel.org
Fixes: 1f4b34f825e8 ("kvm/x86: Hyper-V SynIC timers")
Signed-off-by: Nicolas Saenz Julienne <nsaenz@amazon.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://lore.kernel.org/r/20231017155101.40677-1-nsaenz@amazon.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/hyperv.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index e03e320847cd..20eb8f55e1f1 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -674,10 +674,12 @@ static int stimer_set_count(struct kvm_vcpu_hv_stimer *stimer, u64 count,
 
 	stimer_cleanup(stimer);
 	stimer->count = count;
-	if (stimer->count == 0)
-		stimer->config.enable = 0;
-	else if (stimer->config.auto_enable)
-		stimer->config.enable = 1;
+	if (!host) {
+		if (stimer->count == 0)
+			stimer->config.enable = 0;
+		else if (stimer->config.auto_enable)
+			stimer->config.enable = 1;
+	}
 
 	if (stimer->config.enable)
 		stimer_mark_pending(stimer, false);

From 910caee34640249305768ee8fdcbe2d885eed6df Mon Sep 17 00:00:00 2001
From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
Date: Thu, 19 Oct 2023 18:06:57 +0200
Subject: [PATCH 0592/1043] KVM: x86: Ignore MSR_AMD64_TW_CFG access

commit 2770d4722036d6bd24bcb78e9cd7f6e572077d03 upstream.

Hyper-V enabled Windows Server 2022 KVM VM cannot be started on Zen1 Ryzen
since it crashes at boot with SYSTEM_THREAD_EXCEPTION_NOT_HANDLED +
STATUS_PRIVILEGED_INSTRUCTION (in other words, because of an unexpected #GP
in the guest kernel).

This is because Windows tries to set bit 8 in MSR_AMD64_TW_CFG and can't
handle receiving a #GP when doing so.

Give this MSR the same treatment that commit 2e32b7190641
("x86, kvm: Add MSR_AMD64_BU_CFG2 to the list of ignored MSRs") gave
MSR_AMD64_BU_CFG2 under justification that this MSR is baremetal-relevant
only.
Although apparently it was then needed for Linux guests, not Windows as in
this case.

With this change, the aforementioned guest setup is able to finish booting
successfully.

This issue can be reproduced either on a Summit Ridge Ryzen (with
just "-cpu host") or on a Naples EPYC (with "-cpu host,stepping=1" since
EPYC is ordinarily stepping 2).

Alternatively, userspace could solve the problem by using MSR filters, but
forcing every userspace to define a filter isn't very friendly and doesn't
add much, if any, value.  The only potential hiccup is if one of these
"baremetal-only" MSRs ever requires actual emulation and/or has F/M/S
specific behavior.  But if that happens, then KVM can still punt *that*
handling to userspace since userspace MSR filters "win" over KVM's default
handling.

Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1ce85d9c7c9e9632393816cf19c902e0a3f411f1.1697731406.git.maciej.szmigiero@oracle.com
[sean: call out MSR filtering alternative]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/msr-index.h | 1 +
 arch/x86/kvm/x86.c               | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 8465fc8ffd99..7d7a3cbb8e01 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -505,6 +505,7 @@
 #define MSR_AMD64_CPUID_FN_1		0xc0011004
 #define MSR_AMD64_LS_CFG		0xc0011020
 #define MSR_AMD64_DC_CFG		0xc0011022
+#define MSR_AMD64_TW_CFG		0xc0011023
 
 #define MSR_AMD64_DE_CFG		0xc0011029
 #define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT	 1
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index c2899ff31a06..13e4699a0744 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3132,6 +3132,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 	case MSR_AMD64_PATCH_LOADER:
 	case MSR_AMD64_BU_CFG2:
 	case MSR_AMD64_DC_CFG:
+	case MSR_AMD64_TW_CFG:
 	case MSR_F15H_EX_CFG:
 		break;
 
@@ -3485,6 +3486,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 	case MSR_AMD64_BU_CFG2:
 	case MSR_IA32_PERF_CTL:
 	case MSR_AMD64_DC_CFG:
+	case MSR_AMD64_TW_CFG:
 	case MSR_F15H_EX_CFG:
 	/*
 	 * Intel Sandy Bridge CPUs must support the RAPL (running average power

From 121973ef1ad7b7c6d684b81d55a3ca123d3cc802 Mon Sep 17 00:00:00 2001
From: Paul Moore <paul@paul-moore.com>
Date: Mon, 9 Oct 2023 13:18:49 -0400
Subject: [PATCH 0593/1043] audit: don't take task_lock() in
 audit_exe_compare() code path

commit 47846d51348dd62e5231a83be040981b17c955fa upstream.

The get_task_exe_file() function locks the given task with task_lock()
which when used inside audit_exe_compare() can cause deadlocks on
systems that generate audit records when the task_lock() is held. We
resolve this problem with two changes: ignoring those cases where the
task being audited is not the current task, and changing our approach
to obtaining the executable file struct to not require task_lock().

With the intent of the audit exe filter being to filter on audit events
generated by processes started by the specified executable, it makes
sense that we would only want to use the exe filter on audit records
associated with the currently executing process, e.g. @current.  If
we are asked to filter records using a non-@current task_struct we can
safely ignore the exe filter without negatively impacting the admin's
expectations for the exe filter.

Knowing that we only have to worry about filtering the currently
executing task in audit_exe_compare() we can do away with the
task_lock() and call get_mm_exe_file() with @current->mm directly.

Cc: <stable@vger.kernel.org>
Fixes: 5efc244346f9 ("audit: fix exe_file access in audit_exe_compare")
Reported-by: Andreas Steinmetz <anstein99@googlemail.com>
Reviewed-by: John Johansen <john.johanse@canonical.com>
Reviewed-by: Mateusz Guzik <mjguzik@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/audit_watch.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 2acf7ca49154..ba1dd8bf1bb8 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -527,11 +527,18 @@ int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
 	unsigned long ino;
 	dev_t dev;
 
-	exe_file = get_task_exe_file(tsk);
+	/* only do exe filtering if we are recording @current events/records */
+	if (tsk != current)
+		return 0;
+
+	if (WARN_ON_ONCE(!current->mm))
+		return 0;
+	exe_file = get_mm_exe_file(current->mm);
 	if (!exe_file)
 		return 0;
 	ino = file_inode(exe_file)->i_ino;
 	dev = file_inode(exe_file)->i_sb->s_dev;
 	fput(exe_file);
+
 	return audit_mark_compare(mark, ino, dev);
 }

From fc557bcfd7ff8080d1376f353476e7df8f303a3f Mon Sep 17 00:00:00 2001
From: Paul Moore <paul@paul-moore.com>
Date: Tue, 14 Nov 2023 17:25:48 -0500
Subject: [PATCH 0594/1043] audit: don't WARN_ON_ONCE(!current->mm) in
 audit_exe_compare()

commit 969d90ec212bae4b45bf9d21d7daa30aa6cf055e upstream.

eBPF can end up calling into the audit code from some odd places, and
some of these places don't have @current set properly so we end up
tripping the `WARN_ON_ONCE(!current->mm)` near the top of
`audit_exe_compare()`.  While the basic `!current->mm` check is good,
the `WARN_ON_ONCE()` results in some scary console messages so let's
drop that and just do the regular `!current->mm` check to avoid
problems.

Cc: <stable@vger.kernel.org>
Fixes: 47846d51348d ("audit: don't take task_lock() in audit_exe_compare() code path")
Reported-by: Artem Savkov <asavkov@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/audit_watch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index ba1dd8bf1bb8..edbeffee64b8 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -531,7 +531,7 @@ int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
 	if (tsk != current)
 		return 0;
 
-	if (WARN_ON_ONCE(!current->mm))
+	if (!current->mm)
 		return 0;
 	exe_file = get_mm_exe_file(current->mm);
 	if (!exe_file)

From a158a74e701bd5e10b443d588342e484f356518a Mon Sep 17 00:00:00 2001
From: Muhammad Usama Anjum <usama.anjum@collabora.com>
Date: Mon, 9 Oct 2023 21:20:20 +0500
Subject: [PATCH 0595/1043] tty/sysrq: replace smp_processor_id() with
 get_cpu()

commit dd976a97d15b47656991e185a94ef42a0fa5cfd4 upstream.

The smp_processor_id() shouldn't be called from preemptible code.
Instead use get_cpu() and put_cpu() which disables preemption in
addition to getting the processor id. Enable preemption back after
calling schedule_work() to make sure that the work gets scheduled on all
cores other than the current core. We want to avoid a scenario where
current core's stack trace is printed multiple times and one core's
stack trace isn't printed because of scheduling of current task.

This fixes the following bug:

[  119.143590] sysrq: Show backtrace of all active CPUs
[  119.143902] BUG: using smp_processor_id() in preemptible [00000000] code: bash/873
[  119.144586] caller is debug_smp_processor_id+0x20/0x30
[  119.144827] CPU: 6 PID: 873 Comm: bash Not tainted 5.10.124-dirty #3
[  119.144861] Hardware name: QEMU QEMU Virtual Machine, BIOS 2023.05-1 07/22/2023
[  119.145053] Call trace:
[  119.145093]  dump_backtrace+0x0/0x1a0
[  119.145122]  show_stack+0x18/0x70
[  119.145141]  dump_stack+0xc4/0x11c
[  119.145159]  check_preemption_disabled+0x100/0x110
[  119.145175]  debug_smp_processor_id+0x20/0x30
[  119.145195]  sysrq_handle_showallcpus+0x20/0xc0
[  119.145211]  __handle_sysrq+0x8c/0x1a0
[  119.145227]  write_sysrq_trigger+0x94/0x12c
[  119.145247]  proc_reg_write+0xa8/0xe4
[  119.145266]  vfs_write+0xec/0x280
[  119.145282]  ksys_write+0x6c/0x100
[  119.145298]  __arm64_sys_write+0x20/0x30
[  119.145315]  el0_svc_common.constprop.0+0x78/0x1e4
[  119.145332]  do_el0_svc+0x24/0x8c
[  119.145348]  el0_svc+0x10/0x20
[  119.145364]  el0_sync_handler+0x134/0x140
[  119.145381]  el0_sync+0x180/0x1c0

Cc: jirislaby@kernel.org
Cc: stable@vger.kernel.org
Fixes: 47cab6a722d4 ("debug lockups: Improve lockup detection, fix generic arch fallback")
Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Link: https://lore.kernel.org/r/20231009162021.3607632-1-usama.anjum@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/sysrq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index 7ca209d4e088..ad08eddc1532 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -262,13 +262,14 @@ static void sysrq_handle_showallcpus(int key)
 		if (in_irq())
 			regs = get_irq_regs();
 
-		pr_info("CPU%d:\n", smp_processor_id());
+		pr_info("CPU%d:\n", get_cpu());
 		if (regs)
 			show_regs(regs);
 		else
 			show_stack(NULL, NULL, KERN_INFO);
 
 		schedule_work(&sysrq_showallcpus);
+		put_cpu();
 	}
 }
 

From d5455c421fadea0fc6c3c9f31adf9da2fdd4613d Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Fri, 20 Oct 2023 17:15:29 +0100
Subject: [PATCH 0596/1043] hvc/xen: fix console unplug

commit a30badfd7c13fc8763a9e10c5a12ba7f81515a55 upstream.

On unplug of a Xen console, xencons_disconnect_backend() unconditionally
calls free_irq() via unbind_from_irqhandler(), causing a warning of
freeing an already-free IRQ:

(qemu) device_del con1
[   32.050919] ------------[ cut here ]------------
[   32.050942] Trying to free already-free IRQ 33
[   32.050990] WARNING: CPU: 0 PID: 51 at kernel/irq/manage.c:1895 __free_irq+0x1d4/0x330

It should be using evtchn_put() to tear down the event channel binding,
and let the Linux IRQ side of it be handled by notifier_del_irq() through
the HVC code.

On which topic... xencons_disconnect_backend() should call hvc_remove()
*first*, rather than tearing down the event channel and grant mapping
while they are in use. And then the IRQ is guaranteed to be freed by
the time it's torn down by evtchn_put().

Since evtchn_put() also closes the actual event channel, avoid calling
xenbus_free_evtchn() except in the failure path where the IRQ was not
successfully set up.

However, calling hvc_remove() at the start of xencons_disconnect_backend()
still isn't early enough. An unplug request is indicated by the backend
setting its state to XenbusStateClosing, which triggers a notification
to xencons_backend_changed(), which... does nothing except set its own
frontend state directly to XenbusStateClosed without *actually* tearing
down the HVC device or, you know, making sure it isn't actively in use.

So the backend sees the guest frontend set its state to XenbusStateClosed
and stops servicing the interrupt... and the guest spins for ever in the
domU_write_console() function waiting for the ring to drain.

Fix that one by calling hvc_remove() from xencons_backend_changed() before
signalling to the backend that it's OK to proceed with the removal.

Tested with 'dd if=/dev/zero of=/dev/hvc1' while telling Qemu to remove
the console device.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231020161529.355083-4-dwmw2@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/hvc/hvc_xen.c | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
index 6f387a4fd96a..93c858408b0a 100644
--- a/drivers/tty/hvc/hvc_xen.c
+++ b/drivers/tty/hvc/hvc_xen.c
@@ -363,18 +363,21 @@ void xen_console_resume(void)
 #ifdef CONFIG_HVC_XEN_FRONTEND
 static void xencons_disconnect_backend(struct xencons_info *info)
 {
-	if (info->irq > 0)
-		unbind_from_irqhandler(info->irq, NULL);
-	info->irq = 0;
+	if (info->hvc != NULL)
+		hvc_remove(info->hvc);
+	info->hvc = NULL;
+	if (info->irq > 0) {
+		evtchn_put(info->evtchn);
+		info->irq = 0;
+		info->evtchn = 0;
+	}
+	/* evtchn_put() will also close it so this is only an error path */
 	if (info->evtchn > 0)
 		xenbus_free_evtchn(info->xbdev, info->evtchn);
 	info->evtchn = 0;
 	if (info->gntref > 0)
 		gnttab_free_grant_references(info->gntref);
 	info->gntref = 0;
-	if (info->hvc != NULL)
-		hvc_remove(info->hvc);
-	info->hvc = NULL;
 }
 
 static void xencons_free(struct xencons_info *info)
@@ -538,10 +541,23 @@ static void xencons_backend_changed(struct xenbus_device *dev,
 		if (dev->state == XenbusStateClosed)
 			break;
 		fallthrough;	/* Missed the backend's CLOSING state */
-	case XenbusStateClosing:
+	case XenbusStateClosing: {
+		struct xencons_info *info = dev_get_drvdata(&dev->dev);;
+
+		/*
+		 * Don't tear down the evtchn and grant ref before the other
+		 * end has disconnected, but do stop userspace from trying
+		 * to use the device before we allow the backend to close.
+		 */
+		if (info->hvc) {
+			hvc_remove(info->hvc);
+			info->hvc = NULL;
+		}
+
 		xenbus_frontend_closed(dev);
 		break;
 	}
+	}
 }
 
 static const struct xenbus_device_id xencons_ids[] = {
@@ -600,7 +616,7 @@ static int __init xen_hvc_init(void)
 		list_del(&info->list);
 		spin_unlock_irqrestore(&xencons_lock, flags);
 		if (info->irq)
-			unbind_from_irqhandler(info->irq, NULL);
+			evtchn_put(info->evtchn);
 		kfree(info);
 		return r;
 	}

From 1b0836242900c344623c277b9a990e749f51e791 Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Fri, 20 Oct 2023 17:15:28 +0100
Subject: [PATCH 0597/1043] hvc/xen: fix error path in xen_hvc_init() to always
 register frontend driver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 2704c9a5593f4a47620c12dad78838ca62b52f48 upstream.

The xen_hvc_init() function should always register the frontend driver,
even when there's no primary console — as there may be secondary consoles.
(Qemu can always add secondary consoles, but only the toolstack can add
the primary because it's special.)

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Juergen Gross <jgross@suse.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231020161529.355083-3-dwmw2@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/hvc/hvc_xen.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
index 93c858408b0a..cf0fb650a924 100644
--- a/drivers/tty/hvc/hvc_xen.c
+++ b/drivers/tty/hvc/hvc_xen.c
@@ -588,7 +588,7 @@ static int __init xen_hvc_init(void)
 		ops = &dom0_hvc_ops;
 		r = xen_initial_domain_console_init();
 		if (r < 0)
-			return r;
+			goto register_fe;
 		info = vtermno_to_xencons(HVC_COOKIE);
 	} else {
 		ops = &domU_hvc_ops;
@@ -597,7 +597,7 @@ static int __init xen_hvc_init(void)
 		else
 			r = xen_pv_console_init();
 		if (r < 0)
-			return r;
+			goto register_fe;
 
 		info = vtermno_to_xencons(HVC_COOKIE);
 		info->irq = bind_evtchn_to_irq_lateeoi(info->evtchn);
@@ -622,6 +622,7 @@ static int __init xen_hvc_init(void)
 	}
 
 	r = 0;
+ register_fe:
 #ifdef CONFIG_HVC_XEN_FRONTEND
 	r = xenbus_register_frontend(&xencons_driver);
 #endif

From 85fe64c8dcce16505b1c8730bcc66911fc0e9693 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Mon, 18 Sep 2023 14:48:01 +0200
Subject: [PATCH 0598/1043] PCI/sysfs: Protect driver's D3cold preference from
 user space

commit 70b70a4307cccebe91388337b1c85735ce4de6ff upstream.

struct pci_dev contains two flags which govern whether the device may
suspend to D3cold:

* no_d3cold provides an opt-out for drivers (e.g. if a device is known
  to not wake from D3cold)

* d3cold_allowed provides an opt-out for user space (default is true,
  user space may set to false)

Since commit 9d26d3a8f1b0 ("PCI: Put PCIe ports into D3 during suspend"),
the user space setting overwrites the driver setting.  Essentially user
space is trusted to know better than the driver whether D3cold is
working.

That feels unsafe and wrong.  Assume that the change was introduced
inadvertently and do not overwrite no_d3cold when d3cold_allowed is
modified.  Instead, consider d3cold_allowed in addition to no_d3cold
when choosing a suspend state for the device.

That way, user space may opt out of D3cold if the driver hasn't, but it
may no longer force an opt in if the driver has opted out.

Fixes: 9d26d3a8f1b0 ("PCI: Put PCIe ports into D3 during suspend")
Link: https://lore.kernel.org/r/b8a7f4af2b73f6b506ad8ddee59d747cbf834606.1695025365.git.lukas@wunner.de
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Cc: stable@vger.kernel.org	# v4.8+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/pci-acpi.c  | 2 +-
 drivers/pci/pci-sysfs.c | 5 +----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 745a4e0c4994..bda45c524187 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -909,7 +909,7 @@ static pci_power_t acpi_pci_choose_state(struct pci_dev *pdev)
 {
 	int acpi_state, d_max;
 
-	if (pdev->no_d3cold)
+	if (pdev->no_d3cold || !pdev->d3cold_allowed)
 		d_max = ACPI_STATE_D3_HOT;
 	else
 		d_max = ACPI_STATE_D3_COLD;
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 361de072dfdc..e14c83f59b48 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -500,10 +500,7 @@ static ssize_t d3cold_allowed_store(struct device *dev,
 		return -EINVAL;
 
 	pdev->d3cold_allowed = !!val;
-	if (pdev->d3cold_allowed)
-		pci_d3cold_enable(pdev);
-	else
-		pci_d3cold_disable(pdev);
+	pci_bridge_d3_update(pdev);
 
 	pm_runtime_resume(dev);
 

From 6edbd6b4811f2a40ebe80519f47d0625e3aa51d3 Mon Sep 17 00:00:00 2001
From: Krister Johansen <kjlx@templeofstupid.com>
Date: Fri, 27 Oct 2023 14:46:53 -0700
Subject: [PATCH 0599/1043] watchdog: move softlockup_panic back to early_param

commit 8b793bcda61f6c3ed4f5b2ded7530ef6749580cb upstream.

Setting softlockup_panic from do_sysctl_args() causes it to take effect
later in boot.  The lockup detector is enabled before SMP is brought
online, but do_sysctl_args runs afterwards.  If a user wants to set
softlockup_panic on boot and have it trigger should a softlockup occur
during onlining of the non-boot processors, they could do this prior to
commit f117955a2255 ("kernel/watchdog.c: convert {soft/hard}lockup boot
parameters to sysctl aliases").  However, after this commit the value
of softlockup_panic is set too late to be of help for this type of
problem.  Restore the prior behavior.

Signed-off-by: Krister Johansen <kjlx@templeofstupid.com>
Cc: stable@vger.kernel.org
Fixes: f117955a2255 ("kernel/watchdog.c: convert {soft/hard}lockup boot parameters to sysctl aliases")
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc/proc_sysctl.c | 1 -
 kernel/watchdog.c     | 7 +++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 682f2bf2e525..aff9593feb73 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -1767,7 +1767,6 @@ static const struct sysctl_alias sysctl_aliases[] = {
 	{"hung_task_panic",			"kernel.hung_task_panic" },
 	{"numa_zonelist_order",			"vm.numa_zonelist_order" },
 	{"softlockup_all_cpu_backtrace",	"kernel.softlockup_all_cpu_backtrace" },
-	{"softlockup_panic",			"kernel.softlockup_panic" },
 	{ }
 };
 
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index ec34d9f2eab2..78a4603e14cd 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -176,6 +176,13 @@ static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts);
 static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);
 static unsigned long soft_lockup_nmi_warn;
 
+static int __init softlockup_panic_setup(char *str)
+{
+	softlockup_panic = simple_strtoul(str, NULL, 0);
+	return 1;
+}
+__setup("softlockup_panic=", softlockup_panic_setup);
+
 static int __init nowatchdog_setup(char *str)
 {
 	watchdog_user_enabled = 0;

From 61695b9aecfe7a8eabe55eba8ddfd926e57d0b96 Mon Sep 17 00:00:00 2001
From: Werner Sembach <wse@tuxedocomputers.com>
Date: Mon, 16 Oct 2023 18:08:28 +0200
Subject: [PATCH 0600/1043] ACPI: resource: Do IRQ override on TongFang GMxXGxx

commit 0da9eccde3270b832c059ad618bf66e510c75d33 upstream.

The TongFang GMxXGxx/TUXEDO Stellaris/Pollaris Gen5 needs IRQ overriding
for the keyboard to work.

Adding an entry for this laptop to the override_table makes the internal
keyboard functional.

Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Cc: All applicable <stable@vger.kernel.org>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/resource.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index bfd821173f86..ba70bcded128 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -442,6 +442,18 @@ static const struct dmi_system_id asus_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "B2402CBA"),
 		},
 	},
+	{
+		/* TongFang GMxXGxx/TUXEDO Polaris 15 Gen5 AMD */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GMxXGxx"),
+		},
+	},
+	{
+		/* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_NAME, "GM6XGxX"),
+		},
+	},
 	{
 		.ident = "Asus ExpertBook B2502",
 		.matches = {

From d08a1e75253b4e19ae290b1c35349f12cfcebc0a Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Wed, 25 Oct 2023 10:21:28 -0700
Subject: [PATCH 0601/1043] arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM
 IAS 15.x or newer

commit 146a15b873353f8ac28dc281c139ff611a3c4848 upstream.

Prior to LLVM 15.0.0, LLVM's integrated assembler would incorrectly
byte-swap NOP when compiling for big-endian, and the resulting series of
bytes happened to match the encoding of FNMADD S21, S30, S0, S0.

This went unnoticed until commit:

  34f66c4c4d5518c1 ("arm64: Use a positive cpucap for FP/SIMD")

Prior to that commit, the kernel would always enable the use of FPSIMD
early in boot when __cpu_setup() initialized CPACR_EL1, and so usage of
FNMADD within the kernel was not detected, but could result in the
corruption of user or kernel FPSIMD state.

After that commit, the instructions happen to trap during boot prior to
FPSIMD being detected and enabled, e.g.

| Unhandled 64-bit el1h sync exception on CPU0, ESR 0x000000001fe00000 -- ASIMD
| CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1
| Hardware name: linux,dummy-virt (DT)
| pstate: 400000c9 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : __pi_strcmp+0x1c/0x150
| lr : populate_properties+0xe4/0x254
| sp : ffffd014173d3ad0
| x29: ffffd014173d3af0 x28: fffffbfffddffcb8 x27: 0000000000000000
| x26: 0000000000000058 x25: fffffbfffddfe054 x24: 0000000000000008
| x23: fffffbfffddfe000 x22: fffffbfffddfe000 x21: fffffbfffddfe044
| x20: ffffd014173d3b70 x19: 0000000000000001 x18: 0000000000000005
| x17: 0000000000000010 x16: 0000000000000000 x15: 00000000413e7000
| x14: 0000000000000000 x13: 0000000000001bcc x12: 0000000000000000
| x11: 00000000d00dfeed x10: ffffd414193f2cd0 x9 : 0000000000000000
| x8 : 0101010101010101 x7 : ffffffffffffffc0 x6 : 0000000000000000
| x5 : 0000000000000000 x4 : 0101010101010101 x3 : 000000000000002a
| x2 : 0000000000000001 x1 : ffffd014171f2988 x0 : fffffbfffddffcb8
| Kernel panic - not syncing: Unhandled exception
| CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1
| Hardware name: linux,dummy-virt (DT)
| Call trace:
|  dump_backtrace+0xec/0x108
|  show_stack+0x18/0x2c
|  dump_stack_lvl+0x50/0x68
|  dump_stack+0x18/0x24
|  panic+0x13c/0x340
|  el1t_64_irq_handler+0x0/0x1c
|  el1_abort+0x0/0x5c
|  el1h_64_sync+0x64/0x68
|  __pi_strcmp+0x1c/0x150
|  unflatten_dt_nodes+0x1e8/0x2d8
|  __unflatten_device_tree+0x5c/0x15c
|  unflatten_device_tree+0x38/0x50
|  setup_arch+0x164/0x1e0
|  start_kernel+0x64/0x38c
|  __primary_switched+0xbc/0xc4

Restrict CONFIG_CPU_BIG_ENDIAN to a known good assembler, which is
either GNU as or LLVM's IAS 15.0.0 and newer, which contains the linked
commit.

Closes: https://github.com/ClangBuiltLinux/linux/issues/1948
Link: https://github.com/llvm/llvm-project/commit/1379b150991f70a5782e9a143c2ba5308da1161c
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Cc: stable@vger.kernel.org
Acked-by: Mark Rutland <mark.rutland@arm.com>
Link: https://lore.kernel.org/r/20231025-disable-arm64-be-ias-b4-llvm-15-v1-1-b25263ed8b23@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/Kconfig | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 34bd4cba81e6..13cf137da999 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -986,6 +986,8 @@ choice
 config CPU_BIG_ENDIAN
 	bool "Build big-endian kernel"
 	depends on !LD_IS_LLD || LLD_VERSION >= 130000
+	# https://github.com/llvm/llvm-project/commit/1379b150991f70a5782e9a143c2ba5308da1161c
+	depends on AS_IS_GNU || AS_VERSION >= 150000
 	help
 	  Say Y if you plan on running a kernel with a big-endian userspace.
 

From 8dc83cf762902ff18fee2437f550c2b6a4bbb968 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sun, 22 Oct 2023 11:48:11 +0200
Subject: [PATCH 0602/1043] parisc/pdc: Add width field to struct pdc_model

commit 6240553b52c475d9fc9674de0521b77e692f3764 upstream.

PDC2.0 specifies the additional PSW-bit field.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/include/uapi/asm/pdc.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/parisc/include/uapi/asm/pdc.h b/arch/parisc/include/uapi/asm/pdc.h
index 15211723ebf5..ee903551ae10 100644
--- a/arch/parisc/include/uapi/asm/pdc.h
+++ b/arch/parisc/include/uapi/asm/pdc.h
@@ -465,6 +465,7 @@ struct pdc_model {		/* for PDC_MODEL */
 	unsigned long arch_rev;
 	unsigned long pot_key;
 	unsigned long curr_key;
+	unsigned long width;	/* default of PSW_W bit (1=enabled) */
 };
 
 struct pdc_cache_cf {		/* for PDC_CACHE  (I/D-caches) */

From 30af31fc002e3743d8927ef63627d0792a4fe5f8 Mon Sep 17 00:00:00 2001
From: Kathiravan Thirumoorthy <quic_kathirav@quicinc.com>
Date: Thu, 14 Sep 2023 12:29:51 +0530
Subject: [PATCH 0603/1043] clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT
 flag from PLL clocks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e641a070137dd959932c7c222e000d9d941167a2 upstream.

GPLL, NSS crypto PLL clock rates are fixed and shouldn't be scaled based
on the request from dependent clocks. Doing so will result in the
unexpected behaviour. So drop the CLK_SET_RATE_PARENT flag from the PLL
clocks.

Cc: stable@vger.kernel.org
Fixes: b8e7e519625f ("clk: qcom: ipq8074: add remaining PLL’s")
Signed-off-by: Kathiravan Thirumoorthy <quic_kathirav@quicinc.com>
Link: https://lore.kernel.org/r/20230913-gpll_cleanup-v2-1-c8ceb1a37680@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/qcom/gcc-ipq8074.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c
index d6d5defb82c9..0393154fea2f 100644
--- a/drivers/clk/qcom/gcc-ipq8074.c
+++ b/drivers/clk/qcom/gcc-ipq8074.c
@@ -418,7 +418,6 @@ static struct clk_fixed_factor gpll0_out_main_div2 = {
 		},
 		.num_parents = 1,
 		.ops = &clk_fixed_factor_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 
@@ -465,7 +464,6 @@ static struct clk_alpha_pll_postdiv gpll2 = {
 		},
 		.num_parents = 1,
 		.ops = &clk_alpha_pll_postdiv_ro_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 
@@ -498,7 +496,6 @@ static struct clk_alpha_pll_postdiv gpll4 = {
 		},
 		.num_parents = 1,
 		.ops = &clk_alpha_pll_postdiv_ro_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 
@@ -532,7 +529,6 @@ static struct clk_alpha_pll_postdiv gpll6 = {
 		},
 		.num_parents = 1,
 		.ops = &clk_alpha_pll_postdiv_ro_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 
@@ -546,7 +542,6 @@ static struct clk_fixed_factor gpll6_out_main_div2 = {
 		},
 		.num_parents = 1,
 		.ops = &clk_fixed_factor_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 
@@ -611,7 +606,6 @@ static struct clk_alpha_pll_postdiv nss_crypto_pll = {
 		},
 		.num_parents = 1,
 		.ops = &clk_alpha_pll_postdiv_ro_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 

From 3a4431014cfbf4fcea82aa3875011c4dbc43ebe3 Mon Sep 17 00:00:00 2001
From: Kathiravan Thirumoorthy <quic_kathirav@quicinc.com>
Date: Thu, 14 Sep 2023 12:29:52 +0530
Subject: [PATCH 0604/1043] clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT
 flag from PLL clocks

commit 99cd4935cb972d0aafb16838bb2aeadbcaf196ce upstream.

GPLL, NSS crypto PLL clock rates are fixed and shouldn't be scaled based
on the request from dependent clocks. Doing so will result in the
unexpected behaviour. So drop the CLK_SET_RATE_PARENT flag from the PLL
clocks.

Cc: stable@vger.kernel.org
Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support")
Signed-off-by: Kathiravan Thirumoorthy <quic_kathirav@quicinc.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230913-gpll_cleanup-v2-2-c8ceb1a37680@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/qcom/gcc-ipq6018.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c
index cde62a11f573..4c5c7a8f41d0 100644
--- a/drivers/clk/qcom/gcc-ipq6018.c
+++ b/drivers/clk/qcom/gcc-ipq6018.c
@@ -75,7 +75,6 @@ static struct clk_fixed_factor gpll0_out_main_div2 = {
 				&gpll0_main.clkr.hw },
 		.num_parents = 1,
 		.ops = &clk_fixed_factor_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 
@@ -89,7 +88,6 @@ static struct clk_alpha_pll_postdiv gpll0 = {
 				&gpll0_main.clkr.hw },
 		.num_parents = 1,
 		.ops = &clk_alpha_pll_postdiv_ro_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 
@@ -164,7 +162,6 @@ static struct clk_alpha_pll_postdiv gpll6 = {
 				&gpll6_main.clkr.hw },
 		.num_parents = 1,
 		.ops = &clk_alpha_pll_postdiv_ro_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 
@@ -195,7 +192,6 @@ static struct clk_alpha_pll_postdiv gpll4 = {
 				&gpll4_main.clkr.hw },
 		.num_parents = 1,
 		.ops = &clk_alpha_pll_postdiv_ro_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 
@@ -246,7 +242,6 @@ static struct clk_alpha_pll_postdiv gpll2 = {
 				&gpll2_main.clkr.hw },
 		.num_parents = 1,
 		.ops = &clk_alpha_pll_postdiv_ro_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 
@@ -277,7 +272,6 @@ static struct clk_alpha_pll_postdiv nss_crypto_pll = {
 				&nss_crypto_pll_main.clkr.hw },
 		.num_parents = 1,
 		.ops = &clk_alpha_pll_postdiv_ro_ops,
-		.flags = CLK_SET_RATE_PARENT,
 	},
 };
 

From 198366a5ffe65adf177add7aff5a75011e303606 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@linaro.org>
Date: Thu, 2 Nov 2023 10:51:06 +0300
Subject: [PATCH 0605/1043] mmc: vub300: fix an error code

commit b44f9da81783fda72632ef9b0d05ea3f3ca447a5 upstream.

This error path should return -EINVAL instead of success.

Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/0769d30c-ad80-421b-bf5d-7d6f5d85604e@moroto.mountain
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/vub300.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index 7dc0e91dabfc..05ffd5bf5a6f 100644
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -2311,6 +2311,7 @@ static int vub300_probe(struct usb_interface *interface,
 		vub300->read_only =
 			(0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
 	} else {
+		retval = -EINVAL;
 		goto error5;
 	}
 	usb_set_intfdata(interface, vub300);

From e3ed58ee4e4aa795496902166b06487ede73fbc4 Mon Sep 17 00:00:00 2001
From: Nitin Yadav <n-yadav@ti.com>
Date: Thu, 26 Oct 2023 11:44:58 +0530
Subject: [PATCH 0606/1043] mmc: sdhci_am654: fix start loop index for TAP
 value parsing

commit 71956d0cb56c1e5f9feeb4819db87a076418e930 upstream.

ti,otap-del-sel-legacy/ti,itap-del-sel-legacy passed from DT
are currently ignored for all SD/MMC and eMMC modes. Fix this
by making start loop index to MMC_TIMING_LEGACY.

Fixes: 8ee5fc0e0b3b ("mmc: sdhci_am654: Update OTAPDLY writes")
Signed-off-by: Nitin Yadav <n-yadav@ti.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231026061458.1116276-1-n-yadav@ti.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/sdhci_am654.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c
index 8e52905458f9..eb52e0c5a020 100644
--- a/drivers/mmc/host/sdhci_am654.c
+++ b/drivers/mmc/host/sdhci_am654.c
@@ -600,7 +600,7 @@ static int sdhci_am654_get_otap_delay(struct sdhci_host *host,
 		return 0;
 	}
 
-	for (i = MMC_TIMING_MMC_HS; i <= MMC_TIMING_MMC_HS400; i++) {
+	for (i = MMC_TIMING_LEGACY; i <= MMC_TIMING_MMC_HS400; i++) {
 
 		ret = device_property_read_u32(dev, td[i].otap_binding,
 					       &sdhci_am654->otap_del_sel[i]);

From 1fd46d32772da7531c390c3089dd1cc9dc263d30 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Wed, 11 Oct 2023 09:46:45 +0200
Subject: [PATCH 0607/1043] PCI/ASPM: Fix L1 substate handling in
 aspm_attr_store_common()

commit 8e37372ad0bea4c9b4712d9943f6ae96cff9491f upstream.

aspm_attr_store_common(), which handles sysfs control of ASPM, has the same
problem as fb097dcd5a28 ("PCI/ASPM: Disable only ASPM_STATE_L1 when driver
disables L1"): disabling L1 adds only ASPM_L1 (but not any of the L1.x
substates) to the "aspm_disable" mask.

Enabling one substate, e.g., L1.1, via sysfs removes ASPM_L1 from the
disable mask.  Since disabling L1 via sysfs doesn't add any of the
substates to the disable mask, enabling L1.1 actually enables *all* the
substates.

In this scenario:

  - Write 0 to "l1_aspm" to disable L1
  - Write 1 to "l1_1_aspm" to enable L1.1

the intention is to disable L1 and all L1.x substates, then enable just
L1.1, but in fact, *all* L1.x substates are enabled.

Fix this by explicitly disabling all the L1.x substates when disabling L1.

Fixes: 72ea91afbfb0 ("PCI/ASPM: Add sysfs attributes for controlling ASPM link states")
Link: https://lore.kernel.org/r/6ba7dd79-9cfe-4ed0-a002-d99cb842f361@gmail.com
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/pcie/aspm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index ef6f0ceb92f9..8ab8abd79e89 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -1250,6 +1250,8 @@ static ssize_t aspm_attr_store_common(struct device *dev,
 			link->aspm_disable &= ~ASPM_STATE_L1;
 	} else {
 		link->aspm_disable |= state;
+		if (state & ASPM_STATE_L1)
+			link->aspm_disable |= ASPM_STATE_L1SS;
 	}
 
 	pcie_config_aspm_link(link, policy_to_aspm_state(link));

From 21bc829337ca60222bf5881bbb2bf88b6392f946 Mon Sep 17 00:00:00 2001
From: Vignesh Viswanathan <quic_viswanat@quicinc.com>
Date: Mon, 4 Sep 2023 22:55:13 +0530
Subject: [PATCH 0608/1043] arm64: dts: qcom: ipq6018: Fix hwlock index for
 SMEM

commit 95d97b111e1e184b0c8656137033ed64f2cf21e4 upstream.

SMEM uses lock index 3 of the TCSR Mutex hwlock for allocations
in SMEM region shared by the Host and FW.

Fix the SMEM hwlock index to 3 for IPQ6018.

Cc: stable@vger.kernel.org
Fixes: 5bf635621245 ("arm64: dts: ipq6018: Add a few device nodes")
Signed-off-by: Vignesh Viswanathan <quic_viswanat@quicinc.com>
Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230904172516.479866-3-quic_viswanat@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
index 2a1f03cdb52c..201a3bb5511c 100644
--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
@@ -175,7 +175,7 @@ q6_region: memory@4ab00000 {
 	smem {
 		compatible = "qcom,smem";
 		memory-region = <&smem_region>;
-		hwlocks = <&tcsr_mutex 0>;
+		hwlocks = <&tcsr_mutex 3>;
 	};
 
 	soc: soc {

From df8363e468f29a37f3b5ccab6bdfed9d51d29996 Mon Sep 17 00:00:00 2001
From: Brian Geffon <bgeffon@google.com>
Date: Thu, 21 Sep 2023 13:00:45 -0400
Subject: [PATCH 0609/1043] PM: hibernate: Use __get_safe_page() rather than
 touching the list

commit f0c7183008b41e92fa676406d87f18773724b48b upstream.

We found at least one situation where the safe pages list was empty and
get_buffer() would gladly try to use a NULL pointer.

Signed-off-by: Brian Geffon <bgeffon@google.com>
Fixes: 8357376d3df2 ("[PATCH] swsusp: Improve handling of highmem")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/power/snapshot.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index f5dccd445d36..c924e8a8f088 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -2372,8 +2372,9 @@ static void *get_highmem_page_buffer(struct page *page,
 		pbe->copy_page = tmp;
 	} else {
 		/* Copy of the page will be stored in normal memory */
-		kaddr = safe_pages_list;
-		safe_pages_list = safe_pages_list->next;
+		kaddr = __get_safe_page(ca->gfp_mask);
+		if (!kaddr)
+			return ERR_PTR(-ENOMEM);
 		pbe->copy_page = virt_to_page(kaddr);
 	}
 	pbe->next = highmem_pblist;
@@ -2553,8 +2554,9 @@ static void *get_buffer(struct memory_bitmap *bm, struct chain_allocator *ca)
 		return ERR_PTR(-ENOMEM);
 	}
 	pbe->orig_address = page_address(page);
-	pbe->address = safe_pages_list;
-	safe_pages_list = safe_pages_list->next;
+	pbe->address = __get_safe_page(ca->gfp_mask);
+	if (!pbe->address)
+		return ERR_PTR(-ENOMEM);
 	pbe->next = restore_pblist;
 	restore_pblist = pbe;
 	return pbe->address;

From 3c1c1af25d45c2fcac2ff26dc7d8e422e7522b40 Mon Sep 17 00:00:00 2001
From: Brian Geffon <bgeffon@google.com>
Date: Fri, 22 Sep 2023 12:07:04 -0400
Subject: [PATCH 0610/1043] PM: hibernate: Clean up sync_read handling in
 snapshot_write_next()

commit d08970df1980476f27936e24d452550f3e9e92e1 upstream.

In snapshot_write_next(), sync_read is set and unset in three different
spots unnecessiarly. As a result there is a subtle bug where the first
page after the meta data has been loaded unconditionally sets sync_read
to 0. If this first PFN was actually a highmem page, then the returned
buffer will be the global "buffer," and the page needs to be loaded
synchronously.

That is, I'm not sure we can always assume the following to be safe:

	handle->buffer = get_buffer(&orig_bm, &ca);
	handle->sync_read = 0;

Because get_buffer() can call get_highmem_page_buffer() which can
return 'buffer'.

The easiest way to address this is just set sync_read before
snapshot_write_next() returns if handle->buffer == buffer.

Signed-off-by: Brian Geffon <bgeffon@google.com>
Fixes: 8357376d3df2 ("[PATCH] swsusp: Improve handling of highmem")
Cc: All applicable <stable@vger.kernel.org>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/power/snapshot.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index c924e8a8f088..c1bdaae07f4c 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -2587,8 +2587,6 @@ int snapshot_write_next(struct snapshot_handle *handle)
 	if (handle->cur > 1 && handle->cur > nr_meta_pages + nr_copy_pages)
 		return 0;
 
-	handle->sync_read = 1;
-
 	if (!handle->cur) {
 		if (!buffer)
 			/* This makes the buffer be freed by swsusp_free() */
@@ -2624,7 +2622,6 @@ int snapshot_write_next(struct snapshot_handle *handle)
 			memory_bm_position_reset(&orig_bm);
 			restore_pblist = NULL;
 			handle->buffer = get_buffer(&orig_bm, &ca);
-			handle->sync_read = 0;
 			if (IS_ERR(handle->buffer))
 				return PTR_ERR(handle->buffer);
 		}
@@ -2634,9 +2631,8 @@ int snapshot_write_next(struct snapshot_handle *handle)
 		handle->buffer = get_buffer(&orig_bm, &ca);
 		if (IS_ERR(handle->buffer))
 			return PTR_ERR(handle->buffer);
-		if (handle->buffer != buffer)
-			handle->sync_read = 0;
 	}
+	handle->sync_read = (handle->buffer == buffer);
 	handle->cur++;
 	return PAGE_SIZE;
 }

From 175f4b062f69f49263fa5ee66218fb333ce97850 Mon Sep 17 00:00:00 2001
From: Catalin Marinas <catalin.marinas@arm.com>
Date: Sat, 30 Sep 2023 17:46:56 +0000
Subject: [PATCH 0611/1043] rcu: kmemleak: Ignore kmemleak false positives when
 RCU-freeing objects

commit 5f98fd034ca6fd1ab8c91a3488968a0e9caaabf6 upstream.

Since the actual slab freeing is deferred when calling kvfree_rcu(), so
is the kmemleak_free() callback informing kmemleak of the object
deletion. From the perspective of the kvfree_rcu() caller, the object is
freed and it may remove any references to it. Since kmemleak does not
scan RCU internal data storing the pointer, it will report such objects
as leaks during the grace period.

Tell kmemleak to ignore such objects on the kvfree_call_rcu() path. Note
that the tiny RCU implementation does not have such issue since the
objects can be tracked from the rcu_ctrlblk structure.

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Christoph Paasch <cpaasch@apple.com>
Closes: https://lore.kernel.org/all/F903A825-F05F-4B77-A2B5-7356282FBA2C@apple.com/
Cc: <stable@vger.kernel.org>
Tested-by: Christoph Paasch <cpaasch@apple.com>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/rcu/tree.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index eec8e2f7537e..06bfe61d3cd3 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -31,6 +31,7 @@
 #include <linux/bitops.h>
 #include <linux/export.h>
 #include <linux/completion.h>
+#include <linux/kmemleak.h>
 #include <linux/moduleparam.h>
 #include <linux/percpu.h>
 #include <linux/notifier.h>
@@ -3547,6 +3548,14 @@ void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
 
 	WRITE_ONCE(krcp->count, krcp->count + 1);
 
+	/*
+	 * The kvfree_rcu() caller considers the pointer freed at this point
+	 * and likely removes any references to it. Since the actual slab
+	 * freeing (and kmemleak_free()) is deferred, tell kmemleak to ignore
+	 * this object (no scanning or false positives reporting).
+	 */
+	kmemleak_ignore(ptr);
+
 	// Set timer to drain after KFREE_DRAIN_JIFFIES.
 	if (rcu_scheduler_active == RCU_SCHEDULER_RUNNING &&
 	    !krcp->monitor_todo) {

From 76211f1dd91d2a34f19862920923b0a0f1ba902c Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Mon, 18 Sep 2023 14:15:33 -0400
Subject: [PATCH 0612/1043] btrfs: don't arbitrarily slow down delalloc if
 we're committing

commit 11aeb97b45ad2e0040cbb2a589bc403152526345 upstream.

We have a random schedule_timeout() if the current transaction is
committing, which seems to be a holdover from the original delalloc
reservation code.

Remove this, we have the proper flushing stuff, we shouldn't be hoping
for random timing things to make everything work.  This just induces
latency for no reason.

CC: stable@vger.kernel.org # 5.4+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/delalloc-space.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/fs/btrfs/delalloc-space.c b/fs/btrfs/delalloc-space.c
index bacee09b7bfd..45b2a5ecd63a 100644
--- a/fs/btrfs/delalloc-space.c
+++ b/fs/btrfs/delalloc-space.c
@@ -307,9 +307,6 @@ int btrfs_delalloc_reserve_metadata(struct btrfs_inode *inode, u64 num_bytes)
 	} else {
 		if (current->journal_info)
 			flush = BTRFS_RESERVE_FLUSH_LIMIT;
-
-		if (btrfs_transaction_in_commit(fs_info))
-			schedule_timeout(1);
 	}
 
 	num_bytes = ALIGN(num_bytes, fs_info->sectorsize);

From df4133ebc86a123194616bc1d75d373bc1cd8cab Mon Sep 17 00:00:00 2001
From: Kathiravan Thirumoorthy <quic_kathirav@quicinc.com>
Date: Mon, 25 Sep 2023 13:59:22 +0530
Subject: [PATCH 0613/1043] firmware: qcom_scm: use 64-bit calling convention
 only when client is 64-bit

commit 3337a6fea25370d3d244ec6bb38c71ee86fcf837 upstream.

Per the "SMC calling convention specification", the 64-bit calling
convention can only be used when the client is 64-bit. Whereas the
32-bit calling convention can be used by either a 32-bit or a 64-bit
client.

Currently during SCM probe, irrespective of the client, 64-bit calling
convention is made, which is incorrect and may lead to the undefined
behaviour when the client is 32-bit. Let's fix it.

Cc: stable@vger.kernel.org
Fixes: 9a434cee773a ("firmware: qcom_scm: Dynamically support SMCCC and legacy conventions")
Reviewed-By: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Kathiravan Thirumoorthy <quic_kathirav@quicinc.com>
Link: https://lore.kernel.org/r/20230925-scm-v3-1-8790dff6a749@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/firmware/qcom_scm.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
index 96086e7df910..3e3e37e0e660 100644
--- a/drivers/firmware/qcom_scm.c
+++ b/drivers/firmware/qcom_scm.c
@@ -136,6 +136,12 @@ static enum qcom_scm_convention __get_convention(void)
 	if (likely(qcom_scm_convention != SMC_CONVENTION_UNKNOWN))
 		return qcom_scm_convention;
 
+	/*
+	 * Per the "SMC calling convention specification", the 64-bit calling
+	 * convention can only be used when the client is 64-bit, otherwise
+	 * system will encounter the undefined behaviour.
+	 */
+#if IS_ENABLED(CONFIG_ARM64)
 	/*
 	 * Device isn't required as there is only one argument - no device
 	 * needed to dma_map_single to secure world
@@ -156,6 +162,7 @@ static enum qcom_scm_convention __get_convention(void)
 		forced = true;
 		goto found;
 	}
+#endif
 
 	probed_convention = SMC_CONVENTION_ARM_32;
 	ret = __scm_smc_call(NULL, &desc, probed_convention, &res, true);

From cd5a262a07a514912140b6d42bd17a5aaee2a868 Mon Sep 17 00:00:00 2001
From: Mimi Zohar <zohar@linux.ibm.com>
Date: Wed, 18 Oct 2023 14:47:02 -0400
Subject: [PATCH 0614/1043] ima: detect changes to the backing overlay file

commit b836c4d29f2744200b2af41e14bf50758dddc818 upstream.

Commit 18b44bc5a672 ("ovl: Always reevaluate the file signature for
IMA") forced signature re-evaulation on every file access.

Instead of always re-evaluating the file's integrity, detect a change
to the backing file, by comparing the cached file metadata with the
backing file's metadata.  Verifying just the i_version has not changed
is insufficient.  In addition save and compare the i_ino and s_dev
as well.

Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Tested-by: Eric Snowberg <eric.snowberg@oracle.com>
Tested-by: Raul E Rangel <rrangel@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/super.c              |  2 +-
 security/integrity/ima/ima_api.c  |  5 +++++
 security/integrity/ima/ima_main.c | 16 +++++++++++++++-
 security/integrity/integrity.h    |  2 ++
 4 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index e0384095ca96..5d7df839902d 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -2028,7 +2028,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 	sb->s_xattr = ovl_xattr_handlers;
 	sb->s_fs_info = ofs;
 	sb->s_flags |= SB_POSIXACL;
-	sb->s_iflags |= SB_I_SKIP_SYNC | SB_I_IMA_UNVERIFIABLE_SIGNATURE;
+	sb->s_iflags |= SB_I_SKIP_SYNC;
 
 	err = -ENOMEM;
 	root_dentry = ovl_get_root(sb, upperpath.dentry, oe);
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 4f39fb93f278..70efd4aa1bd1 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -212,6 +212,7 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
 {
 	const char *audit_cause = "failed";
 	struct inode *inode = file_inode(file);
+	struct inode *real_inode = d_real_inode(file_dentry(file));
 	const char *filename = file->f_path.dentry->d_name.name;
 	int result = 0;
 	int length;
@@ -262,6 +263,10 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
 	iint->ima_hash = tmpbuf;
 	memcpy(iint->ima_hash, &hash, length);
 	iint->version = i_version;
+	if (real_inode != inode) {
+		iint->real_ino = real_inode->i_ino;
+		iint->real_dev = real_inode->i_sb->s_dev;
+	}
 
 	/* Possibly temporary failure due to type of read (eg. O_DIRECT) */
 	if (!result)
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index dd4b28b11ebe..8e0fe0ce6164 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -26,6 +26,7 @@
 #include <linux/ima.h>
 #include <linux/iversion.h>
 #include <linux/fs.h>
+#include <linux/iversion.h>
 
 #include "ima.h"
 
@@ -197,7 +198,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
 			       u32 secid, char *buf, loff_t size, int mask,
 			       enum ima_hooks func)
 {
-	struct inode *inode = file_inode(file);
+	struct inode *backing_inode, *inode = file_inode(file);
 	struct integrity_iint_cache *iint = NULL;
 	struct ima_template_desc *template_desc = NULL;
 	char *pathbuf = NULL;
@@ -271,6 +272,19 @@ static int process_measurement(struct file *file, const struct cred *cred,
 		iint->measured_pcrs = 0;
 	}
 
+	/* Detect and re-evaluate changes made to the backing file. */
+	backing_inode = d_real_inode(file_dentry(file));
+	if (backing_inode != inode &&
+	    (action & IMA_DO_MASK) && (iint->flags & IMA_DONE_MASK)) {
+		if (!IS_I_VERSION(backing_inode) ||
+		    backing_inode->i_sb->s_dev != iint->real_dev ||
+		    backing_inode->i_ino != iint->real_ino ||
+		    !inode_eq_iversion(backing_inode, iint->version)) {
+			iint->flags &= ~IMA_DONE_MASK;
+			iint->measured_pcrs = 0;
+		}
+	}
+
 	/* Determine if already appraised/measured based on bitmask
 	 * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED,
 	 *  IMA_AUDIT, IMA_AUDITED)
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 413c803c5208..bc51a4e83989 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -131,6 +131,8 @@ struct integrity_iint_cache {
 	unsigned long flags;
 	unsigned long measured_pcrs;
 	unsigned long atomic_flags;
+	unsigned long real_ino;
+	dev_t real_dev;
 	enum integrity_status ima_file_status:4;
 	enum integrity_status ima_mmap_status:4;
 	enum integrity_status ima_bprm_status:4;

From c3f61ca4861267139f2bf910807ee01256c05125 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro@kernel.org>
Date: Thu, 19 Oct 2023 17:31:14 +0200
Subject: [PATCH 0615/1043] wifi: ath11k: fix temperature event locking

commit 1a5352a81b4720ba43d9c899974e3bddf7ce0ce8 upstream.

The ath11k active pdevs are protected by RCU but the temperature event
handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a
read-side critical section as reported by RCU lockdep:

	=============================
	WARNING: suspicious RCU usage
	6.6.0-rc6 #7 Not tainted
	-----------------------------
	drivers/net/wireless/ath/ath11k/mac.c:638 suspicious rcu_dereference_check() usage!

	other info that might help us debug this:

	rcu_scheduler_active = 2, debug_locks = 1
	no locks held by swapper/0/0.
	...
	Call trace:
	...
	 lockdep_rcu_suspicious+0x16c/0x22c
	 ath11k_mac_get_ar_by_pdev_id+0x194/0x1b0 [ath11k]
	 ath11k_wmi_tlv_op_rx+0xa84/0x2c1c [ath11k]
	 ath11k_htc_rx_completion_handler+0x388/0x510 [ath11k]

Mark the code in question as an RCU read-side critical section to avoid
any potential use-after-free issues.

Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23

Fixes: a41d10348b01 ("ath11k: add thermal sensor device support")
Cc: stable@vger.kernel.org      # 5.7
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20231019153115.26401-2-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 53846dc9a5c5..7d61d259fa18 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -6401,15 +6401,19 @@ ath11k_wmi_pdev_temperature_event(struct ath11k_base *ab,
 	ath11k_dbg(ab, ATH11K_DBG_WMI,
 		   "pdev temperature ev temp %d pdev_id %d\n", ev->temp, ev->pdev_id);
 
+	rcu_read_lock();
+
 	ar = ath11k_mac_get_ar_by_pdev_id(ab, ev->pdev_id);
 	if (!ar) {
 		ath11k_warn(ab, "invalid pdev id in pdev temperature ev %d", ev->pdev_id);
-		kfree(tb);
-		return;
+		goto exit;
 	}
 
 	ath11k_thermal_event_temperature(ar, ev->temp);
 
+exit:
+	rcu_read_unlock();
+
 	kfree(tb);
 }
 

From f882f51905517575c9f793a3dff567af90ef9a10 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro@kernel.org>
Date: Thu, 19 Oct 2023 17:31:15 +0200
Subject: [PATCH 0616/1043] wifi: ath11k: fix dfs radar event locking

commit 3b6c14833165f689cc5928574ebafe52bbce5f1e upstream.

The ath11k active pdevs are protected by RCU but the DFS radar event
handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a
read-side critical section.

Mark the code in question as an RCU read-side critical section to avoid
any potential use-after-free issues.

Compile tested only.

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Cc: stable@vger.kernel.org      # 5.6
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20231019153115.26401-3-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 7d61d259fa18..7c2d74533521 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -6355,6 +6355,8 @@ ath11k_wmi_pdev_dfs_radar_detected_event(struct ath11k_base *ab, struct sk_buff
 		   ev->detector_id, ev->segment_id, ev->timestamp, ev->is_chirp,
 		   ev->freq_offset, ev->sidx);
 
+	rcu_read_lock();
+
 	ar = ath11k_mac_get_ar_by_pdev_id(ab, ev->pdev_id);
 
 	if (!ar) {
@@ -6372,6 +6374,8 @@ ath11k_wmi_pdev_dfs_radar_detected_event(struct ath11k_base *ab, struct sk_buff
 		ieee80211_radar_detected(ar->hw);
 
 exit:
+	rcu_read_unlock();
+
 	kfree(tb);
 }
 

From 03ed26935bebf6b6fd8a656490bf3dcc71b72679 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro@kernel.org>
Date: Thu, 19 Oct 2023 13:25:21 +0200
Subject: [PATCH 0617/1043] wifi: ath11k: fix htt pktlog locking

commit 3f77c7d605b29df277d77e9ee75d96e7ad145d2d upstream.

The ath11k active pdevs are protected by RCU but the htt pktlog handling
code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a
read-side critical section.

Mark the code in question as an RCU read-side critical section to avoid
any potential use-after-free issues.

Compile tested only.

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Cc: stable@vger.kernel.org      # 5.6
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20231019112521.2071-1-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath11k/dp_rx.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index 583bcf148403..a50325f4634b 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -1578,14 +1578,20 @@ static void ath11k_htt_pktlog(struct ath11k_base *ab, struct sk_buff *skb)
 	u8 pdev_id;
 
 	pdev_id = FIELD_GET(HTT_T2H_PPDU_STATS_INFO_PDEV_ID, data->hdr);
+
+	rcu_read_lock();
+
 	ar = ath11k_mac_get_ar_by_pdev_id(ab, pdev_id);
 	if (!ar) {
 		ath11k_warn(ab, "invalid pdev id %d on htt pktlog\n", pdev_id);
-		return;
+		goto out;
 	}
 
 	trace_ath11k_htt_pktlog(ar, data->payload, hdr->size,
 				ar->ab->pktlog_defs_checksum);
+
+out:
+	rcu_read_unlock();
 }
 
 static void ath11k_htt_backpressure_event_handler(struct ath11k_base *ab,

From b2c194fe8f31363d3e1dd038ff4fe8b0eac5b24e Mon Sep 17 00:00:00 2001
From: Rong Chen <rong.chen@amlogic.com>
Date: Thu, 26 Oct 2023 15:31:56 +0800
Subject: [PATCH 0618/1043] mmc: meson-gx: Remove setting of CMD_CFG_ERROR

commit 57925e16c9f7d18012bcf45bfa658f92c087981a upstream.

For the t7 and older SoC families, the CMD_CFG_ERROR has no effect.
Starting from SoC family C3, setting this bit without SG LINK data
address will cause the controller to generate an IRQ and stop working.

To fix it, don't set the bit CMD_CFG_ERROR anymore.

Fixes: 18f92bc02f17 ("mmc: meson-gx: make sure the descriptor is stopped on errors")
Signed-off-by: Rong Chen <rong.chen@amlogic.com>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231026073156.2868310-1-rong.chen@amlogic.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/meson-gx-mmc.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index 1992eea8b777..78c9a56b051d 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -800,7 +800,6 @@ static void meson_mmc_start_cmd(struct mmc_host *mmc, struct mmc_command *cmd)
 
 	cmd_cfg |= FIELD_PREP(CMD_CFG_CMD_INDEX_MASK, cmd->opcode);
 	cmd_cfg |= CMD_CFG_OWNER;  /* owned by CPU */
-	cmd_cfg |= CMD_CFG_ERROR; /* stop in case of error */
 
 	meson_mmc_set_response_bits(cmd, &cmd_cfg);
 

From 943347e53a75ba6d83444e22690b1d72c2ef8454 Mon Sep 17 00:00:00 2001
From: Herve Codina <herve.codina@bootlin.com>
Date: Tue, 24 Oct 2023 17:03:35 +0200
Subject: [PATCH 0619/1043] genirq/generic_chip: Make irq_remove_generic_chip()
 irqdomain aware

commit 5e7afb2eb7b2a7c81e9f608cbdf74a07606fd1b5 upstream.

irq_remove_generic_chip() calculates the Linux interrupt number for removing the
handler and interrupt chip based on gc::irq_base as a linear function of
the bit positions of set bits in the @msk argument.

When the generic chip is present in an irq domain, i.e. created with a call
to irq_alloc_domain_generic_chips(), gc::irq_base contains not the base
Linux interrupt number.  It contains the base hardware interrupt for this
chip. It is set to 0 for the first chip in the domain, 0 + N for the next
chip, where $N is the number of hardware interrupts per chip.

That means the Linux interrupt number cannot be calculated based on
gc::irq_base for irqdomain based chips without a domain map lookup, which
is currently missing.

Rework the code to take the irqdomain case into account and calculate the
Linux interrupt number by a irqdomain lookup of the domain specific
hardware interrupt number.

[ tglx: Massage changelog. Reshuffle the logic and add a proper comment. ]

Fixes: cfefd21e693d ("genirq: Add chip suspend and resume callbacks")
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231024150335.322282-1-herve.codina@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/irq/generic-chip.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
index e2999a070a99..4195e7ad1ff2 100644
--- a/kernel/irq/generic-chip.c
+++ b/kernel/irq/generic-chip.c
@@ -537,21 +537,34 @@ EXPORT_SYMBOL_GPL(irq_setup_alt_chip);
 void irq_remove_generic_chip(struct irq_chip_generic *gc, u32 msk,
 			     unsigned int clr, unsigned int set)
 {
-	unsigned int i = gc->irq_base;
+	unsigned int i, virq;
 
 	raw_spin_lock(&gc_lock);
 	list_del(&gc->list);
 	raw_spin_unlock(&gc_lock);
 
-	for (; msk; msk >>= 1, i++) {
+	for (i = 0; msk; msk >>= 1, i++) {
 		if (!(msk & 0x01))
 			continue;
 
+		/*
+		 * Interrupt domain based chips store the base hardware
+		 * interrupt number in gc::irq_base. Otherwise gc::irq_base
+		 * contains the base Linux interrupt number.
+		 */
+		if (gc->domain) {
+			virq = irq_find_mapping(gc->domain, gc->irq_base + i);
+			if (!virq)
+				continue;
+		} else {
+			virq = gc->irq_base + i;
+		}
+
 		/* Remove handler first. That will mask the irq line */
-		irq_set_handler(i, NULL);
-		irq_set_chip(i, &no_irq_chip);
-		irq_set_chip_data(i, NULL);
-		irq_modify_status(i, clr, set);
+		irq_set_handler(virq, NULL);
+		irq_set_chip(virq, &no_irq_chip);
+		irq_set_chip_data(virq, NULL);
+		irq_modify_status(virq, clr, set);
 	}
 }
 EXPORT_SYMBOL_GPL(irq_remove_generic_chip);

From 2bcdc1b6b61e8446bcec6b3e3548bd2e220477f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Sun, 1 Oct 2023 19:02:53 +0200
Subject: [PATCH 0620/1043] PCI: keystone: Don't discard .remove() callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 200bddbb3f5202bbce96444fdc416305de14f547 upstream.

With CONFIG_PCIE_KEYSTONE=y and ks_pcie_remove() marked with __exit, the
function is discarded from the driver. In this case a bound device can
still get unbound, e.g via sysfs. Then no cleanup code is run resulting in
resource leaks or worse.

The right thing to do is do always have the remove callback available.
Note that this driver cannot be compiled as a module, so ks_pcie_remove()
was always discarded before this change and modpost couldn't warn about
this issue. Furthermore the __ref annotation also prevents a warning.

Fixes: 0c4ffcfe1fbc ("PCI: keystone: Add TI Keystone PCIe driver")
Link: https://lore.kernel.org/r/20231001170254.2506508-4-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/dwc/pci-keystone.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
index 90482d5246ff..d300e29c153f 100644
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -1338,7 +1338,7 @@ static int __init ks_pcie_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static int __exit ks_pcie_remove(struct platform_device *pdev)
+static int ks_pcie_remove(struct platform_device *pdev)
 {
 	struct keystone_pcie *ks_pcie = platform_get_drvdata(pdev);
 	struct device_link **link = ks_pcie->link;
@@ -1356,7 +1356,7 @@ static int __exit ks_pcie_remove(struct platform_device *pdev)
 
 static struct platform_driver ks_pcie_driver __refdata = {
 	.probe  = ks_pcie_probe,
-	.remove = __exit_p(ks_pcie_remove),
+	.remove = ks_pcie_remove,
 	.driver = {
 		.name	= "keystone-pcie",
 		.of_match_table = of_match_ptr(ks_pcie_of_match),

From db5ebaeb8fdaed31fb90155d716652448f42dee1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Sun, 1 Oct 2023 19:02:54 +0200
Subject: [PATCH 0621/1043] PCI: keystone: Don't discard .probe() callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 7994db905c0fd692cf04c527585f08a91b560144 upstream.

The __init annotation makes the ks_pcie_probe() function disappear after
booting completes. However a device can also be bound later. In that case,
we try to call ks_pcie_probe(), but the backing memory is likely already
overwritten.

The right thing to do is do always have the probe callback available.  Note
that the (wrong) __refdata annotation prevented this issue to be noticed by
modpost.

Fixes: 0c4ffcfe1fbc ("PCI: keystone: Add TI Keystone PCIe driver")
Link: https://lore.kernel.org/r/20231001170254.2506508-5-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/dwc/pci-keystone.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
index d300e29c153f..5b722287aac9 100644
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -1142,7 +1142,7 @@ static const struct of_device_id ks_pcie_of_match[] = {
 	{ },
 };
 
-static int __init ks_pcie_probe(struct platform_device *pdev)
+static int ks_pcie_probe(struct platform_device *pdev)
 {
 	const struct dw_pcie_host_ops *host_ops;
 	const struct dw_pcie_ep_ops *ep_ops;
@@ -1354,7 +1354,7 @@ static int ks_pcie_remove(struct platform_device *pdev)
 	return 0;
 }
 
-static struct platform_driver ks_pcie_driver __refdata = {
+static struct platform_driver ks_pcie_driver = {
 	.probe  = ks_pcie_probe,
 	.remove = ks_pcie_remove,
 	.driver = {

From f729cf6f3217e7486066b24ffedcb6983ae629e6 Mon Sep 17 00:00:00 2001
From: Zhihao Cheng <chengzhihao1@huawei.com>
Date: Tue, 19 Sep 2023 09:25:25 +0800
Subject: [PATCH 0622/1043] jbd2: fix potential data lost in recovering journal
 raced with synchronizing fs bdev

commit 61187fce8600e8ef90e601be84f9d0f3222c1206 upstream.

JBD2 makes sure journal data is fallen on fs device by sync_blockdev(),
however, other process could intercept the EIO information from bdev's
mapping, which leads journal recovering successful even EIO occurs during
data written back to fs device.

We found this problem in our product, iscsi + multipath is chosen for block
device of ext4. Unstable network may trigger kpartx to rescan partitions in
device mapper layer. Detailed process is shown as following:

  mount          kpartx          irq
jbd2_journal_recover
 do_one_pass
  memcpy(nbh->b_data, obh->b_data) // copy data to fs dev from journal
  mark_buffer_dirty // mark bh dirty
         vfs_read
	  generic_file_read_iter // dio
	   filemap_write_and_wait_range
	    __filemap_fdatawrite_range
	     do_writepages
	      block_write_full_folio
	       submit_bh_wbc
	            >>  EIO occurs in disk  <<
	                     end_buffer_async_write
			      mark_buffer_write_io_error
			       mapping_set_error
			        set_bit(AS_EIO, &mapping->flags) // set!
	    filemap_check_errors
	     test_and_clear_bit(AS_EIO, &mapping->flags) // clear!
 err2 = sync_blockdev
  filemap_write_and_wait
   filemap_check_errors
    test_and_clear_bit(AS_EIO, &mapping->flags) // false
 err2 = 0

Filesystem is mounted successfully even data from journal is failed written
into disk, and ext4/ocfs2 could become corrupted.

Fix it by comparing the wb_err state in fs block device before recovering
and after recovering.

A reproducer can be found in the kernel bugzilla referenced below.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=217888
Cc: stable@vger.kernel.org
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230919012525.1783108-1-chengzhihao1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/jbd2/recovery.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 1ae1697fe99b..3755a462d7c7 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -287,6 +287,8 @@ int jbd2_journal_recover(journal_t *journal)
 	journal_superblock_t *	sb;
 
 	struct recovery_info	info;
+	errseq_t		wb_err;
+	struct address_space	*mapping;
 
 	memset(&info, 0, sizeof(info));
 	sb = journal->j_superblock;
@@ -304,6 +306,9 @@ int jbd2_journal_recover(journal_t *journal)
 		return 0;
 	}
 
+	wb_err = 0;
+	mapping = journal->j_fs_dev->bd_inode->i_mapping;
+	errseq_check_and_advance(&mapping->wb_err, &wb_err);
 	err = do_one_pass(journal, &info, PASS_SCAN);
 	if (!err)
 		err = do_one_pass(journal, &info, PASS_REVOKE);
@@ -322,6 +327,9 @@ int jbd2_journal_recover(journal_t *journal)
 
 	jbd2_journal_clear_revoke(journal);
 	err2 = sync_blockdev(journal->j_fs_dev);
+	if (!err)
+		err = err2;
+	err2 = errseq_check_and_advance(&mapping->wb_err, &wb_err);
 	if (!err)
 		err = err2;
 	/* Make sure all replayed data is on permanent storage */

From 9386f59759b432ebb4695603a40d96a60de3afcb Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Mon, 4 Sep 2023 17:32:27 -0700
Subject: [PATCH 0623/1043] quota: explicitly forbid quota files from being
 encrypted

commit d3cc1b0be258191d6360c82ea158c2972f8d3991 upstream.

Since commit d7e7b9af104c ("fscrypt: stop using keyrings subsystem for
fscrypt_master_key"), xfstest generic/270 causes a WARNING when run on
f2fs with test_dummy_encryption in the mount options:

$ kvm-xfstests -c f2fs/encrypt generic/270
[...]
WARNING: CPU: 1 PID: 2453 at fs/crypto/keyring.c:240 fscrypt_destroy_keyring+0x1f5/0x260

The cause of the WARNING is that not all encrypted inodes have been
evicted before fscrypt_destroy_keyring() is called, which violates an
assumption.  This happens because the test uses an external quota file,
which gets automatically encrypted due to test_dummy_encryption.

Encryption of quota files has never really been supported.  On ext4,
ext4_quota_read() does not decrypt the data, so encrypted quota files
are always considered invalid on ext4.  On f2fs, f2fs_quota_read() uses
the pagecache, so trying to use an encrypted quota file gets farther,
resulting in the issue described above being possible.  But this was
never intended to be possible, and there is no use case for it.

Therefore, make the quota support layer explicitly reject using
IS_ENCRYPTED inodes when quotaon is attempted.

Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20230905003227.326998-1-ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/quota/dquot.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index fd2ca079448d..4bb4b4b79827 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -2398,6 +2398,20 @@ static int vfs_setup_quota_inode(struct inode *inode, int type)
 	if (sb_has_quota_loaded(sb, type))
 		return -EBUSY;
 
+	/*
+	 * Quota files should never be encrypted.  They should be thought of as
+	 * filesystem metadata, not user data.  New-style internal quota files
+	 * cannot be encrypted by users anyway, but old-style external quota
+	 * files could potentially be incorrectly created in an encrypted
+	 * directory, hence this explicit check.  Some reasons why encrypted
+	 * quota files don't work include: (1) some filesystems that support
+	 * encryption don't handle it in their quota_read and quota_write, and
+	 * (2) cleaning up encrypted quota files at unmount would need special
+	 * consideration, as quota files are cleaned up later than user files.
+	 */
+	if (IS_ENCRYPTED(inode))
+		return -EINVAL;
+
 	dqopt->files[type] = igrab(inode);
 	if (!dqopt->files[type])
 		return -EIO;

From 8f8fc95b3a7f39d7ca3aff514f21f5a02c7c2ac7 Mon Sep 17 00:00:00 2001
From: Benjamin Bara <benjamin.bara@skidata.com>
Date: Sat, 15 Jul 2023 09:53:23 +0200
Subject: [PATCH 0624/1043] kernel/reboot: emergency_restart: Set correct
 system_state

commit 60466c067927abbcaff299845abd4b7069963139 upstream.

As the emergency restart does not call kernel_restart_prepare(), the
system_state stays in SYSTEM_RUNNING.

Since bae1d3a05a8b, this hinders i2c_in_atomic_xfer_mode() from becoming
active, and therefore might lead to avoidable warnings in the restart
handlers, e.g.:

[   12.667612] WARNING: CPU: 1 PID: 1 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x33c/0x6b0
[   12.676926] Voluntary context switch within RCU read-side critical section!
...
[   12.742376]  schedule_timeout from wait_for_completion_timeout+0x90/0x114
[   12.749179]  wait_for_completion_timeout from tegra_i2c_wait_completion+0x40/0x70
...
[   12.994527]  atomic_notifier_call_chain from machine_restart+0x34/0x58
[   13.001050]  machine_restart from panic+0x2a8/0x32c

Avoid these by setting the correct system_state.

Fixes: bae1d3a05a8b ("i2c: core: remove use of in_atomic()")
Cc: stable@vger.kernel.org # v5.2+
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Tested-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Benjamin Bara <benjamin.bara@skidata.com>
Link: https://lore.kernel.org/r/20230327-tegra-pmic-reboot-v7-1-18699d5dcd76@skidata.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/reboot.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/reboot.c b/kernel/reboot.c
index af6f23d8bea1..e297b35fc652 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -64,6 +64,7 @@ EXPORT_SYMBOL_GPL(pm_power_off_prepare);
 void emergency_restart(void)
 {
 	kmsg_dump(KMSG_DUMP_EMERG);
+	system_state = SYSTEM_RESTART;
 	machine_emergency_restart();
 }
 EXPORT_SYMBOL_GPL(emergency_restart);

From 25284c46b657f48c0f3880a2e0706c70d81182c0 Mon Sep 17 00:00:00 2001
From: Benjamin Bara <benjamin.bara@skidata.com>
Date: Sat, 15 Jul 2023 09:53:24 +0200
Subject: [PATCH 0625/1043] i2c: core: Run atomic i2c xfer when !preemptible

commit aa49c90894d06e18a1ee7c095edbd2f37c232d02 upstream.

Since bae1d3a05a8b, i2c transfers are non-atomic if preemption is
disabled. However, non-atomic i2c transfers require preemption (e.g. in
wait_for_completion() while waiting for the DMA).

panic() calls preempt_disable_notrace() before calling
emergency_restart(). Therefore, if an i2c device is used for the
restart, the xfer should be atomic. This avoids warnings like:

[   12.667612] WARNING: CPU: 1 PID: 1 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x33c/0x6b0
[   12.676926] Voluntary context switch within RCU read-side critical section!
...
[   12.742376]  schedule_timeout from wait_for_completion_timeout+0x90/0x114
[   12.749179]  wait_for_completion_timeout from tegra_i2c_wait_completion+0x40/0x70
...
[   12.994527]  atomic_notifier_call_chain from machine_restart+0x34/0x58
[   13.001050]  machine_restart from panic+0x2a8/0x32c

Use !preemptible() instead, which is basically the same check as
pre-v5.2.

Fixes: bae1d3a05a8b ("i2c: core: remove use of in_atomic()")
Cc: stable@vger.kernel.org # v5.2+
Suggested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Acked-by: Wolfram Sang <wsa@kernel.org>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Tested-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Benjamin Bara <benjamin.bara@skidata.com>
Link: https://lore.kernel.org/r/20230327-tegra-pmic-reboot-v7-2-18699d5dcd76@skidata.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/i2c-core.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-core.h b/drivers/i2c/i2c-core.h
index 8ce261167a2d..ea17f13b44c8 100644
--- a/drivers/i2c/i2c-core.h
+++ b/drivers/i2c/i2c-core.h
@@ -29,7 +29,7 @@ int i2c_dev_irq_from_resources(const struct resource *resources,
  */
 static inline bool i2c_in_atomic_xfer_mode(void)
 {
-	return system_state > SYSTEM_RUNNING && irqs_disabled();
+	return system_state > SYSTEM_RUNNING && !preemptible();
 }
 
 static inline int __i2c_lock_bus_helper(struct i2c_adapter *adap)

From 788322e1ede6cae5a8ddd34893413e3d5aa48798 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sanju=C3=A1n=20Garc=C3=ADa=2C=20Jorge?=
 <Jorge.SanjuanGarcia@duagon.com>
Date: Thu, 19 Oct 2023 14:15:34 +0000
Subject: [PATCH 0626/1043] mcb: fix error handling for different scenarios
 when parsing

commit 63ba2d07b4be72b94216d20561f43e1150b25d98 upstream.

chameleon_parse_gdd() may fail for different reasons and end up
in the err tag. Make sure we at least always free the mcb_device
allocated with mcb_alloc_dev().

If mcb_device_register() fails, make sure to give up the reference
in the same place the device was added.

Fixes: 728ac3389296 ("mcb: mcb-parse: fix error handing in chameleon_parse_gdd()")
Cc: stable <stable@kernel.org>
Reviewed-by: Jose Javier Rodriguez Barbarin <JoseJavier.Rodriguez@duagon.com>
Signed-off-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
Link: https://lore.kernel.org/r/20231019141434.57971-2-jorge.sanjuangarcia@duagon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mcb/mcb-core.c  | 1 +
 drivers/mcb/mcb-parse.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
index 806a3d9da12f..2ca69184ca1a 100644
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -248,6 +248,7 @@ int mcb_device_register(struct mcb_bus *bus, struct mcb_device *dev)
 	return 0;
 
 out:
+	put_device(&dev->dev);
 
 	return ret;
 }
diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
index 656b6b71c768..1ae37e693de0 100644
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -106,7 +106,7 @@ static int chameleon_parse_gdd(struct mcb_bus *bus,
 	return 0;
 
 err:
-	put_device(&mdev->dev);
+	mcb_free_dev(mdev);
 
 	return ret;
 }

From d24340f081046be1f9747c53f3010a6a142baf8e Mon Sep 17 00:00:00 2001
From: Alain Volmat <alain.volmat@foss.st.com>
Date: Mon, 9 Oct 2023 10:24:50 +0200
Subject: [PATCH 0627/1043] dmaengine: stm32-mdma: correct desc prep when
 channel running

commit 03f25d53b145bc2f7ccc82fc04e4482ed734f524 upstream.

In case of the prep descriptor while the channel is already running, the
CCR register value stored into the channel could already have its EN bit
set.  This would lead to a bad transfer since, at start transfer time,
enabling the channel while other registers aren't yet properly set.
To avoid this, ensure to mask the CCR_EN bit when storing the ccr value
into the mdma channel structure.

Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver")
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Cc: stable@vger.kernel.org
Tested-by: Alain Volmat <alain.volmat@foss.st.com>
Link: https://lore.kernel.org/r/20231009082450.452877-1-amelie.delaunay@foss.st.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/dma/stm32-mdma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
index 3e57176ca0ca..40b052c6733a 100644
--- a/drivers/dma/stm32-mdma.c
+++ b/drivers/dma/stm32-mdma.c
@@ -509,7 +509,7 @@ static int stm32_mdma_set_xfer_param(struct stm32_mdma_chan *chan,
 	src_maxburst = chan->dma_config.src_maxburst;
 	dst_maxburst = chan->dma_config.dst_maxburst;
 
-	ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id));
+	ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)) & ~STM32_MDMA_CCR_EN;
 	ctcr = stm32_mdma_read(dmadev, STM32_MDMA_CTCR(chan->id));
 	ctbr = stm32_mdma_read(dmadev, STM32_MDMA_CTBR(chan->id));
 
@@ -937,7 +937,7 @@ stm32_mdma_prep_dma_memcpy(struct dma_chan *c, dma_addr_t dest, dma_addr_t src,
 	if (!desc)
 		return NULL;
 
-	ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id));
+	ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)) & ~STM32_MDMA_CCR_EN;
 	ctcr = stm32_mdma_read(dmadev, STM32_MDMA_CTCR(chan->id));
 	ctbr = stm32_mdma_read(dmadev, STM32_MDMA_CTBR(chan->id));
 	cbndtr = stm32_mdma_read(dmadev, STM32_MDMA_CBNDTR(chan->id));

From 63d2023fbbe1adbcc712178cb5d4968a914f836e Mon Sep 17 00:00:00 2001
From: Zi Yan <ziy@nvidia.com>
Date: Wed, 13 Sep 2023 16:12:44 -0400
Subject: [PATCH 0628/1043] mm/cma: use nth_page() in place of direct struct
 page manipulation

commit 2e7cfe5cd5b6b0b98abf57a3074885979e187c1c upstream.

Patch series "Use nth_page() in place of direct struct page manipulation",
v3.

On SPARSEMEM without VMEMMAP, struct page is not guaranteed to be
contiguous, since each memory section's memmap might be allocated
independently.  hugetlb pages can go beyond a memory section size, thus
direct struct page manipulation on hugetlb pages/subpages might give wrong
struct page.  Kernel provides nth_page() to do the manipulation properly.
Use that whenever code can see hugetlb pages.


This patch (of 5):

When dealing with hugetlb pages, manipulating struct page pointers
directly can get to wrong struct page, since struct page is not guaranteed
to be contiguous on SPARSEMEM without VMEMMAP.  Use nth_page() to handle
it properly.

Without the fix, page_kasan_tag_reset() could reset wrong page tags,
causing a wrong kasan result.  No related bug is reported.  The fix
comes from code inspection.

Link: https://lkml.kernel.org/r/20230913201248.452081-1-zi.yan@sent.com
Link: https://lkml.kernel.org/r/20230913201248.452081-2-zi.yan@sent.com
Fixes: 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Muchun Song <songmuchun@bytedance.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Mike Rapoport (IBM) <rppt@kernel.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/cma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/cma.c b/mm/cma.c
index 7f415d7cda9f..3c3f1436f643 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -482,7 +482,7 @@ struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align,
 	 */
 	if (page) {
 		for (i = 0; i < count; i++)
-			page_kasan_tag_reset(page + i);
+			page_kasan_tag_reset(nth_page(page, i));
 	}
 
 	if (ret && !no_warn) {

From dce3e7c400553a70e31048b50ab86785693293ee Mon Sep 17 00:00:00 2001
From: Zi Yan <ziy@nvidia.com>
Date: Wed, 13 Sep 2023 16:12:46 -0400
Subject: [PATCH 0629/1043] mm/memory_hotplug: use pfn math in place of direct
 struct page manipulation

commit 1640a0ef80f6d572725f5b0330038c18e98ea168 upstream.

When dealing with hugetlb pages, manipulating struct page pointers
directly can get to wrong struct page, since struct page is not guaranteed
to be contiguous on SPARSEMEM without VMEMMAP.  Use pfn calculation to
handle it properly.

Without the fix, a wrong number of page might be skipped. Since skip cannot be
negative, scan_movable_page() will end early and might miss a movable page with
-ENOENT. This might fail offline_pages(). No bug is reported. The fix comes
from code inspection.

Link: https://lkml.kernel.org/r/20230913201248.452081-4-zi.yan@sent.com
Fixes: eeb0efd071d8 ("mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Mike Rapoport (IBM) <rppt@kernel.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/memory_hotplug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 5286945470b9..553b0705dce8 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1263,7 +1263,7 @@ static int scan_movable_pages(unsigned long start, unsigned long end,
 		head = compound_head(page);
 		if (page_huge_active(head))
 			goto found;
-		skip = compound_nr(head) - (page - head);
+		skip = compound_nr(head) - (pfn - page_to_pfn(head));
 		pfn += skip - 1;
 	}
 	return -ENOENT;

From 76320f05b99d3b84335fe83706a31e84c5aaa850 Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Fri, 20 Oct 2023 22:30:29 +0200
Subject: [PATCH 0630/1043] mtd: cfi_cmdset_0001: Byte swap OTP info

commit 565fe150624ee77dc63a735cc1b3bff5101f38a3 upstream.

Currently the offset into the device when looking for OTP
bits can go outside of the address of the MTD NOR devices,
and if that memory isn't readable, bad things happen
on the IXP4xx (added prints that illustrate the problem before
the crash):

cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x00000100
ixp4xx_copy_from copy from 0x00000100 to 0xc880dd78
cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x12000000
ixp4xx_copy_from copy from 0x12000000 to 0xc880dd78
8<--- cut here ---
Unable to handle kernel paging request at virtual address db000000
[db000000] *pgd=00000000
(...)

This happens in this case because the IXP4xx is big endian and
the 32- and 16-bit fields in the struct cfi_intelext_otpinfo are not
properly byteswapped. Compare to how the code in read_pri_intelext()
byteswaps the fields in struct cfi_pri_intelext.

Adding a small byte swapping loop for the OTP in read_pri_intelext()
and the crash goes away.

The problem went unnoticed for many years until I enabled
CONFIG_MTD_OTP on the IXP4xx as well, triggering the bug.

Cc: stable@vger.kernel.org
Reviewed-by: Nicolas Pitre <nico@fluxnic.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20231020-mtd-otp-byteswap-v4-1-0d132c06aa9d@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/chips/cfi_cmdset_0001.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 42001c49833b..a45a27c70c87 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -420,9 +420,25 @@ read_pri_intelext(struct map_info *map, __u16 adr)
 		extra_size = 0;
 
 		/* Protection Register info */
-		if (extp->NumProtectionFields)
+		if (extp->NumProtectionFields) {
+			struct cfi_intelext_otpinfo *otp =
+				(struct cfi_intelext_otpinfo *)&extp->extra[0];
+
 			extra_size += (extp->NumProtectionFields - 1) *
-				      sizeof(struct cfi_intelext_otpinfo);
+				sizeof(struct cfi_intelext_otpinfo);
+
+			if (extp_size >= sizeof(*extp) + extra_size) {
+				int i;
+
+				/* Do some byteswapping if necessary */
+				for (i = 0; i < extp->NumProtectionFields - 1; i++) {
+					otp->ProtRegAddr = le32_to_cpu(otp->ProtRegAddr);
+					otp->FactGroups = le16_to_cpu(otp->FactGroups);
+					otp->UserGroups = le16_to_cpu(otp->UserGroups);
+					otp++;
+				}
+			}
+		}
 	}
 
 	if (extp->MinorVersion >= '1') {

From c6effcdd7dd03bd37ec3f72769e96f765e0390f5 Mon Sep 17 00:00:00 2001
From: Joshua Yeong <joshua.yeong@starfivetech.com>
Date: Wed, 13 Sep 2023 11:17:45 +0800
Subject: [PATCH 0631/1043] i3c: master: cdns: Fix reading status register

commit 4bd8405257da717cd556f99e5fb68693d12c9766 upstream.

IBIR_DEPTH and CMDR_DEPTH should read from status0 instead of status1.

Cc: stable@vger.kernel.org
Fixes: 603f2bee2c54 ("i3c: master: Add driver for Cadence IP")
Signed-off-by: Joshua Yeong <joshua.yeong@starfivetech.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/r/20230913031743.11439-2-joshua.yeong@starfivetech.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i3c/master/i3c-master-cdns.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/i3c/master/i3c-master-cdns.c b/drivers/i3c/master/i3c-master-cdns.c
index 3f2226928fe0..6b9df33ac561 100644
--- a/drivers/i3c/master/i3c-master-cdns.c
+++ b/drivers/i3c/master/i3c-master-cdns.c
@@ -192,7 +192,7 @@
 #define SLV_STATUS1_HJ_DIS		BIT(18)
 #define SLV_STATUS1_MR_DIS		BIT(17)
 #define SLV_STATUS1_PROT_ERR		BIT(16)
-#define SLV_STATUS1_DA(x)		(((s) & GENMASK(15, 9)) >> 9)
+#define SLV_STATUS1_DA(s)		(((s) & GENMASK(15, 9)) >> 9)
 #define SLV_STATUS1_HAS_DA		BIT(8)
 #define SLV_STATUS1_DDR_RX_FULL		BIT(7)
 #define SLV_STATUS1_DDR_TX_FULL		BIT(6)
@@ -1622,13 +1622,13 @@ static int cdns_i3c_master_probe(struct platform_device *pdev)
 	/* Device ID0 is reserved to describe this master. */
 	master->maxdevs = CONF_STATUS0_DEVS_NUM(val);
 	master->free_rr_slots = GENMASK(master->maxdevs, 1);
+	master->caps.ibirfifodepth = CONF_STATUS0_IBIR_DEPTH(val);
+	master->caps.cmdrfifodepth = CONF_STATUS0_CMDR_DEPTH(val);
 
 	val = readl(master->regs + CONF_STATUS1);
 	master->caps.cmdfifodepth = CONF_STATUS1_CMD_DEPTH(val);
 	master->caps.rxfifodepth = CONF_STATUS1_RX_DEPTH(val);
 	master->caps.txfifodepth = CONF_STATUS1_TX_DEPTH(val);
-	master->caps.ibirfifodepth = CONF_STATUS0_IBIR_DEPTH(val);
-	master->caps.cmdrfifodepth = CONF_STATUS0_CMDR_DEPTH(val);
 
 	spin_lock_init(&master->ibi.lock);
 	master->ibi.num_slots = CONF_STATUS1_IBI_HW_RES(val);

From 064c697cac4bf75b4d739a54883f5cd376919bcb Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Fri, 10 Nov 2023 16:13:15 +0100
Subject: [PATCH 0632/1043] parisc: Prevent booting 64-bit kernels on PA1.x
 machines

commit a406b8b424fa01f244c1aab02ba186258448c36b upstream.

Bail out early with error message when trying to boot a 64-bit kernel on
32-bit machines. This fixes the previous commit to include the check for
true 64-bit kernels as well.

Signed-off-by: Helge Deller <deller@gmx.de>
Fixes: 591d2108f3abc ("parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines")
Cc:  <stable@vger.kernel.org> # v6.0+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/kernel/head.S | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index 598d0938449d..2f95c2429f77 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -69,9 +69,8 @@ $bss_loop:
 	stw,ma          %arg2,4(%r1)
 	stw,ma          %arg3,4(%r1)
 
-#if !defined(CONFIG_64BIT) && defined(CONFIG_PA20)
-	/* This 32-bit kernel was compiled for PA2.0 CPUs. Check current CPU
-	 * and halt kernel if we detect a PA1.x CPU. */
+#if defined(CONFIG_PA20)
+	/* check for 64-bit capable CPU as required by current kernel */
 	ldi		32,%r10
 	mtctl		%r10,%cr11
 	.level 2.0

From 5e34fe50a97618f56ec802cfec9ac03335d8895a Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Tue, 7 Nov 2023 14:33:32 +0100
Subject: [PATCH 0633/1043] parisc/pgtable: Do not drop upper 5 address bits of
 physical address

commit 166b0110d1ee53290bd11618df6e3991c117495a upstream.

When calculating the pfn for the iitlbt/idtlbt instruction, do not
drop the upper 5 address bits. This doesn't seem to have an effect
on physical hardware which uses less physical address bits, but in
qemu the missing bits are visible.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc:  <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/kernel/entry.S | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index 05bed27eef85..25bef679290f 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -497,13 +497,13 @@
 	 * to a CPU TLB 4k PFN (4k => 12 bits to shift) */
 	#define PAGE_ADD_SHIFT		(PAGE_SHIFT-12)
 	#define PAGE_ADD_HUGE_SHIFT	(REAL_HPAGE_SHIFT-12)
+	#define PFN_START_BIT	(63-ASM_PFN_PTE_SHIFT+(63-58)-PAGE_ADD_SHIFT)
 
 	/* Drop prot bits and convert to page addr for iitlbt and idtlbt */
 	.macro		convert_for_tlb_insert20 pte,tmp
 #ifdef CONFIG_HUGETLB_PAGE
 	copy		\pte,\tmp
-	extrd,u		\tmp,(63-ASM_PFN_PTE_SHIFT)+(63-58)+PAGE_ADD_SHIFT,\
-				64-PAGE_SHIFT-PAGE_ADD_SHIFT,\pte
+	extrd,u		\tmp,PFN_START_BIT,PFN_START_BIT+1,\pte
 
 	depdi		_PAGE_SIZE_ENCODING_DEFAULT,63,\
 				(63-58)+PAGE_ADD_SHIFT,\pte
@@ -511,8 +511,7 @@
 	depdi		_HUGE_PAGE_SIZE_ENCODING_DEFAULT,63,\
 				(63-58)+PAGE_ADD_HUGE_SHIFT,\pte
 #else /* Huge pages disabled */
-	extrd,u		\pte,(63-ASM_PFN_PTE_SHIFT)+(63-58)+PAGE_ADD_SHIFT,\
-				64-PAGE_SHIFT-PAGE_ADD_SHIFT,\pte
+	extrd,u		\pte,PFN_START_BIT,PFN_START_BIT+1,\pte
 	depdi		_PAGE_SIZE_ENCODING_DEFAULT,63,\
 				(63-58)+PAGE_ADD_SHIFT,\pte
 #endif

From f04fa1e1997fd94d7dae6fd6f6c6eae850756f75 Mon Sep 17 00:00:00 2001
From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Date: Thu, 19 Oct 2023 13:29:20 +0300
Subject: [PATCH 0634/1043] xhci: Enable RPM on controllers that support
 low-power states

commit a5d6264b638efeca35eff72177fd28d149e0764b upstream.

Use the low-power states of the underlying platform to enable runtime PM.
If the platform doesn't support runtime D3, then enabling default RPM will
result in the controller malfunctioning, as in the case of hotplug devices
not being detected because of a failed interrupt generation.

Cc: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20231019102924.2797346-16-mathias.nyman@linux.intel.com
Cc: Oleksandr Natalenko <oleksandr@natalenko.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-pci.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 7d0c2cccbfc0..0933a94ebe29 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -505,7 +505,9 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 	/* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */
 	pm_runtime_put_noidle(&dev->dev);
 
-	if (xhci->quirks & XHCI_DEFAULT_PM_RUNTIME_ALLOW)
+	if (pci_choose_state(dev, PMSG_SUSPEND) == PCI_D0)
+		pm_runtime_forbid(&dev->dev);
+	else if (xhci->quirks & XHCI_DEFAULT_PM_RUNTIME_ALLOW)
 		pm_runtime_allow(&dev->dev);
 
 	dma_set_max_seg_size(&dev->dev, UINT_MAX);

From a681d28b973fd446c75b11dbc17592a214a6eef1 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 9 Nov 2023 15:19:54 +0100
Subject: [PATCH 0635/1043] ALSA: info: Fix potential deadlock at disconnection

commit c7a60651953359f98dbf24b43e1bf561e1573ed4 upstream.

As reported recently, ALSA core info helper may cause a deadlock at
the forced device disconnection during the procfs operation.

The proc_remove() (that is called from the snd_card_disconnect()
helper) has a synchronization of the pending procfs accesses via
wait_for_completion().  Meanwhile, ALSA procfs helper takes the global
mutex_lock(&info_mutex) at both the proc_open callback and
snd_card_info_disconnect() helper.  Since the proc_open can't finish
due to the mutex lock, wait_for_completion() never returns, either,
hence it deadlocks.

	TASK#1				TASK#2
	proc_reg_open()
	  takes use_pde()
	snd_info_text_entry_open()
					snd_card_disconnect()
					snd_info_card_disconnect()
					  takes mutex_lock(&info_mutex)
					proc_remove()
					wait_for_completion(unused_pde)
					  ... waiting task#1 closes
	mutex_lock(&info_mutex)
		=> DEADLOCK

This patch is a workaround for avoiding the deadlock scenario above.

The basic strategy is to move proc_remove() call outside the mutex
lock.  proc_remove() can work gracefully without extra locking, and it
can delete the tree recursively alone.  So, we call proc_remove() at
snd_info_card_disconnection() at first, then delete the rest resources
recursively within the info_mutex lock.

After the change, the function snd_info_disconnect() doesn't do
disconnection by itself any longer, but it merely clears the procfs
pointer.  So rename the function to snd_info_clear_entries() for
avoiding confusion.

The similar change is applied to snd_info_free_entry(), too.  Since
the proc_remove() is called only conditionally with the non-NULL
entry->p, it's skipped after the snd_info_clear_entries() call.

Reported-by: Shinhyung Kang <s47.kang@samsung.com>
Closes: https://lore.kernel.org/r/664457955.21699345385931.JavaMail.epsvc@epcpadp4
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20231109141954.4283-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/info.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/sound/core/info.c b/sound/core/info.c
index d6fb11c3250c..ebae11b49429 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -57,7 +57,7 @@ struct snd_info_private_data {
 };
 
 static int snd_info_version_init(void);
-static void snd_info_disconnect(struct snd_info_entry *entry);
+static void snd_info_clear_entries(struct snd_info_entry *entry);
 
 /*
 
@@ -570,11 +570,16 @@ void snd_info_card_disconnect(struct snd_card *card)
 {
 	if (!card)
 		return;
-	mutex_lock(&info_mutex);
+
 	proc_remove(card->proc_root_link);
-	card->proc_root_link = NULL;
 	if (card->proc_root)
-		snd_info_disconnect(card->proc_root);
+		proc_remove(card->proc_root->p);
+
+	mutex_lock(&info_mutex);
+	if (card->proc_root)
+		snd_info_clear_entries(card->proc_root);
+	card->proc_root_link = NULL;
+	card->proc_root = NULL;
 	mutex_unlock(&info_mutex);
 }
 
@@ -746,15 +751,14 @@ struct snd_info_entry *snd_info_create_card_entry(struct snd_card *card,
 }
 EXPORT_SYMBOL(snd_info_create_card_entry);
 
-static void snd_info_disconnect(struct snd_info_entry *entry)
+static void snd_info_clear_entries(struct snd_info_entry *entry)
 {
 	struct snd_info_entry *p;
 
 	if (!entry->p)
 		return;
 	list_for_each_entry(p, &entry->children, list)
-		snd_info_disconnect(p);
-	proc_remove(entry->p);
+		snd_info_clear_entries(p);
 	entry->p = NULL;
 }
 
@@ -771,8 +775,9 @@ void snd_info_free_entry(struct snd_info_entry * entry)
 	if (!entry)
 		return;
 	if (entry->p) {
+		proc_remove(entry->p);
 		mutex_lock(&info_mutex);
-		snd_info_disconnect(entry);
+		snd_info_clear_entries(entry);
 		mutex_unlock(&info_mutex);
 	}
 

From ddd47d8d1ba6555d367c4d339a974f5ac4534e99 Mon Sep 17 00:00:00 2001
From: Kailang Yang <kailang@realtek.com>
Date: Fri, 10 Nov 2023 15:16:06 +0800
Subject: [PATCH 0636/1043] ALSA: hda/realtek - Add Dell ALC295 to pin fall
 back table

commit 4b21a669ca21ed8f24ef4530b2918be5730114de upstream.

Add ALC295 to pin fall back table.
Remove 5 pin quirks for Dell ALC295.
ALC295 was only support MIC2 for external MIC function.
ALC295 assigned model "ALC269_FIXUP_DELL1_MIC_NO_PRESENCE" for pin
fall back table.
It was assigned wrong model. So, let's remove it.

Fixes: fbc571290d9f ("ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform")
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/7c1998e873834df98d59bd7e0d08c72e@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index adfab80b8189..08c443898855 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9881,22 +9881,6 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
 		{0x12, 0x90a60130},
 		{0x17, 0x90170110},
 		{0x21, 0x03211020}),
-	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
-		{0x14, 0x90170110},
-		{0x21, 0x04211020}),
-	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
-		{0x14, 0x90170110},
-		{0x21, 0x04211030}),
-	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
-		ALC295_STANDARD_PINS,
-		{0x17, 0x21014020},
-		{0x18, 0x21a19030}),
-	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
-		ALC295_STANDARD_PINS,
-		{0x17, 0x21014040},
-		{0x18, 0x21a19050}),
-	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
-		ALC295_STANDARD_PINS),
 	SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC298_STANDARD_PINS,
 		{0x17, 0x90170110}),
@@ -9940,6 +9924,9 @@ static const struct snd_hda_pin_quirk alc269_fallback_pin_fixup_tbl[] = {
 	SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
 		{0x19, 0x40000000},
 		{0x1b, 0x40000000}),
+	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
+		{0x19, 0x40000000},
+		{0x1b, 0x40000000}),
 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
 		{0x19, 0x40000000},
 		{0x1a, 0x40000000}),

From ba30578def840fe64e2e25eb0cf22283fa7a8184 Mon Sep 17 00:00:00 2001
From: Chandradeep Dey <codesigning@chandradeepdey.com>
Date: Sat, 11 Nov 2023 19:25:49 +0100
Subject: [PATCH 0637/1043] ALSA: hda/realtek - Enable internal speaker of ASUS
 K6500ZC

commit 713f040cd22285fcc506f40a0d259566e6758c3c upstream.

Apply the already existing quirk chain ALC294_FIXUP_ASUS_SPK to enable
the internal speaker of ASUS K6500ZC.

Signed-off-by: Chandradeep Dey <codesigning@chandradeepdey.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/NizcVHQ--3-9@chandradeepdey.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 08c443898855..65f8dc65b967 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9036,6 +9036,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK),
 	SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1043, 0x10d3, "ASUS K6500ZC", ALC294_FIXUP_ASUS_SPK),
 	SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),

From 1e66cd408353ddd0cf4121e168ad6fca4995f2ac Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Mon, 26 Apr 2021 11:11:06 +0100
Subject: [PATCH 0638/1043] serial: meson: remove redundant initialization of
 variable id

[ Upstream commit 021212f5335229ed12e3d31f9b7d30bd3bb66f7d ]

The variable id being initialized with a value that is never read
and it is being updated later with a new value. The initialization is
redundant and can be removed. Since id is just being used in a for-loop
inside a local scope, move the declaration of id to that scope.

Reviewed-by: Kevin Hilman <khilman@baylibre.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Addresses-Coverity: ("Unused value")
Link: https://lore.kernel.org/r/20210426101106.9122-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 2a1d728f20ed ("tty: serial: meson: fix hard LOCKUP on crtscts mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/meson_uart.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/meson_uart.c b/drivers/tty/serial/meson_uart.c
index 91b7359b79a2..d06653493f0e 100644
--- a/drivers/tty/serial/meson_uart.c
+++ b/drivers/tty/serial/meson_uart.c
@@ -729,12 +729,13 @@ static int meson_uart_probe(struct platform_device *pdev)
 	struct resource *res_mem, *res_irq;
 	struct uart_port *port;
 	int ret = 0;
-	int id = -1;
 
 	if (pdev->dev.of_node)
 		pdev->id = of_alias_get_id(pdev->dev.of_node, "serial");
 
 	if (pdev->id < 0) {
+		int id;
+
 		for (id = AML_UART_PORT_OFFSET; id < AML_UART_PORT_NUM; id++) {
 			if (!meson_ports[id]) {
 				pdev->id = id;

From 980c3135f1ae6fe686a70c8ba78eb1bb4bde3060 Mon Sep 17 00:00:00 2001
From: Neil Armstrong <narmstrong@baylibre.com>
Date: Tue, 18 May 2021 09:58:32 +0200
Subject: [PATCH 0639/1043] tty: serial: meson: retrieve port FIFO size from DT

[ Upstream commit 27d44e05d7b85d9d4cfe0a3c0663ea49752ece93 ]

Now the DT bindings has a property to get the FIFO size for a particular port,
retrieve it and use to setup the FIFO interrupts threshold.

Reviewed-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20210518075833.3736038-3-narmstrong@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 2a1d728f20ed ("tty: serial: meson: fix hard LOCKUP on crtscts mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/meson_uart.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/meson_uart.c b/drivers/tty/serial/meson_uart.c
index d06653493f0e..78bda91a6bf1 100644
--- a/drivers/tty/serial/meson_uart.c
+++ b/drivers/tty/serial/meson_uart.c
@@ -728,6 +728,7 @@ static int meson_uart_probe(struct platform_device *pdev)
 {
 	struct resource *res_mem, *res_irq;
 	struct uart_port *port;
+	u32 fifosize = 64; /* Default is 64, 128 for EE UART_0 */
 	int ret = 0;
 
 	if (pdev->dev.of_node)
@@ -755,6 +756,8 @@ static int meson_uart_probe(struct platform_device *pdev)
 	if (!res_irq)
 		return -ENODEV;
 
+	of_property_read_u32(pdev->dev.of_node, "fifo-size", &fifosize);
+
 	if (meson_ports[pdev->id]) {
 		dev_err(&pdev->dev, "port %d already allocated\n", pdev->id);
 		return -EBUSY;
@@ -784,7 +787,7 @@ static int meson_uart_probe(struct platform_device *pdev)
 	port->type = PORT_MESON;
 	port->x_char = 0;
 	port->ops = &meson_uart_ops;
-	port->fifosize = 64;
+	port->fifosize = fifosize;
 
 	meson_ports[pdev->id] = port;
 	platform_set_drvdata(pdev, port);

From 07c61839582de17d83d21bd7ec0caf8591af33e9 Mon Sep 17 00:00:00 2001
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Date: Fri, 24 Dec 2021 14:29:10 +0000
Subject: [PATCH 0640/1043] serial: meson: Use platform_get_irq() to get the
 interrupt

[ Upstream commit 5b68061983471470d4109bac776145245f06bc09 ]

platform_get_resource(pdev, IORESOURCE_IRQ, ..) relies on static
allocation of IRQ resources in DT core code, this causes an issue
when using hierarchical interrupt domains using "interrupts" property
in the node as this bypasses the hierarchical setup and messes up the
irq chaining.

In preparation for removal of static setup of IRQ resource from DT core
code use platform_get_irq().

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://lore.kernel.org/r/20211224142917.6966-5-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 2a1d728f20ed ("tty: serial: meson: fix hard LOCKUP on crtscts mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/meson_uart.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/tty/serial/meson_uart.c b/drivers/tty/serial/meson_uart.c
index 78bda91a6bf1..bdc394afec5b 100644
--- a/drivers/tty/serial/meson_uart.c
+++ b/drivers/tty/serial/meson_uart.c
@@ -726,10 +726,11 @@ static int meson_uart_probe_clocks(struct platform_device *pdev,
 
 static int meson_uart_probe(struct platform_device *pdev)
 {
-	struct resource *res_mem, *res_irq;
+	struct resource *res_mem;
 	struct uart_port *port;
 	u32 fifosize = 64; /* Default is 64, 128 for EE UART_0 */
 	int ret = 0;
+	int irq;
 
 	if (pdev->dev.of_node)
 		pdev->id = of_alias_get_id(pdev->dev.of_node, "serial");
@@ -752,9 +753,9 @@ static int meson_uart_probe(struct platform_device *pdev)
 	if (!res_mem)
 		return -ENODEV;
 
-	res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-	if (!res_irq)
-		return -ENODEV;
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		return irq;
 
 	of_property_read_u32(pdev->dev.of_node, "fifo-size", &fifosize);
 
@@ -779,7 +780,7 @@ static int meson_uart_probe(struct platform_device *pdev)
 	port->iotype = UPIO_MEM;
 	port->mapbase = res_mem->start;
 	port->mapsize = resource_size(res_mem);
-	port->irq = res_irq->start;
+	port->irq = irq;
 	port->flags = UPF_BOOT_AUTOCONF | UPF_LOW_LATENCY;
 	port->has_sysrq = IS_ENABLED(CONFIG_SERIAL_MESON_CONSOLE);
 	port->dev = &pdev->dev;

From 2ed25af15b32a49f387984fb9d5be6d1086a885a Mon Sep 17 00:00:00 2001
From: Pavel Krasavin <pkrasavin@imaqliq.com>
Date: Sat, 14 Oct 2023 11:39:26 +0000
Subject: [PATCH 0641/1043] tty: serial: meson: fix hard LOCKUP on crtscts mode

[ Upstream commit 2a1d728f20edeee7f26dc307ed9df4e0d23947ab ]

There might be hard lockup if we set crtscts mode on port without RTS/CTS configured:

# stty -F /dev/ttyAML6 crtscts; echo 1 > /dev/ttyAML6; echo 2 > /dev/ttyAML6
[   95.890386] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
[   95.890857] rcu:     3-...0: (201 ticks this GP) idle=e33c/1/0x4000000000000000 softirq=5844/5846 fqs=4984
[   95.900212] rcu:     (detected by 2, t=21016 jiffies, g=7753, q=296 ncpus=4)
[   95.906972] Task dump for CPU 3:
[   95.910178] task:bash            state:R  running task     stack:0     pid:205   ppid:1      flags:0x00000202
[   95.920059] Call trace:
[   95.922485]  __switch_to+0xe4/0x168
[   95.925951]  0xffffff8003477508
[   95.974379] watchdog: Watchdog detected hard LOCKUP on cpu 3
[   95.974424] Modules linked in: 88x2cs(O) rtc_meson_vrtc

Possible solution would be to not allow to setup crtscts on such port.

Tested on S905X3 based board.

Fixes: ff7693d079e5 ("ARM: meson: serial: add MesonX SoC on-chip uart driver")
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Krasavin <pkrasavin@imaqliq.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Dmitry Rokosov <ddrokosov@salutedevices.com>

v6: stable tag added
v5: https://lore.kernel.org/lkml/OF43DA36FF.2BD3BB21-ON00258A47.005A8125-00258A47.005A9513@gdc.ru/
added missed Reviewed-by tags, Fixes tag added according to Dmitry and Neil notes
v4: https://lore.kernel.org/lkml/OF55521400.7512350F-ON00258A47.003F7254-00258A47.0040E15C@gdc.ru/
More correct patch subject according to Jiri's note
v3: https://lore.kernel.org/lkml/OF6CF5FFA0.CCFD0E8E-ON00258A46.00549EDF-00258A46.0054BB62@gdc.ru/
"From:" line added to the mail
v2: https://lore.kernel.org/lkml/OF950BEF72.7F425944-ON00258A46.00488A76-00258A46.00497D44@gdc.ru/
braces for single statement removed according to Dmitry's note
v1: https://lore.kernel.org/lkml/OF28B2B8C9.5BC0CD28-ON00258A46.0037688F-00258A46.0039155B@gdc.ru/
Link: https://lore.kernel.org/r/OF66360032.51C36182-ON00258A48.003F656B-00258A48.0040092C@gdc.ru

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/meson_uart.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/serial/meson_uart.c b/drivers/tty/serial/meson_uart.c
index bdc394afec5b..bb66a3f06626 100644
--- a/drivers/tty/serial/meson_uart.c
+++ b/drivers/tty/serial/meson_uart.c
@@ -370,10 +370,14 @@ static void meson_uart_set_termios(struct uart_port *port,
 	else
 		val |= AML_UART_STOP_BIT_1SB;
 
-	if (cflags & CRTSCTS)
-		val &= ~AML_UART_TWO_WIRE_EN;
-	else
+	if (cflags & CRTSCTS) {
+		if (port->flags & UPF_HARD_FLOW)
+			val &= ~AML_UART_TWO_WIRE_EN;
+		else
+			termios->c_cflag &= ~CRTSCTS;
+	} else {
 		val |= AML_UART_TWO_WIRE_EN;
+	}
 
 	writel(val, port->membase + AML_UART_CONTROL);
 
@@ -731,6 +735,7 @@ static int meson_uart_probe(struct platform_device *pdev)
 	u32 fifosize = 64; /* Default is 64, 128 for EE UART_0 */
 	int ret = 0;
 	int irq;
+	bool has_rtscts;
 
 	if (pdev->dev.of_node)
 		pdev->id = of_alias_get_id(pdev->dev.of_node, "serial");
@@ -758,6 +763,7 @@ static int meson_uart_probe(struct platform_device *pdev)
 		return irq;
 
 	of_property_read_u32(pdev->dev.of_node, "fifo-size", &fifosize);
+	has_rtscts = of_property_read_bool(pdev->dev.of_node, "uart-has-rtscts");
 
 	if (meson_ports[pdev->id]) {
 		dev_err(&pdev->dev, "port %d already allocated\n", pdev->id);
@@ -782,6 +788,8 @@ static int meson_uart_probe(struct platform_device *pdev)
 	port->mapsize = resource_size(res_mem);
 	port->irq = irq;
 	port->flags = UPF_BOOT_AUTOCONF | UPF_LOW_LATENCY;
+	if (has_rtscts)
+		port->flags |= UPF_HARD_FLOW;
 	port->has_sysrq = IS_ENABLED(CONFIG_SERIAL_MESON_CONSOLE);
 	port->dev = &pdev->dev;
 	port->line = pdev->id;

From 8617305611c16e124d1b8f2ce73c008bc9119f93 Mon Sep 17 00:00:00 2001
From: Christian Marangi <ansuelsmth@gmail.com>
Date: Tue, 24 Oct 2023 20:30:14 +0200
Subject: [PATCH 0642/1043] cpufreq: stats: Fix buffer overflow detection in
 trans_stats()

[ Upstream commit ea167a7fc2426f7685c3735e104921c1a20a6d3f ]

Commit 3c0897c180c6 ("cpufreq: Use scnprintf() for avoiding potential
buffer overflow") switched from snprintf to the more secure scnprintf
but never updated the exit condition for PAGE_SIZE.

As the commit say and as scnprintf document, what scnprintf returns what
is actually written not counting the '\0' end char. This results in the
case of len exceeding the size, len set to PAGE_SIZE - 1, as it can be
written at max PAGE_SIZE - 1 (as '\0' is not counted)

Because of len is never set to PAGE_SIZE, the function never break early,
never prints the warning and never return -EFBIG.

Fix this by changing the condition to PAGE_SIZE - 1 to correctly trigger
the error.

Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
Fixes: 3c0897c180c6 ("cpufreq: Use scnprintf() for avoiding potential buffer overflow")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/cpufreq_stats.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index 6cd5c8ab5d49..ab856dd2d5fc 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -131,25 +131,25 @@ static ssize_t show_trans_table(struct cpufreq_policy *policy, char *buf)
 	len += scnprintf(buf + len, PAGE_SIZE - len, "   From  :    To\n");
 	len += scnprintf(buf + len, PAGE_SIZE - len, "         : ");
 	for (i = 0; i < stats->state_num; i++) {
-		if (len >= PAGE_SIZE)
+		if (len >= PAGE_SIZE - 1)
 			break;
 		len += scnprintf(buf + len, PAGE_SIZE - len, "%9u ",
 				stats->freq_table[i]);
 	}
-	if (len >= PAGE_SIZE)
-		return PAGE_SIZE;
+	if (len >= PAGE_SIZE - 1)
+		return PAGE_SIZE - 1;
 
 	len += scnprintf(buf + len, PAGE_SIZE - len, "\n");
 
 	for (i = 0; i < stats->state_num; i++) {
-		if (len >= PAGE_SIZE)
+		if (len >= PAGE_SIZE - 1)
 			break;
 
 		len += scnprintf(buf + len, PAGE_SIZE - len, "%9u: ",
 				stats->freq_table[i]);
 
 		for (j = 0; j < stats->state_num; j++) {
-			if (len >= PAGE_SIZE)
+			if (len >= PAGE_SIZE - 1)
 				break;
 
 			if (pending)
@@ -159,12 +159,12 @@ static ssize_t show_trans_table(struct cpufreq_policy *policy, char *buf)
 
 			len += scnprintf(buf + len, PAGE_SIZE - len, "%9u ", count);
 		}
-		if (len >= PAGE_SIZE)
+		if (len >= PAGE_SIZE - 1)
 			break;
 		len += scnprintf(buf + len, PAGE_SIZE - len, "\n");
 	}
 
-	if (len >= PAGE_SIZE) {
+	if (len >= PAGE_SIZE - 1) {
 		pr_warn_once("cpufreq transition table exceeds PAGE_SIZE. Disabling\n");
 		return -EFBIG;
 	}

From 0952747362c19a84392caa50df00fc78076e1423 Mon Sep 17 00:00:00 2001
From: Artem Lukyanov <dukzcry@ya.ru>
Date: Wed, 23 Nov 2022 11:10:05 +0300
Subject: [PATCH 0643/1043] Bluetooth: btusb: Add Realtek RTL8852BE support ID
 0x0cb8:0xc559

[ Upstream commit 393b4916b7b5b94faf5c6a7c68df1c62d17e4f38 ]

Add the support ID(0x0cb8, 0xc559) to usb_device_id table for
Realtek RTL8852BE.

The device info from /sys/kernel/debug/usb/devices as below.

T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0cb8 ProdID=c559 Rev= 0.00
S:  Manufacturer=Realtek
S:  Product=Bluetooth Radio
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Artem Lukyanov <dukzcry@ya.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: da06ff1f585e ("Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index cc210fb790d8..fffb73e6f49d 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -415,6 +415,10 @@ static const struct usb_device_id blacklist_table[] = {
 	{ USB_DEVICE(0x13d3, 0x3586), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
 
+	/* Realtek 8852BE Bluetooth devices */
+	{ USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
+
 	/* Realtek Bluetooth devices */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
 	  .driver_info = BTUSB_REALTEK },

From 3aba34baa4fb8536ef6565d27060443817d51de4 Mon Sep 17 00:00:00 2001
From: Larry Finger <Larry.Finger@lwfinger.net>
Date: Wed, 22 Mar 2023 19:52:02 -0500
Subject: [PATCH 0644/1043] bluetooth: Add device 0bda:887b to device tables

[ Upstream commit 730a1d1a93a3e30c3723f87af97a8517334b2203 ]

This device is part of a Realtek RTW8852BE chip.

The device table entry is as follows:

T:  Bus=03 Lev=01 Prnt=01 Port=12 Cnt=02 Dev#=  3 Spd=12   MxCh= 0
D:  Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0bda ProdID=887b Rev= 0.00
S:  Manufacturer=Realtek
S:  Product=Bluetooth Radio
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: da06ff1f585e ("Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index fffb73e6f49d..bb1ec0cac2b2 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -418,6 +418,8 @@ static const struct usb_device_id blacklist_table[] = {
 	/* Realtek 8852BE Bluetooth devices */
 	{ USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x0bda, 0x887b), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
 
 	/* Realtek Bluetooth devices */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),

From 990d4c76d2542e5272f9ccab58a9944b30d3b82c Mon Sep 17 00:00:00 2001
From: Larry Finger <Larry.Finger@lwfinger.net>
Date: Wed, 22 Mar 2023 19:52:03 -0500
Subject: [PATCH 0645/1043] bluetooth: Add device 13d3:3571 to device tables

[ Upstream commit 069f534247bb6db4f8c2c2ea8e9155abf495c37e ]

This device is part of a Realtek RTW8852BE chip. The device table is as follows:

T:  Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=13d3 ProdID=3571 Rev= 0.00
S:  Manufacturer=Realtek
S:  Product=Bluetooth Radio
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: da06ff1f585e ("Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index bb1ec0cac2b2..6c225f48a26d 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -420,6 +420,8 @@ static const struct usb_device_id blacklist_table[] = {
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x0bda, 0x887b), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x13d3, 0x3571), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
 
 	/* Realtek Bluetooth devices */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),

From dbbf3c4560021de46943f68fe2900a7839869175 Mon Sep 17 00:00:00 2001
From: Masum Reza <masumrezarock100@gmail.com>
Date: Sun, 24 Sep 2023 16:46:55 +0530
Subject: [PATCH 0646/1043] Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to
 device tables

[ Upstream commit 02be109d3a405dbc4d53fb4b4473d7a113548088 ]

This device is used in TP-Link TX20E WiFi+Bluetooth adapter.

Relevant information in /sys/kernel/debug/usb/devices
about the Bluetooth device is listed as the below.

T:  Bus=01 Lev=01 Prnt=01 Port=08 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=13d3 ProdID=3570 Rev= 0.00
S:  Manufacturer=Realtek
S:  Product=Bluetooth Radio
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Masum Reza <masumrezarock100@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: da06ff1f585e ("Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 6c225f48a26d..f1079614bfdb 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -420,6 +420,8 @@ static const struct usb_device_id blacklist_table[] = {
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x0bda, 0x887b), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x13d3, 0x3570), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x13d3, 0x3571), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
 

From 62d15b6a6ec9bef74a60cad69ae781de7289df1b Mon Sep 17 00:00:00 2001
From: Guan Wentao <guanwentao@uniontech.com>
Date: Thu, 12 Oct 2023 19:21:17 +0800
Subject: [PATCH 0647/1043] Bluetooth: btusb: Add 0bda:b85b for Fn-Link
 RTL8852BE

[ Upstream commit da06ff1f585ea784c79f80e7fab0e0c4ebb49c1c ]

Add PID/VID 0bda:b85b for Realtek RTL8852BE USB bluetooth part.
The PID/VID was reported by the patch last year. [1]
Some SBCs like rockpi 5B A8 module contains the device.
And it`s founded in website. [2] [3]

Here is the device tables in /sys/kernel/debug/usb/devices .

T:  Bus=07 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0bda ProdID=b85b Rev= 0.00
S:  Manufacturer=Realtek
S:  Product=Bluetooth Radio
S:  SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Link: https://lore.kernel.org/all/20220420052402.19049-1-tangmeng@uniontech.com/ [1]
Link: https://forum.radxa.com/t/bluetooth-on-ubuntu/13051/4 [2]
Link: https://ubuntuforums.org/showthread.php?t=2489527 [3]

Cc: stable@vger.kernel.org
Signed-off-by: Meng Tang <tangmeng@uniontech.com>
Signed-off-by: Guan Wentao <guanwentao@uniontech.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f1079614bfdb..a1a8b282b99b 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -420,6 +420,8 @@ static const struct usb_device_id blacklist_table[] = {
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x0bda, 0x887b), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
+	{ USB_DEVICE(0x0bda, 0xb85b), .driver_info = BTUSB_REALTEK |
+						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x13d3, 0x3570), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
 	{ USB_DEVICE(0x13d3, 0x3571), .driver_info = BTUSB_REALTEK |

From bdda1c356d586ab189b01aef826d5a36fa41a40b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Sun, 1 Oct 2023 19:02:51 +0200
Subject: [PATCH 0648/1043] PCI: exynos: Don't discard .remove() callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 83a939f0fdc208ff3639dd3d42ac9b3c35607fd2 ]

With CONFIG_PCI_EXYNOS=y and exynos_pcie_remove() marked with __exit, the
function is discarded from the driver. In this case a bound device can
still get unbound, e.g via sysfs. Then no cleanup code is run resulting in
resource leaks or worse.

The right thing to do is do always have the remove callback available.
This fixes the following warning by modpost:

  WARNING: modpost: drivers/pci/controller/dwc/pci-exynos: section mismatch in reference: exynos_pcie_driver+0x8 (section: .data) -> exynos_pcie_remove (section: .exit.text)

(with ARCH=x86_64 W=1 allmodconfig).

Fixes: 340cba6092c2 ("pci: Add PCIe driver for Samsung Exynos")
Link: https://lore.kernel.org/r/20231001170254.2506508-2-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/dwc/pci-exynos.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/dwc/pci-exynos.c b/drivers/pci/controller/dwc/pci-exynos.c
index 242683cde04a..3823e5881996 100644
--- a/drivers/pci/controller/dwc/pci-exynos.c
+++ b/drivers/pci/controller/dwc/pci-exynos.c
@@ -503,7 +503,7 @@ static int __init exynos_pcie_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static int __exit exynos_pcie_remove(struct platform_device *pdev)
+static int exynos_pcie_remove(struct platform_device *pdev)
 {
 	struct exynos_pcie *ep = platform_get_drvdata(pdev);
 
@@ -522,7 +522,7 @@ static const struct of_device_id exynos_pcie_of_match[] = {
 };
 
 static struct platform_driver exynos_pcie_driver = {
-	.remove		= __exit_p(exynos_pcie_remove),
+	.remove		= exynos_pcie_remove,
 	.driver = {
 		.name	= "exynos-pcie",
 		.of_match_table = exynos_pcie_of_match,

From 2b3931eb8e9ccf7a633844b49f0bac4e2f75972f Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date: Fri, 9 Sep 2022 11:20:31 +0200
Subject: [PATCH 0649/1043] arm64: dts: qcom: ipq6018: switch TCSR mutex to
 MMIO

[ Upstream commit f5e303aefc06b7508d7a490f9a2d80e4dc134c70 ]

The TCSR mutex bindings allow device to be described only with address
space (so it uses MMIO, not syscon regmap).  This seems reasonable as
TCSR mutex is actually a dedicated IO address space and it also fixes DT
schema checks:

  qcom/ipq6018-cp01-c1.dtb: hwlock: 'reg' is a required property
  qcom/ipq6018-cp01-c1.dtb: hwlock: 'syscon' does not match any of the regexes: 'pinctrl-[0-9]+'

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20220909092035.223915-12-krzysztof.kozlowski@linaro.org
Stable-dep-of: 72fc3d58b87b ("arm64: dts: qcom: ipq6018: Fix tcsr_mutex register size")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/ipq6018.dtsi | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
index 201a3bb5511c..a8c26aff6f37 100644
--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
@@ -129,12 +129,6 @@ scm {
 		};
 	};
 
-	tcsr_mutex: hwlock {
-		compatible = "qcom,tcsr-mutex";
-		syscon = <&tcsr_mutex_regs 0 0x80>;
-		#hwlock-cells = <1>;
-	};
-
 	pmuv8: pmu {
 		compatible = "arm,cortex-a53-pmu";
 		interrupts = <GIC_PPI 7 (GIC_CPU_MASK_SIMPLE(4) |
@@ -242,9 +236,10 @@ gcc: gcc@1800000 {
 			#reset-cells = <1>;
 		};
 
-		tcsr_mutex_regs: syscon@1905000 {
-			compatible = "syscon";
-			reg = <0x0 0x01905000 0x0 0x8000>;
+		tcsr_mutex: hwlock@1905000 {
+			compatible = "qcom,ipq6018-tcsr-mutex", "qcom,tcsr-mutex";
+			reg = <0x0 0x01905000 0x0 0x1000>;
+			#hwlock-cells = <1>;
 		};
 
 		tcsr_q6: syscon@1945000 {

From 969d994612ff70556bbf4614311965137defd99a Mon Sep 17 00:00:00 2001
From: Vignesh Viswanathan <quic_viswanat@quicinc.com>
Date: Tue, 5 Sep 2023 15:25:34 +0530
Subject: [PATCH 0650/1043] arm64: dts: qcom: ipq6018: Fix tcsr_mutex register
 size

[ Upstream commit 72fc3d58b87b0d622039c6299b89024fbb7b420f ]

IPQ6018's TCSR Mutex HW lock register has 32 locks of size 4KB each.
Total size of the TCSR Mutex registers is 128KB.

Fix size of the tcsr_mutex hwlock register to 0x20000.

Changes in v2:
 - Drop change to remove qcom,ipq6018-tcsr-mutex compatible string
 - Added Fixes and stable tags

Cc: stable@vger.kernel.org
Fixes: 5bf635621245 ("arm64: dts: ipq6018: Add a few device nodes")
Signed-off-by: Vignesh Viswanathan <quic_viswanat@quicinc.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230905095535.1263113-2-quic_viswanat@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
index a8c26aff6f37..367720910677 100644
--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
@@ -238,7 +238,7 @@ gcc: gcc@1800000 {
 
 		tcsr_mutex: hwlock@1905000 {
 			compatible = "qcom,ipq6018-tcsr-mutex", "qcom,tcsr-mutex";
-			reg = <0x0 0x01905000 0x0 0x1000>;
+			reg = <0x0 0x01905000 0x0 0x20000>;
 			#hwlock-cells = <1>;
 		};
 

From a011391f019ccf8aca0df3a0b90055ac814f6a91 Mon Sep 17 00:00:00 2001
From: Johnathan Mantey <johnathanx.mantey@intel.com>
Date: Mon, 13 Nov 2023 08:30:29 -0800
Subject: [PATCH 0651/1043] Revert ncsi: Propagate carrier gain/loss events to
 the NCSI controller

commit 9e2e7efbbbff69d8340abb56d375dd79d1f5770f upstream.

This reverts commit 3780bb29311eccb7a1c9641032a112eed237f7e3.

The cited commit introduced unwanted behavior.

The intent for the commit was to be able to detect carrier loss/gain
for just the NIC connected to the BMC. The unwanted effect is a
carrier loss for auxiliary paths also causes the BMC to lose
carrier. The BMC never regains carrier despite the secondary NIC
regaining a link.

This change, when merged, needs to be backported to stable kernels.
5.4-stable, 5.10-stable, 5.15-stable, 6.1-stable, 6.5-stable

Fixes: 3780bb29311e ("ncsi: Propagate carrier gain/loss events to the NCSI controller")
CC: stable@vger.kernel.org
Signed-off-by: Johnathan Mantey <johnathanx.mantey@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ncsi/ncsi-aen.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c
index f8854bff286c..62fb1031763d 100644
--- a/net/ncsi/ncsi-aen.c
+++ b/net/ncsi/ncsi-aen.c
@@ -89,11 +89,6 @@ static int ncsi_aen_handler_lsc(struct ncsi_dev_priv *ndp,
 	if ((had_link == has_link) || chained)
 		return 0;
 
-	if (had_link)
-		netif_carrier_off(ndp->ndev.dev);
-	else
-		netif_carrier_on(ndp->ndev.dev);
-
 	if (!ndp->multi_package && !nc->package->multi_channel) {
 		if (had_link) {
 			ndp->flags |= NCSI_DEV_RESHUFFLE;

From 8327f50442d2555f24dbbf670ef1991d31425b14 Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Tue, 31 Oct 2023 13:32:06 +0100
Subject: [PATCH 0652/1043] lsm: fix default return value for vm_enough_memory

commit 866d648059d5faf53f1cd960b43fe8365ad93ea7 upstream.

1 is the return value that implements a "no-op" hook, not 0.

Cc: stable@vger.kernel.org
Fixes: 98e828a0650f ("security: Refactor declaration of LSM hooks")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/lsm_hook_defs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index d13631a5e908..e3ae119121d5 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -48,7 +48,7 @@ LSM_HOOK(int, 0, quota_on, struct dentry *dentry)
 LSM_HOOK(int, 0, syslog, int type)
 LSM_HOOK(int, 0, settime, const struct timespec64 *ts,
 	 const struct timezone *tz)
-LSM_HOOK(int, 0, vm_enough_memory, struct mm_struct *mm, long pages)
+LSM_HOOK(int, 1, vm_enough_memory, struct mm_struct *mm, long pages)
 LSM_HOOK(int, 0, bprm_creds_for_exec, struct linux_binprm *bprm)
 LSM_HOOK(int, 0, bprm_creds_from_file, struct linux_binprm *bprm, struct file *file)
 LSM_HOOK(int, 0, bprm_check_security, struct linux_binprm *bprm)

From 8e29eebe4c39cb169ed2d1712fb5bfb0b70bc2de Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Tue, 31 Oct 2023 13:32:07 +0100
Subject: [PATCH 0653/1043] lsm: fix default return value for inode_getsecctx

commit b36995b8609a5a8fe5cf259a1ee768fcaed919f8 upstream.

-EOPNOTSUPP is the return value that implements a "no-op" hook, not 0.

Without this fix having only the BPF LSM enabled (with no programs
attached) can cause uninitialized variable reads in
nfsd4_encode_fattr(), because the BPF hook returns 0 without touching
the 'ctxlen' variable and the corresponding 'contextlen' variable in
nfsd4_encode_fattr() remains uninitialized, yet being treated as valid
based on the 0 return value.

Cc: stable@vger.kernel.org
Fixes: 98e828a0650f ("security: Refactor declaration of LSM hooks")
Reported-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/lsm_hook_defs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index e3ae119121d5..693ed9c614b6 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -255,7 +255,7 @@ LSM_HOOK(void, LSM_RET_VOID, release_secctx, char *secdata, u32 seclen)
 LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode)
 LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 ctxlen)
 LSM_HOOK(int, 0, inode_setsecctx, struct dentry *dentry, void *ctx, u32 ctxlen)
-LSM_HOOK(int, 0, inode_getsecctx, struct inode *inode, void **ctx,
+LSM_HOOK(int, -EOPNOTSUPP, inode_getsecctx, struct inode *inode, void **ctx,
 	 u32 *ctxlen)
 
 #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)

From cb1006640cb353af268e3aee447c5b9a852c70ca Mon Sep 17 00:00:00 2001
From: Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
Date: Thu, 2 Nov 2023 10:30:08 +0700
Subject: [PATCH 0654/1043] i2c: designware: Disable TX_EMPTY irq while waiting
 for block length byte

commit e8183fa10c25c7b3c20670bf2b430ddcc1ee03c0 upstream.

During SMBus block data read process, we have seen high interrupt rate
because of TX_EMPTY irq status while waiting for block length byte (the
first data byte after the address phase). The interrupt handler does not
do anything because the internal state is kept as STATUS_WRITE_IN_PROGRESS.
Hence, we should disable TX_EMPTY IRQ until I2C DesignWare receives
first data byte from I2C device, then re-enable it to resume SMBus
transaction.

It takes 0.789 ms for host to receive data length from slave.
Without the patch, i2c_dw_isr() is called 99 times by TX_EMPTY interrupt.
And it is none after applying the patch.

Cc: stable@vger.kernel.org
Co-developed-by: Chuong Tran <chuong@os.amperecomputing.com>
Signed-off-by: Chuong Tran <chuong@os.amperecomputing.com>
Signed-off-by: Tam Nguyen <tamnguyenchi@os.amperecomputing.com>
Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/busses/i2c-designware-master.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index 106080b25e81..8a3d35cacdcb 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -362,10 +362,16 @@ i2c_dw_xfer_msg(struct dw_i2c_dev *dev)
 
 		/*
 		 * Because we don't know the buffer length in the
-		 * I2C_FUNC_SMBUS_BLOCK_DATA case, we can't stop
-		 * the transaction here.
+		 * I2C_FUNC_SMBUS_BLOCK_DATA case, we can't stop the
+		 * transaction here. Also disable the TX_EMPTY IRQ
+		 * while waiting for the data length byte to avoid the
+		 * bogus interrupts flood.
 		 */
-		if (buf_len > 0 || flags & I2C_M_RECV_LEN) {
+		if (flags & I2C_M_RECV_LEN) {
+			dev->status |= STATUS_WRITE_IN_PROGRESS;
+			intr_mask &= ~DW_IC_INTR_TX_EMPTY;
+			break;
+		} else if (buf_len > 0) {
 			/* more bytes to be written */
 			dev->status |= STATUS_WRITE_IN_PROGRESS;
 			break;
@@ -401,6 +407,13 @@ i2c_dw_recv_len(struct dw_i2c_dev *dev, u8 len)
 	msgs[dev->msg_read_idx].len = len;
 	msgs[dev->msg_read_idx].flags &= ~I2C_M_RECV_LEN;
 
+	/*
+	 * Received buffer length, re-enable TX_EMPTY interrupt
+	 * to resume the SMBUS transaction.
+	 */
+	regmap_update_bits(dev->map, DW_IC_INTR_MASK, DW_IC_INTR_TX_EMPTY,
+			   DW_IC_INTR_TX_EMPTY);
+
 	return len;
 }
 

From 4dc0484e90a3cde1cb1514f1db1de3145d99cb18 Mon Sep 17 00:00:00 2001
From: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Date: Fri, 27 Oct 2023 08:57:38 +0200
Subject: [PATCH 0655/1043] net: dsa: lan9303: consequently nested-lock
 physical MDIO

commit 5a22fbcc10f3f7d94c5d88afbbffa240a3677057 upstream.

When LAN9303 is MDIO-connected two callchains exist into
mdio->bus->write():

1. switch ports 1&2 ("physical" PHYs):

virtual (switch-internal) MDIO bus (lan9303_switch_ops->phy_{read|write})->
  lan9303_mdio_phy_{read|write} -> mdiobus_{read|write}_nested

2. LAN9303 virtual PHY:

virtual MDIO bus (lan9303_phy_{read|write}) ->
  lan9303_virt_phy_reg_{read|write} -> regmap -> lan9303_mdio_{read|write}

If the latter functions just take
mutex_lock(&sw_dev->device->bus->mdio_lock) it triggers a LOCKDEP
false-positive splat. It's false-positive because the first
mdio_lock in the second callchain above belongs to virtual MDIO bus, the
second mdio_lock belongs to physical MDIO bus.

Consequent annotation in lan9303_mdio_{read|write} as nested lock
(similar to lan9303_mdio_phy_{read|write}, it's the same physical MDIO bus)
prevents the following splat:

WARNING: possible circular locking dependency detected
5.15.71 #1 Not tainted
------------------------------------------------------
kworker/u4:3/609 is trying to acquire lock:
ffff000011531c68 (lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock){+.+.}-{3:3}, at: regmap_lock_mutex
but task is already holding lock:
ffff0000114c44d8 (&bus->mdio_lock){+.+.}-{3:3}, at: mdiobus_read
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&bus->mdio_lock){+.+.}-{3:3}:
       lock_acquire
       __mutex_lock
       mutex_lock_nested
       lan9303_mdio_read
       _regmap_read
       regmap_read
       lan9303_probe
       lan9303_mdio_probe
       mdio_probe
       really_probe
       __driver_probe_device
       driver_probe_device
       __device_attach_driver
       bus_for_each_drv
       __device_attach
       device_initial_probe
       bus_probe_device
       deferred_probe_work_func
       process_one_work
       worker_thread
       kthread
       ret_from_fork
-> #0 (lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock){+.+.}-{3:3}:
       __lock_acquire
       lock_acquire.part.0
       lock_acquire
       __mutex_lock
       mutex_lock_nested
       regmap_lock_mutex
       regmap_read
       lan9303_phy_read
       dsa_slave_phy_read
       __mdiobus_read
       mdiobus_read
       get_phy_device
       mdiobus_scan
       __mdiobus_register
       dsa_register_switch
       lan9303_probe
       lan9303_mdio_probe
       mdio_probe
       really_probe
       __driver_probe_device
       driver_probe_device
       __device_attach_driver
       bus_for_each_drv
       __device_attach
       device_initial_probe
       bus_probe_device
       deferred_probe_work_func
       process_one_work
       worker_thread
       kthread
       ret_from_fork
other info that might help us debug this:
 Possible unsafe locking scenario:
       CPU0                    CPU1
       ----                    ----
  lock(&bus->mdio_lock);
                               lock(lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock);
                               lock(&bus->mdio_lock);
  lock(lan9303_mdio:131:(&lan9303_mdio_regmap_config)->lock);
*** DEADLOCK ***
5 locks held by kworker/u4:3/609:
 #0: ffff000002842938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work
 #1: ffff80000bacbd60 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work
 #2: ffff000007645178 (&dev->mutex){....}-{3:3}, at: __device_attach
 #3: ffff8000096e6e78 (dsa2_mutex){+.+.}-{3:3}, at: dsa_register_switch
 #4: ffff0000114c44d8 (&bus->mdio_lock){+.+.}-{3:3}, at: mdiobus_read
stack backtrace:
CPU: 1 PID: 609 Comm: kworker/u4:3 Not tainted 5.15.71 #1
Workqueue: events_unbound deferred_probe_work_func
Call trace:
 dump_backtrace
 show_stack
 dump_stack_lvl
 dump_stack
 print_circular_bug
 check_noncircular
 __lock_acquire
 lock_acquire.part.0
 lock_acquire
 __mutex_lock
 mutex_lock_nested
 regmap_lock_mutex
 regmap_read
 lan9303_phy_read
 dsa_slave_phy_read
 __mdiobus_read
 mdiobus_read
 get_phy_device
 mdiobus_scan
 __mdiobus_register
 dsa_register_switch
 lan9303_probe
 lan9303_mdio_probe
...

Cc: stable@vger.kernel.org
Fixes: dc7005831523 ("net: dsa: LAN9303: add MDIO managed mode support")
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20231027065741.534971-1-alexander.sverdlin@siemens.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/lan9303_mdio.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dsa/lan9303_mdio.c b/drivers/net/dsa/lan9303_mdio.c
index 9cbe80460b53..a5787dc370eb 100644
--- a/drivers/net/dsa/lan9303_mdio.c
+++ b/drivers/net/dsa/lan9303_mdio.c
@@ -32,7 +32,7 @@ static int lan9303_mdio_write(void *ctx, uint32_t reg, uint32_t val)
 	struct lan9303_mdio *sw_dev = (struct lan9303_mdio *)ctx;
 
 	reg <<= 2; /* reg num to offset */
-	mutex_lock(&sw_dev->device->bus->mdio_lock);
+	mutex_lock_nested(&sw_dev->device->bus->mdio_lock, MDIO_MUTEX_NESTED);
 	lan9303_mdio_real_write(sw_dev->device, reg, val & 0xffff);
 	lan9303_mdio_real_write(sw_dev->device, reg + 2, (val >> 16) & 0xffff);
 	mutex_unlock(&sw_dev->device->bus->mdio_lock);
@@ -50,7 +50,7 @@ static int lan9303_mdio_read(void *ctx, uint32_t reg, uint32_t *val)
 	struct lan9303_mdio *sw_dev = (struct lan9303_mdio *)ctx;
 
 	reg <<= 2; /* reg num to offset */
-	mutex_lock(&sw_dev->device->bus->mdio_lock);
+	mutex_lock_nested(&sw_dev->device->bus->mdio_lock, MDIO_MUTEX_NESTED);
 	*val = lan9303_mdio_real_read(sw_dev->device, reg);
 	*val |= (lan9303_mdio_real_read(sw_dev->device, reg + 2) << 16);
 	mutex_unlock(&sw_dev->device->bus->mdio_lock);

From 430603f6de337bd47369d0e6922088bf83442d79 Mon Sep 17 00:00:00 2001
From: Klaus Kudielka <klaus.kudielka@gmail.com>
Date: Tue, 7 Nov 2023 18:44:02 +0100
Subject: [PATCH 0656/1043] net: phylink: initialize carrier state at creation

commit 02d5fdbf4f2b8c406f7a4c98fa52aa181a11d733 upstream.

Background: Turris Omnia (Armada 385); eth2 (mvneta) connected to SFP bus;
SFP module is present, but no fiber connected, so definitely no carrier.

After booting, eth2 is down, but netdev LED trigger surprisingly reports
link active. Then, after "ip link set eth2 up", the link indicator goes
away - as I would have expected it from the beginning.

It turns out, that the default carrier state after netdev creation is
"carrier ok". Some ethernet drivers explicitly call netif_carrier_off
during probing, others (like mvneta) don't - which explains the current
behaviour: only when the device is brought up, phylink_start calls
netif_carrier_off.

Fix this for all drivers using phylink, by calling netif_carrier_off in
phylink_create.

Fixes: 089381b27abe ("leds: initial support for Turris Omnia LEDs")
Cc: stable@vger.kernel.org
Suggested-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Klaus Kudielka <klaus.kudielka@gmail.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/phylink.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 57b1b138522e..cbdd01f31162 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -838,6 +838,7 @@ struct phylink *phylink_create(struct phylink_config *config,
 	pl->config = config;
 	if (config->type == PHYLINK_NETDEV) {
 		pl->netdev = to_net_dev(config->dev);
+		netif_carrier_off(pl->netdev);
 	} else if (config->type == PHYLINK_DEV) {
 		pl->dev = config->dev;
 	} else {

From 829f0d5231b729af86b71653a1a75dfa794f8196 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Sat, 9 Sep 2023 22:25:06 +0200
Subject: [PATCH 0657/1043] i2c: i801: fix potential race in
 i801_block_transaction_byte_by_byte

commit f78ca48a8ba9cdec96e8839351e49eec3233b177 upstream.

Currently we set SMBHSTCNT_LAST_BYTE only after the host has started
receiving the last byte. If we get e.g. preempted before setting
SMBHSTCNT_LAST_BYTE, the host may be finished with receiving the byte
before SMBHSTCNT_LAST_BYTE is set.
Therefore change the code to set SMBHSTCNT_LAST_BYTE before writing
SMBHSTSTS_BYTE_DONE for the byte before the last byte. Now the code
is also consistent with what we do in i801_isr_byte_done().

Reported-by: Jean Delvare <jdelvare@suse.com>
Closes: https://lore.kernel.org/linux-i2c/20230828152747.09444625@endymion.delvare/
Cc: stable@vger.kernel.org
Acked-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/i2c/busses/i2c-i801.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 4aec451d7251..cb8f56022592 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -735,15 +735,11 @@ static int i801_block_transaction_byte_by_byte(struct i801_priv *priv,
 		return i801_check_post(priv, status);
 	}
 
+	if (len == 1 && read_write == I2C_SMBUS_READ)
+		smbcmd |= SMBHSTCNT_LAST_BYTE;
+	outb_p(smbcmd | SMBHSTCNT_START, SMBHSTCNT(priv));
+
 	for (i = 1; i <= len; i++) {
-		if (i == len && read_write == I2C_SMBUS_READ)
-			smbcmd |= SMBHSTCNT_LAST_BYTE;
-		outb_p(smbcmd, SMBHSTCNT(priv));
-
-		if (i == 1)
-			outb_p(inb(SMBHSTCNT(priv)) | SMBHSTCNT_START,
-			       SMBHSTCNT(priv));
-
 		status = i801_wait_byte_done(priv);
 		if (status)
 			goto exit;
@@ -766,9 +762,12 @@ static int i801_block_transaction_byte_by_byte(struct i801_priv *priv,
 			data->block[0] = len;
 		}
 
-		/* Retrieve/store value in SMBBLKDAT */
-		if (read_write == I2C_SMBUS_READ)
+		if (read_write == I2C_SMBUS_READ) {
 			data->block[i] = inb_p(SMBBLKDAT(priv));
+			if (i == len - 1)
+				outb_p(smbcmd | SMBHSTCNT_LAST_BYTE, SMBHSTCNT(priv));
+		}
+
 		if (read_write == I2C_SMBUS_WRITE && i+1 <= len)
 			outb_p(data->block[i+1], SMBBLKDAT(priv));
 

From c041f5ddef00c731c541e00bc8ae97b8c84c682f Mon Sep 17 00:00:00 2001
From: Su Hui <suhui@nfschina.com>
Date: Sun, 8 Oct 2023 14:39:30 +0800
Subject: [PATCH 0658/1043] f2fs: avoid format-overflow warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e0d4e8acb3789c5a8651061fbab62ca24a45c063 upstream.

With gcc and W=1 option, there's a warning like this:

fs/f2fs/compress.c: In function ‘f2fs_init_page_array_cache’:
fs/f2fs/compress.c:1984:47: error: ‘%u’ directive writing between
1 and 7 bytes into a region of size between 5 and 8
[-Werror=format-overflow=]
 1984 |  sprintf(slab_name, "f2fs_page_array_entry-%u:%u", MAJOR(dev),
		MINOR(dev));
      |                                               ^~

String "f2fs_page_array_entry-%u:%u" can up to 35. The first "%u" can up
to 4 and the second "%u" can up to 7, so total size is "24 + 4 + 7 = 35".
slab_name's size should be 35 rather than 32.

Cc: stable@vger.kernel.org
Signed-off-by: Su Hui <suhui@nfschina.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/compress.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index 1be9de40f0b5..a94e102d1586 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -1574,7 +1574,7 @@ void f2fs_decompress_end_io(struct page **rpages,
 int f2fs_init_page_array_cache(struct f2fs_sb_info *sbi)
 {
 	dev_t dev = sbi->sb->s_bdev->bd_dev;
-	char slab_name[32];
+	char slab_name[35];
 
 	sprintf(slab_name, "f2fs_page_array_entry-%u:%u", MAJOR(dev), MINOR(dev));
 

From dfa9f4ea6502f8e8051af4aaebbd0032cbfef998 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Fri, 6 Oct 2023 22:31:52 +0100
Subject: [PATCH 0659/1043] media: lirc: drop trailing space from scancode
 transmit

commit c8a489f820179fb12251e262b50303c29de991ac upstream.

When transmitting, infrared drivers expect an odd number of samples; iow
without a trailing space. No problems have been observed so far, so
this is just belt and braces.

Fixes: 9b6192589be7 ("media: lirc: implement scancode sending")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/lirc_dev.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index 220363b9a868..9c888047fa99 100644
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -286,7 +286,11 @@ static ssize_t lirc_transmit(struct file *file, const char __user *buf,
 		if (ret < 0)
 			goto out_kfree_raw;
 
-		count = ret;
+		/* drop trailing space */
+		if (!(ret % 2))
+			count = ret - 1;
+		else
+			count = ret;
 
 		txbuf = kmalloc_array(count, sizeof(unsigned int), GFP_KERNEL);
 		if (!txbuf) {

From 0f887306bd8bbd6ad02cd0b4ed894cd9367a8f73 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Fri, 6 Oct 2023 12:54:25 +0100
Subject: [PATCH 0660/1043] media: sharp: fix sharp encoding

commit 4f7efc71891462ab7606da7039f480d7c1584a13 upstream.

The Sharp protocol[1] encoding has incorrect timings for bit space.

[1] https://www.sbprojects.net/knowledge/ir/sharp.php

Fixes: d35afc5fe097 ("[media] rc: ir-sharp-decoder: Add encode capability")
Cc: stable@vger.kernel.org
Reported-by: Joe Ferner <joe.m.ferner@gmail.com>
Closes: https://sourceforge.net/p/lirc/mailman/message/38604507/
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/ir-sharp-decoder.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/media/rc/ir-sharp-decoder.c b/drivers/media/rc/ir-sharp-decoder.c
index d09c38c07dbd..053151cd8f21 100644
--- a/drivers/media/rc/ir-sharp-decoder.c
+++ b/drivers/media/rc/ir-sharp-decoder.c
@@ -15,7 +15,9 @@
 #define SHARP_UNIT		40  /* us */
 #define SHARP_BIT_PULSE		(8    * SHARP_UNIT) /* 320us */
 #define SHARP_BIT_0_PERIOD	(25   * SHARP_UNIT) /* 1ms (680us space) */
-#define SHARP_BIT_1_PERIOD	(50   * SHARP_UNIT) /* 2ms (1680ms space) */
+#define SHARP_BIT_1_PERIOD	(50   * SHARP_UNIT) /* 2ms (1680us space) */
+#define SHARP_BIT_0_SPACE	(17   * SHARP_UNIT) /* 680us space */
+#define SHARP_BIT_1_SPACE	(42   * SHARP_UNIT) /* 1680us space */
 #define SHARP_ECHO_SPACE	(1000 * SHARP_UNIT) /* 40 ms */
 #define SHARP_TRAILER_SPACE	(125  * SHARP_UNIT) /* 5 ms (even longer) */
 
@@ -168,8 +170,8 @@ static const struct ir_raw_timings_pd ir_sharp_timings = {
 	.header_pulse  = 0,
 	.header_space  = 0,
 	.bit_pulse     = SHARP_BIT_PULSE,
-	.bit_space[0]  = SHARP_BIT_0_PERIOD,
-	.bit_space[1]  = SHARP_BIT_1_PERIOD,
+	.bit_space[0]  = SHARP_BIT_0_SPACE,
+	.bit_space[1]  = SHARP_BIT_1_SPACE,
 	.trailer_pulse = SHARP_BIT_PULSE,
 	.trailer_space = SHARP_ECHO_SPACE,
 	.msb_first     = 1,

From da240b7bada2e1b4e30cf2c1f46f988e05023468 Mon Sep 17 00:00:00 2001
From: Vikash Garodia <quic_vgarodia@quicinc.com>
Date: Thu, 10 Aug 2023 07:55:04 +0530
Subject: [PATCH 0661/1043] media: venus: hfi_parser: Add check to keep the
 number of codecs within range

commit 0768a9dd809ef52440b5df7dce5a1c1c7e97abbd upstream.

Supported codec bitmask is populated from the payload from venus firmware.
There is a possible case when all the bits in the codec bitmask is set. In
such case, core cap for decoder is filled  and MAX_CODEC_NUM is utilized.
Now while filling the caps for encoder, it can lead to access the caps
array beyong 32 index. Hence leading to OOB write.
The fix counts the supported encoder and decoder. If the count is more than
max, then it skips accessing the caps.

Cc: stable@vger.kernel.org
Fixes: 1a73374a04e5 ("media: venus: hfi_parser: add common capability parser")
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/qcom/venus/hfi_parser.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/qcom/venus/hfi_parser.c b/drivers/media/platform/qcom/venus/hfi_parser.c
index 2dcf7eaea4ce..ca3841827b4e 100644
--- a/drivers/media/platform/qcom/venus/hfi_parser.c
+++ b/drivers/media/platform/qcom/venus/hfi_parser.c
@@ -19,6 +19,9 @@ static void init_codecs(struct venus_core *core)
 	struct venus_caps *caps = core->caps, *cap;
 	unsigned long bit;
 
+	if (hweight_long(core->dec_codecs) + hweight_long(core->enc_codecs) > MAX_CODEC_NUM)
+		return;
+
 	for_each_set_bit(bit, &core->dec_codecs, MAX_CODEC_NUM) {
 		cap = &caps[core->codecs_count++];
 		cap->codec = BIT(bit);

From bcee276a1e02468b73563b6db292458efe9f326b Mon Sep 17 00:00:00 2001
From: Vikash Garodia <quic_vgarodia@quicinc.com>
Date: Thu, 10 Aug 2023 07:55:02 +0530
Subject: [PATCH 0662/1043] media: venus: hfi: fix the check to handle session
 buffer requirement

commit b18e36dfd6c935da60a971310374f3dfec3c82e1 upstream.

Buffer requirement, for different buffer type, comes from video firmware.
While copying these requirements, there is an OOB possibility when the
payload from firmware is more than expected size. Fix the check to avoid
the OOB possibility.

Cc: stable@vger.kernel.org
Fixes: 09c2845e8fe4 ("[media] media: venus: hfi: add Host Firmware Interface (HFI)")
Reviewed-by: Nathan Hebert <nhebert@chromium.org>
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/qcom/venus/hfi_msgs.c b/drivers/media/platform/qcom/venus/hfi_msgs.c
index 06a1908ca225..1d9b743062f1 100644
--- a/drivers/media/platform/qcom/venus/hfi_msgs.c
+++ b/drivers/media/platform/qcom/venus/hfi_msgs.c
@@ -351,7 +351,7 @@ session_get_prop_buf_req(struct hfi_msg_session_property_info_pkt *pkt,
 		memcpy(&bufreq[idx], buf_req, sizeof(*bufreq));
 		idx++;
 
-		if (idx > HFI_BUFFER_TYPE_MAX)
+		if (idx >= HFI_BUFFER_TYPE_MAX)
 			return HFI_ERR_SESSION_INVALID_PARAMETER;
 
 		req_bytes -= sizeof(struct hfi_buffer_requirements);

From b51b20c018c6815e7d3bdb49f4a2ab465339c248 Mon Sep 17 00:00:00 2001
From: Vikash Garodia <quic_vgarodia@quicinc.com>
Date: Thu, 10 Aug 2023 07:55:03 +0530
Subject: [PATCH 0663/1043] media: venus: hfi: add checks to handle
 capabilities from firmware

commit 8d0b89398b7ebc52103e055bf36b60b045f5258f upstream.

The hfi parser, parses the capabilities received from venus firmware and
copies them to core capabilities. Consider below api, for example,
fill_caps - In this api, caps in core structure gets updated with the
number of capabilities received in firmware data payload. If the same api
is called multiple times, there is a possibility of copying beyond the max
allocated size in core caps.
Similar possibilities in fill_raw_fmts and fill_profile_level functions.

Cc: stable@vger.kernel.org
Fixes: 1a73374a04e5 ("media: venus: hfi_parser: add common capability parser")
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/qcom/venus/hfi_parser.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/media/platform/qcom/venus/hfi_parser.c b/drivers/media/platform/qcom/venus/hfi_parser.c
index ca3841827b4e..e13e555b3515 100644
--- a/drivers/media/platform/qcom/venus/hfi_parser.c
+++ b/drivers/media/platform/qcom/venus/hfi_parser.c
@@ -89,6 +89,9 @@ static void fill_profile_level(struct venus_caps *cap, const void *data,
 {
 	const struct hfi_profile_level *pl = data;
 
+	if (cap->num_pl + num >= HFI_MAX_PROFILE_COUNT)
+		return;
+
 	memcpy(&cap->pl[cap->num_pl], pl, num * sizeof(*pl));
 	cap->num_pl += num;
 }
@@ -114,6 +117,9 @@ fill_caps(struct venus_caps *cap, const void *data, unsigned int num)
 {
 	const struct hfi_capability *caps = data;
 
+	if (cap->num_caps + num >= MAX_CAP_ENTRIES)
+		return;
+
 	memcpy(&cap->caps[cap->num_caps], caps, num * sizeof(*caps));
 	cap->num_caps += num;
 }
@@ -140,6 +146,9 @@ static void fill_raw_fmts(struct venus_caps *cap, const void *fmts,
 {
 	const struct raw_formats *formats = fmts;
 
+	if (cap->num_fmts + num_fmts >= MAX_FMT_ENTRIES)
+		return;
+
 	memcpy(&cap->fmts[cap->num_fmts], formats, num_fmts * sizeof(*formats));
 	cap->num_fmts += num_fmts;
 }
@@ -162,6 +171,9 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data)
 		rawfmts[i].buftype = fmt->buffer_type;
 		i++;
 
+		if (i >= MAX_FMT_ENTRIES)
+			return;
+
 		if (pinfo->num_planes > MAX_PLANES)
 			break;
 

From 6875820f36bfb208d656f7ea6f457d8f78b9d8a3 Mon Sep 17 00:00:00 2001
From: Mahmoud Adam <mngyadam@amazon.com>
Date: Fri, 10 Nov 2023 19:21:04 +0100
Subject: [PATCH 0664/1043] nfsd: fix file memleak on client_opens_release

commit bc1b5acb40201a0746d68a7d7cfc141899937f4f upstream.

seq_release should be called to free the allocated seq_file

Cc: stable@vger.kernel.org # v5.3+
Signed-off-by: Mahmoud Adam <mngyadam@amazon.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Fixes: 78599c42ae3c ("nfsd4: add file to display list of client's opens")
Reviewed-by: NeilBrown <neilb@suse.de>
Tested-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4state.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index b045be7394a0..d402ca0b535f 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2647,7 +2647,7 @@ static int client_opens_release(struct inode *inode, struct file *file)
 
 	/* XXX: alternatively, we could get/drop in seq start/stop */
 	drop_client(clp);
-	return 0;
+	return seq_release(inode, file);
 }
 
 static const struct file_operations client_states_fops = {

From e2d2e266089d5dbddbd44040b65aa7e8007d7a02 Mon Sep 17 00:00:00 2001
From: Roman Gushchin <roman.gushchin@linux.dev>
Date: Tue, 7 Nov 2023 09:18:02 -0800
Subject: [PATCH 0665/1043] mm: kmem: drop __GFP_NOFAIL when allocating objcg
 vectors

commit 24948e3b7b12e0031a6edb4f49bbb9fb2ad1e4e9 upstream.

Objcg vectors attached to slab pages to store slab object ownership
information are allocated using gfp flags for the original slab
allocation.  Depending on slab page order and the size of slab objects,
objcg vector can take several pages.

If the original allocation was done with the __GFP_NOFAIL flag, it
triggered a warning in the page allocation code.  Indeed, order > 1 pages
should not been allocated with the __GFP_NOFAIL flag.

Fix this by simply dropping the __GFP_NOFAIL flag when allocating the
objcg vector.  It effectively allows to skip the accounting of a single
slab object under a heavy memory pressure.

An alternative would be to implement the mechanism to fallback to order-0
allocations for accounting metadata, which is also not perfect because it
will increase performance penalty and memory footprint of the kernel
memory accounting under memory pressure.

Link: https://lkml.kernel.org/r/ZUp8ZFGxwmCx4ZFr@P9FQF9L96D.corp.robot.car
Signed-off-by: Roman Gushchin <roman.gushchin@linux.dev>
Reported-by: Christoph Lameter <cl@linux.com>
Closes: https://lkml.kernel.org/r/6b42243e-f197-600a-5d22-56bd728a5ad8@gentwo.org
Acked-by: Shakeel Butt <shakeelb@google.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/memcontrol.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 751e3670d7b0..ddc8ed096dec 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2892,7 +2892,8 @@ static void commit_charge(struct page *page, struct mem_cgroup *memcg)
  * Moreover, it should not come from DMA buffer and is not readily
  * reclaimable. So those GFP bits should be masked off.
  */
-#define OBJCGS_CLEAR_MASK	(__GFP_DMA | __GFP_RECLAIMABLE | __GFP_ACCOUNT)
+#define OBJCGS_CLEAR_MASK	(__GFP_DMA | __GFP_RECLAIMABLE | \
+				 __GFP_ACCOUNT | __GFP_NOFAIL)
 
 int memcg_alloc_page_obj_cgroups(struct page *page, struct kmem_cache *s,
 				 gfp_t gfp)

From f6e014b5eb1d2410df93debc827ea8e9623b7868 Mon Sep 17 00:00:00 2001
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Date: Wed, 30 Aug 2023 16:16:09 +0100
Subject: [PATCH 0666/1043] media: qcom: camss: Fix vfe_get() error jump

commit 26bda3da00c3edef727a6acb00ed2eb4b22f8723 upstream.

Right now it is possible to do a vfe_get() with the internal reference
count at 1. If vfe_check_clock_rates() returns non-zero then we will
leave the reference count as-is and

run:
- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()

skip:
- camss_disable_clocks()

Subsequent vfe_put() calls will when the ref-count is non-zero
unconditionally run:

- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()
- camss_disable_clocks()

vfe_get() should not attempt to roll-back on error when the ref-count is
non-zero as the upper layers will still do their own vfe_put() operations.

vfe_put() will drop the reference count and do the necessary power
domain release, the cleanup jumps in vfe_get() should only be run when
the ref-count is zero.

[   50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ #80
[   50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023
[   50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   50.095802] pc : refcount_warn_saturate+0xf4/0x148
[   50.095804] lr : refcount_warn_saturate+0xf4/0x148
[   50.095805] sp : ffff80000c7cb8b0
[   50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000
[   50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000
[   50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005
[   50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff
[   50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320
[   50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520
[   50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954
[   50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8
[   50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000
[   50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040
[   50.095835] Call trace:
[   50.095836]  refcount_warn_saturate+0xf4/0x148
[   50.095838]  device_link_put_kref+0x84/0xc8
[   50.095843]  device_link_del+0x38/0x58
[   50.095846]  vfe_pm_domain_off+0x3c/0x50 [qcom_camss]
[   50.095860]  vfe_put+0x114/0x140 [qcom_camss]
[   50.095869]  csid_set_power+0x2c8/0x408 [qcom_camss]
[   50.095878]  pipeline_pm_power_one+0x164/0x170 [videodev]
[   50.095896]  pipeline_pm_power+0xc4/0x110 [videodev]
[   50.095909]  v4l2_pipeline_pm_use+0x5c/0xa0 [videodev]
[   50.095923]  v4l2_pipeline_pm_get+0x1c/0x30 [videodev]
[   50.095937]  video_open+0x7c/0x100 [qcom_camss]
[   50.095945]  v4l2_open+0x84/0x130 [videodev]
[   50.095960]  chrdev_open+0xc8/0x250
[   50.095964]  do_dentry_open+0x1bc/0x498
[   50.095966]  vfs_open+0x34/0x40
[   50.095968]  path_openat+0xb44/0xf20
[   50.095971]  do_filp_open+0xa4/0x160
[   50.095974]  do_sys_openat2+0xc8/0x188
[   50.095975]  __arm64_sys_openat+0x6c/0xb8
[   50.095977]  invoke_syscall+0x50/0x128
[   50.095982]  el0_svc_common.constprop.0+0x4c/0x100
[   50.095985]  do_el0_svc+0x40/0xa8
[   50.095988]  el0_svc+0x2c/0x88
[   50.095991]  el0t_64_sync_handler+0xf4/0x120
[   50.095994]  el0t_64_sync+0x190/0x198
[   50.095996] ---[ end trace 0000000000000000 ]---

Fixes: 779096916dae ("media: camss: vfe: Fix runtime PM imbalance on error")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/platform/qcom/camss/camss-vfe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
index b7d2293a5004..a9fee4a2e214 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe.c
@@ -1282,7 +1282,7 @@ static int vfe_get(struct vfe_device *vfe)
 	} else {
 		ret = vfe_check_clock_rates(vfe);
 		if (ret < 0)
-			goto error_pm_runtime_get;
+			goto error_pm_domain;
 	}
 	vfe->power_count++;
 

From 3a51aee542b0e5936c3e3de8878532fe13fe1337 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Tue, 21 Nov 2023 09:09:33 +0100
Subject: [PATCH 0667/1043] Revert "net: r8169: Disable multicast filter for
 RTL8168H and RTL8107E"

commit 6a26310273c323380da21eb23fcfd50e31140913 upstream.

This reverts commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df.

I couldn't reproduce the reported issue. What I did, based on a pcap
packet log provided by the reporter:
- Used same chip version (RTL8168h)
- Set MAC address to the one used on the reporters system
- Replayed the EAPOL unicast packet that, according to the reporter,
  was filtered out by the mc filter.
The packet was properly received.

Therefore the root cause of the reported issue seems to be somewhere
else. Disabling mc filtering completely for the most common chip
version is a quite big hammer. Therefore revert the change and wait
for further analysis results from the reporter.

Cc: stable@vger.kernel.org
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 6e0fe77d1019..ab6af1f1ad5b 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -2581,9 +2581,7 @@ static void rtl_set_rx_mode(struct net_device *dev)
 		rx_mode &= ~AcceptMulticast;
 	} else if (netdev_mc_count(dev) > MC_FILTER_LIMIT ||
 		   dev->flags & IFF_ALLMULTI ||
-		   tp->mac_version == RTL_GIGA_MAC_VER_35 ||
-		   tp->mac_version == RTL_GIGA_MAC_VER_46 ||
-		   tp->mac_version == RTL_GIGA_MAC_VER_48) {
+		   tp->mac_version == RTL_GIGA_MAC_VER_35) {
 		/* accept all multicasts */
 	} else if (netdev_mc_empty(dev)) {
 		rx_mode &= ~AcceptMulticast;

From c878db71edc06a5c43ebf2ceae264e85e68a7c3c Mon Sep 17 00:00:00 2001
From: Max Kellermann <max.kellermann@ionos.com>
Date: Tue, 19 Sep 2023 10:18:23 +0200
Subject: [PATCH 0668/1043] ext4: apply umask if ACL support is disabled

commit 484fd6c1de13b336806a967908a927cc0356e312 upstream.

The function ext4_init_acl() calls posix_acl_create() which is
responsible for applying the umask.  But without
CONFIG_EXT4_FS_POSIX_ACL, ext4_init_acl() is an empty inline function,
and nobody applies the umask.

This fixes a bug which causes the umask to be ignored with O_TMPFILE
on ext4:

 https://github.com/MusicPlayerDaemon/MPD/issues/558
 https://bugs.gentoo.org/show_bug.cgi?id=686142#c3
 https://bugzilla.kernel.org/show_bug.cgi?id=203625

Reviewed-by: "J. Bruce Fields" <bfields@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Link: https://lore.kernel.org/r/20230919081824.1096619-1-max.kellermann@ionos.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/acl.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ext4/acl.h b/fs/ext4/acl.h
index 9b63f5416a2f..7f3b25b3fa6d 100644
--- a/fs/ext4/acl.h
+++ b/fs/ext4/acl.h
@@ -67,6 +67,11 @@ extern int ext4_init_acl(handle_t *, struct inode *, struct inode *);
 static inline int
 ext4_init_acl(handle_t *handle, struct inode *inode, struct inode *dir)
 {
+	/* usually, the umask is applied by posix_acl_create(), but if
+	   ext4 ACL support is disabled at compile time, we need to do
+	   it here, because posix_acl_create() will never be called */
+	inode->i_mode &= ~current_umask();
+
 	return 0;
 }
 #endif  /* CONFIG_EXT4_FS_POSIX_ACL */

From d739a7e38944208d0b937604389c0e9b82a944db Mon Sep 17 00:00:00 2001
From: Kemeng Shi <shikemeng@huaweicloud.com>
Date: Sun, 27 Aug 2023 01:47:00 +0800
Subject: [PATCH 0669/1043] ext4: correct offset of gdb backup in non meta_bg
 group to update_backups

commit 31f13421c004a420c0e9d288859c9ea9259ea0cc upstream.

Commit 0aeaa2559d6d5 ("ext4: fix corruption when online resizing a 1K
bigalloc fs") found that primary superblock's offset in its group is
not equal to offset of backup superblock in its group when block size
is 1K and bigalloc is enabled. As group descriptor blocks are right
after superblock, we can't pass block number of gdb to update_backups
for the same reason.

The root casue of the issue above is that leading 1K padding block is
count as data block offset for primary block while backup block has no
padding block offset in its group.

Remove padding data block count to fix the issue for gdb backups.

For meta_bg case, update_backups treat blk_off as block number, do no
conversion in this case.

Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20230826174712.4059355-2-shikemeng@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/resize.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 51cebc1990eb..a71bec2afff7 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1543,6 +1543,8 @@ static int ext4_flex_group_add(struct super_block *sb,
 		int gdb_num_end = ((group + flex_gd->count - 1) /
 				   EXT4_DESC_PER_BLOCK(sb));
 		int meta_bg = ext4_has_feature_meta_bg(sb);
+		sector_t padding_blocks = meta_bg ? 0 : sbi->s_sbh->b_blocknr -
+					 ext4_group_first_block_no(sb, 0);
 		sector_t old_gdb = 0;
 
 		update_backups(sb, ext4_group_first_block_no(sb, 0),
@@ -1554,8 +1556,8 @@ static int ext4_flex_group_add(struct super_block *sb,
 						     gdb_num);
 			if (old_gdb == gdb_bh->b_blocknr)
 				continue;
-			update_backups(sb, gdb_bh->b_blocknr, gdb_bh->b_data,
-				       gdb_bh->b_size, meta_bg);
+			update_backups(sb, gdb_bh->b_blocknr - padding_blocks,
+				       gdb_bh->b_data, gdb_bh->b_size, meta_bg);
 			old_gdb = gdb_bh->b_blocknr;
 		}
 	}

From 3c1ad03a5ff20645ca67a84af8a078285fe20702 Mon Sep 17 00:00:00 2001
From: Kemeng Shi <shikemeng@huaweicloud.com>
Date: Sun, 27 Aug 2023 01:47:02 +0800
Subject: [PATCH 0670/1043] ext4: correct return value of ext4_convert_meta_bg

commit 48f1551592c54f7d8e2befc72a99ff4e47f7dca0 upstream.

Avoid to ignore error in "err".

Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Link: https://lore.kernel.org/r/20230826174712.4059355-4-shikemeng@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/resize.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index a71bec2afff7..2ff807666256 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -1918,9 +1918,7 @@ static int ext4_convert_meta_bg(struct super_block *sb, struct inode *inode)
 
 errout:
 	ret = ext4_journal_stop(handle);
-	if (!err)
-		err = ret;
-	return ret;
+	return err ? err : ret;
 
 invalid_resize_inode:
 	ext4_error(sb, "corrupted/inconsistent resize inode");

From 0932764fb54ac6a30c26000c329b1d1e3ba41039 Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Thu, 24 Aug 2023 17:26:04 +0800
Subject: [PATCH 0671/1043] ext4: correct the start block of counting reserved
 clusters

commit 40ea98396a3659062267d1fe5f99af4f7e4f05e3 upstream.

When big allocate feature is enabled, we need to count and update
reserved clusters before removing a delayed only extent_status entry.
{init|count|get}_rsvd() have already done this, but the start block
number of this counting isn't correct in the following case.

  lblk            end
   |               |
   v               v
          -------------------------
          |                       | orig_es
          -------------------------
                   ^              ^
      len1 is 0    |     len2     |

If the start block of the orig_es entry founded is bigger than lblk, we
passed lblk as start block to count_rsvd(), but the length is correct,
finally, the range to be counted is offset. This patch fix this by
passing the start blocks to 'orig_es->lblk + len1'.

Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20230824092619.1327976-2-yi.zhang@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/extents_status.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index fee54ab42bba..7806adcc41a7 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -1366,8 +1366,8 @@ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
 			}
 		}
 		if (count_reserved)
-			count_rsvd(inode, lblk, orig_es.es_len - len1 - len2,
-				   &orig_es, &rc);
+			count_rsvd(inode, orig_es.es_lblk + len1,
+				   orig_es.es_len - len1 - len2, &orig_es, &rc);
 		goto out_get_reserved;
 	}
 

From 7dc933b4b49879ba49df0bc9b99e7f1daf5b3a52 Mon Sep 17 00:00:00 2001
From: Kemeng Shi <shikemeng@huaweicloud.com>
Date: Sun, 27 Aug 2023 01:47:03 +0800
Subject: [PATCH 0672/1043] ext4: remove gdb backup copy for meta bg in
 setup_new_flex_group_blocks

commit 40dd7953f4d606c280074f10d23046b6812708ce upstream.

Wrong check of gdb backup in meta bg as following:
first_group is the first group of meta_bg which contains target group, so
target group is always >= first_group. We check if target group has gdb
backup by comparing first_group with [group + 1] and [group +
EXT4_DESC_PER_BLOCK(sb) - 1]. As group >= first_group, then [group + N] is
> first_group. So no copy of gdb backup in meta bg is done in
setup_new_flex_group_blocks.

No need to do gdb backup copy in meta bg from setup_new_flex_group_blocks
as we always copy updated gdb block to backups at end of
ext4_flex_group_add as following:

ext4_flex_group_add
  /* no gdb backup copy for meta bg any more */
  setup_new_flex_group_blocks

  /* update current group number */
  ext4_update_super
    sbi->s_groups_count += flex_gd->count;

  /*
   * if group in meta bg contains backup is added, the primary gdb block
   * of the meta bg will be copy to backup in new added group here.
   */
  for (; gdb_num <= gdb_num_end; gdb_num++)
    update_backups(...)

In summary, we can remove wrong gdb backup copy code in
setup_new_flex_group_blocks.

Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20230826174712.4059355-5-shikemeng@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/resize.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 2ff807666256..9b4199a1e039 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -554,13 +554,8 @@ static int setup_new_flex_group_blocks(struct super_block *sb,
 		if (meta_bg == 0 && !ext4_bg_has_super(sb, group))
 			goto handle_itb;
 
-		if (meta_bg == 1) {
-			ext4_group_t first_group;
-			first_group = ext4_meta_bg_first_group(sb, group);
-			if (first_group != group + 1 &&
-			    first_group != group + EXT4_DESC_PER_BLOCK(sb) - 1)
-				goto handle_itb;
-		}
+		if (meta_bg == 1)
+			goto handle_itb;
 
 		block = start + ext4_bg_has_super(sb, group);
 		/* Copy all of the GDT blocks into the backup in this group */

From dfa8e63ca527894061f877ac5176ba513a3974c2 Mon Sep 17 00:00:00 2001
From: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Date: Tue, 17 Oct 2023 16:01:35 +0200
Subject: [PATCH 0673/1043] drm/amd/pm: Handle non-terminated overdrive
 commands.

commit 08e9ebc75b5bcfec9d226f9e16bab2ab7b25a39a upstream.

The incoming strings might not be terminated by a newline
or a 0.

(found while testing a program that just wrote the string
 itself, causing a crash)

Cc: stable@vger.kernel.org
Fixes: e3933f26b657 ("drm/amd/pp: Add edit/commit/show OD clock/voltage support in sysfs")
Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/pm/amdgpu_pm.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
index d58a59cf4f85..fb1aaf959e7c 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
@@ -776,7 +776,7 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
 	if (amdgpu_in_reset(adev))
 		return -EPERM;
 
-	if (count > 127)
+	if (count > 127 || count == 0)
 		return -EINVAL;
 
 	if (*buf == 's')
@@ -792,7 +792,8 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
 	else
 		return -EINVAL;
 
-	memcpy(buf_cpy, buf, count+1);
+	memcpy(buf_cpy, buf, count);
+	buf_cpy[count] = 0;
 
 	tmp_str = buf_cpy;
 
@@ -807,6 +808,9 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
 			return -EINVAL;
 		parameter_size++;
 
+		if (!tmp_str)
+			break;
+
 		while (isspace(*tmp_str))
 			tmp_str++;
 	}

From e2bdd437886c4e412bd6f85b9788d26ca7943e5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
Date: Thu, 9 Nov 2023 10:12:39 +0100
Subject: [PATCH 0674/1043] drm/amdgpu: fix error handling in
 amdgpu_bo_list_get()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 12f76050d8d4d10dab96333656b821bd4620d103 upstream.

We should not leak the pointer where we couldn't grab the reference
on to the caller because it can be that the error handling still
tries to put the reference then.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
index 714178f1b6c6..9fb8012007e2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
@@ -178,6 +178,7 @@ int amdgpu_bo_list_get(struct amdgpu_fpriv *fpriv, int id,
 	}
 
 	rcu_read_unlock();
+	*result = NULL;
 	return -ENOENT;
 }
 

From aeeb1ad2dd4e2448b964f02af480a62aef1c6cf5 Mon Sep 17 00:00:00 2001
From: Lewis Huang <lewis.huang@amd.com>
Date: Thu, 19 Oct 2023 17:22:21 +0800
Subject: [PATCH 0675/1043] drm/amd/display: Change the DMCUB mailbox memory
 location from FB to inbox

commit 5911d02cac70d7fb52009fbd37423e63f8f6f9bc upstream.

[WHY]
Flush command sent to DMCUB spends more time for execution on
a dGPU than on an APU. This causes cursor lag when using high
refresh rate mouses.

[HOW]
1. Change the DMCUB mailbox memory location from FB to inbox.
2. Only change windows memory to inbox.

Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Acked-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Lewis Huang <lewis.huang@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 13 ++++----
 drivers/gpu/drm/amd/display/dmub/dmub_srv.h   | 22 ++++++++-----
 .../gpu/drm/amd/display/dmub/src/dmub_srv.c   | 32 ++++++++++++++-----
 3 files changed, 45 insertions(+), 22 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 652ddec18838..54d6b4128721 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1293,7 +1293,7 @@ static int dm_dmub_sw_init(struct amdgpu_device *adev)
 	struct dmub_srv_create_params create_params;
 	struct dmub_srv_region_params region_params;
 	struct dmub_srv_region_info region_info;
-	struct dmub_srv_fb_params fb_params;
+	struct dmub_srv_memory_params memory_params;
 	struct dmub_srv_fb_info *fb_info;
 	struct dmub_srv *dmub_srv;
 	const struct dmcub_firmware_header_v1_0 *hdr;
@@ -1389,6 +1389,7 @@ static int dm_dmub_sw_init(struct amdgpu_device *adev)
 		adev->dm.dmub_fw->data +
 		le32_to_cpu(hdr->header.ucode_array_offset_bytes) +
 		PSP_HEADER_BYTES;
+	region_params.is_mailbox_in_inbox = false;
 
 	status = dmub_srv_calc_region_info(dmub_srv, &region_params,
 					   &region_info);
@@ -1410,10 +1411,10 @@ static int dm_dmub_sw_init(struct amdgpu_device *adev)
 		return r;
 
 	/* Rebase the regions on the framebuffer address. */
-	memset(&fb_params, 0, sizeof(fb_params));
-	fb_params.cpu_addr = adev->dm.dmub_bo_cpu_addr;
-	fb_params.gpu_addr = adev->dm.dmub_bo_gpu_addr;
-	fb_params.region_info = &region_info;
+	memset(&memory_params, 0, sizeof(memory_params));
+	memory_params.cpu_fb_addr = adev->dm.dmub_bo_cpu_addr;
+	memory_params.gpu_fb_addr = adev->dm.dmub_bo_gpu_addr;
+	memory_params.region_info = &region_info;
 
 	adev->dm.dmub_fb_info =
 		kzalloc(sizeof(*adev->dm.dmub_fb_info), GFP_KERNEL);
@@ -1425,7 +1426,7 @@ static int dm_dmub_sw_init(struct amdgpu_device *adev)
 		return -ENOMEM;
 	}
 
-	status = dmub_srv_calc_fb_info(dmub_srv, &fb_params, fb_info);
+	status = dmub_srv_calc_mem_info(dmub_srv, &memory_params, fb_info);
 	if (status != DMUB_STATUS_OK) {
 		DRM_ERROR("Error calculating DMUB FB info: %d\n", status);
 		return -EINVAL;
diff --git a/drivers/gpu/drm/amd/display/dmub/dmub_srv.h b/drivers/gpu/drm/amd/display/dmub/dmub_srv.h
index 882b4e2816b5..733e41b81a4e 100644
--- a/drivers/gpu/drm/amd/display/dmub/dmub_srv.h
+++ b/drivers/gpu/drm/amd/display/dmub/dmub_srv.h
@@ -152,6 +152,7 @@ struct dmub_srv_region_params {
 	uint32_t vbios_size;
 	const uint8_t *fw_inst_const;
 	const uint8_t *fw_bss_data;
+	bool is_mailbox_in_inbox;
 };
 
 /**
@@ -171,20 +172,25 @@ struct dmub_srv_region_params {
  */
 struct dmub_srv_region_info {
 	uint32_t fb_size;
+	uint32_t inbox_size;
 	uint8_t num_regions;
 	struct dmub_region regions[DMUB_WINDOW_TOTAL];
 };
 
 /**
- * struct dmub_srv_fb_params - parameters used for driver fb setup
+ * struct dmub_srv_memory_params - parameters used for driver fb setup
  * @region_info: region info calculated by dmub service
- * @cpu_addr: base cpu address for the framebuffer
- * @gpu_addr: base gpu virtual address for the framebuffer
+ * @cpu_fb_addr: base cpu address for the framebuffer
+ * @cpu_inbox_addr: base cpu address for the gart
+ * @gpu_fb_addr: base gpu virtual address for the framebuffer
+ * @gpu_inbox_addr: base gpu virtual address for the gart
  */
-struct dmub_srv_fb_params {
+struct dmub_srv_memory_params {
 	const struct dmub_srv_region_info *region_info;
-	void *cpu_addr;
-	uint64_t gpu_addr;
+	void *cpu_fb_addr;
+	void *cpu_inbox_addr;
+	uint64_t gpu_fb_addr;
+	uint64_t gpu_inbox_addr;
 };
 
 /**
@@ -398,8 +404,8 @@ dmub_srv_calc_region_info(struct dmub_srv *dmub,
  *   DMUB_STATUS_OK - success
  *   DMUB_STATUS_INVALID - unspecified error
  */
-enum dmub_status dmub_srv_calc_fb_info(struct dmub_srv *dmub,
-				       const struct dmub_srv_fb_params *params,
+enum dmub_status dmub_srv_calc_mem_info(struct dmub_srv *dmub,
+				       const struct dmub_srv_memory_params *params,
 				       struct dmub_srv_fb_info *out);
 
 /**
diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
index 08da423b24a1..56c671d21dc8 100644
--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
@@ -250,7 +250,7 @@ dmub_srv_calc_region_info(struct dmub_srv *dmub,
 	uint32_t fw_state_size = DMUB_FW_STATE_SIZE;
 	uint32_t trace_buffer_size = DMUB_TRACE_BUFFER_SIZE;
 	uint32_t scratch_mem_size = DMUB_SCRATCH_MEM_SIZE;
-
+	uint32_t previous_top = 0;
 	if (!dmub->sw_init)
 		return DMUB_STATUS_INVALID;
 
@@ -275,8 +275,15 @@ dmub_srv_calc_region_info(struct dmub_srv *dmub,
 	bios->base = dmub_align(stack->top, 256);
 	bios->top = bios->base + params->vbios_size;
 
-	mail->base = dmub_align(bios->top, 256);
-	mail->top = mail->base + DMUB_MAILBOX_SIZE;
+	if (params->is_mailbox_in_inbox) {
+		mail->base = 0;
+		mail->top = mail->base + DMUB_MAILBOX_SIZE;
+		previous_top = bios->top;
+	} else {
+		mail->base = dmub_align(bios->top, 256);
+		mail->top = mail->base + DMUB_MAILBOX_SIZE;
+		previous_top = mail->top;
+	}
 
 	fw_info = dmub_get_fw_meta_info(params);
 
@@ -295,7 +302,7 @@ dmub_srv_calc_region_info(struct dmub_srv *dmub,
 			dmub->fw_version = fw_info->fw_version;
 	}
 
-	trace_buff->base = dmub_align(mail->top, 256);
+	trace_buff->base = dmub_align(previous_top, 256);
 	trace_buff->top = trace_buff->base + dmub_align(trace_buffer_size, 64);
 
 	fw_state->base = dmub_align(trace_buff->top, 256);
@@ -306,11 +313,14 @@ dmub_srv_calc_region_info(struct dmub_srv *dmub,
 
 	out->fb_size = dmub_align(scratch_mem->top, 4096);
 
+	if (params->is_mailbox_in_inbox)
+		out->inbox_size = dmub_align(mail->top, 4096);
+
 	return DMUB_STATUS_OK;
 }
 
-enum dmub_status dmub_srv_calc_fb_info(struct dmub_srv *dmub,
-				       const struct dmub_srv_fb_params *params,
+enum dmub_status dmub_srv_calc_mem_info(struct dmub_srv *dmub,
+				       const struct dmub_srv_memory_params *params,
 				       struct dmub_srv_fb_info *out)
 {
 	uint8_t *cpu_base;
@@ -325,8 +335,8 @@ enum dmub_status dmub_srv_calc_fb_info(struct dmub_srv *dmub,
 	if (params->region_info->num_regions != DMUB_NUM_WINDOWS)
 		return DMUB_STATUS_INVALID;
 
-	cpu_base = (uint8_t *)params->cpu_addr;
-	gpu_base = params->gpu_addr;
+	cpu_base = (uint8_t *)params->cpu_fb_addr;
+	gpu_base = params->gpu_fb_addr;
 
 	for (i = 0; i < DMUB_NUM_WINDOWS; ++i) {
 		const struct dmub_region *reg =
@@ -334,6 +344,12 @@ enum dmub_status dmub_srv_calc_fb_info(struct dmub_srv *dmub,
 
 		out->fb[i].cpu_addr = cpu_base + reg->base;
 		out->fb[i].gpu_addr = gpu_base + reg->base;
+
+		if (i == DMUB_WINDOW_4_MAILBOX && params->cpu_inbox_addr != 0) {
+			out->fb[i].cpu_addr = (uint8_t *)params->cpu_inbox_addr + reg->base;
+			out->fb[i].gpu_addr = params->gpu_inbox_addr + reg->base;
+		}
+
 		out->fb[i].size = reg->top - reg->base;
 	}
 

From c6e8af2a8a63e0957284c16003c501e4a058e8d9 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Sat, 21 Oct 2023 12:30:29 -0600
Subject: [PATCH 0676/1043] io_uring/fdinfo: lock SQ thread while retrieving
 thread cpu/pid

commit 7644b1a1c9a7ae8ab99175989bfc8676055edb46 upstream.

We could race with SQ thread exit, and if we do, we'll hit a NULL pointer
dereference when the thread is cleared. Grab the SQPOLL data lock before
attempting to get the task cpu and pid for fdinfo, this ensures we have a
stable view of it.

Cc: stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218032
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: He Gao <hegao@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/io_uring.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 800b5cc385af..1fe05e70cc79 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -10238,7 +10238,7 @@ static int io_uring_show_cred(struct seq_file *m, unsigned int id,
 
 static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 {
-	struct io_sq_data *sq = NULL;
+	int sq_pid = -1, sq_cpu = -1;
 	bool has_lock;
 	int i;
 
@@ -10251,13 +10251,19 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx *ctx, struct seq_file *m)
 	has_lock = mutex_trylock(&ctx->uring_lock);
 
 	if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL)) {
-		sq = ctx->sq_data;
-		if (!sq->thread)
-			sq = NULL;
+		struct io_sq_data *sq = ctx->sq_data;
+
+		if (mutex_trylock(&sq->lock)) {
+			if (sq->thread) {
+				sq_pid = task_pid_nr(sq->thread);
+				sq_cpu = task_cpu(sq->thread);
+			}
+			mutex_unlock(&sq->lock);
+		}
 	}
 
-	seq_printf(m, "SqThread:\t%d\n", sq ? task_pid_nr(sq->thread) : -1);
-	seq_printf(m, "SqThreadCpu:\t%d\n", sq ? task_cpu(sq->thread) : -1);
+	seq_printf(m, "SqThread:\t%d\n", sq_pid);
+	seq_printf(m, "SqThreadCpu:\t%d\n", sq_cpu);
 	seq_printf(m, "UserFiles:\t%u\n", ctx->nr_user_files);
 	for (i = 0; has_lock && i < ctx->nr_user_files; i++) {
 		struct file *f = io_file_from_index(ctx, i);

From a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Date: Tue, 31 Oct 2023 12:24:53 -0400
Subject: [PATCH 0677/1043] tracing: Have trace_event_file have ref counters

commit bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 upstream.

The following can crash the kernel:

 # cd /sys/kernel/tracing
 # echo 'p:sched schedule' > kprobe_events
 # exec 5>>events/kprobes/sched/enable
 # > kprobe_events
 # exec 5>&-

The above commands:

 1. Change directory to the tracefs directory
 2. Create a kprobe event (doesn't matter what one)
 3. Open bash file descriptor 5 on the enable file of the kprobe event
 4. Delete the kprobe event (removes the files too)
 5. Close the bash file descriptor 5

The above causes a crash!

 BUG: kernel NULL pointer dereference, address: 0000000000000028
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [#1] PREEMPT SMP PTI
 CPU: 6 PID: 877 Comm: bash Not tainted 6.5.0-rc4-test-00008-g2c6b6b1029d4-dirty #186
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
 RIP: 0010:tracing_release_file_tr+0xc/0x50

What happens here is that the kprobe event creates a trace_event_file
"file" descriptor that represents the file in tracefs to the event. It
maintains state of the event (is it enabled for the given instance?).
Opening the "enable" file gets a reference to the event "file" descriptor
via the open file descriptor. When the kprobe event is deleted, the file is
also deleted from the tracefs system which also frees the event "file"
descriptor.

But as the tracefs file is still opened by user space, it will not be
totally removed until the final dput() is called on it. But this is not
true with the event "file" descriptor that is already freed. If the user
does a write to or simply closes the file descriptor it will reference the
event "file" descriptor that was just freed, causing a use-after-free bug.

To solve this, add a ref count to the event "file" descriptor as well as a
new flag called "FREED". The "file" will not be freed until the last
reference is released. But the FREE flag will be set when the event is
removed to prevent any more modifications to that event from happening,
even if there's still a reference to the event "file" descriptor.

Link: https://lore.kernel.org/linux-trace-kernel/20231031000031.1e705592@gandalf.local.home/
Link: https://lore.kernel.org/linux-trace-kernel/20231031122453.7a48b923@gandalf.local.home

Cc: stable@vger.kernel.org
Cc: Mark Rutland <mark.rutland@arm.com>
Fixes: f5ca233e2e66d ("tracing: Increase trace array ref count on enable and filter files")
Reported-by: Beau Belgrave <beaub@linux.microsoft.com>
Tested-by: Beau Belgrave <beaub@linux.microsoft.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/trace_events.h       |  4 +++
 kernel/trace/trace.c               | 15 +++++++++++
 kernel/trace/trace.h               |  3 +++
 kernel/trace/trace_events.c        | 43 +++++++++++++++++++-----------
 kernel/trace/trace_events_filter.c |  3 +++
 5 files changed, 53 insertions(+), 15 deletions(-)

diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index 6fb20722f49b..f7ed0471d5a8 100644
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h
@@ -369,6 +369,7 @@ enum {
 	EVENT_FILE_FL_TRIGGER_COND_BIT,
 	EVENT_FILE_FL_PID_FILTER_BIT,
 	EVENT_FILE_FL_WAS_ENABLED_BIT,
+	EVENT_FILE_FL_FREED_BIT,
 };
 
 extern struct trace_event_file *trace_get_event_file(const char *instance,
@@ -507,6 +508,7 @@ extern int __kprobe_event_add_fields(struct dynevent_cmd *cmd, ...);
  *  TRIGGER_COND  - When set, one or more triggers has an associated filter
  *  PID_FILTER    - When set, the event is filtered based on pid
  *  WAS_ENABLED   - Set when enabled to know to clear trace on module removal
+ *  FREED         - File descriptor is freed, all fields should be considered invalid
  */
 enum {
 	EVENT_FILE_FL_ENABLED		= (1 << EVENT_FILE_FL_ENABLED_BIT),
@@ -520,6 +522,7 @@ enum {
 	EVENT_FILE_FL_TRIGGER_COND	= (1 << EVENT_FILE_FL_TRIGGER_COND_BIT),
 	EVENT_FILE_FL_PID_FILTER	= (1 << EVENT_FILE_FL_PID_FILTER_BIT),
 	EVENT_FILE_FL_WAS_ENABLED	= (1 << EVENT_FILE_FL_WAS_ENABLED_BIT),
+	EVENT_FILE_FL_FREED		= (1 << EVENT_FILE_FL_FREED_BIT),
 };
 
 struct trace_event_file {
@@ -548,6 +551,7 @@ struct trace_event_file {
 	 * caching and such. Which is mostly OK ;-)
 	 */
 	unsigned long		flags;
+	atomic_t		ref;	/* ref count for opened files */
 	atomic_t		sm_ref;	/* soft-mode reference counter */
 	atomic_t		tm_ref;	/* trigger-mode reference counter */
 };
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 196eec0423ff..89a8bb8e24df 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4572,6 +4572,20 @@ int tracing_open_file_tr(struct inode *inode, struct file *filp)
 	if (ret)
 		return ret;
 
+	mutex_lock(&event_mutex);
+
+	/* Fail if the file is marked for removal */
+	if (file->flags & EVENT_FILE_FL_FREED) {
+		trace_array_put(file->tr);
+		ret = -ENODEV;
+	} else {
+		event_file_get(file);
+	}
+
+	mutex_unlock(&event_mutex);
+	if (ret)
+		return ret;
+
 	filp->private_data = inode->i_private;
 
 	return 0;
@@ -4582,6 +4596,7 @@ int tracing_release_file_tr(struct inode *inode, struct file *filp)
 	struct trace_event_file *file = inode->i_private;
 
 	trace_array_put(file->tr);
+	event_file_put(file);
 
 	return 0;
 }
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 7fa00b83dfa4..7c90872f2435 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -1784,6 +1784,9 @@ extern int register_event_command(struct event_command *cmd);
 extern int unregister_event_command(struct event_command *cmd);
 extern int register_trigger_hist_enable_disable_cmds(void);
 
+extern void event_file_get(struct trace_event_file *file);
+extern void event_file_put(struct trace_event_file *file);
+
 /**
  * struct event_trigger_ops - callbacks for trace event triggers
  *
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index c7f0a02442e5..4b5a8d7275be 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -746,26 +746,38 @@ static void remove_subsystem(struct trace_subsystem_dir *dir)
 	}
 }
 
+void event_file_get(struct trace_event_file *file)
+{
+	atomic_inc(&file->ref);
+}
+
+void event_file_put(struct trace_event_file *file)
+{
+	if (WARN_ON_ONCE(!atomic_read(&file->ref))) {
+		if (file->flags & EVENT_FILE_FL_FREED)
+			kmem_cache_free(file_cachep, file);
+		return;
+	}
+
+	if (atomic_dec_and_test(&file->ref)) {
+		/* Count should only go to zero when it is freed */
+		if (WARN_ON_ONCE(!(file->flags & EVENT_FILE_FL_FREED)))
+			return;
+		kmem_cache_free(file_cachep, file);
+	}
+}
+
 static void remove_event_file_dir(struct trace_event_file *file)
 {
 	struct dentry *dir = file->dir;
-	struct dentry *child;
 
-	if (dir) {
-		spin_lock(&dir->d_lock);	/* probably unneeded */
-		list_for_each_entry(child, &dir->d_subdirs, d_child) {
-			if (d_really_is_positive(child))	/* probably unneeded */
-				d_inode(child)->i_private = NULL;
-		}
-		spin_unlock(&dir->d_lock);
-
-		tracefs_remove(dir);
-	}
+	tracefs_remove(dir);
 
 	list_del(&file->list);
 	remove_subsystem(file->system);
 	free_event_filter(file->filter);
-	kmem_cache_free(file_cachep, file);
+	file->flags |= EVENT_FILE_FL_FREED;
+	event_file_put(file);
 }
 
 /*
@@ -1138,7 +1150,7 @@ event_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
 		flags = file->flags;
 	mutex_unlock(&event_mutex);
 
-	if (!file)
+	if (!file || flags & EVENT_FILE_FL_FREED)
 		return -ENODEV;
 
 	if (flags & EVENT_FILE_FL_ENABLED &&
@@ -1176,7 +1188,7 @@ event_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
 		ret = -ENODEV;
 		mutex_lock(&event_mutex);
 		file = event_file_data(filp);
-		if (likely(file))
+		if (likely(file && !(file->flags & EVENT_FILE_FL_FREED)))
 			ret = ftrace_event_enable_disable(file, val);
 		mutex_unlock(&event_mutex);
 		break;
@@ -1445,7 +1457,7 @@ event_filter_read(struct file *filp, char __user *ubuf, size_t cnt,
 
 	mutex_lock(&event_mutex);
 	file = event_file_data(filp);
-	if (file)
+	if (file && !(file->flags & EVENT_FILE_FL_FREED))
 		print_event_filter(file, s);
 	mutex_unlock(&event_mutex);
 
@@ -2482,6 +2494,7 @@ trace_create_new_event(struct trace_event_call *call,
 	atomic_set(&file->tm_ref, 0);
 	INIT_LIST_HEAD(&file->triggers);
 	list_add(&file->list, &tr->events);
+	event_file_get(file);
 
 	return file;
 }
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index a255ffbe342f..c1db5b62d811 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1893,6 +1893,9 @@ int apply_event_filter(struct trace_event_file *file, char *filter_string)
 	struct event_filter *filter = NULL;
 	int err;
 
+	if (file->flags & EVENT_FILE_FL_FREED)
+		return -ENODEV;
+
 	if (!strcmp(strstrip(filter_string), "0")) {
 		filter_disable(file);
 		filter = event_filter(file);

From 7d1d3f1134254f5fae926f79fc0d94e3d7e2e452 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 21 Nov 2023 13:13:30 +0100
Subject: [PATCH 0678/1043] netfilter: nftables: update table flags from the
 commit phase

commit 0ce7cf4127f14078ca598ba9700d813178a59409 upstream.

Do not update table flags from the preparation phase. Store the flags
update into the transaction, then update the flags from the commit
phase.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/netfilter/nf_tables.h |  9 ++++++---
 net/netfilter/nf_tables_api.c     | 31 ++++++++++++++++---------------
 2 files changed, 22 insertions(+), 18 deletions(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 1d59a109417d..41c9a3644bbb 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1479,13 +1479,16 @@ struct nft_trans_chain {
 
 struct nft_trans_table {
 	bool				update;
-	bool				enable;
+	u8				state;
+	u32				flags;
 };
 
 #define nft_trans_table_update(trans)	\
 	(((struct nft_trans_table *)trans->data)->update)
-#define nft_trans_table_enable(trans)	\
-	(((struct nft_trans_table *)trans->data)->enable)
+#define nft_trans_table_state(trans)	\
+	(((struct nft_trans_table *)trans->data)->state)
+#define nft_trans_table_flags(trans)	\
+	(((struct nft_trans_table *)trans->data)->flags)
 
 struct nft_trans_elem {
 	struct nft_set			*set;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 78b268bd7f01..76495299e240 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1074,6 +1074,12 @@ static void nf_tables_table_disable(struct net *net, struct nft_table *table)
 	nft_table_disable(net, table, 0);
 }
 
+enum {
+	NFT_TABLE_STATE_UNCHANGED	= 0,
+	NFT_TABLE_STATE_DORMANT,
+	NFT_TABLE_STATE_WAKEUP
+};
+
 static int nf_tables_updtable(struct nft_ctx *ctx)
 {
 	struct nft_trans *trans;
@@ -1097,19 +1103,17 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
 
 	if ((flags & NFT_TABLE_F_DORMANT) &&
 	    !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
-		nft_trans_table_enable(trans) = false;
+		nft_trans_table_state(trans) = NFT_TABLE_STATE_DORMANT;
 	} else if (!(flags & NFT_TABLE_F_DORMANT) &&
 		   ctx->table->flags & NFT_TABLE_F_DORMANT) {
-		ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
 		ret = nf_tables_table_enable(ctx->net, ctx->table);
 		if (ret >= 0)
-			nft_trans_table_enable(trans) = true;
-		else
-			ctx->table->flags |= NFT_TABLE_F_DORMANT;
+			nft_trans_table_state(trans) = NFT_TABLE_STATE_WAKEUP;
 	}
 	if (ret < 0)
 		goto err;
 
+	nft_trans_table_flags(trans) = flags;
 	nft_trans_table_update(trans) = true;
 	nft_trans_commit_list_add_tail(ctx->net, trans);
 	return 0;
@@ -8475,11 +8479,10 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
 		switch (trans->msg_type) {
 		case NFT_MSG_NEWTABLE:
 			if (nft_trans_table_update(trans)) {
-				if (!nft_trans_table_enable(trans)) {
-					nf_tables_table_disable(net,
-								trans->ctx.table);
-					trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
-				}
+				if (nft_trans_table_state(trans) == NFT_TABLE_STATE_DORMANT)
+					nf_tables_table_disable(net, trans->ctx.table);
+
+				trans->ctx.table->flags = nft_trans_table_flags(trans);
 			} else {
 				nft_clear(net, trans->ctx.table);
 			}
@@ -8728,11 +8731,9 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
 		switch (trans->msg_type) {
 		case NFT_MSG_NEWTABLE:
 			if (nft_trans_table_update(trans)) {
-				if (nft_trans_table_enable(trans)) {
-					nf_tables_table_disable(net,
-								trans->ctx.table);
-					trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
-				}
+				if (nft_trans_table_state(trans) == NFT_TABLE_STATE_WAKEUP)
+					nf_tables_table_disable(net, trans->ctx.table);
+
 				nft_trans_destroy(trans);
 			} else {
 				list_del_rcu(&trans->ctx.table->list);

From d9c4da8cb74e8ee6e58a064a3573aa37acf6c935 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 21 Nov 2023 13:13:31 +0100
Subject: [PATCH 0679/1043] netfilter: nf_tables: fix table flag updates

commit 179d9ba5559a756f4322583388b3213fe4e391b0 upstream.

The dormant flag need to be updated from the preparation phase,
otherwise, two consecutive requests to dorm a table in the same batch
might try to remove the same hooks twice, resulting in the following
warning:

 hook not found, pf 3 num 0
 WARNING: CPU: 0 PID: 334 at net/netfilter/core.c:480 __nf_unregister_net_hook+0x1eb/0x610 net/netfilter/core.c:480
 Modules linked in:
 CPU: 0 PID: 334 Comm: kworker/u4:5 Not tainted 5.12.0-syzkaller #0
 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 Workqueue: netns cleanup_net
 RIP: 0010:__nf_unregister_net_hook+0x1eb/0x610 net/netfilter/core.c:480

This patch is a partial revert of 0ce7cf4127f1 ("netfilter: nftables:
update table flags from the commit phase") to restore the previous
behaviour.

However, there is still another problem: A batch containing a series of
dorm-wakeup-dorm table and vice-versa also trigger the warning above
since hook unregistration happens from the preparation phase, while hook
registration occurs from the commit phase.

To fix this problem, this patch adds two internal flags to annotate the
original dormant flag status which are __NFT_TABLE_F_WAS_DORMANT and
__NFT_TABLE_F_WAS_AWAKEN, to restore it from the abort path.

The __NFT_TABLE_F_UPDATE bitmask allows to handle the dormant flag update
with one single transaction.

Reported-by: syzbot+7ad5cd1615f2d89c6e7e@syzkaller.appspotmail.com
Fixes: 0ce7cf4127f1 ("netfilter: nftables: update table flags from the commit phase")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/netfilter/nf_tables.h        |  6 ---
 include/uapi/linux/netfilter/nf_tables.h |  1 +
 net/netfilter/nf_tables_api.c            | 61 ++++++++++++++++--------
 3 files changed, 42 insertions(+), 26 deletions(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 41c9a3644bbb..2237657514e1 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1479,16 +1479,10 @@ struct nft_trans_chain {
 
 struct nft_trans_table {
 	bool				update;
-	u8				state;
-	u32				flags;
 };
 
 #define nft_trans_table_update(trans)	\
 	(((struct nft_trans_table *)trans->data)->update)
-#define nft_trans_table_state(trans)	\
-	(((struct nft_trans_table *)trans->data)->state)
-#define nft_trans_table_flags(trans)	\
-	(((struct nft_trans_table *)trans->data)->flags)
 
 struct nft_trans_elem {
 	struct nft_set			*set;
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 1d8dd58f83a5..163b7ec577e7 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -165,6 +165,7 @@ enum nft_hook_attributes {
 enum nft_table_flags {
 	NFT_TABLE_F_DORMANT	= 0x1,
 };
+#define NFT_TABLE_F_MASK       (NFT_TABLE_F_DORMANT)
 
 /**
  * enum nft_table_attributes - nf_tables table netlink attributes
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 76495299e240..3bda40a826b9 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -863,7 +863,8 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
 		goto nla_put_failure;
 
 	if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
-	    nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
+	    nla_put_be32(skb, NFTA_TABLE_FLAGS,
+			 htonl(table->flags & NFT_TABLE_F_MASK)) ||
 	    nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
 	    nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
 			 NFTA_TABLE_PAD))
@@ -1071,20 +1072,22 @@ static int nf_tables_table_enable(struct net *net, struct nft_table *table)
 
 static void nf_tables_table_disable(struct net *net, struct nft_table *table)
 {
+	table->flags &= ~NFT_TABLE_F_DORMANT;
 	nft_table_disable(net, table, 0);
+	table->flags |= NFT_TABLE_F_DORMANT;
 }
 
-enum {
-	NFT_TABLE_STATE_UNCHANGED	= 0,
-	NFT_TABLE_STATE_DORMANT,
-	NFT_TABLE_STATE_WAKEUP
-};
+#define __NFT_TABLE_F_INTERNAL		(NFT_TABLE_F_MASK + 1)
+#define __NFT_TABLE_F_WAS_DORMANT	(__NFT_TABLE_F_INTERNAL << 0)
+#define __NFT_TABLE_F_WAS_AWAKEN	(__NFT_TABLE_F_INTERNAL << 1)
+#define __NFT_TABLE_F_UPDATE		(__NFT_TABLE_F_WAS_DORMANT | \
+					 __NFT_TABLE_F_WAS_AWAKEN)
 
 static int nf_tables_updtable(struct nft_ctx *ctx)
 {
 	struct nft_trans *trans;
 	u32 flags;
-	int ret = 0;
+	int ret;
 
 	if (!ctx->nla[NFTA_TABLE_FLAGS])
 		return 0;
@@ -1103,21 +1106,27 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
 
 	if ((flags & NFT_TABLE_F_DORMANT) &&
 	    !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
-		nft_trans_table_state(trans) = NFT_TABLE_STATE_DORMANT;
+		ctx->table->flags |= NFT_TABLE_F_DORMANT;
+		if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE))
+			ctx->table->flags |= __NFT_TABLE_F_WAS_AWAKEN;
 	} else if (!(flags & NFT_TABLE_F_DORMANT) &&
 		   ctx->table->flags & NFT_TABLE_F_DORMANT) {
-		ret = nf_tables_table_enable(ctx->net, ctx->table);
-		if (ret >= 0)
-			nft_trans_table_state(trans) = NFT_TABLE_STATE_WAKEUP;
-	}
-	if (ret < 0)
-		goto err;
+		ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
+		if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) {
+			ret = nf_tables_table_enable(ctx->net, ctx->table);
+			if (ret < 0)
+				goto err_register_hooks;
+
+			ctx->table->flags |= __NFT_TABLE_F_WAS_DORMANT;
+		}
+	}
 
-	nft_trans_table_flags(trans) = flags;
 	nft_trans_table_update(trans) = true;
 	nft_trans_commit_list_add_tail(ctx->net, trans);
+
 	return 0;
-err:
+
+err_register_hooks:
 	nft_trans_destroy(trans);
 	return ret;
 }
@@ -8479,10 +8488,14 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
 		switch (trans->msg_type) {
 		case NFT_MSG_NEWTABLE:
 			if (nft_trans_table_update(trans)) {
-				if (nft_trans_table_state(trans) == NFT_TABLE_STATE_DORMANT)
+				if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) {
+					nft_trans_destroy(trans);
+					break;
+				}
+				if (trans->ctx.table->flags & NFT_TABLE_F_DORMANT)
 					nf_tables_table_disable(net, trans->ctx.table);
 
-				trans->ctx.table->flags = nft_trans_table_flags(trans);
+				trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE;
 			} else {
 				nft_clear(net, trans->ctx.table);
 			}
@@ -8731,9 +8744,17 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
 		switch (trans->msg_type) {
 		case NFT_MSG_NEWTABLE:
 			if (nft_trans_table_update(trans)) {
-				if (nft_trans_table_state(trans) == NFT_TABLE_STATE_WAKEUP)
+				if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) {
+					nft_trans_destroy(trans);
+					break;
+				}
+				if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_DORMANT) {
 					nf_tables_table_disable(net, trans->ctx.table);
-
+					trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
+				} else if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_AWAKEN) {
+					trans->ctx.table->flags &= ~NFT_TABLE_F_DORMANT;
+				}
+				trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE;
 				nft_trans_destroy(trans);
 			} else {
 				list_del_rcu(&trans->ctx.table->list);

From 7ce66afcaaf6df7dc905493cf4a8ad7868815d16 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 21 Nov 2023 13:13:32 +0100
Subject: [PATCH 0680/1043] netfilter: nf_tables: disable toggling dormant
 table state more than once

commit c9bd26513b3a11b3adb3c2ed8a31a01a87173ff1 upstream.

nft -f -<<EOF
add table ip t
add table ip t { flags dormant; }
add chain ip t c { type filter hook input priority 0; }
add table ip t
EOF

Triggers a splat from nf core on next table delete because we lose
track of right hook register state:

WARNING: CPU: 2 PID: 1597 at net/netfilter/core.c:501 __nf_unregister_net_hook
RIP: 0010:__nf_unregister_net_hook+0x41b/0x570
 nf_unregister_net_hook+0xb4/0xf0
 __nf_tables_unregister_hook+0x160/0x1d0
[..]

The above should have table in *active* state, but in fact no
hooks were registered.

Reject on/off/on games rather than attempting to fix this.

Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates")
Reported-by: "Lee, Cherie-Anne" <cherie.lee@starlabs.sg>
Cc: Bing-Jhong Billy Jheng <billy@starlabs.sg>
Cc: info@starlabs.sg
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nf_tables_api.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 3bda40a826b9..dfb347f8d3ad 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1099,6 +1099,10 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
 	if (flags == ctx->table->flags)
 		return 0;
 
+	/* No dormant off/on/off/on games in single transaction */
+	if (ctx->table->flags & __NFT_TABLE_F_UPDATE)
+		return -EINVAL;
+
 	trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
 				sizeof(struct nft_trans_table));
 	if (trans == NULL)

From 610057f4f6e01dd7289f6144059ca6fd87ea3488 Mon Sep 17 00:00:00 2001
From: Mike Tipton <mdtipton@codeaurora.org>
Date: Fri, 23 Jun 2023 14:50:42 +0200
Subject: [PATCH 0681/1043] interconnect: qcom: Add support for mask-based BCMs

commit d8630f050d3fd2079f8617dd6c00c6509109c755 upstream.

Some BCMs aren't directly associated with the data path (i.e. ACV) and
therefore don't communicate using BW. Instead, they are simply
enabled/disabled with a simple bit mask. Add support for these.

Origin commit retrieved from:
https://git.codelinaro.org/clo/la/kernel/msm-5.15/-/commit/2d1573e0206998151b342e6b52a4c0f7234d7e36

Signed-off-by: Mike Tipton <mdtipton@codeaurora.org>
[narmstrong: removed copyright change from original commit]
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230619-topic-sm8550-upstream-interconnect-mask-vote-v2-1-709474b151cc@linaro.org
Fixes: fafc114a468e ("interconnect: qcom: Add SM8450 interconnect provider driver")
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/interconnect/qcom/bcm-voter.c | 5 +++++
 drivers/interconnect/qcom/icc-rpmh.h  | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/drivers/interconnect/qcom/bcm-voter.c b/drivers/interconnect/qcom/bcm-voter.c
index 3c0809095a31..320e418cf753 100644
--- a/drivers/interconnect/qcom/bcm-voter.c
+++ b/drivers/interconnect/qcom/bcm-voter.c
@@ -90,6 +90,11 @@ static void bcm_aggregate(struct qcom_icc_bcm *bcm)
 
 		temp = agg_peak[bucket] * bcm->vote_scale;
 		bcm->vote_y[bucket] = bcm_div(temp, bcm->aux_data.unit);
+
+		if (bcm->enable_mask && (bcm->vote_x[bucket] || bcm->vote_y[bucket])) {
+			bcm->vote_x[bucket] = 0;
+			bcm->vote_y[bucket] = bcm->enable_mask;
+		}
 	}
 
 	if (bcm->keepalive && bcm->vote_x[QCOM_ICC_BUCKET_AMC] == 0 &&
diff --git a/drivers/interconnect/qcom/icc-rpmh.h b/drivers/interconnect/qcom/icc-rpmh.h
index e5f61ab989e7..029a350c2884 100644
--- a/drivers/interconnect/qcom/icc-rpmh.h
+++ b/drivers/interconnect/qcom/icc-rpmh.h
@@ -81,6 +81,7 @@ struct qcom_icc_node {
  * @vote_x: aggregated threshold values, represents sum_bw when @type is bw bcm
  * @vote_y: aggregated threshold values, represents peak_bw when @type is bw bcm
  * @vote_scale: scaling factor for vote_x and vote_y
+ * @enable_mask: optional mask to send as vote instead of vote_x/vote_y
  * @dirty: flag used to indicate whether the bcm needs to be committed
  * @keepalive: flag used to indicate whether a keepalive is required
  * @aux_data: auxiliary data used when calculating threshold values and
@@ -97,6 +98,7 @@ struct qcom_icc_bcm {
 	u64 vote_x[QCOM_ICC_NUM_BUCKETS];
 	u64 vote_y[QCOM_ICC_NUM_BUCKETS];
 	u64 vote_scale;
+	u32 enable_mask;
 	bool dirty;
 	bool keepalive;
 	struct bcm_db aux_data;

From 479e8b8925415420b31e2aa65f9b0db3dea2adf4 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 28 Nov 2023 16:55:02 +0000
Subject: [PATCH 0682/1043] Linux 5.10.202

Link: https://lore.kernel.org/r/20231124171947.127438872@linuxfoundation.org
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Link: https://lore.kernel.org/r/20231125163116.998338186@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://lore.kernel.org/r/20231126154335.643804657@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 7ef22771de76..ed0e42c99c90 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 201
+SUBLEVEL = 202
 EXTRAVERSION =
 NAME = Dare mighty things
 

From ddf606c1f533ec6f15c1dc8115cc3f7d742a6b90 Mon Sep 17 00:00:00 2001
From: Yongqin Liu <yongqin.liu@linaro.org>
Date: Fri, 1 Dec 2023 12:37:19 +0800
Subject: [PATCH 0683/1043] ANDROID: GKI: db845c: Update symbols list and ABI
 on rpmsg_register_device_override

android12-5.10-lts is broken on Dragonboard 845c because of
recently added symbol, rpmsg_register_device_override.

So updated the symbols list by running:
  "BUILD_CONFIG=common/build.config.db845c \
    KMI_SYMBOL_LIST_ADD_ONLY=1 build/build_abi.sh -s"

And the abi_gki_aarch64 ABI by running:
  "BUILD_CONFIG=common/build.config.gki.aarch64 \
    ABI_DEFINITION=abi_gki_aarch64.xml KMI_SYMBOL_LIST_ADD_ONLY=1 \
     build/build_abi.sh --update --print-report"

========================================================
Leaf changes summary: 1 artifact changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

1 Added function:

  [A] 'function int rpmsg_register_device_override(rpmsg_device*, const char*)'

========================================================

Bug: 313495196

Change-Id: I3a3504b6d2061bfce0abe9801e2ecb210c337b9f
Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
---
 android/abi_gki_aarch64.xml    | 6049 ++++++++++++++++----------------
 android/abi_gki_aarch64_db845c |   33 +-
 2 files changed, 3054 insertions(+), 3028 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 9d5dc942ce59..d57e8af2e648 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -4719,6 +4719,7 @@
       <elf-symbol name='rpmsg_get_signals' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe380b6c5'/>
       <elf-symbol name='rpmsg_poll' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6c9d8e4'/>
       <elf-symbol name='rpmsg_register_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3705e77b'/>
+      <elf-symbol name='rpmsg_register_device_override' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x313bcc10'/>
       <elf-symbol name='rpmsg_send' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf38ca6cf'/>
       <elf-symbol name='rpmsg_sendto' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x40b44740'/>
       <elf-symbol name='rpmsg_set_signals' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7c5444f2'/>
@@ -8331,7 +8332,7 @@
           <var-decl name='no_retry' type-id='b50a4934' visibility='default' filepath='include/drm/ttm/ttm_bo_driver.h' line='352' column='1'/>
         </data-member>
       </class-decl>
-      <enum-decl name='dwc3_ep0_state' filepath='drivers/usb/dwc3/core.h' line='782' column='1' id='045093ad'>
+      <enum-decl name='dwc3_ep0_state' filepath='drivers/usb/dwc3/core.h' line='779' column='1' id='045093ad'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='EP0_UNCONNECTED' value='0'/>
         <enumerator name='EP0_SETUP_PHASE' value='1'/>
@@ -8684,45 +8685,45 @@
         <parameter type-id='b59d7dce'/>
         <return type-id='79a0948f'/>
       </function-type>
-      <class-decl name='dquot_operations' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='325' column='1' id='0584e65d'>
+      <class-decl name='dquot_operations' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='327' column='1' id='0584e65d'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='write_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='326' column='1'/>
+          <var-decl name='write_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='328' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='alloc_dquot' type-id='324070f9' visibility='default' filepath='include/linux/quota.h' line='327' column='1'/>
+          <var-decl name='alloc_dquot' type-id='324070f9' visibility='default' filepath='include/linux/quota.h' line='329' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='destroy_dquot' type-id='dbc22931' visibility='default' filepath='include/linux/quota.h' line='328' column='1'/>
+          <var-decl name='destroy_dquot' type-id='dbc22931' visibility='default' filepath='include/linux/quota.h' line='330' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='acquire_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='329' column='1'/>
+          <var-decl name='acquire_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='331' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='release_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='330' column='1'/>
+          <var-decl name='release_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='332' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='mark_dirty' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='331' column='1'/>
+          <var-decl name='mark_dirty' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='333' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='write_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='332' column='1'/>
+          <var-decl name='write_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='334' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='get_reserved_space' type-id='15543b10' visibility='default' filepath='include/linux/quota.h' line='335' column='1'/>
+          <var-decl name='get_reserved_space' type-id='15543b10' visibility='default' filepath='include/linux/quota.h' line='337' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='get_projid' type-id='c23b3cbc' visibility='default' filepath='include/linux/quota.h' line='336' column='1'/>
+          <var-decl name='get_projid' type-id='c23b3cbc' visibility='default' filepath='include/linux/quota.h' line='338' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='get_inode_usage' type-id='6b7539fb' visibility='default' filepath='include/linux/quota.h' line='338' column='1'/>
+          <var-decl name='get_inode_usage' type-id='6b7539fb' visibility='default' filepath='include/linux/quota.h' line='340' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='get_next_id' type-id='70b08f83' visibility='default' filepath='include/linux/quota.h' line='340' column='1'/>
+          <var-decl name='get_next_id' type-id='70b08f83' visibility='default' filepath='include/linux/quota.h' line='342' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='342' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='344' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='343' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='345' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='51d715c2' size-in-bits='64' id='0588e2f0'/>
@@ -9259,33 +9260,33 @@
           <var-decl name='inquiry_string' type-id='aa60f212' visibility='default' filepath='drivers/usb/gadget/function/storage_common.h' line='122' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='platform_driver' size-in-bits='1920' is-struct='yes' visibility='default' filepath='include/linux/platform_device.h' line='206' column='1' id='0742eda5'>
+      <class-decl name='platform_driver' size-in-bits='1920' is-struct='yes' visibility='default' filepath='include/linux/platform_device.h' line='210' column='1' id='0742eda5'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='probe' type-id='e05ae2cd' visibility='default' filepath='include/linux/platform_device.h' line='207' column='1'/>
+          <var-decl name='probe' type-id='e05ae2cd' visibility='default' filepath='include/linux/platform_device.h' line='211' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='remove' type-id='e05ae2cd' visibility='default' filepath='include/linux/platform_device.h' line='208' column='1'/>
+          <var-decl name='remove' type-id='e05ae2cd' visibility='default' filepath='include/linux/platform_device.h' line='212' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='shutdown' type-id='2cbd236c' visibility='default' filepath='include/linux/platform_device.h' line='209' column='1'/>
+          <var-decl name='shutdown' type-id='2cbd236c' visibility='default' filepath='include/linux/platform_device.h' line='213' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='suspend' type-id='5a92c1cc' visibility='default' filepath='include/linux/platform_device.h' line='210' column='1'/>
+          <var-decl name='suspend' type-id='5a92c1cc' visibility='default' filepath='include/linux/platform_device.h' line='214' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='resume' type-id='e05ae2cd' visibility='default' filepath='include/linux/platform_device.h' line='211' column='1'/>
+          <var-decl name='resume' type-id='e05ae2cd' visibility='default' filepath='include/linux/platform_device.h' line='215' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='driver' type-id='fe007c02' visibility='default' filepath='include/linux/platform_device.h' line='212' column='1'/>
+          <var-decl name='driver' type-id='fe007c02' visibility='default' filepath='include/linux/platform_device.h' line='216' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1728'>
-          <var-decl name='id_table' type-id='79c2f4f8' visibility='default' filepath='include/linux/platform_device.h' line='213' column='1'/>
+          <var-decl name='id_table' type-id='79c2f4f8' visibility='default' filepath='include/linux/platform_device.h' line='217' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1792'>
-          <var-decl name='prevent_deferred_probe' type-id='b50a4934' visibility='default' filepath='include/linux/platform_device.h' line='214' column='1'/>
+          <var-decl name='prevent_deferred_probe' type-id='b50a4934' visibility='default' filepath='include/linux/platform_device.h' line='218' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1856'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/platform_device.h' line='216' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/platform_device.h' line='220' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='9423c42a' size-in-bits='64' id='07445d6c'/>
@@ -9708,12 +9709,12 @@
           <var-decl name='sched_priority' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/sched/types.h' line='8' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='__anonymous_struct__' size-in-bits='64' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4449' column='1' id='0898701c'>
+      <class-decl name='__anonymous_struct__' size-in-bits='64' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4451' column='1' id='0898701c'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='netns_ino' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4450' column='1'/>
+          <var-decl name='netns_ino' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4452' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='attach_type' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4451' column='1'/>
+          <var-decl name='attach_type' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4453' column='1'/>
         </data-member>
       </class-decl>
       <typedef-decl name='__be64' type-id='d3130597' filepath='include/uapi/linux/types.h' line='34' column='1' id='0899c7ad'/>
@@ -11046,9 +11047,9 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='e5a91b7f' size-in-bits='64' id='0adcd7cb'/>
-      <union-decl name='__anonymous_union__' size-in-bits='32' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4443' column='1' id='0add2232'>
+      <union-decl name='__anonymous_union__' size-in-bits='32' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4445' column='1' id='0add2232'>
         <data-member access='public'>
-          <var-decl name='map' type-id='88b40ff4' visibility='default' filepath='include/uapi/linux/bpf.h' line='4446' column='1'/>
+          <var-decl name='map' type-id='88b40ff4' visibility='default' filepath='include/uapi/linux/bpf.h' line='4448' column='1'/>
         </data-member>
       </union-decl>
       <function-type size-in-bits='64' id='0ae96173'>
@@ -11555,12 +11556,12 @@
       </class-decl>
       <pointer-type-def type-id='51dff603' size-in-bits='64' id='0c90828b'/>
       <pointer-type-def type-id='36051b76' size-in-bits='64' id='0c90c619'/>
-      <class-decl name='cfg80211_ssid' size-in-bits='264' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2122' column='1' id='0c960fcf'>
+      <class-decl name='cfg80211_ssid' size-in-bits='264' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2125' column='1' id='0c960fcf'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='ssid' type-id='e3dc4fdb' visibility='default' filepath='include/net/cfg80211.h' line='2123' column='1'/>
+          <var-decl name='ssid' type-id='e3dc4fdb' visibility='default' filepath='include/net/cfg80211.h' line='2126' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='ssid_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='2124' column='1'/>
+          <var-decl name='ssid_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='2127' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='__anonymous_struct__' size-in-bits='192' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/futex.h' line='33' column='1' id='0c98ac07'>
@@ -12771,24 +12772,24 @@
       </function-type>
       <pointer-type-def type-id='bd4974e4' size-in-bits='64' id='100f2106'/>
       <qualified-type-def type-id='78e57306' const='yes' id='10117043'/>
-      <class-decl name='trace_subsystem_dir' size-in-bits='384' is-struct='yes' visibility='default' filepath='kernel/trace/trace.h' line='1440' column='1' id='10143522'>
+      <class-decl name='trace_subsystem_dir' size-in-bits='384' is-struct='yes' visibility='default' filepath='kernel/trace/trace.h' line='1443' column='1' id='10143522'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='kernel/trace/trace.h' line='1441' column='1'/>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='kernel/trace/trace.h' line='1444' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='subsystem' type-id='841939f3' visibility='default' filepath='kernel/trace/trace.h' line='1442' column='1'/>
+          <var-decl name='subsystem' type-id='841939f3' visibility='default' filepath='kernel/trace/trace.h' line='1445' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='tr' type-id='898c1076' visibility='default' filepath='kernel/trace/trace.h' line='1443' column='1'/>
+          <var-decl name='tr' type-id='898c1076' visibility='default' filepath='kernel/trace/trace.h' line='1446' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='entry' type-id='27675065' visibility='default' filepath='kernel/trace/trace.h' line='1444' column='1'/>
+          <var-decl name='entry' type-id='27675065' visibility='default' filepath='kernel/trace/trace.h' line='1447' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='ref_count' type-id='95e97e5e' visibility='default' filepath='kernel/trace/trace.h' line='1445' column='1'/>
+          <var-decl name='ref_count' type-id='95e97e5e' visibility='default' filepath='kernel/trace/trace.h' line='1448' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='352'>
-          <var-decl name='nr_events' type-id='95e97e5e' visibility='default' filepath='kernel/trace/trace.h' line='1446' column='1'/>
+          <var-decl name='nr_events' type-id='95e97e5e' visibility='default' filepath='kernel/trace/trace.h' line='1449' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='v4l2_frmsize_discrete' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/uapi/linux/videodev2.h' line='814' column='1' id='10186cf6'>
@@ -12832,48 +12833,48 @@
       <qualified-type-def type-id='852a961e' const='yes' id='1027eea9'/>
       <pointer-type-def type-id='c01f4982' size-in-bits='64' id='102ab76c'/>
       <pointer-type-def type-id='6e03f2ca' size-in-bits='64' id='103756a0'/>
-      <class-decl name='extcon_cable' size-in-bits='1664' is-struct='yes' visibility='default' filepath='drivers/extcon/extcon.c' line='200' column='1' id='103b4c26'>
+      <class-decl name='extcon_cable' size-in-bits='1664' is-struct='yes' visibility='default' filepath='drivers/extcon/extcon.c' line='208' column='1' id='103b4c26'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='edev' type-id='c0d6fada' visibility='default' filepath='drivers/extcon/extcon.c' line='201' column='1'/>
+          <var-decl name='edev' type-id='c0d6fada' visibility='default' filepath='drivers/extcon/extcon.c' line='209' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='cable_index' type-id='95e97e5e' visibility='default' filepath='drivers/extcon/extcon.c' line='202' column='1'/>
+          <var-decl name='cable_index' type-id='95e97e5e' visibility='default' filepath='drivers/extcon/extcon.c' line='210' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='attr_g' type-id='e4af473b' visibility='default' filepath='drivers/extcon/extcon.c' line='204' column='1'/>
+          <var-decl name='attr_g' type-id='e4af473b' visibility='default' filepath='drivers/extcon/extcon.c' line='212' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='attr_name' type-id='dbf3947c' visibility='default' filepath='drivers/extcon/extcon.c' line='205' column='1'/>
+          <var-decl name='attr_name' type-id='dbf3947c' visibility='default' filepath='drivers/extcon/extcon.c' line='213' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='attr_state' type-id='dbf3947c' visibility='default' filepath='drivers/extcon/extcon.c' line='206' column='1'/>
+          <var-decl name='attr_state' type-id='dbf3947c' visibility='default' filepath='drivers/extcon/extcon.c' line='214' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='attrs' type-id='ff62a050' visibility='default' filepath='drivers/extcon/extcon.c' line='208' column='1'/>
+          <var-decl name='attrs' type-id='ff62a050' visibility='default' filepath='drivers/extcon/extcon.c' line='216' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='usb_propval' type-id='475a4bff' visibility='default' filepath='drivers/extcon/extcon.c' line='210' column='1'/>
+          <var-decl name='usb_propval' type-id='475a4bff' visibility='default' filepath='drivers/extcon/extcon.c' line='218' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1248'>
-          <var-decl name='chg_propval' type-id='0b5e6ab9' visibility='default' filepath='drivers/extcon/extcon.c' line='211' column='1'/>
+          <var-decl name='chg_propval' type-id='0b5e6ab9' visibility='default' filepath='drivers/extcon/extcon.c' line='219' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='jack_propval' type-id='0b5e6ab9' visibility='default' filepath='drivers/extcon/extcon.c' line='212' column='1'/>
+          <var-decl name='jack_propval' type-id='0b5e6ab9' visibility='default' filepath='drivers/extcon/extcon.c' line='220' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1312'>
-          <var-decl name='disp_propval' type-id='0b5c2c22' visibility='default' filepath='drivers/extcon/extcon.c' line='213' column='1'/>
+          <var-decl name='disp_propval' type-id='0b5c2c22' visibility='default' filepath='drivers/extcon/extcon.c' line='221' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='usb_bits' type-id='f066dd3c' visibility='default' filepath='drivers/extcon/extcon.c' line='215' column='1'/>
+          <var-decl name='usb_bits' type-id='f066dd3c' visibility='default' filepath='drivers/extcon/extcon.c' line='223' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='chg_bits' type-id='f066dd3c' visibility='default' filepath='drivers/extcon/extcon.c' line='216' column='1'/>
+          <var-decl name='chg_bits' type-id='f066dd3c' visibility='default' filepath='drivers/extcon/extcon.c' line='224' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='jack_bits' type-id='f066dd3c' visibility='default' filepath='drivers/extcon/extcon.c' line='217' column='1'/>
+          <var-decl name='jack_bits' type-id='f066dd3c' visibility='default' filepath='drivers/extcon/extcon.c' line='225' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='disp_bits' type-id='f066dd3c' visibility='default' filepath='drivers/extcon/extcon.c' line='218' column='1'/>
+          <var-decl name='disp_bits' type-id='f066dd3c' visibility='default' filepath='drivers/extcon/extcon.c' line='226' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='103ba521'>
@@ -13238,30 +13239,30 @@
       </function-type>
       <pointer-type-def type-id='14617e76' size-in-bits='64' id='117460b0'/>
       <pointer-type-def type-id='cf396435' size-in-bits='64' id='11777d05'/>
-      <class-decl name='ieee80211_iface_combination' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4453' column='1' id='1179f27e'>
+      <class-decl name='ieee80211_iface_combination' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4456' column='1' id='1179f27e'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='limits' type-id='2fde6795' visibility='default' filepath='include/net/cfg80211.h' line='4458' column='1'/>
+          <var-decl name='limits' type-id='2fde6795' visibility='default' filepath='include/net/cfg80211.h' line='4461' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='num_different_channels' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4464' column='1'/>
+          <var-decl name='num_different_channels' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4467' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='max_interfaces' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4470' column='1'/>
+          <var-decl name='max_interfaces' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4473' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='112'>
-          <var-decl name='n_limits' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4476' column='1'/>
+          <var-decl name='n_limits' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4479' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='120'>
-          <var-decl name='beacon_int_infra_match' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='4483' column='1'/>
+          <var-decl name='beacon_int_infra_match' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='4486' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='radar_detect_widths' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4489' column='1'/>
+          <var-decl name='radar_detect_widths' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4492' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='136'>
-          <var-decl name='radar_detect_regions' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4495' column='1'/>
+          <var-decl name='radar_detect_regions' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4498' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='beacon_int_min_gcd' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4508' column='1'/>
+          <var-decl name='beacon_int_min_gcd' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4511' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='ad974870' size-in-bits='64' id='117abbea'/>
@@ -13945,93 +13946,93 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='4d855bce' size-in-bits='64' id='12a060a4'/>
-      <class-decl name='cfg80211_sched_scan_request' size-in-bits='1600' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2340' column='1' id='12a2e88f'>
+      <class-decl name='cfg80211_sched_scan_request' size-in-bits='1600' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2343' column='1' id='12a2e88f'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='reqid' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='2341' column='1'/>
+          <var-decl name='reqid' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='2344' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='ssids' type-id='a1fa7fb7' visibility='default' filepath='include/net/cfg80211.h' line='2342' column='1'/>
+          <var-decl name='ssids' type-id='a1fa7fb7' visibility='default' filepath='include/net/cfg80211.h' line='2345' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='n_ssids' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2343' column='1'/>
+          <var-decl name='n_ssids' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2346' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='n_channels' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2344' column='1'/>
+          <var-decl name='n_channels' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2347' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='scan_width' type-id='95d46034' visibility='default' filepath='include/net/cfg80211.h' line='2345' column='1'/>
+          <var-decl name='scan_width' type-id='95d46034' visibility='default' filepath='include/net/cfg80211.h' line='2348' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='ie' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2346' column='1'/>
+          <var-decl name='ie' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2349' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='ie_len' type-id='b59d7dce' visibility='default' filepath='include/net/cfg80211.h' line='2347' column='1'/>
+          <var-decl name='ie_len' type-id='b59d7dce' visibility='default' filepath='include/net/cfg80211.h' line='2350' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2348' column='1'/>
+          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2351' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='match_sets' type-id='ea00c914' visibility='default' filepath='include/net/cfg80211.h' line='2349' column='1'/>
+          <var-decl name='match_sets' type-id='ea00c914' visibility='default' filepath='include/net/cfg80211.h' line='2352' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='n_match_sets' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2350' column='1'/>
+          <var-decl name='n_match_sets' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2353' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='544'>
-          <var-decl name='min_rssi_thold' type-id='a7832498' visibility='default' filepath='include/net/cfg80211.h' line='2351' column='1'/>
+          <var-decl name='min_rssi_thold' type-id='a7832498' visibility='default' filepath='include/net/cfg80211.h' line='2354' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='delay' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2352' column='1'/>
+          <var-decl name='delay' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2355' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='scan_plans' type-id='302e9391' visibility='default' filepath='include/net/cfg80211.h' line='2353' column='1'/>
+          <var-decl name='scan_plans' type-id='302e9391' visibility='default' filepath='include/net/cfg80211.h' line='2356' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='n_scan_plans' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2354' column='1'/>
+          <var-decl name='n_scan_plans' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2357' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='736'>
-          <var-decl name='mac_addr' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='2356' column='1'/>
+          <var-decl name='mac_addr' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='2359' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='784'>
-          <var-decl name='mac_addr_mask' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='2357' column='1'/>
+          <var-decl name='mac_addr_mask' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='2360' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='relative_rssi_set' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='2359' column='1'/>
+          <var-decl name='relative_rssi_set' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='2362' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='840'>
-          <var-decl name='relative_rssi' type-id='fdbf7a0f' visibility='default' filepath='include/net/cfg80211.h' line='2360' column='1'/>
+          <var-decl name='relative_rssi' type-id='fdbf7a0f' visibility='default' filepath='include/net/cfg80211.h' line='2363' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='864'>
-          <var-decl name='rssi_adjust' type-id='5da08e25' visibility='default' filepath='include/net/cfg80211.h' line='2361' column='1'/>
+          <var-decl name='rssi_adjust' type-id='5da08e25' visibility='default' filepath='include/net/cfg80211.h' line='2364' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='wiphy' type-id='666fb412' visibility='default' filepath='include/net/cfg80211.h' line='2364' column='1'/>
+          <var-decl name='wiphy' type-id='666fb412' visibility='default' filepath='include/net/cfg80211.h' line='2367' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='dev' type-id='68a2d05b' visibility='default' filepath='include/net/cfg80211.h' line='2365' column='1'/>
+          <var-decl name='dev' type-id='68a2d05b' visibility='default' filepath='include/net/cfg80211.h' line='2368' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='scan_start' type-id='7359adad' visibility='default' filepath='include/net/cfg80211.h' line='2366' column='1'/>
+          <var-decl name='scan_start' type-id='7359adad' visibility='default' filepath='include/net/cfg80211.h' line='2369' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='report_results' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='2367' column='1'/>
+          <var-decl name='report_results' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='2370' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='callback_head' type-id='e3d8ce29' visibility='default' filepath='include/net/cfg80211.h' line='2368' column='1'/>
+          <var-decl name='callback_head' type-id='e3d8ce29' visibility='default' filepath='include/net/cfg80211.h' line='2371' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='owner_nlportid' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2369' column='1'/>
+          <var-decl name='owner_nlportid' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2372' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1376'>
-          <var-decl name='nl_owner_dead' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='2370' column='1'/>
+          <var-decl name='nl_owner_dead' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='2373' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='2371' column='1'/>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='2374' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='2373' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='2376' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='channels' type-id='14cad687' visibility='default' filepath='include/net/cfg80211.h' line='2376' column='1'/>
+          <var-decl name='channels' type-id='14cad687' visibility='default' filepath='include/net/cfg80211.h' line='2379' column='1'/>
         </data-member>
       </class-decl>
       <typedef-decl name='pgd_t' type-id='59473550' filepath='arch/arm64/include/asm/pgtable-types.h' line='39' column='1' id='12aa8ce4'/>
@@ -15933,51 +15934,51 @@
         <enumerator name='HK_FLAG_KTHREAD' value='256'/>
       </enum-decl>
       <pointer-type-def type-id='5f0ccb86' size-in-bits='64' id='174bf37c'/>
-      <class-decl name='cfg80211_wowlan_tcp' size-in-bits='768' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2974' column='1' id='1752769a'>
+      <class-decl name='cfg80211_wowlan_tcp' size-in-bits='768' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2977' column='1' id='1752769a'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='sock' type-id='13103032' visibility='default' filepath='include/net/cfg80211.h' line='2975' column='1'/>
+          <var-decl name='sock' type-id='13103032' visibility='default' filepath='include/net/cfg80211.h' line='2978' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='src' type-id='78a133c2' visibility='default' filepath='include/net/cfg80211.h' line='2976' column='1'/>
+          <var-decl name='src' type-id='78a133c2' visibility='default' filepath='include/net/cfg80211.h' line='2979' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='dst' type-id='78a133c2' visibility='default' filepath='include/net/cfg80211.h' line='2976' column='1'/>
+          <var-decl name='dst' type-id='78a133c2' visibility='default' filepath='include/net/cfg80211.h' line='2979' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='src_port' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='2977' column='1'/>
+          <var-decl name='src_port' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='2980' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='144'>
-          <var-decl name='dst_port' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='2977' column='1'/>
+          <var-decl name='dst_port' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='2980' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='dst_mac' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='2978' column='1'/>
+          <var-decl name='dst_mac' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='2981' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='payload_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2979' column='1'/>
+          <var-decl name='payload_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2982' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='payload' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2980' column='1'/>
+          <var-decl name='payload' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2983' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='payload_seq' type-id='d5a1b375' visibility='default' filepath='include/net/cfg80211.h' line='2981' column='1'/>
+          <var-decl name='payload_seq' type-id='d5a1b375' visibility='default' filepath='include/net/cfg80211.h' line='2984' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='416'>
-          <var-decl name='data_interval' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2982' column='1'/>
+          <var-decl name='data_interval' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2985' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='wake_len' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2983' column='1'/>
+          <var-decl name='wake_len' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2986' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='wake_data' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2984' column='1'/>
+          <var-decl name='wake_data' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2987' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='wake_mask' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2984' column='1'/>
+          <var-decl name='wake_mask' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2987' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='tokens_size' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2985' column='1'/>
+          <var-decl name='tokens_size' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2988' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='672'>
-          <var-decl name='payload_tok' type-id='2868c21b' visibility='default' filepath='include/net/cfg80211.h' line='2987' column='1'/>
+          <var-decl name='payload_tok' type-id='2868c21b' visibility='default' filepath='include/net/cfg80211.h' line='2990' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/perf_event.h' line='153' column='1' id='17578164'>
@@ -17298,12 +17299,12 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='e4664ea7' size-in-bits='64' id='1a0da7f7'/>
-      <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4436' column='1' id='1a126b50'>
+      <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4438' column='1' id='1a126b50'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='cgroup_id' type-id='d3130597' visibility='default' filepath='include/uapi/linux/bpf.h' line='4437' column='1'/>
+          <var-decl name='cgroup_id' type-id='d3130597' visibility='default' filepath='include/uapi/linux/bpf.h' line='4439' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='attach_type' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4438' column='1'/>
+          <var-decl name='attach_type' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4440' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='1a13292a'>
@@ -17487,18 +17488,18 @@
       </enum-decl>
       <pointer-type-def type-id='83ac033d' size-in-bits='64' id='1ac0dc69'/>
       <qualified-type-def type-id='1f03d7fe' const='yes' id='1ac45f89'/>
-      <class-decl name='__anonymous_struct__' size-in-bits='192' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/sysctl.h' line='135' column='1' id='1acab550'>
+      <class-decl name='__anonymous_struct__' size-in-bits='192' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/sysctl.h' line='143' column='1' id='1acab550'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='ctl_table' type-id='631dc3c1' visibility='default' filepath='include/linux/sysctl.h' line='136' column='1'/>
+          <var-decl name='ctl_table' type-id='631dc3c1' visibility='default' filepath='include/linux/sysctl.h' line='144' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='used' type-id='95e97e5e' visibility='default' filepath='include/linux/sysctl.h' line='137' column='1'/>
+          <var-decl name='used' type-id='95e97e5e' visibility='default' filepath='include/linux/sysctl.h' line='145' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='count' type-id='95e97e5e' visibility='default' filepath='include/linux/sysctl.h' line='138' column='1'/>
+          <var-decl name='count' type-id='95e97e5e' visibility='default' filepath='include/linux/sysctl.h' line='146' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='nreg' type-id='95e97e5e' visibility='default' filepath='include/linux/sysctl.h' line='139' column='1'/>
+          <var-decl name='nreg' type-id='95e97e5e' visibility='default' filepath='include/linux/sysctl.h' line='147' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='__anonymous_struct__' size-in-bits='448' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='517' column='1' id='1ad3cea4'>
@@ -19046,42 +19047,42 @@
           <var-decl name='packets' type-id='d3130597' visibility='default' filepath='include/net/gen_stats.h' line='13' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='xhci_vendor_ops' size-in-bits='768' is-struct='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='2243' column='1' id='1faef6b3'>
+      <class-decl name='xhci_vendor_ops' size-in-bits='768' is-struct='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='2245' column='1' id='1faef6b3'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='vendor_init' type-id='e2d5afe3' visibility='default' filepath='drivers/usb/host/xhci.h' line='2244' column='1'/>
+          <var-decl name='vendor_init' type-id='e2d5afe3' visibility='default' filepath='drivers/usb/host/xhci.h' line='2246' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='vendor_cleanup' type-id='465f7e18' visibility='default' filepath='drivers/usb/host/xhci.h' line='2245' column='1'/>
+          <var-decl name='vendor_cleanup' type-id='465f7e18' visibility='default' filepath='drivers/usb/host/xhci.h' line='2247' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='is_usb_offload_enabled' type-id='65f4b33e' visibility='default' filepath='drivers/usb/host/xhci.h' line='2246' column='1'/>
+          <var-decl name='is_usb_offload_enabled' type-id='65f4b33e' visibility='default' filepath='drivers/usb/host/xhci.h' line='2248' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='queue_irq_work' type-id='19cf2a10' visibility='default' filepath='drivers/usb/host/xhci.h' line='2249' column='1'/>
+          <var-decl name='queue_irq_work' type-id='19cf2a10' visibility='default' filepath='drivers/usb/host/xhci.h' line='2251' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='alloc_dcbaa' type-id='ffedaefa' visibility='default' filepath='drivers/usb/host/xhci.h' line='2251' column='1'/>
+          <var-decl name='alloc_dcbaa' type-id='ffedaefa' visibility='default' filepath='drivers/usb/host/xhci.h' line='2253' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='free_dcbaa' type-id='465f7e18' visibility='default' filepath='drivers/usb/host/xhci.h' line='2253' column='1'/>
+          <var-decl name='free_dcbaa' type-id='465f7e18' visibility='default' filepath='drivers/usb/host/xhci.h' line='2255' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='alloc_transfer_ring' type-id='7a09678a' visibility='default' filepath='drivers/usb/host/xhci.h' line='2255' column='1'/>
+          <var-decl name='alloc_transfer_ring' type-id='7a09678a' visibility='default' filepath='drivers/usb/host/xhci.h' line='2257' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='free_transfer_ring' type-id='60881d05' visibility='default' filepath='drivers/usb/host/xhci.h' line='2258' column='1'/>
+          <var-decl name='free_transfer_ring' type-id='60881d05' visibility='default' filepath='drivers/usb/host/xhci.h' line='2260' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='sync_dev_ctx' type-id='2916d511' visibility='default' filepath='drivers/usb/host/xhci.h' line='2260' column='1'/>
+          <var-decl name='sync_dev_ctx' type-id='2916d511' visibility='default' filepath='drivers/usb/host/xhci.h' line='2262' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='usb_offload_skip_urb' type-id='75f1eb36' visibility='default' filepath='drivers/usb/host/xhci.h' line='2261' column='1'/>
+          <var-decl name='usb_offload_skip_urb' type-id='75f1eb36' visibility='default' filepath='drivers/usb/host/xhci.h' line='2263' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='alloc_container_ctx' type-id='6d5e21be' visibility='default' filepath='drivers/usb/host/xhci.h' line='2262' column='1'/>
+          <var-decl name='alloc_container_ctx' type-id='6d5e21be' visibility='default' filepath='drivers/usb/host/xhci.h' line='2264' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='free_container_ctx' type-id='a23db496' visibility='default' filepath='drivers/usb/host/xhci.h' line='2264' column='1'/>
+          <var-decl name='free_container_ctx' type-id='a23db496' visibility='default' filepath='drivers/usb/host/xhci.h' line='2266' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='__anonymous_struct__' size-in-bits='160' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='568' column='1' id='1fb21a42'>
@@ -19205,12 +19206,12 @@
       </function-type>
       <pointer-type-def type-id='3490ee41' size-in-bits='64' id='200ffa89'/>
       <pointer-type-def type-id='a721b4ab' size-in-bits='64' id='20174b1f'/>
-      <union-decl name='__anonymous_union__' size-in-bits='192' is-anonymous='yes' visibility='default' filepath='include/linux/sysctl.h' line='134' column='1' id='201d54e5'>
+      <union-decl name='__anonymous_union__' size-in-bits='192' is-anonymous='yes' visibility='default' filepath='include/linux/sysctl.h' line='142' column='1' id='201d54e5'>
         <data-member access='public'>
-          <var-decl name='' type-id='1acab550' visibility='default' filepath='include/linux/sysctl.h' line='135' column='1'/>
+          <var-decl name='' type-id='1acab550' visibility='default' filepath='include/linux/sysctl.h' line='143' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/linux/sysctl.h' line='141' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/linux/sysctl.h' line='149' column='1'/>
         </data-member>
       </union-decl>
       <function-type size-in-bits='64' id='201ffa8e'>
@@ -19635,12 +19636,12 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='26527266' size-in-bits='64' id='211c185c'/>
-      <class-decl name='ieee80211_txrx_stypes' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4511' column='1' id='21301fc9'>
+      <class-decl name='ieee80211_txrx_stypes' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4514' column='1' id='21301fc9'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='tx' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4512' column='1'/>
+          <var-decl name='tx' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4515' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='16'>
-          <var-decl name='rx' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4512' column='1'/>
+          <var-decl name='rx' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4515' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='2962e9d2' size-in-bits='64' id='213608e4'/>
@@ -20258,24 +20259,24 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='a447f0ac' size-in-bits='64' id='233fa2f2'/>
-      <class-decl name='rpmsg_driver' size-in-bits='1728' is-struct='yes' visibility='default' filepath='include/linux/rpmsg.h' line='111' column='1' id='234005a7'>
+      <class-decl name='rpmsg_driver' size-in-bits='1728' is-struct='yes' visibility='default' filepath='include/linux/rpmsg.h' line='113' column='1' id='234005a7'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='drv' type-id='fe007c02' visibility='default' filepath='include/linux/rpmsg.h' line='112' column='1'/>
+          <var-decl name='drv' type-id='fe007c02' visibility='default' filepath='include/linux/rpmsg.h' line='114' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='id_table' type-id='ac456034' visibility='default' filepath='include/linux/rpmsg.h' line='113' column='1'/>
+          <var-decl name='id_table' type-id='ac456034' visibility='default' filepath='include/linux/rpmsg.h' line='115' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='probe' type-id='f853ae55' visibility='default' filepath='include/linux/rpmsg.h' line='114' column='1'/>
+          <var-decl name='probe' type-id='f853ae55' visibility='default' filepath='include/linux/rpmsg.h' line='116' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='remove' type-id='170fcd6a' visibility='default' filepath='include/linux/rpmsg.h' line='115' column='1'/>
+          <var-decl name='remove' type-id='170fcd6a' visibility='default' filepath='include/linux/rpmsg.h' line='117' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='callback' type-id='2a873f51' visibility='default' filepath='include/linux/rpmsg.h' line='116' column='1'/>
+          <var-decl name='callback' type-id='2a873f51' visibility='default' filepath='include/linux/rpmsg.h' line='118' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='signals' type-id='3362870f' visibility='default' filepath='include/linux/rpmsg.h' line='117' column='1'/>
+          <var-decl name='signals' type-id='3362870f' visibility='default' filepath='include/linux/rpmsg.h' line='119' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='23420063'>
@@ -22084,9 +22085,9 @@
       <array-type-def dimensions='1' type-id='8f048e17' size-in-bits='160' id='26fb03b8'>
         <subrange length='20' type-id='7ff19f0f' id='fdca39cf'/>
       </array-type-def>
-      <class-decl name='__anonymous_struct__' size-in-bits='32' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4433' column='1' id='2701a934'>
+      <class-decl name='__anonymous_struct__' size-in-bits='32' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4435' column='1' id='2701a934'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='attach_type' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4434' column='1'/>
+          <var-decl name='attach_type' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4436' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='2707fa43'>
@@ -24851,42 +24852,42 @@
         <parameter type-id='95e97e5e'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='dwc3_hwparams' size-in-bits='448' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='867' column='1' id='2d79d174'>
+      <class-decl name='dwc3_hwparams' size-in-bits='448' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='864' column='1' id='2d79d174'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hwparams0' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='868' column='1'/>
+          <var-decl name='hwparams0' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='865' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='hwparams1' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='869' column='1'/>
+          <var-decl name='hwparams1' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='866' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='hwparams2' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='870' column='1'/>
+          <var-decl name='hwparams2' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='867' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='hwparams3' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='871' column='1'/>
+          <var-decl name='hwparams3' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='868' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='hwparams4' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='872' column='1'/>
+          <var-decl name='hwparams4' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='869' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='hwparams5' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='873' column='1'/>
+          <var-decl name='hwparams5' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='870' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='hwparams6' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='874' column='1'/>
+          <var-decl name='hwparams6' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='871' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='hwparams7' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='875' column='1'/>
+          <var-decl name='hwparams7' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='872' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='hwparams8' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='876' column='1'/>
+          <var-decl name='hwparams8' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='873' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='288'>
-          <var-decl name='hwparams9' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='877' column='1'/>
+          <var-decl name='hwparams9' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='874' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='879' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='876' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='880' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='877' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='425bcb9d' size-in-bits='64' id='2d81b115'/>
@@ -25080,12 +25081,12 @@
       <typedef-decl name='pgprot_t' type-id='051883a9' filepath='arch/arm64/include/asm/pgtable-types.h' line='43' column='1' id='2e2dcbd3'/>
       <pointer-type-def type-id='ac28b246' size-in-bits='64' id='2e320710'/>
       <pointer-type-def type-id='97aa083d' size-in-bits='64' id='2e3e746d'/>
-      <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4429' column='1' id='2e3f1f1e'>
+      <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4431' column='1' id='2e3f1f1e'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='tp_name' type-id='d3130597' visibility='default' filepath='include/uapi/linux/bpf.h' line='4430' column='1'/>
+          <var-decl name='tp_name' type-id='d3130597' visibility='default' filepath='include/uapi/linux/bpf.h' line='4432' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='tp_name_len' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4431' column='1'/>
+          <var-decl name='tp_name_len' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4433' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='regulator_bulk_data' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/regulator/consumer.h' line='169' column='1' id='2e3fb70e'>
@@ -25658,15 +25659,15 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='06f84b1d' size-in-bits='64' id='2fde6795'/>
-      <class-decl name='workqueue_attrs' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/workqueue.h' line='143' column='1' id='2fe6f208'>
+      <class-decl name='workqueue_attrs' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/workqueue.h' line='144' column='1' id='2fe6f208'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='nice' type-id='95e97e5e' visibility='default' filepath='include/linux/workqueue.h' line='147' column='1'/>
+          <var-decl name='nice' type-id='95e97e5e' visibility='default' filepath='include/linux/workqueue.h' line='148' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='cpumask' type-id='b16b461b' visibility='default' filepath='include/linux/workqueue.h' line='152' column='1'/>
+          <var-decl name='cpumask' type-id='b16b461b' visibility='default' filepath='include/linux/workqueue.h' line='153' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='no_numa' type-id='b50a4934' visibility='default' filepath='include/linux/workqueue.h' line='161' column='1'/>
+          <var-decl name='no_numa' type-id='b50a4934' visibility='default' filepath='include/linux/workqueue.h' line='162' column='1'/>
         </data-member>
       </class-decl>
       <qualified-type-def type-id='5b3ea0c8' const='yes' id='2fecddf7'/>
@@ -28032,18 +28033,18 @@
           <var-decl name='cache_order' type-id='f0981eeb' visibility='default' filepath='include/../mm/slab.h' line='210' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='wiphy_iftype_ext_capab' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4683' column='1' id='378a6c5a'>
+      <class-decl name='wiphy_iftype_ext_capab' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4686' column='1' id='378a6c5a'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='iftype' type-id='86505f90' visibility='default' filepath='include/net/cfg80211.h' line='4684' column='1'/>
+          <var-decl name='iftype' type-id='86505f90' visibility='default' filepath='include/net/cfg80211.h' line='4687' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='extended_capabilities' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='4685' column='1'/>
+          <var-decl name='extended_capabilities' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='4688' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='extended_capabilities_mask' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='4686' column='1'/>
+          <var-decl name='extended_capabilities_mask' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='4689' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='extended_capabilities_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4687' column='1'/>
+          <var-decl name='extended_capabilities_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4690' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='3793087b'>
@@ -28481,12 +28482,12 @@
       <pointer-type-def type-id='c8c25625' size-in-bits='64' id='390f38a5'/>
       <pointer-type-def type-id='754a5cbf' size-in-bits='64' id='390fbe8f'/>
       <pointer-type-def type-id='d35840cd' size-in-bits='64' id='391871d1'/>
-      <class-decl name='cfg80211_sched_scan_plan' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2274' column='1' id='391881a9'>
+      <class-decl name='cfg80211_sched_scan_plan' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2277' column='1' id='391881a9'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='interval' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2275' column='1'/>
+          <var-decl name='interval' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2278' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='iterations' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2276' column='1'/>
+          <var-decl name='iterations' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='2279' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='usb_device_id' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/mod_devicetable.h' line='121' column='1' id='391a9024'>
@@ -30275,141 +30276,141 @@
       </class-decl>
       <pointer-type-def type-id='46eaf6b3' size-in-bits='64' id='3ce232db'/>
       <pointer-type-def type-id='c21690c0' size-in-bits='64' id='3ce3447a'/>
-      <class-decl name='wireless_dev' size-in-bits='3904' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='5297' column='1' id='3ce3a3e9'>
+      <class-decl name='wireless_dev' size-in-bits='3904' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='5300' column='1' id='3ce3a3e9'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='wiphy' type-id='666fb412' visibility='default' filepath='include/net/cfg80211.h' line='5298' column='1'/>
+          <var-decl name='wiphy' type-id='666fb412' visibility='default' filepath='include/net/cfg80211.h' line='5301' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='iftype' type-id='86505f90' visibility='default' filepath='include/net/cfg80211.h' line='5299' column='1'/>
+          <var-decl name='iftype' type-id='86505f90' visibility='default' filepath='include/net/cfg80211.h' line='5302' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='5302' column='1'/>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='5305' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='netdev' type-id='68a2d05b' visibility='default' filepath='include/net/cfg80211.h' line='5303' column='1'/>
+          <var-decl name='netdev' type-id='68a2d05b' visibility='default' filepath='include/net/cfg80211.h' line='5306' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='identifier' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5305' column='1'/>
+          <var-decl name='identifier' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5308' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='mgmt_registrations' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='5307' column='1'/>
+          <var-decl name='mgmt_registrations' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='5310' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='mgmt_registrations_lock' type-id='fb4018a0' visibility='default' filepath='include/net/cfg80211.h' line='5314' column='1'/>
+          <var-decl name='mgmt_registrations_lock' type-id='fb4018a0' visibility='default' filepath='include/net/cfg80211.h' line='5317' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='mgmt_registrations_need_update' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5315' column='1'/>
+          <var-decl name='mgmt_registrations_need_update' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5318' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='mtx' type-id='925167dc' visibility='default' filepath='include/net/cfg80211.h' line='5317' column='1'/>
+          <var-decl name='mtx' type-id='925167dc' visibility='default' filepath='include/net/cfg80211.h' line='5320' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='use_4addr' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5319' column='1'/>
+          <var-decl name='use_4addr' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5322' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='968'>
-          <var-decl name='is_running' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5319' column='1'/>
+          <var-decl name='is_running' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5322' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='976'>
-          <var-decl name='address' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='5321' column='1'/>
+          <var-decl name='address' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='5324' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='ssid' type-id='e3dc4fdb' visibility='default' filepath='include/net/cfg80211.h' line='5324' column='1'/>
+          <var-decl name='ssid' type-id='e3dc4fdb' visibility='default' filepath='include/net/cfg80211.h' line='5327' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='ssid_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5325' column='1'/>
+          <var-decl name='ssid_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5328' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1288'>
-          <var-decl name='mesh_id_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5325' column='1'/>
+          <var-decl name='mesh_id_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5328' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1296'>
-          <var-decl name='mesh_id_up_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5325' column='1'/>
+          <var-decl name='mesh_id_up_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5328' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='conn' type-id='6dbc8e18' visibility='default' filepath='include/net/cfg80211.h' line='5326' column='1'/>
+          <var-decl name='conn' type-id='6dbc8e18' visibility='default' filepath='include/net/cfg80211.h' line='5329' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='connect_keys' type-id='561a36db' visibility='default' filepath='include/net/cfg80211.h' line='5327' column='1'/>
+          <var-decl name='connect_keys' type-id='561a36db' visibility='default' filepath='include/net/cfg80211.h' line='5330' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='conn_bss_type' type-id='cb952348' visibility='default' filepath='include/net/cfg80211.h' line='5328' column='1'/>
+          <var-decl name='conn_bss_type' type-id='cb952348' visibility='default' filepath='include/net/cfg80211.h' line='5331' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1504'>
-          <var-decl name='conn_owner_nlportid' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5329' column='1'/>
+          <var-decl name='conn_owner_nlportid' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5332' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='disconnect_wk' type-id='ef9025d0' visibility='default' filepath='include/net/cfg80211.h' line='5331' column='1'/>
+          <var-decl name='disconnect_wk' type-id='ef9025d0' visibility='default' filepath='include/net/cfg80211.h' line='5334' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1920'>
-          <var-decl name='disconnect_bssid' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='5332' column='1'/>
+          <var-decl name='disconnect_bssid' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='5335' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1984'>
-          <var-decl name='event_list' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='5334' column='1'/>
+          <var-decl name='event_list' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='5337' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2112'>
-          <var-decl name='event_lock' type-id='fb4018a0' visibility='default' filepath='include/net/cfg80211.h' line='5335' column='1'/>
+          <var-decl name='event_lock' type-id='fb4018a0' visibility='default' filepath='include/net/cfg80211.h' line='5338' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2176'>
-          <var-decl name='current_bss' type-id='1819dec8' visibility='default' filepath='include/net/cfg80211.h' line='5337' column='1'/>
+          <var-decl name='current_bss' type-id='1819dec8' visibility='default' filepath='include/net/cfg80211.h' line='5340' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2240'>
-          <var-decl name='preset_chandef' type-id='e07d69c8' visibility='default' filepath='include/net/cfg80211.h' line='5338' column='1'/>
+          <var-decl name='preset_chandef' type-id='e07d69c8' visibility='default' filepath='include/net/cfg80211.h' line='5341' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2496'>
-          <var-decl name='chandef' type-id='e07d69c8' visibility='default' filepath='include/net/cfg80211.h' line='5339' column='1'/>
+          <var-decl name='chandef' type-id='e07d69c8' visibility='default' filepath='include/net/cfg80211.h' line='5342' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2752'>
-          <var-decl name='ibss_fixed' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5341' column='1'/>
+          <var-decl name='ibss_fixed' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5344' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2760'>
-          <var-decl name='ibss_dfs_possible' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5342' column='1'/>
+          <var-decl name='ibss_dfs_possible' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5345' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2768'>
-          <var-decl name='ps' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5344' column='1'/>
+          <var-decl name='ps' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5347' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2784'>
-          <var-decl name='ps_timeout' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='5345' column='1'/>
+          <var-decl name='ps_timeout' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='5348' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2816'>
-          <var-decl name='beacon_interval' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='5347' column='1'/>
+          <var-decl name='beacon_interval' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='5350' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2848'>
-          <var-decl name='ap_unexpected_nlportid' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5349' column='1'/>
+          <var-decl name='ap_unexpected_nlportid' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5352' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2880'>
-          <var-decl name='owner_nlportid' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5351' column='1'/>
+          <var-decl name='owner_nlportid' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5354' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2912'>
-          <var-decl name='nl_owner_dead' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5352' column='1'/>
+          <var-decl name='nl_owner_dead' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5355' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2920'>
-          <var-decl name='cac_started' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5354' column='1'/>
+          <var-decl name='cac_started' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5357' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2944'>
-          <var-decl name='cac_start_time' type-id='7359adad' visibility='default' filepath='include/net/cfg80211.h' line='5355' column='1'/>
+          <var-decl name='cac_start_time' type-id='7359adad' visibility='default' filepath='include/net/cfg80211.h' line='5358' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3008'>
-          <var-decl name='cac_time_ms' type-id='f0981eeb' visibility='default' filepath='include/net/cfg80211.h' line='5356' column='1'/>
+          <var-decl name='cac_time_ms' type-id='f0981eeb' visibility='default' filepath='include/net/cfg80211.h' line='5359' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3072'>
-          <var-decl name='cqm_config' type-id='ee527710' visibility='default' filepath='include/net/cfg80211.h' line='5374' column='1'/>
+          <var-decl name='cqm_config' type-id='ee527710' visibility='default' filepath='include/net/cfg80211.h' line='5377' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3136'>
-          <var-decl name='pmsr_list' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='5376' column='1'/>
+          <var-decl name='pmsr_list' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='5379' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3264'>
-          <var-decl name='pmsr_lock' type-id='fb4018a0' visibility='default' filepath='include/net/cfg80211.h' line='5377' column='1'/>
+          <var-decl name='pmsr_lock' type-id='fb4018a0' visibility='default' filepath='include/net/cfg80211.h' line='5380' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3328'>
-          <var-decl name='pmsr_free_wk' type-id='ef9025d0' visibility='default' filepath='include/net/cfg80211.h' line='5378' column='1'/>
+          <var-decl name='pmsr_free_wk' type-id='ef9025d0' visibility='default' filepath='include/net/cfg80211.h' line='5381' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3712'>
-          <var-decl name='unprot_beacon_reported' type-id='7359adad' visibility='default' filepath='include/net/cfg80211.h' line='5380' column='1'/>
+          <var-decl name='unprot_beacon_reported' type-id='7359adad' visibility='default' filepath='include/net/cfg80211.h' line='5383' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3776'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='5382' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='5385' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3840'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='5383' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='5386' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='coupling_desc' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/regulator/driver.h' line='425' column='1' id='3ce445fe'>
@@ -31689,12 +31690,12 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='abcb190c' size-in-bits='64' id='3fbbdf8e'/>
-      <class-decl name='ctl_table_set' size-in-bits='768' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='158' column='1' id='3fc3d262'>
+      <class-decl name='ctl_table_set' size-in-bits='768' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='166' column='1' id='3fc3d262'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='is_seen' type-id='35e8c658' visibility='default' filepath='include/linux/sysctl.h' line='159' column='1'/>
+          <var-decl name='is_seen' type-id='35e8c658' visibility='default' filepath='include/linux/sysctl.h' line='167' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='dir' type-id='7c7d6006' visibility='default' filepath='include/linux/sysctl.h' line='160' column='1'/>
+          <var-decl name='dir' type-id='7c7d6006' visibility='default' filepath='include/linux/sysctl.h' line='168' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='fscrypt_master_key_secret' size-in-bits='1152' is-struct='yes' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='441' column='1' id='3fc794fa'>
@@ -33245,30 +33246,30 @@
         <parameter type-id='eaa32e2f'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='lwtunnel_state' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/net/lwtunnel.h' line='25' column='1' id='44644afc'>
+      <class-decl name='lwtunnel_state' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/net/lwtunnel.h' line='28' column='1' id='44644afc'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='type' type-id='d315442e' visibility='default' filepath='include/net/lwtunnel.h' line='26' column='1'/>
+          <var-decl name='type' type-id='d315442e' visibility='default' filepath='include/net/lwtunnel.h' line='29' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='16'>
-          <var-decl name='flags' type-id='d315442e' visibility='default' filepath='include/net/lwtunnel.h' line='27' column='1'/>
+          <var-decl name='flags' type-id='d315442e' visibility='default' filepath='include/net/lwtunnel.h' line='30' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='headroom' type-id='d315442e' visibility='default' filepath='include/net/lwtunnel.h' line='28' column='1'/>
+          <var-decl name='headroom' type-id='d315442e' visibility='default' filepath='include/net/lwtunnel.h' line='31' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='refcnt' type-id='49178f86' visibility='default' filepath='include/net/lwtunnel.h' line='29' column='1'/>
+          <var-decl name='refcnt' type-id='49178f86' visibility='default' filepath='include/net/lwtunnel.h' line='32' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='orig_output' type-id='0023218e' visibility='default' filepath='include/net/lwtunnel.h' line='30' column='1'/>
+          <var-decl name='orig_output' type-id='0023218e' visibility='default' filepath='include/net/lwtunnel.h' line='33' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='orig_input' type-id='d2e00785' visibility='default' filepath='include/net/lwtunnel.h' line='31' column='1'/>
+          <var-decl name='orig_input' type-id='d2e00785' visibility='default' filepath='include/net/lwtunnel.h' line='34' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/lwtunnel.h' line='32' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/lwtunnel.h' line='35' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='data' type-id='167619f6' visibility='default' filepath='include/net/lwtunnel.h' line='33' column='1'/>
+          <var-decl name='data' type-id='167619f6' visibility='default' filepath='include/net/lwtunnel.h' line='36' column='1'/>
         </data-member>
       </class-decl>
       <union-decl name='__anonymous_union__' size-in-bits='320' is-anonymous='yes' visibility='default' filepath='drivers/scsi/ufs/ufs.h' line='520' column='1' id='4467d7e7'>
@@ -33989,18 +33990,18 @@
       </class-decl>
       <pointer-type-def type-id='855e3679' size-in-bits='64' id='464f84a9'/>
       <pointer-type-def type-id='80b5c3cd' size-in-bits='64' id='46530b39'/>
-      <class-decl name='wake_irq' size-in-bits='192' is-struct='yes' visibility='default' filepath='drivers/base/power/power.h' line='31' column='1' id='4657336c'>
+      <class-decl name='wake_irq' size-in-bits='192' is-struct='yes' visibility='default' filepath='drivers/base/power/power.h' line='34' column='1' id='4657336c'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='dev' type-id='fa0b179b' visibility='default' filepath='drivers/base/power/power.h' line='32' column='1'/>
+          <var-decl name='dev' type-id='fa0b179b' visibility='default' filepath='drivers/base/power/power.h' line='35' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='status' type-id='f0981eeb' visibility='default' filepath='drivers/base/power/power.h' line='33' column='1'/>
+          <var-decl name='status' type-id='f0981eeb' visibility='default' filepath='drivers/base/power/power.h' line='36' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='irq' type-id='95e97e5e' visibility='default' filepath='drivers/base/power/power.h' line='34' column='1'/>
+          <var-decl name='irq' type-id='95e97e5e' visibility='default' filepath='drivers/base/power/power.h' line='37' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='drivers/base/power/power.h' line='35' column='1'/>
+          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='drivers/base/power/power.h' line='38' column='1'/>
         </data-member>
       </class-decl>
       <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/linux/key.h' line='111' column='1' id='465ca58e'>
@@ -34716,18 +34717,18 @@
       <pointer-type-def type-id='b9d8dce4' size-in-bits='64' id='47fc8c26'/>
       <pointer-type-def type-id='674bdea8' size-in-bits='64' id='4813c4da'/>
       <pointer-type-def type-id='81c3d1f5' size-in-bits='64' id='4814c3f9'/>
-      <class-decl name='ip_ra_chain' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/net/ip.h' line='127' column='1' id='4816a146'>
+      <class-decl name='ip_ra_chain' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/net/ip.h' line='128' column='1' id='4816a146'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='next' type-id='00c4cbac' visibility='default' filepath='include/net/ip.h' line='128' column='1'/>
+          <var-decl name='next' type-id='00c4cbac' visibility='default' filepath='include/net/ip.h' line='129' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='sk' type-id='f772df6d' visibility='default' filepath='include/net/ip.h' line='129' column='1'/>
+          <var-decl name='sk' type-id='f772df6d' visibility='default' filepath='include/net/ip.h' line='130' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='' type-id='4fa91678' visibility='default' filepath='include/net/ip.h' line='130' column='1'/>
+          <var-decl name='' type-id='4fa91678' visibility='default' filepath='include/net/ip.h' line='131' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/ip.h' line='134' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/ip.h' line='135' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='d67e1739' size-in-bits='64' id='4817356d'/>
@@ -34738,60 +34739,60 @@
         <parameter type-id='83c1bde6'/>
         <return type-id='48b5725f'/>
       </function-type>
-      <class-decl name='dwc3_request' size-in-bits='1664' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='920' column='1' id='48288128'>
+      <class-decl name='dwc3_request' size-in-bits='1664' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='917' column='1' id='48288128'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='request' type-id='43806adf' visibility='default' filepath='drivers/usb/dwc3/core.h' line='921' column='1'/>
+          <var-decl name='request' type-id='43806adf' visibility='default' filepath='drivers/usb/dwc3/core.h' line='918' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='drivers/usb/dwc3/core.h' line='922' column='1'/>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='drivers/usb/dwc3/core.h' line='919' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='dep' type-id='b31af340' visibility='default' filepath='drivers/usb/dwc3/core.h' line='923' column='1'/>
+          <var-decl name='dep' type-id='b31af340' visibility='default' filepath='drivers/usb/dwc3/core.h' line='920' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='sg' type-id='bf3ef905' visibility='default' filepath='drivers/usb/dwc3/core.h' line='924' column='1'/>
+          <var-decl name='sg' type-id='bf3ef905' visibility='default' filepath='drivers/usb/dwc3/core.h' line='921' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='start_sg' type-id='bf3ef905' visibility='default' filepath='drivers/usb/dwc3/core.h' line='925' column='1'/>
+          <var-decl name='start_sg' type-id='bf3ef905' visibility='default' filepath='drivers/usb/dwc3/core.h' line='922' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='num_pending_sgs' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='927' column='1'/>
+          <var-decl name='num_pending_sgs' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='924' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1184'>
-          <var-decl name='num_queued_sgs' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='928' column='1'/>
+          <var-decl name='num_queued_sgs' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='925' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='remaining' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='929' column='1'/>
+          <var-decl name='remaining' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='926' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1248'>
-          <var-decl name='status' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='931' column='1'/>
+          <var-decl name='status' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='928' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='epnum' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='940' column='1'/>
+          <var-decl name='epnum' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='937' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='trb' type-id='0d6a59e1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='941' column='1'/>
+          <var-decl name='trb' type-id='0d6a59e1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='938' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='trb_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='942' column='1'/>
+          <var-decl name='trb_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='939' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='num_trbs' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='944' column='1'/>
+          <var-decl name='num_trbs' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='941' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='needs_extra_trb' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='946' column='1'/>
+          <var-decl name='needs_extra_trb' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='943' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='direction' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='947' column='1'/>
+          <var-decl name='direction' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='944' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2'>
-          <var-decl name='mapped' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='948' column='1'/>
+          <var-decl name='mapped' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='945' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='950' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='947' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='951' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='948' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='08594205' size-in-bits='64' id='482ccc39'/>
@@ -37459,12 +37460,12 @@
         <parameter type-id='eaa32e2f'/>
         <return type-id='855e3679'/>
       </function-type>
-      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/net/ip.h' line='130' column='1' id='4fa91678'>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/net/ip.h' line='131' column='1' id='4fa91678'>
         <data-member access='public'>
-          <var-decl name='destructor' type-id='841969d0' visibility='default' filepath='include/net/ip.h' line='131' column='1'/>
+          <var-decl name='destructor' type-id='841969d0' visibility='default' filepath='include/net/ip.h' line='132' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='saved_sk' type-id='f772df6d' visibility='default' filepath='include/net/ip.h' line='132' column='1'/>
+          <var-decl name='saved_sk' type-id='f772df6d' visibility='default' filepath='include/net/ip.h' line='133' column='1'/>
         </data-member>
       </union-decl>
       <function-type size-in-bits='64' id='4fab04f8'>
@@ -39459,9 +39460,9 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='fb246cd7' size-in-bits='64' id='53f7c7e3'/>
-      <class-decl name='execute_work' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/workqueue.h' line='174' column='1' id='53f7ea88'>
+      <class-decl name='execute_work' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/workqueue.h' line='175' column='1' id='53f7ea88'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/workqueue.h' line='175' column='1'/>
+          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/workqueue.h' line='176' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='spinlock' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/linux/spinlock_types.h' line='71' column='1' id='53fb272e'>
@@ -39680,60 +39681,60 @@
           <var-decl name='' type-id='7432b366' visibility='default' filepath='include/linux/io-pgtable.h' line='96' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='tcp_congestion_ops' size-in-bits='1216' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1063' column='1' id='54718f09'>
+      <class-decl name='tcp_congestion_ops' size-in-bits='1216' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1067' column='1' id='54718f09'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/tcp.h' line='1064' column='1'/>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/tcp.h' line='1068' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='key' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1065' column='1'/>
+          <var-decl name='key' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1069' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1066' column='1'/>
+          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1070' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='init' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='1069' column='1'/>
+          <var-decl name='init' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='1073' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='release' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='1071' column='1'/>
+          <var-decl name='release' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='1075' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='ssthresh' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1074' column='1'/>
+          <var-decl name='ssthresh' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1078' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='cong_avoid' type-id='ece3af1e' visibility='default' filepath='include/net/tcp.h' line='1076' column='1'/>
+          <var-decl name='cong_avoid' type-id='ece3af1e' visibility='default' filepath='include/net/tcp.h' line='1080' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='set_state' type-id='f5feb7a4' visibility='default' filepath='include/net/tcp.h' line='1078' column='1'/>
+          <var-decl name='set_state' type-id='f5feb7a4' visibility='default' filepath='include/net/tcp.h' line='1082' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='cwnd_event' type-id='bfacbc7a' visibility='default' filepath='include/net/tcp.h' line='1080' column='1'/>
+          <var-decl name='cwnd_event' type-id='bfacbc7a' visibility='default' filepath='include/net/tcp.h' line='1084' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='in_ack_event' type-id='815f64bf' visibility='default' filepath='include/net/tcp.h' line='1082' column='1'/>
+          <var-decl name='in_ack_event' type-id='815f64bf' visibility='default' filepath='include/net/tcp.h' line='1086' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='undo_cwnd' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1084' column='1'/>
+          <var-decl name='undo_cwnd' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1088' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='pkts_acked' type-id='bffb5883' visibility='default' filepath='include/net/tcp.h' line='1086' column='1'/>
+          <var-decl name='pkts_acked' type-id='bffb5883' visibility='default' filepath='include/net/tcp.h' line='1090' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='min_tso_segs' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1088' column='1'/>
+          <var-decl name='min_tso_segs' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1092' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='sndbuf_expand' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1090' column='1'/>
+          <var-decl name='sndbuf_expand' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1094' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='cong_control' type-id='636d3a20' visibility='default' filepath='include/net/tcp.h' line='1094' column='1'/>
+          <var-decl name='cong_control' type-id='636d3a20' visibility='default' filepath='include/net/tcp.h' line='1098' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='get_info' type-id='14ca5c08' visibility='default' filepath='include/net/tcp.h' line='1096' column='1'/>
+          <var-decl name='get_info' type-id='14ca5c08' visibility='default' filepath='include/net/tcp.h' line='1100' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/net/tcp.h' line='1099' column='1'/>
+          <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/net/tcp.h' line='1103' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/tcp.h' line='1100' column='1'/>
+          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/tcp.h' line='1104' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='673937f2' size-in-bits='64' id='5474f420'/>
@@ -40169,21 +40170,21 @@
       <array-type-def dimensions='1' type-id='cf29c9b3' size-in-bits='infinite' id='55685a92'>
         <subrange length='infinite' type-id='7ff19f0f' id='031f2035'/>
       </array-type-def>
-      <class-decl name='wiphy_wowlan_tcp_support' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4544' column='1' id='557bca33'>
+      <class-decl name='wiphy_wowlan_tcp_support' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4547' column='1' id='557bca33'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='tok' type-id='6a8cbf59' visibility='default' filepath='include/net/cfg80211.h' line='4545' column='1'/>
+          <var-decl name='tok' type-id='6a8cbf59' visibility='default' filepath='include/net/cfg80211.h' line='4548' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='data_payload_max' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4546' column='1'/>
+          <var-decl name='data_payload_max' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4549' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='data_interval_max' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4547' column='1'/>
+          <var-decl name='data_interval_max' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4550' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='wake_payload_max' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4548' column='1'/>
+          <var-decl name='wake_payload_max' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4551' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='seq' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='4549' column='1'/>
+          <var-decl name='seq' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='4552' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='557c51cd'>
@@ -40788,7 +40789,7 @@
         <enumerator name='REF_CLK_FREQ_52_MHZ' value='3'/>
         <enumerator name='REF_CLK_FREQ_INVAL' value='-1'/>
       </enum-decl>
-      <enum-decl name='dwc3_ep0_next' filepath='drivers/usb/dwc3/core.h' line='775' column='1' id='56e3bcb9'>
+      <enum-decl name='dwc3_ep0_next' filepath='drivers/usb/dwc3/core.h' line='772' column='1' id='56e3bcb9'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='DWC3_EP0_UNKNOWN' value='0'/>
         <enumerator name='DWC3_EP0_COMPLETE' value='1'/>
@@ -40889,24 +40890,24 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='4baf5c00' size-in-bits='64' id='56fe8aea'/>
-      <union-decl name='__anonymous_union__' size-in-bits='128' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4428' column='1' id='570caa49'>
+      <union-decl name='__anonymous_union__' size-in-bits='128' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4430' column='1' id='570caa49'>
         <data-member access='public'>
-          <var-decl name='raw_tracepoint' type-id='2e3f1f1e' visibility='default' filepath='include/uapi/linux/bpf.h' line='4432' column='1'/>
+          <var-decl name='raw_tracepoint' type-id='2e3f1f1e' visibility='default' filepath='include/uapi/linux/bpf.h' line='4434' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='tracing' type-id='2701a934' visibility='default' filepath='include/uapi/linux/bpf.h' line='4435' column='1'/>
+          <var-decl name='tracing' type-id='2701a934' visibility='default' filepath='include/uapi/linux/bpf.h' line='4437' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='cgroup' type-id='1a126b50' visibility='default' filepath='include/uapi/linux/bpf.h' line='4439' column='1'/>
+          <var-decl name='cgroup' type-id='1a126b50' visibility='default' filepath='include/uapi/linux/bpf.h' line='4441' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='iter' type-id='77a16ce4' visibility='default' filepath='include/uapi/linux/bpf.h' line='4448' column='1'/>
+          <var-decl name='iter' type-id='77a16ce4' visibility='default' filepath='include/uapi/linux/bpf.h' line='4450' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='netns' type-id='0898701c' visibility='default' filepath='include/uapi/linux/bpf.h' line='4452' column='1'/>
+          <var-decl name='netns' type-id='0898701c' visibility='default' filepath='include/uapi/linux/bpf.h' line='4454' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='xdp' type-id='f052f7e3' visibility='default' filepath='include/uapi/linux/bpf.h' line='4455' column='1'/>
+          <var-decl name='xdp' type-id='f052f7e3' visibility='default' filepath='include/uapi/linux/bpf.h' line='4457' column='1'/>
         </data-member>
       </union-decl>
       <class-decl name='cpufreq_stats' is-struct='yes' visibility='default' is-declaration-only='yes' id='570cf6cf'/>
@@ -42827,24 +42828,24 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='615707ca' size-in-bits='64' id='5ad57c34'/>
-      <class-decl name='delayed_work' size-in-bits='1088' is-struct='yes' visibility='default' filepath='include/linux/workqueue.h' line='118' column='1' id='5ad6e0ef'>
+      <class-decl name='delayed_work' size-in-bits='1088' is-struct='yes' visibility='default' filepath='include/linux/workqueue.h' line='119' column='1' id='5ad6e0ef'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/workqueue.h' line='119' column='1'/>
+          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/workqueue.h' line='120' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='timer' type-id='abe41e67' visibility='default' filepath='include/linux/workqueue.h' line='120' column='1'/>
+          <var-decl name='timer' type-id='abe41e67' visibility='default' filepath='include/linux/workqueue.h' line='121' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='wq' type-id='242e3d19' visibility='default' filepath='include/linux/workqueue.h' line='123' column='1'/>
+          <var-decl name='wq' type-id='242e3d19' visibility='default' filepath='include/linux/workqueue.h' line='124' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='cpu' type-id='95e97e5e' visibility='default' filepath='include/linux/workqueue.h' line='124' column='1'/>
+          <var-decl name='cpu' type-id='95e97e5e' visibility='default' filepath='include/linux/workqueue.h' line='125' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/workqueue.h' line='126' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/workqueue.h' line='127' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/workqueue.h' line='127' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/workqueue.h' line='128' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='cd5d79f4' size-in-bits='64' id='5ad9edb6'/>
@@ -43035,27 +43036,27 @@
       </class-decl>
       <pointer-type-def type-id='70c545cd' size-in-bits='64' id='5bb9c75d'/>
       <typedef-decl name='uLong' type-id='7359adad' filepath='include/linux/zconf.h' line='54' column='1' id='5bbcce85'/>
-      <class-decl name='wiphy_wowlan_support' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4567' column='1' id='5bbd300b'>
+      <class-decl name='wiphy_wowlan_support' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4570' column='1' id='5bbd300b'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4568' column='1'/>
+          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4571' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='n_patterns' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4569' column='1'/>
+          <var-decl name='n_patterns' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4572' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='pattern_max_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4570' column='1'/>
+          <var-decl name='pattern_max_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4573' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='pattern_min_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4571' column='1'/>
+          <var-decl name='pattern_min_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4574' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='max_pkt_offset' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4572' column='1'/>
+          <var-decl name='max_pkt_offset' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4575' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='max_nd_match_sets' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4573' column='1'/>
+          <var-decl name='max_nd_match_sets' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4576' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='tcp' type-id='b3ebc0a8' visibility='default' filepath='include/net/cfg80211.h' line='4574' column='1'/>
+          <var-decl name='tcp' type-id='b3ebc0a8' visibility='default' filepath='include/net/cfg80211.h' line='4577' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='5bbf1052'>
@@ -43956,12 +43957,12 @@
         </data-member>
       </union-decl>
       <pointer-type-def type-id='09ffba8a' size-in-bits='64' id='5d92c9e0'/>
-      <class-decl name='cfg80211_bss_select_adjust' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2285' column='1' id='5da08e25'>
+      <class-decl name='cfg80211_bss_select_adjust' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2288' column='1' id='5da08e25'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='band' type-id='3eaa0294' visibility='default' filepath='include/net/cfg80211.h' line='2286' column='1'/>
+          <var-decl name='band' type-id='3eaa0294' visibility='default' filepath='include/net/cfg80211.h' line='2289' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='delta' type-id='fdbf7a0f' visibility='default' filepath='include/net/cfg80211.h' line='2287' column='1'/>
+          <var-decl name='delta' type-id='fdbf7a0f' visibility='default' filepath='include/net/cfg80211.h' line='2290' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='watchdog_info' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/uapi/linux/watchdog.h' line='18' column='1' id='5da1665b'>
@@ -44741,7 +44742,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='4fb62cb0' size-in-bits='64' id='5f493a9f'/>
-      <enum-decl name='tcp_ca_event' filepath='include/net/tcp.h' line='1000' column='1' id='5f51e977'>
+      <enum-decl name='tcp_ca_event' filepath='include/net/tcp.h' line='1004' column='1' id='5f51e977'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='CA_EVENT_TX_START' value='0'/>
         <enumerator name='CA_EVENT_CWND_RESTART' value='1'/>
@@ -45145,12 +45146,12 @@
         <subrange length='2' type-id='7ff19f0f' id='52efc4ef'/>
       </array-type-def>
       <pointer-type-def type-id='e5f6c4d2' size-in-bits='64' id='5fe73d20'/>
-      <class-decl name='event_filter' size-in-bits='128' is-struct='yes' visibility='default' filepath='kernel/trace/trace.h' line='1428' column='1' id='5ff1273a'>
+      <class-decl name='event_filter' size-in-bits='128' is-struct='yes' visibility='default' filepath='kernel/trace/trace.h' line='1431' column='1' id='5ff1273a'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='prog' type-id='efd0fdec' visibility='default' filepath='kernel/trace/trace.h' line='1429' column='1'/>
+          <var-decl name='prog' type-id='efd0fdec' visibility='default' filepath='kernel/trace/trace.h' line='1432' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='filter_string' type-id='26a90f95' visibility='default' filepath='kernel/trace/trace.h' line='1430' column='1'/>
+          <var-decl name='filter_string' type-id='26a90f95' visibility='default' filepath='kernel/trace/trace.h' line='1433' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='5ff29c2c'>
@@ -45429,6 +45430,9 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='c46c1f27' size-in-bits='64' id='60a257ef'/>
+      <array-type-def dimensions='1' type-id='e7d2a5fc' size-in-bits='infinite' id='60a540a8'>
+        <subrange length='infinite' type-id='7ff19f0f' id='031f2035'/>
+      </array-type-def>
       <class-decl name='snd_dec_flac' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/uapi/sound/compress_params.h' line='325' column='1' id='60b3851a'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='sample_size' type-id='d315442e' visibility='default' filepath='include/uapi/sound/compress_params.h' line='326' column='1'/>
@@ -46995,7 +46999,7 @@
         <return type-id='48b5725f'/>
       </function-type>
       <typedef-decl name='refcount_t' type-id='637cfeaf' filepath='include/linux/refcount.h' line='113' column='1' id='64615833'/>
-      <typedef-decl name='rpmsg_rx_sig_t' type-id='3362870f' filepath='include/linux/rpmsg.h' line='64' column='1' id='646ceeb7'/>
+      <typedef-decl name='rpmsg_rx_sig_t' type-id='3362870f' filepath='include/linux/rpmsg.h' line='66' column='1' id='646ceeb7'/>
       <class-decl name='devfreq_event_data' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/devfreq-event.h' line='47' column='1' id='64705f1a'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='load_count' type-id='7359adad' visibility='default' filepath='include/linux/devfreq-event.h' line='48' column='1'/>
@@ -48576,7 +48580,7 @@
       </union-decl>
       <pointer-type-def type-id='514fe525' size-in-bits='64' id='67f526b5'/>
       <pointer-type-def type-id='02ee425a' size-in-bits='64' id='67f66cfc'/>
-      <typedef-decl name='xhci_get_quirks_t' type-id='da11b16a' filepath='drivers/usb/host/xhci.h' line='2104' column='1' id='67f831c0'/>
+      <typedef-decl name='xhci_get_quirks_t' type-id='da11b16a' filepath='drivers/usb/host/xhci.h' line='2106' column='1' id='67f831c0'/>
       <typedef-decl name='snd_pcm_format_t' type-id='95e97e5e' filepath='include/uapi/sound/asound.h' line='194' column='1' id='67fa9bd5'/>
       <pointer-type-def type-id='70e959e4' size-in-bits='64' id='68074686'/>
       <pointer-type-def type-id='b5d4a6d2' size-in-bits='64' id='680bf43c'/>
@@ -48630,252 +48634,252 @@
       <pointer-type-def type-id='b855e40d' size-in-bits='64' id='684d860d'/>
       <pointer-type-def type-id='2b18e57b' size-in-bits='64' id='6850d327'/>
       <pointer-type-def type-id='3b03705e' size-in-bits='64' id='6850e780'/>
-      <class-decl name='wiphy' size-in-bits='11264' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4938' column='1' id='68523a94'>
+      <class-decl name='wiphy' size-in-bits='11264' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4941' column='1' id='68523a94'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='perm_addr' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='4941' column='1'/>
+          <var-decl name='perm_addr' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='4944' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='48'>
-          <var-decl name='addr_mask' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='4942' column='1'/>
+          <var-decl name='addr_mask' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='4945' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='addresses' type-id='01b378ab' visibility='default' filepath='include/net/cfg80211.h' line='4944' column='1'/>
+          <var-decl name='addresses' type-id='01b378ab' visibility='default' filepath='include/net/cfg80211.h' line='4947' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='mgmt_stypes' type-id='0cda9080' visibility='default' filepath='include/net/cfg80211.h' line='4946' column='1'/>
+          <var-decl name='mgmt_stypes' type-id='0cda9080' visibility='default' filepath='include/net/cfg80211.h' line='4949' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='iface_combinations' type-id='fa32a449' visibility='default' filepath='include/net/cfg80211.h' line='4948' column='1'/>
+          <var-decl name='iface_combinations' type-id='fa32a449' visibility='default' filepath='include/net/cfg80211.h' line='4951' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='n_iface_combinations' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4949' column='1'/>
+          <var-decl name='n_iface_combinations' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4952' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='352'>
-          <var-decl name='software_iftypes' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4950' column='1'/>
+          <var-decl name='software_iftypes' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4953' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='368'>
-          <var-decl name='n_addresses' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4952' column='1'/>
+          <var-decl name='n_addresses' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4955' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='interface_modes' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4955' column='1'/>
+          <var-decl name='interface_modes' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4958' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='400'>
-          <var-decl name='max_acl_mac_addrs' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4957' column='1'/>
+          <var-decl name='max_acl_mac_addrs' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4960' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='416'>
-          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4959' column='1'/>
+          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4962' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='regulatory_flags' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4959' column='1'/>
+          <var-decl name='regulatory_flags' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4962' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='480'>
-          <var-decl name='features' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4959' column='1'/>
+          <var-decl name='features' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4962' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='ext_features' type-id='d3180915' visibility='default' filepath='include/net/cfg80211.h' line='4960' column='1'/>
+          <var-decl name='ext_features' type-id='d3180915' visibility='default' filepath='include/net/cfg80211.h' line='4963' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='ap_sme_capa' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4962' column='1'/>
+          <var-decl name='ap_sme_capa' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4965' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='608'>
-          <var-decl name='signal_type' type-id='b8524648' visibility='default' filepath='include/net/cfg80211.h' line='4964' column='1'/>
+          <var-decl name='signal_type' type-id='b8524648' visibility='default' filepath='include/net/cfg80211.h' line='4967' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='bss_priv_size' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4966' column='1'/>
+          <var-decl name='bss_priv_size' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4969' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='672'>
-          <var-decl name='max_scan_ssids' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4967' column='1'/>
+          <var-decl name='max_scan_ssids' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4970' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='680'>
-          <var-decl name='max_sched_scan_reqs' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4968' column='1'/>
+          <var-decl name='max_sched_scan_reqs' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4971' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='688'>
-          <var-decl name='max_sched_scan_ssids' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4969' column='1'/>
+          <var-decl name='max_sched_scan_ssids' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4972' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='696'>
-          <var-decl name='max_match_sets' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4970' column='1'/>
+          <var-decl name='max_match_sets' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4973' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='max_scan_ie_len' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4971' column='1'/>
+          <var-decl name='max_scan_ie_len' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4974' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='720'>
-          <var-decl name='max_sched_scan_ie_len' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4972' column='1'/>
+          <var-decl name='max_sched_scan_ie_len' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4975' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='736'>
-          <var-decl name='max_sched_scan_plans' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4973' column='1'/>
+          <var-decl name='max_sched_scan_plans' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4976' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='max_sched_scan_plan_interval' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4974' column='1'/>
+          <var-decl name='max_sched_scan_plan_interval' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4977' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='800'>
-          <var-decl name='max_sched_scan_plan_iterations' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4975' column='1'/>
+          <var-decl name='max_sched_scan_plan_iterations' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4978' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='n_cipher_suites' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4977' column='1'/>
+          <var-decl name='n_cipher_suites' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4980' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='cipher_suites' type-id='aded214c' visibility='default' filepath='include/net/cfg80211.h' line='4978' column='1'/>
+          <var-decl name='cipher_suites' type-id='aded214c' visibility='default' filepath='include/net/cfg80211.h' line='4981' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='n_akm_suites' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4980' column='1'/>
+          <var-decl name='n_akm_suites' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4983' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='akm_suites' type-id='aded214c' visibility='default' filepath='include/net/cfg80211.h' line='4981' column='1'/>
+          <var-decl name='akm_suites' type-id='aded214c' visibility='default' filepath='include/net/cfg80211.h' line='4984' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='iftype_akm_suites' type-id='6196d741' visibility='default' filepath='include/net/cfg80211.h' line='4983' column='1'/>
+          <var-decl name='iftype_akm_suites' type-id='6196d741' visibility='default' filepath='include/net/cfg80211.h' line='4986' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='num_iftype_akm_suites' type-id='f0981eeb' visibility='default' filepath='include/net/cfg80211.h' line='4984' column='1'/>
+          <var-decl name='num_iftype_akm_suites' type-id='f0981eeb' visibility='default' filepath='include/net/cfg80211.h' line='4987' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1184'>
-          <var-decl name='retry_short' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4986' column='1'/>
+          <var-decl name='retry_short' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4989' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1192'>
-          <var-decl name='retry_long' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4987' column='1'/>
+          <var-decl name='retry_long' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4990' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='frag_threshold' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4988' column='1'/>
+          <var-decl name='frag_threshold' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4991' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1248'>
-          <var-decl name='rts_threshold' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4989' column='1'/>
+          <var-decl name='rts_threshold' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4992' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='coverage_class' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4990' column='1'/>
+          <var-decl name='coverage_class' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4993' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1288'>
-          <var-decl name='fw_version' type-id='16dc656a' visibility='default' filepath='include/net/cfg80211.h' line='4992' column='1'/>
+          <var-decl name='fw_version' type-id='16dc656a' visibility='default' filepath='include/net/cfg80211.h' line='4995' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1568'>
-          <var-decl name='hw_version' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4993' column='1'/>
+          <var-decl name='hw_version' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4996' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='wowlan' type-id='78a34b70' visibility='default' filepath='include/net/cfg80211.h' line='4996' column='1'/>
+          <var-decl name='wowlan' type-id='78a34b70' visibility='default' filepath='include/net/cfg80211.h' line='4999' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='wowlan_config' type-id='9d025b00' visibility='default' filepath='include/net/cfg80211.h' line='4997' column='1'/>
+          <var-decl name='wowlan_config' type-id='9d025b00' visibility='default' filepath='include/net/cfg80211.h' line='5000' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1728'>
-          <var-decl name='max_remain_on_channel_duration' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='5000' column='1'/>
+          <var-decl name='max_remain_on_channel_duration' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='5003' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1744'>
-          <var-decl name='max_num_pmkids' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5002' column='1'/>
+          <var-decl name='max_num_pmkids' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5005' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1760'>
-          <var-decl name='available_antennas_tx' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5004' column='1'/>
+          <var-decl name='available_antennas_tx' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5007' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1792'>
-          <var-decl name='available_antennas_rx' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5005' column='1'/>
+          <var-decl name='available_antennas_rx' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5008' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1824'>
-          <var-decl name='probe_resp_offload' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5007' column='1'/>
+          <var-decl name='probe_resp_offload' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5010' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1856'>
-          <var-decl name='extended_capabilities' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='5009' column='1'/>
+          <var-decl name='extended_capabilities' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='5012' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1920'>
-          <var-decl name='extended_capabilities_mask' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='5009' column='1'/>
+          <var-decl name='extended_capabilities_mask' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='5012' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1984'>
-          <var-decl name='extended_capabilities_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5010' column='1'/>
+          <var-decl name='extended_capabilities_len' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5013' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2048'>
-          <var-decl name='iftype_ext_capab' type-id='3ca25343' visibility='default' filepath='include/net/cfg80211.h' line='5012' column='1'/>
+          <var-decl name='iftype_ext_capab' type-id='3ca25343' visibility='default' filepath='include/net/cfg80211.h' line='5015' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2112'>
-          <var-decl name='num_iftype_ext_capab' type-id='f0981eeb' visibility='default' filepath='include/net/cfg80211.h' line='5013' column='1'/>
+          <var-decl name='num_iftype_ext_capab' type-id='f0981eeb' visibility='default' filepath='include/net/cfg80211.h' line='5016' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2176'>
-          <var-decl name='privid' type-id='eaa32e2f' visibility='default' filepath='include/net/cfg80211.h' line='5015' column='1'/>
+          <var-decl name='privid' type-id='eaa32e2f' visibility='default' filepath='include/net/cfg80211.h' line='5018' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2240'>
-          <var-decl name='bands' type-id='281a45dd' visibility='default' filepath='include/net/cfg80211.h' line='5017' column='1'/>
+          <var-decl name='bands' type-id='281a45dd' visibility='default' filepath='include/net/cfg80211.h' line='5020' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2560'>
-          <var-decl name='reg_notifier' type-id='39ee8359' visibility='default' filepath='include/net/cfg80211.h' line='5019' column='1'/>
+          <var-decl name='reg_notifier' type-id='39ee8359' visibility='default' filepath='include/net/cfg80211.h' line='5022' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2624'>
-          <var-decl name='regd' type-id='4e819401' visibility='default' filepath='include/net/cfg80211.h' line='5024' column='1'/>
+          <var-decl name='regd' type-id='4e819401' visibility='default' filepath='include/net/cfg80211.h' line='5027' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2688'>
-          <var-decl name='dev' type-id='66e487eb' visibility='default' filepath='include/net/cfg80211.h' line='5026' column='1'/>
+          <var-decl name='dev' type-id='66e487eb' visibility='default' filepath='include/net/cfg80211.h' line='5029' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9856'>
-          <var-decl name='registered' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5028' column='1'/>
+          <var-decl name='registered' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='5031' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9920'>
-          <var-decl name='debugfsdir' type-id='27675065' visibility='default' filepath='include/net/cfg80211.h' line='5030' column='1'/>
+          <var-decl name='debugfsdir' type-id='27675065' visibility='default' filepath='include/net/cfg80211.h' line='5033' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9984'>
-          <var-decl name='ht_capa_mod_mask' type-id='81f1a1a8' visibility='default' filepath='include/net/cfg80211.h' line='5032' column='1'/>
+          <var-decl name='ht_capa_mod_mask' type-id='81f1a1a8' visibility='default' filepath='include/net/cfg80211.h' line='5035' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10048'>
-          <var-decl name='vht_capa_mod_mask' type-id='fffb07a4' visibility='default' filepath='include/net/cfg80211.h' line='5033' column='1'/>
+          <var-decl name='vht_capa_mod_mask' type-id='fffb07a4' visibility='default' filepath='include/net/cfg80211.h' line='5036' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10112'>
-          <var-decl name='wdev_list' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='5035' column='1'/>
+          <var-decl name='wdev_list' type-id='72f469ec' visibility='default' filepath='include/net/cfg80211.h' line='5038' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10240'>
-          <var-decl name='_net' type-id='c9df1e6c' visibility='default' filepath='include/net/cfg80211.h' line='5037' column='1'/>
+          <var-decl name='_net' type-id='c9df1e6c' visibility='default' filepath='include/net/cfg80211.h' line='5040' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10304'>
-          <var-decl name='coalesce' type-id='9ef499bf' visibility='default' filepath='include/net/cfg80211.h' line='5043' column='1'/>
+          <var-decl name='coalesce' type-id='9ef499bf' visibility='default' filepath='include/net/cfg80211.h' line='5046' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10368'>
-          <var-decl name='vendor_commands' type-id='41e3f782' visibility='default' filepath='include/net/cfg80211.h' line='5045' column='1'/>
+          <var-decl name='vendor_commands' type-id='41e3f782' visibility='default' filepath='include/net/cfg80211.h' line='5048' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10432'>
-          <var-decl name='vendor_events' type-id='b188cc4f' visibility='default' filepath='include/net/cfg80211.h' line='5046' column='1'/>
+          <var-decl name='vendor_events' type-id='b188cc4f' visibility='default' filepath='include/net/cfg80211.h' line='5049' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10496'>
-          <var-decl name='n_vendor_commands' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='5047' column='1'/>
+          <var-decl name='n_vendor_commands' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='5050' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10528'>
-          <var-decl name='n_vendor_events' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='5047' column='1'/>
+          <var-decl name='n_vendor_events' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='5050' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10560'>
-          <var-decl name='max_ap_assoc_sta' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='5049' column='1'/>
+          <var-decl name='max_ap_assoc_sta' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='5052' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10576'>
-          <var-decl name='max_num_csa_counters' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5051' column='1'/>
+          <var-decl name='max_num_csa_counters' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5054' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10592'>
-          <var-decl name='bss_select_support' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5053' column='1'/>
+          <var-decl name='bss_select_support' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5056' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10624'>
-          <var-decl name='nan_supported_bands' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5055' column='1'/>
+          <var-decl name='nan_supported_bands' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5058' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10656'>
-          <var-decl name='txq_limit' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5057' column='1'/>
+          <var-decl name='txq_limit' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5060' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10688'>
-          <var-decl name='txq_memory_limit' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5058' column='1'/>
+          <var-decl name='txq_memory_limit' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5061' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10720'>
-          <var-decl name='txq_quantum' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5059' column='1'/>
+          <var-decl name='txq_quantum' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='5062' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10752'>
-          <var-decl name='tx_queue_len' type-id='7359adad' visibility='default' filepath='include/net/cfg80211.h' line='5061' column='1'/>
+          <var-decl name='tx_queue_len' type-id='7359adad' visibility='default' filepath='include/net/cfg80211.h' line='5064' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='support_mbssid' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5063' column='1'/>
+          <var-decl name='support_mbssid' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5066' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='support_only_he_mbssid' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5064' column='1'/>
+          <var-decl name='support_only_he_mbssid' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5067' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10880'>
-          <var-decl name='pmsr_capa' type-id='5abfac26' visibility='default' filepath='include/net/cfg80211.h' line='5066' column='1'/>
+          <var-decl name='pmsr_capa' type-id='5abfac26' visibility='default' filepath='include/net/cfg80211.h' line='5069' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10944'>
-          <var-decl name='tid_config_support' type-id='f58927cb' visibility='default' filepath='include/net/cfg80211.h' line='5071' column='1'/>
+          <var-decl name='tid_config_support' type-id='f58927cb' visibility='default' filepath='include/net/cfg80211.h' line='5074' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='11136'>
-          <var-decl name='max_data_retry_count' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5073' column='1'/>
+          <var-decl name='max_data_retry_count' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5076' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='11200'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='5075' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='5078' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='11264'>
-          <var-decl name='priv' type-id='e84913bd' visibility='default' filepath='include/net/cfg80211.h' line='5077' column='1'/>
+          <var-decl name='priv' type-id='e84913bd' visibility='default' filepath='include/net/cfg80211.h' line='5080' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='6858ea97'>
@@ -49159,42 +49163,42 @@
       </function-type>
       <pointer-type-def type-id='262a563e' size-in-bits='64' id='6910c028'/>
       <typedef-decl name='efi_query_variable_info_t' type-id='23aa5fb5' filepath='include/linux/efi.h' line='255' column='1' id='69175bf8'/>
-      <class-decl name='dquot' size-in-bits='1792' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='294' column='1' id='691a06da'>
+      <class-decl name='dquot' size-in-bits='1792' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='296' column='1' id='691a06da'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='dq_hash' type-id='03a4a074' visibility='default' filepath='include/linux/quota.h' line='295' column='1'/>
+          <var-decl name='dq_hash' type-id='03a4a074' visibility='default' filepath='include/linux/quota.h' line='297' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='dq_inuse' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='296' column='1'/>
+          <var-decl name='dq_inuse' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='298' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='dq_free' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='297' column='1'/>
+          <var-decl name='dq_free' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='299' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='dq_dirty' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='298' column='1'/>
+          <var-decl name='dq_dirty' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='300' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='dq_lock' type-id='925167dc' visibility='default' filepath='include/linux/quota.h' line='299' column='1'/>
+          <var-decl name='dq_lock' type-id='925167dc' visibility='default' filepath='include/linux/quota.h' line='301' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='dq_dqb_lock' type-id='fb4018a0' visibility='default' filepath='include/linux/quota.h' line='300' column='1'/>
+          <var-decl name='dq_dqb_lock' type-id='fb4018a0' visibility='default' filepath='include/linux/quota.h' line='302' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='928'>
-          <var-decl name='dq_count' type-id='49178f86' visibility='default' filepath='include/linux/quota.h' line='301' column='1'/>
+          <var-decl name='dq_count' type-id='49178f86' visibility='default' filepath='include/linux/quota.h' line='303' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='dq_sb' type-id='42c8f564' visibility='default' filepath='include/linux/quota.h' line='302' column='1'/>
+          <var-decl name='dq_sb' type-id='42c8f564' visibility='default' filepath='include/linux/quota.h' line='304' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='dq_id' type-id='72028e1c' visibility='default' filepath='include/linux/quota.h' line='303' column='1'/>
+          <var-decl name='dq_id' type-id='72028e1c' visibility='default' filepath='include/linux/quota.h' line='305' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='dq_off' type-id='69bf7bee' visibility='default' filepath='include/linux/quota.h' line='304' column='1'/>
+          <var-decl name='dq_off' type-id='69bf7bee' visibility='default' filepath='include/linux/quota.h' line='306' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='dq_flags' type-id='7359adad' visibility='default' filepath='include/linux/quota.h' line='305' column='1'/>
+          <var-decl name='dq_flags' type-id='7359adad' visibility='default' filepath='include/linux/quota.h' line='307' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='dq_dqb' type-id='bd17a943' visibility='default' filepath='include/linux/quota.h' line='306' column='1'/>
+          <var-decl name='dq_dqb' type-id='bd17a943' visibility='default' filepath='include/linux/quota.h' line='308' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='8468004b' size-in-bits='64' id='691d1b3b'/>
@@ -49909,12 +49913,12 @@
       </class-decl>
       <pointer-type-def type-id='3e1d184a' size-in-bits='64' id='6aee814c'/>
       <pointer-type-def type-id='74e7a035' size-in-bits='64' id='6af64a09'/>
-      <class-decl name='uncached_list' size-in-bits='192' is-struct='yes' visibility='default' filepath='net/ipv4/route.c' line='1543' column='1' id='6b1203e5'>
+      <class-decl name='uncached_list' size-in-bits='192' is-struct='yes' visibility='default' filepath='net/ipv4/route.c' line='1545' column='1' id='6b1203e5'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='net/ipv4/route.c' line='1544' column='1'/>
+          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='net/ipv4/route.c' line='1546' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='head' type-id='72f469ec' visibility='default' filepath='net/ipv4/route.c' line='1545' column='1'/>
+          <var-decl name='head' type-id='72f469ec' visibility='default' filepath='net/ipv4/route.c' line='1547' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='bfbf7968' size-in-bits='64' id='6b1642ae'/>
@@ -50845,9 +50849,9 @@
         <parameter type-id='5b4bef1f'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='mac_address' size-in-bits='48' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='1098' column='1' id='6d8d26fb'>
+      <class-decl name='mac_address' size-in-bits='48' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='1101' column='1' id='6d8d26fb'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='addr' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='1099' column='1'/>
+          <var-decl name='addr' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='1102' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='6d905adc'>
@@ -51874,18 +51878,18 @@
           <var-decl name='head' type-id='d504f73d' visibility='default' filepath='include/linux/notifier.h' line='67' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='dwc3_trb' size-in-bits='128' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='847' column='1' id='70923669'>
+      <class-decl name='dwc3_trb' size-in-bits='128' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='844' column='1' id='70923669'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='bpl' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='848' column='1'/>
+          <var-decl name='bpl' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='845' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='bph' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='849' column='1'/>
+          <var-decl name='bph' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='846' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='size' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='850' column='1'/>
+          <var-decl name='size' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='847' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='ctrl' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='851' column='1'/>
+          <var-decl name='ctrl' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='848' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='pci_error_handlers' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/pci.h' line='814' column='1' id='709bf5ba'>
@@ -52034,24 +52038,24 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='291d9c02' size-in-bits='64' id='7114e104'/>
-      <class-decl name='wiphy_coalesce_support' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4587' column='1' id='7124a2a6'>
+      <class-decl name='wiphy_coalesce_support' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4590' column='1' id='7124a2a6'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='n_rules' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4588' column='1'/>
+          <var-decl name='n_rules' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4591' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='max_delay' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4589' column='1'/>
+          <var-decl name='max_delay' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4592' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='n_patterns' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4590' column='1'/>
+          <var-decl name='n_patterns' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4593' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='pattern_max_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4591' column='1'/>
+          <var-decl name='pattern_max_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4594' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='pattern_min_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4592' column='1'/>
+          <var-decl name='pattern_min_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4595' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='max_pkt_offset' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4593' column='1'/>
+          <var-decl name='max_pkt_offset' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4596' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='4292193b' size-in-bits='64' id='7126cf8f'/>
@@ -52483,67 +52487,67 @@
           <var-decl name='sockets_allocated' type-id='84c6078d' visibility='default' filepath='include/net/sock.h' line='1247' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1984'>
-          <var-decl name='memory_pressure' type-id='1d2c2b85' visibility='default' filepath='include/net/sock.h' line='1254' column='1'/>
+          <var-decl name='memory_pressure' type-id='1d2c2b85' visibility='default' filepath='include/net/sock.h' line='1255' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2048'>
-          <var-decl name='sysctl_mem' type-id='3ccc2590' visibility='default' filepath='include/net/sock.h' line='1255' column='1'/>
+          <var-decl name='sysctl_mem' type-id='3ccc2590' visibility='default' filepath='include/net/sock.h' line='1256' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2112'>
-          <var-decl name='sysctl_wmem' type-id='7292109c' visibility='default' filepath='include/net/sock.h' line='1257' column='1'/>
+          <var-decl name='sysctl_wmem' type-id='7292109c' visibility='default' filepath='include/net/sock.h' line='1258' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2176'>
-          <var-decl name='sysctl_rmem' type-id='7292109c' visibility='default' filepath='include/net/sock.h' line='1258' column='1'/>
+          <var-decl name='sysctl_rmem' type-id='7292109c' visibility='default' filepath='include/net/sock.h' line='1259' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2240'>
-          <var-decl name='sysctl_wmem_offset' type-id='19c2251e' visibility='default' filepath='include/net/sock.h' line='1259' column='1'/>
+          <var-decl name='sysctl_wmem_offset' type-id='19c2251e' visibility='default' filepath='include/net/sock.h' line='1260' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2272'>
-          <var-decl name='sysctl_rmem_offset' type-id='19c2251e' visibility='default' filepath='include/net/sock.h' line='1260' column='1'/>
+          <var-decl name='sysctl_rmem_offset' type-id='19c2251e' visibility='default' filepath='include/net/sock.h' line='1261' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2304'>
-          <var-decl name='max_header' type-id='95e97e5e' visibility='default' filepath='include/net/sock.h' line='1262' column='1'/>
+          <var-decl name='max_header' type-id='95e97e5e' visibility='default' filepath='include/net/sock.h' line='1263' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2336'>
-          <var-decl name='no_autobind' type-id='b50a4934' visibility='default' filepath='include/net/sock.h' line='1263' column='1'/>
+          <var-decl name='no_autobind' type-id='b50a4934' visibility='default' filepath='include/net/sock.h' line='1264' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2368'>
-          <var-decl name='slab' type-id='f3b4aca8' visibility='default' filepath='include/net/sock.h' line='1265' column='1'/>
+          <var-decl name='slab' type-id='f3b4aca8' visibility='default' filepath='include/net/sock.h' line='1266' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2432'>
-          <var-decl name='obj_size' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1266' column='1'/>
+          <var-decl name='obj_size' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1267' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2464'>
-          <var-decl name='slab_flags' type-id='f7fe96cb' visibility='default' filepath='include/net/sock.h' line='1267' column='1'/>
+          <var-decl name='slab_flags' type-id='f7fe96cb' visibility='default' filepath='include/net/sock.h' line='1268' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2496'>
-          <var-decl name='useroffset' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1268' column='1'/>
+          <var-decl name='useroffset' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1269' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2528'>
-          <var-decl name='usersize' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1269' column='1'/>
+          <var-decl name='usersize' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1270' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2560'>
-          <var-decl name='orphan_count' type-id='84c6078d' visibility='default' filepath='include/net/sock.h' line='1271' column='1'/>
+          <var-decl name='orphan_count' type-id='84c6078d' visibility='default' filepath='include/net/sock.h' line='1272' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2624'>
-          <var-decl name='rsk_prot' type-id='db994912' visibility='default' filepath='include/net/sock.h' line='1273' column='1'/>
+          <var-decl name='rsk_prot' type-id='db994912' visibility='default' filepath='include/net/sock.h' line='1274' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2688'>
-          <var-decl name='twsk_prot' type-id='d68ad8b5' visibility='default' filepath='include/net/sock.h' line='1274' column='1'/>
+          <var-decl name='twsk_prot' type-id='d68ad8b5' visibility='default' filepath='include/net/sock.h' line='1275' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2752'>
-          <var-decl name='h' type-id='adf5bf47' visibility='default' filepath='include/net/sock.h' line='1281' column='1'/>
+          <var-decl name='h' type-id='adf5bf47' visibility='default' filepath='include/net/sock.h' line='1282' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2816'>
-          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/sock.h' line='1283' column='1'/>
+          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/sock.h' line='1284' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2880'>
-          <var-decl name='name' type-id='16dc656a' visibility='default' filepath='include/net/sock.h' line='1285' column='1'/>
+          <var-decl name='name' type-id='16dc656a' visibility='default' filepath='include/net/sock.h' line='1286' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3136'>
-          <var-decl name='node' type-id='72f469ec' visibility='default' filepath='include/net/sock.h' line='1287' column='1'/>
+          <var-decl name='node' type-id='72f469ec' visibility='default' filepath='include/net/sock.h' line='1288' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3264'>
-          <var-decl name='diag_destroy' type-id='95208a5e' visibility='default' filepath='include/net/sock.h' line='1291' column='1'/>
+          <var-decl name='diag_destroy' type-id='95208a5e' visibility='default' filepath='include/net/sock.h' line='1292' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='trace_buffer' is-struct='yes' visibility='default' is-declaration-only='yes' id='72093c11'/>
@@ -53687,18 +53691,18 @@
       </class-decl>
       <pointer-type-def type-id='c2d135ef' size-in-bits='64' id='741cc96e'/>
       <pointer-type-def type-id='395aad7e' size-in-bits='64' id='74287ea0'/>
-      <class-decl name='cfg80211_match_set' size-in-bits='512' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2258' column='1' id='7430554e'>
+      <class-decl name='cfg80211_match_set' size-in-bits='512' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2261' column='1' id='7430554e'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='ssid' type-id='0c960fcf' visibility='default' filepath='include/net/cfg80211.h' line='2259' column='1'/>
+          <var-decl name='ssid' type-id='0c960fcf' visibility='default' filepath='include/net/cfg80211.h' line='2262' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='264'>
-          <var-decl name='bssid' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='2260' column='1'/>
+          <var-decl name='bssid' type-id='cf1a4160' visibility='default' filepath='include/net/cfg80211.h' line='2263' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='rssi_thold' type-id='a7832498' visibility='default' filepath='include/net/cfg80211.h' line='2261' column='1'/>
+          <var-decl name='rssi_thold' type-id='a7832498' visibility='default' filepath='include/net/cfg80211.h' line='2264' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='352'>
-          <var-decl name='per_band_rssi_thold' type-id='2ccab0ee' visibility='default' filepath='include/net/cfg80211.h' line='2262' column='1'/>
+          <var-decl name='per_band_rssi_thold' type-id='2ccab0ee' visibility='default' filepath='include/net/cfg80211.h' line='2265' column='1'/>
         </data-member>
       </class-decl>
       <union-decl name='__anonymous_union__' size-in-bits='192' is-anonymous='yes' visibility='default' filepath='include/linux/io-pgtable.h' line='96' column='1' id='7432b366'>
@@ -54376,18 +54380,18 @@
         <parameter type-id='37175e4d'/>
         <return type-id='48b5725f'/>
       </function-type>
-      <class-decl name='cfg80211_pkt_pattern' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2949' column='1' id='76959226'>
+      <class-decl name='cfg80211_pkt_pattern' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='2952' column='1' id='76959226'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='mask' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2950' column='1'/>
+          <var-decl name='mask' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2953' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='pattern' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2950' column='1'/>
+          <var-decl name='pattern' type-id='bbaf3419' visibility='default' filepath='include/net/cfg80211.h' line='2953' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='pattern_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2951' column='1'/>
+          <var-decl name='pattern_len' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2954' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='pkt_offset' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2952' column='1'/>
+          <var-decl name='pkt_offset' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='2955' column='1'/>
         </data-member>
       </class-decl>
       <array-type-def dimensions='1' type-id='f22a8abb' size-in-bits='512' id='7698c98a'>
@@ -54775,15 +54779,15 @@
         </data-member>
       </class-decl>
       <typedef-decl name='siphash_key_t' type-id='a1908dcc' filepath='include/linux/siphash.h' line='22' column='1' id='7799da43'/>
-      <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4440' column='1' id='77a16ce4'>
+      <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4442' column='1' id='77a16ce4'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='target_name' type-id='d3130597' visibility='default' filepath='include/uapi/linux/bpf.h' line='4441' column='1'/>
+          <var-decl name='target_name' type-id='d3130597' visibility='default' filepath='include/uapi/linux/bpf.h' line='4443' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='target_name_len' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4442' column='1'/>
+          <var-decl name='target_name_len' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4444' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='' type-id='0add2232' visibility='default' filepath='include/uapi/linux/bpf.h' line='4443' column='1'/>
+          <var-decl name='' type-id='0add2232' visibility='default' filepath='include/uapi/linux/bpf.h' line='4445' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='v4l2_subdev_ir_ops' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/media/v4l2-subdev.h' line='589' column='1' id='77a58158'>
@@ -56464,19 +56468,19 @@
           <var-decl name='id_entry' type-id='79c2f4f8' visibility='default' filepath='include/linux/platform_device.h' line='33' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7680'>
-          <var-decl name='driver_override' type-id='26a90f95' visibility='default' filepath='include/linux/platform_device.h' line='34' column='1'/>
+          <var-decl name='driver_override' type-id='26a90f95' visibility='default' filepath='include/linux/platform_device.h' line='38' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7744'>
-          <var-decl name='mfd_cell' type-id='fb02122b' visibility='default' filepath='include/linux/platform_device.h' line='37' column='1'/>
+          <var-decl name='mfd_cell' type-id='fb02122b' visibility='default' filepath='include/linux/platform_device.h' line='41' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7808'>
-          <var-decl name='archdata' type-id='89ee2f2f' visibility='default' filepath='include/linux/platform_device.h' line='40' column='1'/>
+          <var-decl name='archdata' type-id='89ee2f2f' visibility='default' filepath='include/linux/platform_device.h' line='44' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7808'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/platform_device.h' line='42' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/platform_device.h' line='46' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7872'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/platform_device.h' line='43' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/platform_device.h' line='47' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='0971a711' size-in-bits='64' id='7bb6ff35'/>
@@ -56624,15 +56628,15 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='cd5ad9b0' size-in-bits='64' id='7c07671a'/>
-      <class-decl name='rcu_work' size-in-bits='576' is-struct='yes' visibility='default' filepath='include/linux/workqueue.h' line='130' column='1' id='7c0b9fdb'>
+      <class-decl name='rcu_work' size-in-bits='576' is-struct='yes' visibility='default' filepath='include/linux/workqueue.h' line='131' column='1' id='7c0b9fdb'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/workqueue.h' line='131' column='1'/>
+          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/workqueue.h' line='132' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/linux/workqueue.h' line='132' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/linux/workqueue.h' line='133' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='wq' type-id='242e3d19' visibility='default' filepath='include/linux/workqueue.h' line='135' column='1'/>
+          <var-decl name='wq' type-id='242e3d19' visibility='default' filepath='include/linux/workqueue.h' line='136' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='6daa74bb' size-in-bits='64' id='7c0fed0f'/>
@@ -56904,12 +56908,12 @@
         <subrange length='infinite' type-id='7ff19f0f' id='031f2035'/>
       </array-type-def>
       <qualified-type-def type-id='d53c2eb5' const='yes' id='7c7c6daa'/>
-      <class-decl name='ctl_dir' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='152' column='1' id='7c7d6006'>
+      <class-decl name='ctl_dir' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='160' column='1' id='7c7d6006'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='header' type-id='ed51618b' visibility='default' filepath='include/linux/sysctl.h' line='154' column='1'/>
+          <var-decl name='header' type-id='ed51618b' visibility='default' filepath='include/linux/sysctl.h' line='162' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='root' type-id='dec44472' visibility='default' filepath='include/linux/sysctl.h' line='155' column='1'/>
+          <var-decl name='root' type-id='dec44472' visibility='default' filepath='include/linux/sysctl.h' line='163' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='4a1729fc' size-in-bits='64' id='7c7fffd6'/>
@@ -58453,39 +58457,39 @@
         <parameter type-id='f0981eeb'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='cfg80211_wowlan' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='3008' column='1' id='80126e32'>
+      <class-decl name='cfg80211_wowlan' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='3011' column='1' id='80126e32'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='any' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3009' column='1'/>
+          <var-decl name='any' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3012' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8'>
-          <var-decl name='disconnect' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3009' column='1'/>
+          <var-decl name='disconnect' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3012' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='16'>
-          <var-decl name='magic_pkt' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3009' column='1'/>
+          <var-decl name='magic_pkt' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3012' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='24'>
-          <var-decl name='gtk_rekey_failure' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3009' column='1'/>
+          <var-decl name='gtk_rekey_failure' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3012' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='eap_identity_req' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3010' column='1'/>
+          <var-decl name='eap_identity_req' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3013' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='40'>
-          <var-decl name='four_way_handshake' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3010' column='1'/>
+          <var-decl name='four_way_handshake' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3013' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='48'>
-          <var-decl name='rfkill_release' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3011' column='1'/>
+          <var-decl name='rfkill_release' type-id='b50a4934' visibility='default' filepath='include/net/cfg80211.h' line='3014' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='patterns' type-id='1ed3660c' visibility='default' filepath='include/net/cfg80211.h' line='3012' column='1'/>
+          <var-decl name='patterns' type-id='1ed3660c' visibility='default' filepath='include/net/cfg80211.h' line='3015' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='tcp' type-id='e0c1c1b8' visibility='default' filepath='include/net/cfg80211.h' line='3013' column='1'/>
+          <var-decl name='tcp' type-id='e0c1c1b8' visibility='default' filepath='include/net/cfg80211.h' line='3016' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='n_patterns' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='3014' column='1'/>
+          <var-decl name='n_patterns' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='3017' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='nd_config' type-id='9e4995c7' visibility='default' filepath='include/net/cfg80211.h' line='3015' column='1'/>
+          <var-decl name='nd_config' type-id='9e4995c7' visibility='default' filepath='include/net/cfg80211.h' line='3018' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='802097e5'>
@@ -58600,390 +58604,390 @@
       <pointer-type-def type-id='9ba86a44' size-in-bits='64' id='807b7702'/>
       <pointer-type-def type-id='a82c7e12' size-in-bits='64' id='807c842c'/>
       <pointer-type-def type-id='5f81edee' size-in-bits='64' id='807f0070'/>
-      <class-decl name='dwc3' size-in-bits='10432' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1109' column='1' id='80824a72'>
+      <class-decl name='dwc3' size-in-bits='10432' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1106' column='1' id='80824a72'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='drd_work' type-id='ef9025d0' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1110' column='1'/>
+          <var-decl name='drd_work' type-id='ef9025d0' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1107' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='ep0_trb' type-id='0d6a59e1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1111' column='1'/>
+          <var-decl name='ep0_trb' type-id='0d6a59e1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1108' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='bounce' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1112' column='1'/>
+          <var-decl name='bounce' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1109' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='scratchbuf' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1113' column='1'/>
+          <var-decl name='scratchbuf' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1110' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='setup_buf' type-id='8bff8096' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1114' column='1'/>
+          <var-decl name='setup_buf' type-id='8bff8096' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1111' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='ep0_trb_addr' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1115' column='1'/>
+          <var-decl name='ep0_trb_addr' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1112' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='bounce_addr' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1116' column='1'/>
+          <var-decl name='bounce_addr' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1113' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='scratch_addr' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1117' column='1'/>
+          <var-decl name='scratch_addr' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1114' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='ep0_usb_req' type-id='48288128' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1118' column='1'/>
+          <var-decl name='ep0_usb_req' type-id='48288128' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1115' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2496'>
-          <var-decl name='ep0_in_setup' type-id='f9fef04f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1119' column='1'/>
+          <var-decl name='ep0_in_setup' type-id='f9fef04f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1116' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2752'>
-          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1122' column='1'/>
+          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1119' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2816'>
-          <var-decl name='mutex' type-id='925167dc' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1125' column='1'/>
+          <var-decl name='mutex' type-id='925167dc' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1122' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3200'>
-          <var-decl name='dev' type-id='fa0b179b' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1127' column='1'/>
+          <var-decl name='dev' type-id='fa0b179b' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1124' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3264'>
-          <var-decl name='sysdev' type-id='fa0b179b' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1128' column='1'/>
+          <var-decl name='sysdev' type-id='fa0b179b' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1125' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3328'>
-          <var-decl name='xhci' type-id='db362995' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1130' column='1'/>
+          <var-decl name='xhci' type-id='db362995' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1127' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3392'>
-          <var-decl name='xhci_resources' type-id='05e8efcf' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1131' column='1'/>
+          <var-decl name='xhci_resources' type-id='05e8efcf' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1128' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4928'>
-          <var-decl name='ev_buf' type-id='c4c1659e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1133' column='1'/>
+          <var-decl name='ev_buf' type-id='c4c1659e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1130' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4992'>
-          <var-decl name='eps' type-id='21edd5c3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1134' column='1'/>
+          <var-decl name='eps' type-id='21edd5c3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1131' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7040'>
-          <var-decl name='gadget' type-id='49a58c0c' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1136' column='1'/>
+          <var-decl name='gadget' type-id='49a58c0c' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1133' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7104'>
-          <var-decl name='gadget_driver' type-id='9762ede1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1137' column='1'/>
+          <var-decl name='gadget_driver' type-id='9762ede1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1134' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7168'>
-          <var-decl name='clks' type-id='2942e355' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1139' column='1'/>
+          <var-decl name='clks' type-id='2942e355' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1136' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7232'>
-          <var-decl name='num_clks' type-id='95e97e5e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1140' column='1'/>
+          <var-decl name='num_clks' type-id='95e97e5e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1137' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7296'>
-          <var-decl name='reset' type-id='9f9b8114' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1142' column='1'/>
+          <var-decl name='reset' type-id='9f9b8114' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1139' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7360'>
-          <var-decl name='usb2_phy' type-id='ca9354d1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1144' column='1'/>
+          <var-decl name='usb2_phy' type-id='ca9354d1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1141' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7424'>
-          <var-decl name='usb3_phy' type-id='ca9354d1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1145' column='1'/>
+          <var-decl name='usb3_phy' type-id='ca9354d1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1142' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7488'>
-          <var-decl name='usb2_generic_phy' type-id='503ff1ba' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1147' column='1'/>
+          <var-decl name='usb2_generic_phy' type-id='503ff1ba' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1144' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7552'>
-          <var-decl name='usb3_generic_phy' type-id='503ff1ba' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1148' column='1'/>
+          <var-decl name='usb3_generic_phy' type-id='503ff1ba' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1145' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7616'>
-          <var-decl name='phys_ready' type-id='b50a4934' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1150' column='1'/>
+          <var-decl name='phys_ready' type-id='b50a4934' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1147' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7680'>
-          <var-decl name='ulpi' type-id='144a094f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1152' column='1'/>
+          <var-decl name='ulpi' type-id='144a094f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1149' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7744'>
-          <var-decl name='ulpi_ready' type-id='b50a4934' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1153' column='1'/>
+          <var-decl name='ulpi_ready' type-id='b50a4934' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1150' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7808'>
-          <var-decl name='regs' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1155' column='1'/>
+          <var-decl name='regs' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1152' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7872'>
-          <var-decl name='regs_size' type-id='b59d7dce' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1156' column='1'/>
+          <var-decl name='regs_size' type-id='b59d7dce' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1153' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7936'>
-          <var-decl name='dr_mode' type-id='d291aaf1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1158' column='1'/>
+          <var-decl name='dr_mode' type-id='d291aaf1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1155' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7968'>
-          <var-decl name='current_dr_role' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1159' column='1'/>
+          <var-decl name='current_dr_role' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1156' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8000'>
-          <var-decl name='desired_dr_role' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1160' column='1'/>
+          <var-decl name='desired_dr_role' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1157' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8064'>
-          <var-decl name='edev' type-id='c0d6fada' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1161' column='1'/>
+          <var-decl name='edev' type-id='c0d6fada' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1158' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8128'>
-          <var-decl name='edev_nb' type-id='9b08f7cd' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1162' column='1'/>
+          <var-decl name='edev_nb' type-id='9b08f7cd' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1159' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8320'>
-          <var-decl name='hsphy_mode' type-id='46b5771e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1163' column='1'/>
+          <var-decl name='hsphy_mode' type-id='46b5771e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1160' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8384'>
-          <var-decl name='role_sw' type-id='3e3cd44f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1164' column='1'/>
+          <var-decl name='role_sw' type-id='3e3cd44f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1161' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8448'>
-          <var-decl name='role_switch_default_mode' type-id='d291aaf1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1165' column='1'/>
+          <var-decl name='role_switch_default_mode' type-id='d291aaf1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1162' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8512'>
-          <var-decl name='usb_psy' type-id='c0c93c9e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1167' column='1'/>
+          <var-decl name='usb_psy' type-id='c0c93c9e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1164' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8576'>
-          <var-decl name='fladj' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1169' column='1'/>
+          <var-decl name='fladj' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1166' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8608'>
-          <var-decl name='irq_gadget' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1170' column='1'/>
+          <var-decl name='irq_gadget' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1167' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8640'>
-          <var-decl name='otg_irq' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1171' column='1'/>
+          <var-decl name='otg_irq' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1168' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8672'>
-          <var-decl name='current_otg_role' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1172' column='1'/>
+          <var-decl name='current_otg_role' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1169' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8704'>
-          <var-decl name='desired_otg_role' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1173' column='1'/>
+          <var-decl name='desired_otg_role' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1170' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8736'>
-          <var-decl name='otg_restart_host' type-id='b50a4934' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1174' column='1'/>
+          <var-decl name='otg_restart_host' type-id='b50a4934' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1171' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8768'>
-          <var-decl name='nr_scratch' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1175' column='1'/>
+          <var-decl name='nr_scratch' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1172' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8800'>
-          <var-decl name='u1u2' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1176' column='1'/>
+          <var-decl name='u1u2' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1173' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8832'>
-          <var-decl name='maximum_speed' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1177' column='1'/>
+          <var-decl name='maximum_speed' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1174' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8864'>
-          <var-decl name='gadget_max_speed' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1178' column='1'/>
+          <var-decl name='gadget_max_speed' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1175' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8896'>
-          <var-decl name='max_ssp_rate' type-id='a9ea967a' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1179' column='1'/>
+          <var-decl name='max_ssp_rate' type-id='a9ea967a' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1176' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8928'>
-          <var-decl name='gadget_ssp_rate' type-id='a9ea967a' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1180' column='1'/>
+          <var-decl name='gadget_ssp_rate' type-id='a9ea967a' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1177' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8960'>
-          <var-decl name='ip' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1182' column='1'/>
+          <var-decl name='ip' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1179' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8992'>
-          <var-decl name='revision' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1188' column='1'/>
+          <var-decl name='revision' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1185' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9024'>
-          <var-decl name='version_type' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1226' column='1'/>
+          <var-decl name='version_type' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1223' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9056'>
-          <var-decl name='ep0_next_event' type-id='56e3bcb9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1236' column='1'/>
+          <var-decl name='ep0_next_event' type-id='56e3bcb9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1233' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9088'>
-          <var-decl name='ep0state' type-id='045093ad' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1237' column='1'/>
+          <var-decl name='ep0state' type-id='045093ad' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1234' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9120'>
-          <var-decl name='link_state' type-id='9775e40e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1238' column='1'/>
+          <var-decl name='link_state' type-id='9775e40e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1235' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9152'>
-          <var-decl name='u2sel' type-id='1dc6a898' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1240' column='1'/>
+          <var-decl name='u2sel' type-id='1dc6a898' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1237' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9168'>
-          <var-decl name='u2pel' type-id='1dc6a898' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1241' column='1'/>
+          <var-decl name='u2pel' type-id='1dc6a898' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1238' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9184'>
-          <var-decl name='u1sel' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1242' column='1'/>
+          <var-decl name='u1sel' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1239' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9192'>
-          <var-decl name='u1pel' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1243' column='1'/>
+          <var-decl name='u1pel' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1240' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9200'>
-          <var-decl name='speed' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1245' column='1'/>
+          <var-decl name='speed' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1242' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9208'>
-          <var-decl name='num_eps' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1247' column='1'/>
+          <var-decl name='num_eps' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1244' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9216'>
-          <var-decl name='hwparams' type-id='2d79d174' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1249' column='1'/>
+          <var-decl name='hwparams' type-id='2d79d174' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1246' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9664'>
-          <var-decl name='root' type-id='27675065' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1250' column='1'/>
+          <var-decl name='root' type-id='27675065' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1247' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9728'>
-          <var-decl name='regset' type-id='62fa2ea7' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1251' column='1'/>
+          <var-decl name='regset' type-id='62fa2ea7' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1248' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9792'>
-          <var-decl name='dbg_lsp_select' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1253' column='1'/>
+          <var-decl name='dbg_lsp_select' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1250' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9824'>
-          <var-decl name='test_mode' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1255' column='1'/>
+          <var-decl name='test_mode' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1252' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9832'>
-          <var-decl name='test_mode_nr' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1256' column='1'/>
+          <var-decl name='test_mode_nr' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1253' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9840'>
-          <var-decl name='lpm_nyet_threshold' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1257' column='1'/>
+          <var-decl name='lpm_nyet_threshold' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1254' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9848'>
-          <var-decl name='hird_threshold' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1258' column='1'/>
+          <var-decl name='hird_threshold' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1255' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9856'>
-          <var-decl name='rx_thr_num_pkt_prd' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1259' column='1'/>
+          <var-decl name='rx_thr_num_pkt_prd' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1256' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9864'>
-          <var-decl name='rx_max_burst_prd' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1260' column='1'/>
+          <var-decl name='rx_max_burst_prd' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1257' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9872'>
-          <var-decl name='tx_thr_num_pkt_prd' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1261' column='1'/>
+          <var-decl name='tx_thr_num_pkt_prd' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1258' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9880'>
-          <var-decl name='tx_max_burst_prd' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1262' column='1'/>
+          <var-decl name='tx_max_burst_prd' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1259' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9888'>
-          <var-decl name='tx_fifo_resize_max_num' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1263' column='1'/>
+          <var-decl name='tx_fifo_resize_max_num' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1260' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9920'>
-          <var-decl name='hsphy_interface' type-id='80f4b756' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1265' column='1'/>
+          <var-decl name='hsphy_interface' type-id='80f4b756' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1262' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='connected' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1267' column='1'/>
+          <var-decl name='connected' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1264' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='delayed_status' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1268' column='1'/>
+          <var-decl name='delayed_status' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1265' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2'>
-          <var-decl name='ep0_bounced' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1269' column='1'/>
+          <var-decl name='ep0_bounced' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1266' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3'>
-          <var-decl name='ep0_expect_in' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1270' column='1'/>
+          <var-decl name='ep0_expect_in' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1267' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4'>
-          <var-decl name='has_hibernation' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1271' column='1'/>
+          <var-decl name='has_hibernation' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1268' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5'>
-          <var-decl name='sysdev_is_parent' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1272' column='1'/>
+          <var-decl name='sysdev_is_parent' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1269' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6'>
-          <var-decl name='has_lpm_erratum' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1273' column='1'/>
+          <var-decl name='has_lpm_erratum' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1270' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7'>
-          <var-decl name='is_utmi_l1_suspend' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1274' column='1'/>
+          <var-decl name='is_utmi_l1_suspend' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1271' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8'>
-          <var-decl name='is_fpga' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1275' column='1'/>
+          <var-decl name='is_fpga' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1272' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9'>
-          <var-decl name='pending_events' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1276' column='1'/>
+          <var-decl name='pending_events' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1273' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10'>
-          <var-decl name='do_fifo_resize' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1277' column='1'/>
+          <var-decl name='do_fifo_resize' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1274' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='11'>
-          <var-decl name='pullups_connected' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1278' column='1'/>
+          <var-decl name='pullups_connected' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1275' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12'>
-          <var-decl name='setup_packet_pending' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1279' column='1'/>
+          <var-decl name='setup_packet_pending' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1276' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='13'>
-          <var-decl name='three_stage_setup' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1280' column='1'/>
+          <var-decl name='three_stage_setup' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1277' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='14'>
-          <var-decl name='dis_start_transfer_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1281' column='1'/>
+          <var-decl name='dis_start_transfer_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1278' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='15'>
-          <var-decl name='usb3_lpm_capable' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1282' column='1'/>
+          <var-decl name='usb3_lpm_capable' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1279' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='16'>
-          <var-decl name='usb2_lpm_disable' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1283' column='1'/>
+          <var-decl name='usb2_lpm_disable' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1280' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='17'>
-          <var-decl name='usb2_gadget_lpm_disable' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1284' column='1'/>
+          <var-decl name='usb2_gadget_lpm_disable' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1281' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='18'>
-          <var-decl name='disable_scramble_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1286' column='1'/>
+          <var-decl name='disable_scramble_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1283' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='19'>
-          <var-decl name='u2exit_lfps_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1287' column='1'/>
+          <var-decl name='u2exit_lfps_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1284' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='20'>
-          <var-decl name='u2ss_inp3_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1288' column='1'/>
+          <var-decl name='u2ss_inp3_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1285' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='21'>
-          <var-decl name='req_p1p2p3_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1289' column='1'/>
+          <var-decl name='req_p1p2p3_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1286' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='22'>
-          <var-decl name='del_p1p2p3_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1290' column='1'/>
+          <var-decl name='del_p1p2p3_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1287' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='23'>
-          <var-decl name='del_phy_power_chg_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1291' column='1'/>
+          <var-decl name='del_phy_power_chg_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1288' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='24'>
-          <var-decl name='lfps_filter_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1292' column='1'/>
+          <var-decl name='lfps_filter_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1289' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='25'>
-          <var-decl name='rx_detect_poll_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1293' column='1'/>
+          <var-decl name='rx_detect_poll_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1290' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='26'>
-          <var-decl name='dis_u3_susphy_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1294' column='1'/>
+          <var-decl name='dis_u3_susphy_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1291' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='27'>
-          <var-decl name='dis_u2_susphy_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1295' column='1'/>
+          <var-decl name='dis_u2_susphy_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1292' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='28'>
-          <var-decl name='dis_enblslpm_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1296' column='1'/>
+          <var-decl name='dis_enblslpm_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1293' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='29'>
-          <var-decl name='dis_u1_entry_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1297' column='1'/>
+          <var-decl name='dis_u1_entry_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1294' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='30'>
-          <var-decl name='dis_u2_entry_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1298' column='1'/>
+          <var-decl name='dis_u2_entry_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1295' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='31'>
-          <var-decl name='dis_rxdet_inp3_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1299' column='1'/>
+          <var-decl name='dis_rxdet_inp3_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1296' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='dis_u2_freeclk_exists_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1300' column='1'/>
+          <var-decl name='dis_u2_freeclk_exists_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1297' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='dis_del_phy_power_chg_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1301' column='1'/>
+          <var-decl name='dis_del_phy_power_chg_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1298' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2'>
-          <var-decl name='dis_tx_ipgap_linecheck_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1302' column='1'/>
+          <var-decl name='dis_tx_ipgap_linecheck_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1299' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3'>
-          <var-decl name='parkmode_disable_ss_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1303' column='1'/>
+          <var-decl name='parkmode_disable_ss_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1300' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4'>
-          <var-decl name='tx_de_emphasis_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1305' column='1'/>
+          <var-decl name='tx_de_emphasis_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1302' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5'>
-          <var-decl name='tx_de_emphasis' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1306' column='1'/>
+          <var-decl name='tx_de_emphasis' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1303' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7'>
-          <var-decl name='dis_metastability_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1308' column='1'/>
+          <var-decl name='dis_metastability_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1305' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8'>
-          <var-decl name='dis_split_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1310' column='1'/>
+          <var-decl name='dis_split_quirk' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1307' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9'>
-          <var-decl name='async_callbacks' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1311' column='1'/>
+          <var-decl name='async_callbacks' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1308' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10032'>
-          <var-decl name='imod_interval' type-id='1dc6a898' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1313' column='1'/>
+          <var-decl name='imod_interval' type-id='1dc6a898' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1310' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10048'>
-          <var-decl name='max_cfg_eps' type-id='95e97e5e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1315' column='1'/>
+          <var-decl name='max_cfg_eps' type-id='95e97e5e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1312' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10080'>
-          <var-decl name='last_fifo_depth' type-id='95e97e5e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1316' column='1'/>
+          <var-decl name='last_fifo_depth' type-id='95e97e5e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1313' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10112'>
-          <var-decl name='num_ep_resized' type-id='95e97e5e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1317' column='1'/>
+          <var-decl name='num_ep_resized' type-id='95e97e5e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1314' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10176'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1319' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1316' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10240'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1320' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1317' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10304'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1321' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1318' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10368'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1322' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1319' column='1'/>
         </data-member>
       </class-decl>
       <enum-decl name='irqreturn' filepath='include/linux/irqreturn.h' line='11' column='1' id='8086ea38'>
@@ -59537,36 +59541,36 @@
       <pointer-type-def type-id='1e0c0ad9' size-in-bits='64' id='825b5cd1'/>
       <pointer-type-def type-id='09f0c826' size-in-bits='64' id='825ef190'/>
       <typedef-decl name='dma_async_tx_callback_result' type-id='31316b61' filepath='include/linux/dmaengine.h' line='551' column='1' id='82615040'/>
-      <class-decl name='xhci_driver_overrides' size-in-bits='640' is-struct='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='1952' column='1' id='8264b0e6'>
+      <class-decl name='xhci_driver_overrides' size-in-bits='640' is-struct='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='1954' column='1' id='8264b0e6'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='extra_priv_size' type-id='b59d7dce' visibility='default' filepath='drivers/usb/host/xhci.h' line='1953' column='1'/>
+          <var-decl name='extra_priv_size' type-id='b59d7dce' visibility='default' filepath='drivers/usb/host/xhci.h' line='1955' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='reset' type-id='3d4f6569' visibility='default' filepath='drivers/usb/host/xhci.h' line='1954' column='1'/>
+          <var-decl name='reset' type-id='3d4f6569' visibility='default' filepath='drivers/usb/host/xhci.h' line='1956' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='start' type-id='3d4f6569' visibility='default' filepath='drivers/usb/host/xhci.h' line='1955' column='1'/>
+          <var-decl name='start' type-id='3d4f6569' visibility='default' filepath='drivers/usb/host/xhci.h' line='1957' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='add_endpoint' type-id='2c3372f7' visibility='default' filepath='drivers/usb/host/xhci.h' line='1956' column='1'/>
+          <var-decl name='add_endpoint' type-id='2c3372f7' visibility='default' filepath='drivers/usb/host/xhci.h' line='1958' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='drop_endpoint' type-id='2c3372f7' visibility='default' filepath='drivers/usb/host/xhci.h' line='1958' column='1'/>
+          <var-decl name='drop_endpoint' type-id='2c3372f7' visibility='default' filepath='drivers/usb/host/xhci.h' line='1960' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='check_bandwidth' type-id='530cb308' visibility='default' filepath='drivers/usb/host/xhci.h' line='1960' column='1'/>
+          <var-decl name='check_bandwidth' type-id='530cb308' visibility='default' filepath='drivers/usb/host/xhci.h' line='1962' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='reset_bandwidth' type-id='b48dadb7' visibility='default' filepath='drivers/usb/host/xhci.h' line='1961' column='1'/>
+          <var-decl name='reset_bandwidth' type-id='b48dadb7' visibility='default' filepath='drivers/usb/host/xhci.h' line='1963' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='address_device' type-id='530cb308' visibility='default' filepath='drivers/usb/host/xhci.h' line='1962' column='1'/>
+          <var-decl name='address_device' type-id='530cb308' visibility='default' filepath='drivers/usb/host/xhci.h' line='1964' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='bus_suspend' type-id='3d4f6569' visibility='default' filepath='drivers/usb/host/xhci.h' line='1963' column='1'/>
+          <var-decl name='bus_suspend' type-id='3d4f6569' visibility='default' filepath='drivers/usb/host/xhci.h' line='1965' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='bus_resume' type-id='3d4f6569' visibility='default' filepath='drivers/usb/host/xhci.h' line='1964' column='1'/>
+          <var-decl name='bus_resume' type-id='3d4f6569' visibility='default' filepath='drivers/usb/host/xhci.h' line='1966' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='99f32926' size-in-bits='64' id='82683cec'/>
@@ -61927,36 +61931,36 @@
           <var-decl name='hpd_data' type-id='eaa32e2f' visibility='default' filepath='include/drm/drm_bridge.h' line='762' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='quota_format_ops' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='310' column='1' id='87cad984'>
+      <class-decl name='quota_format_ops' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='312' column='1' id='87cad984'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='check_quota_file' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='311' column='1'/>
+          <var-decl name='check_quota_file' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='313' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='read_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='312' column='1'/>
+          <var-decl name='read_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='314' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='write_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='313' column='1'/>
+          <var-decl name='write_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='315' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='free_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='314' column='1'/>
+          <var-decl name='free_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='316' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='read_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='315' column='1'/>
+          <var-decl name='read_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='317' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='commit_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='316' column='1'/>
+          <var-decl name='commit_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='318' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='release_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='317' column='1'/>
+          <var-decl name='release_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='319' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='get_next_id' type-id='70b08f83' visibility='default' filepath='include/linux/quota.h' line='318' column='1'/>
+          <var-decl name='get_next_id' type-id='70b08f83' visibility='default' filepath='include/linux/quota.h' line='320' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='320' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='322' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='321' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='323' column='1'/>
         </data-member>
       </class-decl>
       <array-type-def dimensions='1' type-id='8af57d41' size-in-bits='32' id='87ce7f1e'>
@@ -62196,18 +62200,18 @@
         <parameter type-id='eaa32e2f'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='bpf_line_info' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4972' column='1' id='88565f1f'>
+      <class-decl name='bpf_line_info' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4974' column='1' id='88565f1f'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='insn_off' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4973' column='1'/>
+          <var-decl name='insn_off' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4975' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='file_name_off' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4974' column='1'/>
+          <var-decl name='file_name_off' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4976' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='line_off' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4975' column='1'/>
+          <var-decl name='line_off' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4977' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='line_col' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4976' column='1'/>
+          <var-decl name='line_col' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4978' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='8857030d'>
@@ -62449,9 +62453,9 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='51a7e6e2' size-in-bits='64' id='88b37d64'/>
-      <class-decl name='__anonymous_struct__' size-in-bits='32' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4444' column='1' id='88b40ff4'>
+      <class-decl name='__anonymous_struct__' size-in-bits='32' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4446' column='1' id='88b40ff4'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='map_id' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4445' column='1'/>
+          <var-decl name='map_id' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4447' column='1'/>
         </data-member>
       </class-decl>
       <array-type-def dimensions='1' type-id='0791d6c8' size-in-bits='768' id='88b5427c'>
@@ -62528,18 +62532,18 @@
           <var-decl name='address' type-id='7359adad' visibility='default' filepath='include/linux/mm.h' line='537' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='bpf_link_info' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4424' column='1' id='891a6859'>
+      <class-decl name='bpf_link_info' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4426' column='1' id='891a6859'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='type' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4425' column='1'/>
+          <var-decl name='type' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4427' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='id' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4426' column='1'/>
+          <var-decl name='id' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4428' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='prog_id' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4427' column='1'/>
+          <var-decl name='prog_id' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4429' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='' type-id='570caa49' visibility='default' filepath='include/uapi/linux/bpf.h' line='4428' column='1'/>
+          <var-decl name='' type-id='570caa49' visibility='default' filepath='include/uapi/linux/bpf.h' line='4430' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='891c6957'>
@@ -62967,12 +62971,12 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='149c6638' size-in-bits='64' id='8a121f49'/>
-      <class-decl name='bpf_func_info' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4964' column='1' id='8a1373a3'>
+      <class-decl name='bpf_func_info' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4966' column='1' id='8a1373a3'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='insn_off' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4965' column='1'/>
+          <var-decl name='insn_off' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4967' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='type_id' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4966' column='1'/>
+          <var-decl name='type_id' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4968' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='snd_device_ops' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/sound/core.h' line='61' column='1' id='8a1bdab0'>
@@ -63220,21 +63224,21 @@
           <var-decl name='_pkey' type-id='3f1a6b60' visibility='default' filepath='include/uapi/asm-generic/siginfo.h' line='92' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='tcp_fastopen_request' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1675' column='1' id='8a4245ed'>
+      <class-decl name='tcp_fastopen_request' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1692' column='1' id='8a4245ed'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='cookie' type-id='98fc5aa2' visibility='default' filepath='include/net/tcp.h' line='1677' column='1'/>
+          <var-decl name='cookie' type-id='98fc5aa2' visibility='default' filepath='include/net/tcp.h' line='1694' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='data' type-id='6b9b777a' visibility='default' filepath='include/net/tcp.h' line='1678' column='1'/>
+          <var-decl name='data' type-id='6b9b777a' visibility='default' filepath='include/net/tcp.h' line='1695' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='size' type-id='b59d7dce' visibility='default' filepath='include/net/tcp.h' line='1679' column='1'/>
+          <var-decl name='size' type-id='b59d7dce' visibility='default' filepath='include/net/tcp.h' line='1696' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='copied' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1680' column='1'/>
+          <var-decl name='copied' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1697' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='uarg' type-id='73789784' visibility='default' filepath='include/net/tcp.h' line='1681' column='1'/>
+          <var-decl name='uarg' type-id='73789784' visibility='default' filepath='include/net/tcp.h' line='1698' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='snd_soc_tplg_vendor_array' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/uapi/sound/asoc.h' line='218' column='1' id='8a4504f5'>
@@ -64136,45 +64140,45 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='9df4c74e' size-in-bits='64' id='8ce270a4'/>
-      <class-decl name='quotactl_ops' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='434' column='1' id='8ce4ff83'>
+      <class-decl name='quotactl_ops' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='436' column='1' id='8ce4ff83'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='quota_on' type-id='de6b64d0' visibility='default' filepath='include/linux/quota.h' line='435' column='1'/>
+          <var-decl name='quota_on' type-id='de6b64d0' visibility='default' filepath='include/linux/quota.h' line='437' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='quota_off' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='436' column='1'/>
+          <var-decl name='quota_off' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='438' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='quota_enable' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='437' column='1'/>
+          <var-decl name='quota_enable' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='439' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='quota_disable' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='438' column='1'/>
+          <var-decl name='quota_disable' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='440' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='quota_sync' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='439' column='1'/>
+          <var-decl name='quota_sync' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='441' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='set_info' type-id='4e326e06' visibility='default' filepath='include/linux/quota.h' line='440' column='1'/>
+          <var-decl name='set_info' type-id='4e326e06' visibility='default' filepath='include/linux/quota.h' line='442' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='get_dqblk' type-id='9e27a8d4' visibility='default' filepath='include/linux/quota.h' line='441' column='1'/>
+          <var-decl name='get_dqblk' type-id='9e27a8d4' visibility='default' filepath='include/linux/quota.h' line='443' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='get_nextdqblk' type-id='483e8c3a' visibility='default' filepath='include/linux/quota.h' line='442' column='1'/>
+          <var-decl name='get_nextdqblk' type-id='483e8c3a' visibility='default' filepath='include/linux/quota.h' line='444' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='set_dqblk' type-id='9e27a8d4' visibility='default' filepath='include/linux/quota.h' line='444' column='1'/>
+          <var-decl name='set_dqblk' type-id='9e27a8d4' visibility='default' filepath='include/linux/quota.h' line='446' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='get_state' type-id='eb638046' visibility='default' filepath='include/linux/quota.h' line='445' column='1'/>
+          <var-decl name='get_state' type-id='eb638046' visibility='default' filepath='include/linux/quota.h' line='447' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='rm_xquota' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='446' column='1'/>
+          <var-decl name='rm_xquota' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='448' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='448' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='450' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='449' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='451' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='e09dbee3' size-in-bits='64' id='8ceda7f7'/>
@@ -64205,7 +64209,7 @@
           <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/kobject.h' line='212' column='1'/>
         </data-member>
       </class-decl>
-      <typedef-decl name='proc_handler' type-id='99803d40' filepath='include/linux/sysctl.h' line='47' column='1' id='8cf4128f'/>
+      <typedef-decl name='proc_handler' type-id='99803d40' filepath='include/linux/sysctl.h' line='55' column='1' id='8cf4128f'/>
       <function-type size-in-bits='64' id='8cfd5cb8'>
         <parameter type-id='352b95f6'/>
         <parameter type-id='95e97e5e'/>
@@ -65929,39 +65933,39 @@
           <var-decl name='pps_short_126_reserved' type-id='84a5c3d4' visibility='default' filepath='include/drm/drm_dsc.h' line='581' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='__anonymous_struct__' size-in-bits='96' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/net/cfg80211.h' line='4715' column='1' id='904b4fe4'>
+      <class-decl name='__anonymous_struct__' size-in-bits='96' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/net/cfg80211.h' line='4718' column='1' id='904b4fe4'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='preambles' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4716' column='1'/>
+          <var-decl name='preambles' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4719' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='bandwidths' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4717' column='1'/>
+          <var-decl name='bandwidths' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4720' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='max_bursts_exponent' type-id='fdbf7a0f' visibility='default' filepath='include/net/cfg80211.h' line='4718' column='1'/>
+          <var-decl name='max_bursts_exponent' type-id='fdbf7a0f' visibility='default' filepath='include/net/cfg80211.h' line='4721' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='72'>
-          <var-decl name='max_ftms_per_burst' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4719' column='1'/>
+          <var-decl name='max_ftms_per_burst' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4722' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='supported' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4720' column='1'/>
+          <var-decl name='supported' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4723' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='asap' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4721' column='1'/>
+          <var-decl name='asap' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4724' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2'>
-          <var-decl name='non_asap' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4722' column='1'/>
+          <var-decl name='non_asap' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4725' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3'>
-          <var-decl name='request_lci' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4723' column='1'/>
+          <var-decl name='request_lci' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4726' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4'>
-          <var-decl name='request_civicloc' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4724' column='1'/>
+          <var-decl name='request_civicloc' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4727' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5'>
-          <var-decl name='trigger_based' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4725' column='1'/>
+          <var-decl name='trigger_based' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4728' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6'>
-          <var-decl name='non_trigger_based' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4726' column='1'/>
+          <var-decl name='non_trigger_based' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4729' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='904e13de'>
@@ -66590,33 +66594,33 @@
       </function-type>
       <pointer-type-def type-id='dc2316e7' size-in-bits='64' id='919b335b'/>
       <pointer-type-def type-id='138d3c05' size-in-bits='64' id='919f23a5'/>
-      <class-decl name='ctl_table' size-in-bits='512' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='114' column='1' id='91a515f9'>
+      <class-decl name='ctl_table' size-in-bits='512' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='122' column='1' id='91a515f9'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='procname' type-id='80f4b756' visibility='default' filepath='include/linux/sysctl.h' line='115' column='1'/>
+          <var-decl name='procname' type-id='80f4b756' visibility='default' filepath='include/linux/sysctl.h' line='123' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='data' type-id='eaa32e2f' visibility='default' filepath='include/linux/sysctl.h' line='116' column='1'/>
+          <var-decl name='data' type-id='eaa32e2f' visibility='default' filepath='include/linux/sysctl.h' line='124' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='maxlen' type-id='95e97e5e' visibility='default' filepath='include/linux/sysctl.h' line='117' column='1'/>
+          <var-decl name='maxlen' type-id='95e97e5e' visibility='default' filepath='include/linux/sysctl.h' line='125' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='mode' type-id='2594b00f' visibility='default' filepath='include/linux/sysctl.h' line='118' column='1'/>
+          <var-decl name='mode' type-id='2594b00f' visibility='default' filepath='include/linux/sysctl.h' line='126' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='child' type-id='631dc3c1' visibility='default' filepath='include/linux/sysctl.h' line='119' column='1'/>
+          <var-decl name='child' type-id='631dc3c1' visibility='default' filepath='include/linux/sysctl.h' line='127' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='proc_handler' type-id='66032958' visibility='default' filepath='include/linux/sysctl.h' line='120' column='1'/>
+          <var-decl name='proc_handler' type-id='66032958' visibility='default' filepath='include/linux/sysctl.h' line='128' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='poll' type-id='4dec003b' visibility='default' filepath='include/linux/sysctl.h' line='121' column='1'/>
+          <var-decl name='poll' type-id='4dec003b' visibility='default' filepath='include/linux/sysctl.h' line='129' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='extra1' type-id='eaa32e2f' visibility='default' filepath='include/linux/sysctl.h' line='122' column='1'/>
+          <var-decl name='extra1' type-id='eaa32e2f' visibility='default' filepath='include/linux/sysctl.h' line='130' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='extra2' type-id='eaa32e2f' visibility='default' filepath='include/linux/sysctl.h' line='123' column='1'/>
+          <var-decl name='extra2' type-id='eaa32e2f' visibility='default' filepath='include/linux/sysctl.h' line='131' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='91b0693b'>
@@ -68603,7 +68607,7 @@
         <return type-id='f9f4b16f'/>
       </function-type>
       <pointer-type-def type-id='b718d3f9' size-in-bits='64' id='9762ede1'/>
-      <enum-decl name='dwc3_link_state' filepath='drivers/usb/dwc3/core.h' line='789' column='1' id='9775e40e'>
+      <enum-decl name='dwc3_link_state' filepath='drivers/usb/dwc3/core.h' line='786' column='1' id='9775e40e'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='DWC3_LINK_STATE_U0' value='0'/>
         <enumerator name='DWC3_LINK_STATE_U1' value='1'/>
@@ -71550,30 +71554,30 @@
       <array-type-def dimensions='1' type-id='91ce1af9' size-in-bits='6144' id='9db16187'>
         <subrange length='96' type-id='7ff19f0f' id='1df62250'/>
       </array-type-def>
-      <class-decl name='qc_info' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='421' column='1' id='9dbdc7de'>
+      <class-decl name='qc_info' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='423' column='1' id='9dbdc7de'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='i_fieldmask' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='422' column='1'/>
+          <var-decl name='i_fieldmask' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='424' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='i_flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='423' column='1'/>
+          <var-decl name='i_flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='425' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='i_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='424' column='1'/>
+          <var-decl name='i_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='426' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='i_ino_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='426' column='1'/>
+          <var-decl name='i_ino_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='428' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='i_rt_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='427' column='1'/>
+          <var-decl name='i_rt_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='429' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='i_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='428' column='1'/>
+          <var-decl name='i_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='430' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='i_ino_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='429' column='1'/>
+          <var-decl name='i_ino_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='431' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='i_rt_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='430' column='1'/>
+          <var-decl name='i_rt_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='432' column='1'/>
         </data-member>
       </class-decl>
       <array-type-def dimensions='1' type-id='f22a8abb' size-in-bits='2432' id='9dc2293d'>
@@ -72417,15 +72421,15 @@
         <enumerator name='GRPQUOTA' value='1'/>
         <enumerator name='PRJQUOTA' value='2'/>
       </enum-decl>
-      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='1941' column='1' id='9ff2562c'>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='1943' column='1' id='9ff2562c'>
         <data-member access='public'>
-          <var-decl name='vendor_ops' type-id='1e9ca7e3' visibility='default' filepath='drivers/usb/host/xhci.h' line='1941' column='1'/>
+          <var-decl name='vendor_ops' type-id='1e9ca7e3' visibility='default' filepath='drivers/usb/host/xhci.h' line='1943' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='' type-id='156952c4' visibility='default' filepath='drivers/usb/host/xhci.h' line='1941' column='1'/>
+          <var-decl name='' type-id='156952c4' visibility='default' filepath='drivers/usb/host/xhci.h' line='1943' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='' type-id='2a125a28' visibility='default' filepath='drivers/usb/host/xhci.h' line='1941' column='1'/>
+          <var-decl name='' type-id='2a125a28' visibility='default' filepath='drivers/usb/host/xhci.h' line='1943' column='1'/>
         </data-member>
       </union-decl>
       <pointer-type-def type-id='2bf16f59' size-in-bits='64' id='a0127209'/>
@@ -72512,45 +72516,45 @@
         <parameter type-id='95e97e5e'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='rate_sample' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1047' column='1' id='a084c932'>
+      <class-decl name='rate_sample' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1051' column='1' id='a084c932'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='prior_mstamp' type-id='91ce1af9' visibility='default' filepath='include/net/tcp.h' line='1048' column='1'/>
+          <var-decl name='prior_mstamp' type-id='91ce1af9' visibility='default' filepath='include/net/tcp.h' line='1052' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='prior_delivered' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1049' column='1'/>
+          <var-decl name='prior_delivered' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1053' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='delivered' type-id='a7832498' visibility='default' filepath='include/net/tcp.h' line='1050' column='1'/>
+          <var-decl name='delivered' type-id='a7832498' visibility='default' filepath='include/net/tcp.h' line='1054' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='interval_us' type-id='bd54fe1a' visibility='default' filepath='include/net/tcp.h' line='1051' column='1'/>
+          <var-decl name='interval_us' type-id='bd54fe1a' visibility='default' filepath='include/net/tcp.h' line='1055' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='snd_interval_us' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1052' column='1'/>
+          <var-decl name='snd_interval_us' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1056' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='rcv_interval_us' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1053' column='1'/>
+          <var-decl name='rcv_interval_us' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1057' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='rtt_us' type-id='bd54fe1a' visibility='default' filepath='include/net/tcp.h' line='1054' column='1'/>
+          <var-decl name='rtt_us' type-id='bd54fe1a' visibility='default' filepath='include/net/tcp.h' line='1058' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='losses' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1055' column='1'/>
+          <var-decl name='losses' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1059' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='352'>
-          <var-decl name='acked_sacked' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1056' column='1'/>
+          <var-decl name='acked_sacked' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1060' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='prior_in_flight' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1057' column='1'/>
+          <var-decl name='prior_in_flight' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1061' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='416'>
-          <var-decl name='is_app_limited' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1058' column='1'/>
+          <var-decl name='is_app_limited' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1062' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='424'>
-          <var-decl name='is_retrans' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1059' column='1'/>
+          <var-decl name='is_retrans' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1063' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='432'>
-          <var-decl name='is_ack_delayed' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1060' column='1'/>
+          <var-decl name='is_ack_delayed' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1064' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='a08a663b'>
@@ -76493,12 +76497,12 @@
         </data-member>
       </class-decl>
       <qualified-type-def type-id='4e0399c2' const='yes' id='a87d8ed1'/>
-      <class-decl name='wq_device' size-in-bits='7232' is-struct='yes' visibility='default' filepath='kernel/workqueue.c' line='5406' column='1' id='a88ecfc8'>
+      <class-decl name='wq_device' size-in-bits='7232' is-struct='yes' visibility='default' filepath='kernel/workqueue.c' line='5413' column='1' id='a88ecfc8'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='wq' type-id='242e3d19' visibility='default' filepath='kernel/workqueue.c' line='5407' column='1'/>
+          <var-decl name='wq' type-id='242e3d19' visibility='default' filepath='kernel/workqueue.c' line='5414' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='dev' type-id='66e487eb' visibility='default' filepath='kernel/workqueue.c' line='5408' column='1'/>
+          <var-decl name='dev' type-id='66e487eb' visibility='default' filepath='kernel/workqueue.c' line='5415' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='_ddebug' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/dynamic_debug.h' line='14' column='1' id='a88f76f1'>
@@ -77261,30 +77265,30 @@
         <parameter type-id='2661e0d9'/>
         <return type-id='f0981eeb'/>
       </function-type>
-      <class-decl name='rpmsg_device' size-in-bits='7744' is-struct='yes' visibility='default' filepath='include/linux/rpmsg.h' line='51' column='1' id='aac7cb3b'>
+      <class-decl name='rpmsg_device' size-in-bits='7744' is-struct='yes' visibility='default' filepath='include/linux/rpmsg.h' line='53' column='1' id='aac7cb3b'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='dev' type-id='66e487eb' visibility='default' filepath='include/linux/rpmsg.h' line='52' column='1'/>
+          <var-decl name='dev' type-id='66e487eb' visibility='default' filepath='include/linux/rpmsg.h' line='54' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7168'>
-          <var-decl name='id' type-id='40980961' visibility='default' filepath='include/linux/rpmsg.h' line='53' column='1'/>
+          <var-decl name='id' type-id='40980961' visibility='default' filepath='include/linux/rpmsg.h' line='55' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7424'>
-          <var-decl name='driver_override' type-id='26a90f95' visibility='default' filepath='include/linux/rpmsg.h' line='54' column='1'/>
+          <var-decl name='driver_override' type-id='26a90f95' visibility='default' filepath='include/linux/rpmsg.h' line='56' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7488'>
-          <var-decl name='src' type-id='19c2251e' visibility='default' filepath='include/linux/rpmsg.h' line='55' column='1'/>
+          <var-decl name='src' type-id='19c2251e' visibility='default' filepath='include/linux/rpmsg.h' line='57' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7520'>
-          <var-decl name='dst' type-id='19c2251e' visibility='default' filepath='include/linux/rpmsg.h' line='56' column='1'/>
+          <var-decl name='dst' type-id='19c2251e' visibility='default' filepath='include/linux/rpmsg.h' line='58' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7552'>
-          <var-decl name='ept' type-id='feb59272' visibility='default' filepath='include/linux/rpmsg.h' line='57' column='1'/>
+          <var-decl name='ept' type-id='feb59272' visibility='default' filepath='include/linux/rpmsg.h' line='59' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7616'>
-          <var-decl name='announce' type-id='b50a4934' visibility='default' filepath='include/linux/rpmsg.h' line='58' column='1'/>
+          <var-decl name='announce' type-id='b50a4934' visibility='default' filepath='include/linux/rpmsg.h' line='60' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7680'>
-          <var-decl name='ops' type-id='d884146d' visibility='default' filepath='include/linux/rpmsg.h' line='60' column='1'/>
+          <var-decl name='ops' type-id='d884146d' visibility='default' filepath='include/linux/rpmsg.h' line='62' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='e4af473b' size-in-bits='64' id='aad24a5b'/>
@@ -77318,15 +77322,15 @@
         <enumerator name='DEVFREQ_TIMER_NUM' value='2'/>
       </enum-decl>
       <pointer-type-def type-id='644441a6' size-in-bits='64' id='aae3718c'/>
-      <class-decl name='dwc3_gadget_ep_cmd_params' size-in-bits='96' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1482' column='1' id='aaf4c449'>
+      <class-decl name='dwc3_gadget_ep_cmd_params' size-in-bits='96' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1479' column='1' id='aaf4c449'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='param2' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1483' column='1'/>
+          <var-decl name='param2' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1480' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='param1' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1484' column='1'/>
+          <var-decl name='param1' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1481' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='param0' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1485' column='1'/>
+          <var-decl name='param0' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1482' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='173cc5a0' size-in-bits='64' id='ab05e282'/>
@@ -77929,9 +77933,9 @@
       <pointer-type-def type-id='512ac7cc' size-in-bits='64' id='ac58af12'/>
       <pointer-type-def type-id='b254b8db' size-in-bits='64' id='ac5f2363'/>
       <pointer-type-def type-id='49a0ad34' size-in-bits='64' id='ac6963b2'/>
-      <class-decl name='prot_inuse' size-in-bits='2048' is-struct='yes' visibility='default' filepath='net/core/sock.c' line='3341' column='1' id='ac763c5d'>
+      <class-decl name='prot_inuse' size-in-bits='2048' is-struct='yes' visibility='default' filepath='net/core/sock.c' line='3356' column='1' id='ac763c5d'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='val' type-id='93e41790' visibility='default' filepath='net/core/sock.c' line='3342' column='1'/>
+          <var-decl name='val' type-id='93e41790' visibility='default' filepath='net/core/sock.c' line='3357' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='ac765b39'>
@@ -78347,18 +78351,18 @@
       <pointer-type-def type-id='476ef610' size-in-bits='64' id='addd4a1a'/>
       <pointer-type-def type-id='1302297b' size-in-bits='64' id='adec6207'/>
       <pointer-type-def type-id='51bb592e' size-in-bits='64' id='aded214c'/>
-      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/net/sock.h' line='1276' column='1' id='adf5bf47'>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/net/sock.h' line='1277' column='1' id='adf5bf47'>
         <data-member access='public'>
-          <var-decl name='hashinfo' type-id='d7a1e3c2' visibility='default' filepath='include/net/sock.h' line='1277' column='1'/>
+          <var-decl name='hashinfo' type-id='d7a1e3c2' visibility='default' filepath='include/net/sock.h' line='1278' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='udp_table' type-id='115daa23' visibility='default' filepath='include/net/sock.h' line='1278' column='1'/>
+          <var-decl name='udp_table' type-id='115daa23' visibility='default' filepath='include/net/sock.h' line='1279' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='raw_hash' type-id='eb2c56dc' visibility='default' filepath='include/net/sock.h' line='1279' column='1'/>
+          <var-decl name='raw_hash' type-id='eb2c56dc' visibility='default' filepath='include/net/sock.h' line='1280' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='smc_hash' type-id='aa8162a3' visibility='default' filepath='include/net/sock.h' line='1280' column='1'/>
+          <var-decl name='smc_hash' type-id='aa8162a3' visibility='default' filepath='include/net/sock.h' line='1281' column='1'/>
         </data-member>
       </union-decl>
       <qualified-type-def type-id='014e0a24' const='yes' id='adff645d'/>
@@ -79223,54 +79227,54 @@
       </enum-decl>
       <pointer-type-def type-id='3f9037c9' size-in-bits='64' id='aef0224d'/>
       <pointer-type-def type-id='e32a3610' size-in-bits='64' id='aef13606'/>
-      <class-decl name='qc_dqblk' size-in-bits='960' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='349' column='1' id='aef83a98'>
+      <class-decl name='qc_dqblk' size-in-bits='960' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='351' column='1' id='aef83a98'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='d_fieldmask' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='350' column='1'/>
+          <var-decl name='d_fieldmask' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='352' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='d_spc_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='351' column='1'/>
+          <var-decl name='d_spc_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='353' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='d_spc_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='352' column='1'/>
+          <var-decl name='d_spc_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='354' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='d_ino_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='353' column='1'/>
+          <var-decl name='d_ino_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='355' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='d_ino_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='354' column='1'/>
+          <var-decl name='d_ino_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='356' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='d_space' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='355' column='1'/>
+          <var-decl name='d_space' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='357' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='d_ino_count' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='356' column='1'/>
+          <var-decl name='d_ino_count' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='358' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='d_ino_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='357' column='1'/>
+          <var-decl name='d_ino_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='359' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='d_spc_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='359' column='1'/>
+          <var-decl name='d_spc_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='361' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='d_ino_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='360' column='1'/>
+          <var-decl name='d_ino_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='362' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='608'>
-          <var-decl name='d_spc_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='361' column='1'/>
+          <var-decl name='d_spc_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='363' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='d_rt_spc_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='362' column='1'/>
+          <var-decl name='d_rt_spc_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='364' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='d_rt_spc_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='363' column='1'/>
+          <var-decl name='d_rt_spc_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='365' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='d_rt_space' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='364' column='1'/>
+          <var-decl name='d_rt_space' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='366' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='d_rt_spc_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='365' column='1'/>
+          <var-decl name='d_rt_spc_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='367' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='d_rt_spc_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='366' column='1'/>
+          <var-decl name='d_rt_spc_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='368' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='aefe43a8'>
@@ -81557,42 +81561,42 @@
         <parameter type-id='7359adad'/>
         <return type-id='bd54fe1a'/>
       </function-type>
-      <class-decl name='platform_device_info' size-in-bits='768' is-struct='yes' visibility='default' filepath='include/linux/platform_device.h' line='85' column='1' id='b4a2c74e'>
+      <class-decl name='platform_device_info' size-in-bits='768' is-struct='yes' visibility='default' filepath='include/linux/platform_device.h' line='89' column='1' id='b4a2c74e'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='parent' type-id='fa0b179b' visibility='default' filepath='include/linux/platform_device.h' line='86' column='1'/>
+          <var-decl name='parent' type-id='fa0b179b' visibility='default' filepath='include/linux/platform_device.h' line='90' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='fwnode' type-id='4a935625' visibility='default' filepath='include/linux/platform_device.h' line='87' column='1'/>
+          <var-decl name='fwnode' type-id='4a935625' visibility='default' filepath='include/linux/platform_device.h' line='91' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='of_node_reused' type-id='b50a4934' visibility='default' filepath='include/linux/platform_device.h' line='88' column='1'/>
+          <var-decl name='of_node_reused' type-id='b50a4934' visibility='default' filepath='include/linux/platform_device.h' line='92' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='include/linux/platform_device.h' line='90' column='1'/>
+          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='include/linux/platform_device.h' line='94' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='id' type-id='95e97e5e' visibility='default' filepath='include/linux/platform_device.h' line='91' column='1'/>
+          <var-decl name='id' type-id='95e97e5e' visibility='default' filepath='include/linux/platform_device.h' line='95' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='res' type-id='e153f6de' visibility='default' filepath='include/linux/platform_device.h' line='93' column='1'/>
+          <var-decl name='res' type-id='e153f6de' visibility='default' filepath='include/linux/platform_device.h' line='97' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='num_res' type-id='f0981eeb' visibility='default' filepath='include/linux/platform_device.h' line='94' column='1'/>
+          <var-decl name='num_res' type-id='f0981eeb' visibility='default' filepath='include/linux/platform_device.h' line='98' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='data' type-id='eaa32e2f' visibility='default' filepath='include/linux/platform_device.h' line='96' column='1'/>
+          <var-decl name='data' type-id='eaa32e2f' visibility='default' filepath='include/linux/platform_device.h' line='100' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='size_data' type-id='b59d7dce' visibility='default' filepath='include/linux/platform_device.h' line='97' column='1'/>
+          <var-decl name='size_data' type-id='b59d7dce' visibility='default' filepath='include/linux/platform_device.h' line='101' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='dma_mask' type-id='91ce1af9' visibility='default' filepath='include/linux/platform_device.h' line='98' column='1'/>
+          <var-decl name='dma_mask' type-id='91ce1af9' visibility='default' filepath='include/linux/platform_device.h' line='102' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='properties' type-id='9e1d140c' visibility='default' filepath='include/linux/platform_device.h' line='100' column='1'/>
+          <var-decl name='properties' type-id='9e1d140c' visibility='default' filepath='include/linux/platform_device.h' line='104' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/platform_device.h' line='102' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/platform_device.h' line='106' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='xfrm_address_filter' size-in-bits='288' is-struct='yes' visibility='default' filepath='include/uapi/linux/xfrm.h' line='496' column='1' id='b4a65d38'>
@@ -83125,7 +83129,7 @@
           <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/psample.h' line='14' column='1'/>
         </data-member>
       </class-decl>
-      <enum-decl name='cfg80211_signal_type' filepath='include/net/cfg80211.h' line='2386' column='1' id='b8524648'>
+      <enum-decl name='cfg80211_signal_type' filepath='include/net/cfg80211.h' line='2389' column='1' id='b8524648'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='CFG80211_SIGNAL_TYPE_NONE' value='0'/>
         <enumerator name='CFG80211_SIGNAL_TYPE_MBM' value='1'/>
@@ -83564,73 +83568,73 @@
           <var-decl name='quirks' type-id='3a47d82b' visibility='default' filepath='drivers/usb/host/xhci.h' line='1855' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='21120'>
-          <var-decl name='num_active_eps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1912' column='1'/>
+          <var-decl name='num_active_eps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1914' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='21152'>
-          <var-decl name='limit_active_eps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1913' column='1'/>
+          <var-decl name='limit_active_eps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1915' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='21184'>
-          <var-decl name='hw_ports' type-id='4add39c5' visibility='default' filepath='drivers/usb/host/xhci.h' line='1914' column='1'/>
+          <var-decl name='hw_ports' type-id='4add39c5' visibility='default' filepath='drivers/usb/host/xhci.h' line='1916' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='21248'>
-          <var-decl name='usb2_rhub' type-id='d2c7a2c1' visibility='default' filepath='drivers/usb/host/xhci.h' line='1915' column='1'/>
+          <var-decl name='usb2_rhub' type-id='d2c7a2c1' visibility='default' filepath='drivers/usb/host/xhci.h' line='1917' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='39744'>
-          <var-decl name='usb3_rhub' type-id='d2c7a2c1' visibility='default' filepath='drivers/usb/host/xhci.h' line='1916' column='1'/>
+          <var-decl name='usb3_rhub' type-id='d2c7a2c1' visibility='default' filepath='drivers/usb/host/xhci.h' line='1918' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hw_lpm_support' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1918' column='1'/>
+          <var-decl name='hw_lpm_support' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1920' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='broken_suspend' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1920' column='1'/>
+          <var-decl name='broken_suspend' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1922' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='58304'>
-          <var-decl name='ext_caps' type-id='f9409001' visibility='default' filepath='drivers/usb/host/xhci.h' line='1922' column='1'/>
+          <var-decl name='ext_caps' type-id='f9409001' visibility='default' filepath='drivers/usb/host/xhci.h' line='1924' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='58368'>
-          <var-decl name='num_ext_caps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1923' column='1'/>
+          <var-decl name='num_ext_caps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1925' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='58432'>
-          <var-decl name='port_caps' type-id='aae3718c' visibility='default' filepath='drivers/usb/host/xhci.h' line='1925' column='1'/>
+          <var-decl name='port_caps' type-id='aae3718c' visibility='default' filepath='drivers/usb/host/xhci.h' line='1927' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='58496'>
-          <var-decl name='num_port_caps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1926' column='1'/>
+          <var-decl name='num_port_caps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1928' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='58560'>
-          <var-decl name='comp_mode_recovery_timer' type-id='abe41e67' visibility='default' filepath='drivers/usb/host/xhci.h' line='1928' column='1'/>
+          <var-decl name='comp_mode_recovery_timer' type-id='abe41e67' visibility='default' filepath='drivers/usb/host/xhci.h' line='1930' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59008'>
-          <var-decl name='port_status_u0' type-id='19c2251e' visibility='default' filepath='drivers/usb/host/xhci.h' line='1929' column='1'/>
+          <var-decl name='port_status_u0' type-id='19c2251e' visibility='default' filepath='drivers/usb/host/xhci.h' line='1931' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59040'>
-          <var-decl name='test_mode' type-id='1dc6a898' visibility='default' filepath='drivers/usb/host/xhci.h' line='1930' column='1'/>
+          <var-decl name='test_mode' type-id='1dc6a898' visibility='default' filepath='drivers/usb/host/xhci.h' line='1932' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59072'>
-          <var-decl name='debugfs_root' type-id='27675065' visibility='default' filepath='drivers/usb/host/xhci.h' line='1934' column='1'/>
+          <var-decl name='debugfs_root' type-id='27675065' visibility='default' filepath='drivers/usb/host/xhci.h' line='1936' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59136'>
-          <var-decl name='debugfs_slots' type-id='27675065' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
+          <var-decl name='debugfs_slots' type-id='27675065' visibility='default' filepath='drivers/usb/host/xhci.h' line='1937' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59200'>
-          <var-decl name='regset_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/xhci.h' line='1936' column='1'/>
+          <var-decl name='regset_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/xhci.h' line='1938' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59328'>
-          <var-decl name='dbc' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/host/xhci.h' line='1938' column='1'/>
+          <var-decl name='dbc' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/host/xhci.h' line='1940' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59392'>
-          <var-decl name='' type-id='9ff2562c' visibility='default' filepath='drivers/usb/host/xhci.h' line='1941' column='1'/>
+          <var-decl name='' type-id='9ff2562c' visibility='default' filepath='drivers/usb/host/xhci.h' line='1943' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59456'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1943' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1945' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59520'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1944' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1946' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59584'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1945' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1947' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59648'>
-          <var-decl name='priv' type-id='c99b5ecd' visibility='default' filepath='drivers/usb/host/xhci.h' line='1948' column='1'/>
+          <var-decl name='priv' type-id='c99b5ecd' visibility='default' filepath='drivers/usb/host/xhci.h' line='1950' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='439a4d86' size-in-bits='64' id='b8fa1170'/>
@@ -84050,18 +84054,18 @@
           <var-decl name='mask' type-id='69281b5f' visibility='default' filepath='include/net/flow_offload.h' line='48' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='event_subsystem' size-in-bits='320' is-struct='yes' visibility='default' filepath='kernel/trace/trace.h' line='1433' column='1' id='ba400603'>
+      <class-decl name='event_subsystem' size-in-bits='320' is-struct='yes' visibility='default' filepath='kernel/trace/trace.h' line='1436' column='1' id='ba400603'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='kernel/trace/trace.h' line='1434' column='1'/>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='kernel/trace/trace.h' line='1437' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='kernel/trace/trace.h' line='1435' column='1'/>
+          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='kernel/trace/trace.h' line='1438' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='filter' type-id='26461068' visibility='default' filepath='kernel/trace/trace.h' line='1436' column='1'/>
+          <var-decl name='filter' type-id='26461068' visibility='default' filepath='kernel/trace/trace.h' line='1439' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='ref_count' type-id='95e97e5e' visibility='default' filepath='kernel/trace/trace.h' line='1437' column='1'/>
+          <var-decl name='ref_count' type-id='95e97e5e' visibility='default' filepath='kernel/trace/trace.h' line='1440' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='net_device_ops' size-in-bits='4992' is-struct='yes' visibility='default' filepath='include/linux/netdevice.h' line='1326' column='1' id='ba44c7d8'>
@@ -87547,12 +87551,12 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='59bcd074' size-in-bits='64' id='bea4d586'/>
-      <class-decl name='ctl_node' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='126' column='1' id='beafd747'>
+      <class-decl name='ctl_node' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='134' column='1' id='beafd747'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='node' type-id='2a8a6332' visibility='default' filepath='include/linux/sysctl.h' line='127' column='1'/>
+          <var-decl name='node' type-id='2a8a6332' visibility='default' filepath='include/linux/sysctl.h' line='135' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='header' type-id='11b101bb' visibility='default' filepath='include/linux/sysctl.h' line='128' column='1'/>
+          <var-decl name='header' type-id='11b101bb' visibility='default' filepath='include/linux/sysctl.h' line='136' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='5fffc559' size-in-bits='64' id='beb4f24d'/>
@@ -88973,21 +88977,21 @@
         </data-member>
       </class-decl>
       <qualified-type-def type-id='9d0ae2a2' const='yes' id='c2623161'/>
-      <class-decl name='quota_info' size-in-bits='2688' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='527' column='1' id='c26e4ad8'>
+      <class-decl name='quota_info' size-in-bits='2688' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='529' column='1' id='c26e4ad8'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='528' column='1'/>
+          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='530' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='dqio_sem' type-id='f19fdb93' visibility='default' filepath='include/linux/quota.h' line='529' column='1'/>
+          <var-decl name='dqio_sem' type-id='f19fdb93' visibility='default' filepath='include/linux/quota.h' line='531' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='files' type-id='e6ff92fb' visibility='default' filepath='include/linux/quota.h' line='530' column='1'/>
+          <var-decl name='files' type-id='e6ff92fb' visibility='default' filepath='include/linux/quota.h' line='532' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='info' type-id='83ae09a1' visibility='default' filepath='include/linux/quota.h' line='531' column='1'/>
+          <var-decl name='info' type-id='83ae09a1' visibility='default' filepath='include/linux/quota.h' line='533' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2496'>
-          <var-decl name='ops' type-id='59bd9302' visibility='default' filepath='include/linux/quota.h' line='532' column='1'/>
+          <var-decl name='ops' type-id='59bd9302' visibility='default' filepath='include/linux/quota.h' line='534' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='fib_rule_port_range' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/uapi/linux/fib_rules.h' line='38' column='1' id='c27f07e7'>
@@ -89086,18 +89090,18 @@
           <var-decl name='lock' type-id='925167dc' visibility='default' filepath='include/media/cec.h' line='49' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='quota_format_type' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='452' column='1' id='c2be49b0'>
+      <class-decl name='quota_format_type' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='454' column='1' id='c2be49b0'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='qf_fmt_id' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='453' column='1'/>
+          <var-decl name='qf_fmt_id' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='455' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='qf_ops' type-id='bd561d05' visibility='default' filepath='include/linux/quota.h' line='454' column='1'/>
+          <var-decl name='qf_ops' type-id='bd561d05' visibility='default' filepath='include/linux/quota.h' line='456' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='qf_owner' type-id='2730d015' visibility='default' filepath='include/linux/quota.h' line='455' column='1'/>
+          <var-decl name='qf_owner' type-id='2730d015' visibility='default' filepath='include/linux/quota.h' line='457' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='qf_next' type-id='eb9a3ab6' visibility='default' filepath='include/linux/quota.h' line='456' column='1'/>
+          <var-decl name='qf_next' type-id='eb9a3ab6' visibility='default' filepath='include/linux/quota.h' line='458' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='c2be64d1'>
@@ -91821,15 +91825,15 @@
           <var-decl name='target_kn' type-id='150efd3f' visibility='default' filepath='include/linux/kernfs.h' line='105' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='wiphy_iftype_akm_suites' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4739' column='1' id='c86a8a16'>
+      <class-decl name='wiphy_iftype_akm_suites' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4742' column='1' id='c86a8a16'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='iftypes_mask' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4740' column='1'/>
+          <var-decl name='iftypes_mask' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4743' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='akm_suites' type-id='aded214c' visibility='default' filepath='include/net/cfg80211.h' line='4741' column='1'/>
+          <var-decl name='akm_suites' type-id='aded214c' visibility='default' filepath='include/net/cfg80211.h' line='4744' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='n_akm_suites' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4742' column='1'/>
+          <var-decl name='n_akm_suites' type-id='95e97e5e' visibility='default' filepath='include/net/cfg80211.h' line='4745' column='1'/>
         </data-member>
       </class-decl>
       <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/linux/property.h' line='271' column='1' id='c86de178'>
@@ -93714,15 +93718,15 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='cfe4f8a2' size-in-bits='64' id='cd733e18'/>
-      <class-decl name='ack_sample' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1033' column='1' id='cd7d3c9d'>
+      <class-decl name='ack_sample' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1037' column='1' id='cd7d3c9d'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='pkts_acked' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1034' column='1'/>
+          <var-decl name='pkts_acked' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1038' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='rtt_us' type-id='a7832498' visibility='default' filepath='include/net/tcp.h' line='1035' column='1'/>
+          <var-decl name='rtt_us' type-id='a7832498' visibility='default' filepath='include/net/tcp.h' line='1039' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='in_flight' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1036' column='1'/>
+          <var-decl name='in_flight' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1040' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='phylink_link_state' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/phylink.h' line='43' column='1' id='cd8ce92b'>
@@ -96300,12 +96304,12 @@
           <var-decl name='xa_head' type-id='eaa32e2f' visibility='default' filepath='include/linux/xarray.h' line='296' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='ctl_table_poll' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='96' column='1' id='d39c42ab'>
+      <class-decl name='ctl_table_poll' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='104' column='1' id='d39c42ab'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='event' type-id='49178f86' visibility='default' filepath='include/linux/sysctl.h' line='97' column='1'/>
+          <var-decl name='event' type-id='49178f86' visibility='default' filepath='include/linux/sysctl.h' line='105' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='wait' type-id='b5ab048f' visibility='default' filepath='include/linux/sysctl.h' line='98' column='1'/>
+          <var-decl name='wait' type-id='b5ab048f' visibility='default' filepath='include/linux/sysctl.h' line='106' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='ld_semaphore' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/tty_ldisc.h' line='134' column='1' id='d3aa38f0'>
@@ -96750,7 +96754,17 @@
       </array-type-def>
       <pointer-type-def type-id='9b08f7cd' size-in-bits='64' id='d504f73d'/>
       <pointer-type-def type-id='8edc59cf' size-in-bits='64' id='d507826b'/>
-      <class-decl name='fscrypt_blk_crypto_key' is-struct='yes' visibility='default' is-declaration-only='yes' id='d509ab32'/>
+      <class-decl name='fscrypt_blk_crypto_key' size-in-bits='1280' is-struct='yes' visibility='default' filepath='fs/crypto/inline_crypt.c' line='25' column='1' id='d509ab32'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='base' type-id='7b61b7b4' visibility='default' filepath='fs/crypto/inline_crypt.c' line='26' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1216'>
+          <var-decl name='num_devs' type-id='95e97e5e' visibility='default' filepath='fs/crypto/inline_crypt.c' line='27' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1280'>
+          <var-decl name='devs' type-id='60a540a8' visibility='default' filepath='fs/crypto/inline_crypt.c' line='28' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='kmsg_dumper' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/kmsg_dump.h' line='40' column='1' id='d50d3459'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/linux/kmsg_dump.h' line='41' column='1'/>
@@ -98328,18 +98342,18 @@
       </array-type-def>
       <pointer-type-def type-id='c90a6da1' size-in-bits='64' id='d8378d75'/>
       <pointer-type-def type-id='41df3a6f' size-in-bits='64' id='d8385083'/>
-      <class-decl name='ctl_table_root' size-in-bits='960' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='163' column='1' id='d83969a6'>
+      <class-decl name='ctl_table_root' size-in-bits='960' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='171' column='1' id='d83969a6'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='default_set' type-id='3fc3d262' visibility='default' filepath='include/linux/sysctl.h' line='164' column='1'/>
+          <var-decl name='default_set' type-id='3fc3d262' visibility='default' filepath='include/linux/sysctl.h' line='172' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='lookup' type-id='50abd760' visibility='default' filepath='include/linux/sysctl.h' line='165' column='1'/>
+          <var-decl name='lookup' type-id='50abd760' visibility='default' filepath='include/linux/sysctl.h' line='173' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='set_ownership' type-id='47727520' visibility='default' filepath='include/linux/sysctl.h' line='166' column='1'/>
+          <var-decl name='set_ownership' type-id='47727520' visibility='default' filepath='include/linux/sysctl.h' line='174' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='permissions' type-id='7bada959' visibility='default' filepath='include/linux/sysctl.h' line='169' column='1'/>
+          <var-decl name='permissions' type-id='7bada959' visibility='default' filepath='include/linux/sysctl.h' line='177' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='4322685c' size-in-bits='64' id='d839e3f6'/>
@@ -100509,78 +100523,78 @@
       </function-type>
       <pointer-type-def type-id='e0ed16c6' size-in-bits='64' id='dc18a9b0'/>
       <typedef-decl name='gro_result_t' type-id='3facc5aa' filepath='include/linux/netdevice.h' line='391' column='1' id='dc1b1685'/>
-      <class-decl name='dwc3_ep' size-in-bits='1856' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='706' column='1' id='dc1b9a32'>
+      <class-decl name='dwc3_ep' size-in-bits='1856' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='703' column='1' id='dc1b9a32'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='endpoint' type-id='8005701f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='707' column='1'/>
+          <var-decl name='endpoint' type-id='8005701f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='704' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='cancelled_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/dwc3/core.h' line='708' column='1'/>
+          <var-decl name='cancelled_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/dwc3/core.h' line='705' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='pending_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/dwc3/core.h' line='709' column='1'/>
+          <var-decl name='pending_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/dwc3/core.h' line='706' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='started_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/dwc3/core.h' line='710' column='1'/>
+          <var-decl name='started_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/dwc3/core.h' line='707' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='regs' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='712' column='1'/>
+          <var-decl name='regs' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='709' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='trb_pool' type-id='0d6a59e1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='714' column='1'/>
+          <var-decl name='trb_pool' type-id='0d6a59e1' visibility='default' filepath='drivers/usb/dwc3/core.h' line='711' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='trb_pool_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='715' column='1'/>
+          <var-decl name='trb_pool_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='712' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='dwc' type-id='5ac4ba20' visibility='default' filepath='drivers/usb/dwc3/core.h' line='716' column='1'/>
+          <var-decl name='dwc' type-id='5ac4ba20' visibility='default' filepath='drivers/usb/dwc3/core.h' line='713' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='saved_state' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='718' column='1'/>
+          <var-decl name='saved_state' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='715' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1312'>
-          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='719' column='1'/>
+          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='716' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='trb_enqueue' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='747' column='1'/>
+          <var-decl name='trb_enqueue' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='744' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1352'>
-          <var-decl name='trb_dequeue' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='748' column='1'/>
+          <var-decl name='trb_dequeue' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='745' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1360'>
-          <var-decl name='number' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='750' column='1'/>
+          <var-decl name='number' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='747' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1368'>
-          <var-decl name='type' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='751' column='1'/>
+          <var-decl name='type' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='748' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1376'>
-          <var-decl name='resource_index' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='752' column='1'/>
+          <var-decl name='resource_index' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='749' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='frame_number' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='753' column='1'/>
+          <var-decl name='frame_number' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='750' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1440'>
-          <var-decl name='interval' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='754' column='1'/>
+          <var-decl name='interval' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='751' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='name' type-id='664ac0b7' visibility='default' filepath='drivers/usb/dwc3/core.h' line='756' column='1'/>
+          <var-decl name='name' type-id='664ac0b7' visibility='default' filepath='drivers/usb/dwc3/core.h' line='753' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='direction' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='758' column='1'/>
+          <var-decl name='direction' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='755' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='stream_capable' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='759' column='1'/>
+          <var-decl name='stream_capable' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='756' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1640'>
-          <var-decl name='combo_num' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='762' column='1'/>
+          <var-decl name='combo_num' type-id='f9b06939' visibility='default' filepath='drivers/usb/dwc3/core.h' line='759' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='start_cmd_status' type-id='95e97e5e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='763' column='1'/>
+          <var-decl name='start_cmd_status' type-id='95e97e5e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='760' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1728'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='765' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='762' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1792'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='766' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='763' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='a9559bf8' size-in-bits='64' id='dc1e097e'/>
@@ -102905,24 +102919,24 @@
           <var-decl name='sdev_data' type-id='c99b5ecd' visibility='default' filepath='include/scsi/scsi_device.h' line='247' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='cfg80211_chan_def' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='692' column='1' id='e07d69c8'>
+      <class-decl name='cfg80211_chan_def' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='695' column='1' id='e07d69c8'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='chan' type-id='ec00acfb' visibility='default' filepath='include/net/cfg80211.h' line='693' column='1'/>
+          <var-decl name='chan' type-id='ec00acfb' visibility='default' filepath='include/net/cfg80211.h' line='696' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='width' type-id='e043cccc' visibility='default' filepath='include/net/cfg80211.h' line='694' column='1'/>
+          <var-decl name='width' type-id='e043cccc' visibility='default' filepath='include/net/cfg80211.h' line='697' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='center_freq1' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='695' column='1'/>
+          <var-decl name='center_freq1' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='698' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='center_freq2' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='696' column='1'/>
+          <var-decl name='center_freq2' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='699' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='edmg' type-id='d87e6929' visibility='default' filepath='include/net/cfg80211.h' line='697' column='1'/>
+          <var-decl name='edmg' type-id='d87e6929' visibility='default' filepath='include/net/cfg80211.h' line='700' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='freq1_offset' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='698' column='1'/>
+          <var-decl name='freq1_offset' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='701' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='bpf_link' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='893' column='1' id='e07e9784'>
@@ -104822,12 +104836,12 @@
       <qualified-type-def type-id='ebd46aa4' const='yes' id='e4664ea7'/>
       <pointer-type-def type-id='07c93537' size-in-bits='64' id='e46f66f3'/>
       <typedef-decl name='uintptr_t' type-id='7359adad' filepath='include/linux/types.h' line='37' column='1' id='e475ab95'/>
-      <class-decl name='ieee80211_iface_limit' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4389' column='1' id='e47a5a92'>
+      <class-decl name='ieee80211_iface_limit' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4392' column='1' id='e47a5a92'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='max' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4390' column='1'/>
+          <var-decl name='max' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4393' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='16'>
-          <var-decl name='types' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4391' column='1'/>
+          <var-decl name='types' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='4394' column='1'/>
         </data-member>
       </class-decl>
       <array-type-def dimensions='1' type-id='f22a8abb' size-in-bits='2624' id='e486d27d'>
@@ -105178,21 +105192,21 @@
       <qualified-type-def type-id='fe71fd28' const='yes' id='e53f43b5'/>
       <pointer-type-def type-id='d6a54726' size-in-bits='64' id='e5411c2c'/>
       <qualified-type-def type-id='ff1a03f4' const='yes' id='e542e4ad'/>
-      <class-decl name='cgroup_namespace' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/cgroup.h' line='868' column='1' id='e54806c5'>
+      <class-decl name='cgroup_namespace' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/cgroup.h' line='867' column='1' id='e54806c5'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='count' type-id='64615833' visibility='default' filepath='include/linux/cgroup.h' line='869' column='1'/>
+          <var-decl name='count' type-id='64615833' visibility='default' filepath='include/linux/cgroup.h' line='868' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='ns' type-id='99f367f2' visibility='default' filepath='include/linux/cgroup.h' line='870' column='1'/>
+          <var-decl name='ns' type-id='99f367f2' visibility='default' filepath='include/linux/cgroup.h' line='869' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='user_ns' type-id='c0ced320' visibility='default' filepath='include/linux/cgroup.h' line='871' column='1'/>
+          <var-decl name='user_ns' type-id='c0ced320' visibility='default' filepath='include/linux/cgroup.h' line='870' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='ucounts' type-id='b1d4934a' visibility='default' filepath='include/linux/cgroup.h' line='872' column='1'/>
+          <var-decl name='ucounts' type-id='b1d4934a' visibility='default' filepath='include/linux/cgroup.h' line='871' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='root_cset' type-id='85d57723' visibility='default' filepath='include/linux/cgroup.h' line='873' column='1'/>
+          <var-decl name='root_cset' type-id='85d57723' visibility='default' filepath='include/linux/cgroup.h' line='872' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='e5507ab5'>
@@ -105929,33 +105943,33 @@
           <var-decl name='sysfs_groups' type-id='9f18d529' visibility='default' filepath='include/linux/led-class-flash.h' line='79' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='dwc3_event_buffer' size-in-bits='448' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='654' column='1' id='e6ab9148'>
+      <class-decl name='dwc3_event_buffer' size-in-bits='448' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='651' column='1' id='e6ab9148'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='buf' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='655' column='1'/>
+          <var-decl name='buf' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='652' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='cache' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='656' column='1'/>
+          <var-decl name='cache' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='653' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='length' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='657' column='1'/>
+          <var-decl name='length' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='654' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='lpos' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='658' column='1'/>
+          <var-decl name='lpos' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='655' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='count' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='659' column='1'/>
+          <var-decl name='count' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='656' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='660' column='1'/>
+          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='drivers/usb/dwc3/core.h' line='657' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='664' column='1'/>
+          <var-decl name='dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/dwc3/core.h' line='661' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='dwc' type-id='5ac4ba20' visibility='default' filepath='drivers/usb/dwc3/core.h' line='666' column='1'/>
+          <var-decl name='dwc' type-id='5ac4ba20' visibility='default' filepath='drivers/usb/dwc3/core.h' line='663' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='668' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/usb/dwc3/core.h' line='665' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='e6af544d'>
@@ -106458,36 +106472,36 @@
           <var-decl name='reverse' type-id='9b105293' visibility='default' filepath='include/linux/user_namespace.h' line='30' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='qc_type_state' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='401' column='1' id='e878d564'>
+      <class-decl name='qc_type_state' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='403' column='1' id='e878d564'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='402' column='1'/>
+          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='404' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='403' column='1'/>
+          <var-decl name='spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='405' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='ino_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='405' column='1'/>
+          <var-decl name='ino_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='407' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='rt_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='406' column='1'/>
+          <var-decl name='rt_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='408' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='407' column='1'/>
+          <var-decl name='spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='409' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='ino_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='408' column='1'/>
+          <var-decl name='ino_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='410' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='rt_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='409' column='1'/>
+          <var-decl name='rt_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='411' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='ino' type-id='3a47d82b' visibility='default' filepath='include/linux/quota.h' line='410' column='1'/>
+          <var-decl name='ino' type-id='3a47d82b' visibility='default' filepath='include/linux/quota.h' line='412' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='blocks' type-id='17345459' visibility='default' filepath='include/linux/quota.h' line='411' column='1'/>
+          <var-decl name='blocks' type-id='17345459' visibility='default' filepath='include/linux/quota.h' line='413' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='nextents' type-id='17345459' visibility='default' filepath='include/linux/quota.h' line='412' column='1'/>
+          <var-decl name='nextents' type-id='17345459' visibility='default' filepath='include/linux/quota.h' line='414' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='c3fc04e5' size-in-bits='64' id='e879a339'/>
@@ -107058,18 +107072,18 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='df81074e' size-in-bits='64' id='e9b5d134'/>
-      <class-decl name='cfg80211_pmsr_capabilities' size-in-bits='160' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4710' column='1' id='e9bb2749'>
+      <class-decl name='cfg80211_pmsr_capabilities' size-in-bits='160' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4713' column='1' id='e9bb2749'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='max_peers' type-id='f0981eeb' visibility='default' filepath='include/net/cfg80211.h' line='4711' column='1'/>
+          <var-decl name='max_peers' type-id='f0981eeb' visibility='default' filepath='include/net/cfg80211.h' line='4714' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='report_ap_tsf' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4712' column='1'/>
+          <var-decl name='report_ap_tsf' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4715' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='randomize_mac_addr' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4713' column='1'/>
+          <var-decl name='randomize_mac_addr' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='4716' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='ftm' type-id='904b4fe4' visibility='default' filepath='include/net/cfg80211.h' line='4727' column='1'/>
+          <var-decl name='ftm' type-id='904b4fe4' visibility='default' filepath='include/net/cfg80211.h' line='4730' column='1'/>
         </data-member>
       </class-decl>
       <union-decl name='__anonymous_union__' size-in-bits='704' is-anonymous='yes' visibility='default' filepath='include/net/flow.h' line='175' column='1' id='e9bb6246'>
@@ -108801,30 +108815,30 @@
         <subrange length='64' type-id='7ff19f0f' id='b10be967'/>
       </array-type-def>
       <pointer-type-def type-id='f6ed712a' size-in-bits='64' id='ed512028'/>
-      <class-decl name='ctl_table_header' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='133' column='1' id='ed51618b'>
+      <class-decl name='ctl_table_header' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/sysctl.h' line='141' column='1' id='ed51618b'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='' type-id='201d54e5' visibility='default' filepath='include/linux/sysctl.h' line='134' column='1'/>
+          <var-decl name='' type-id='201d54e5' visibility='default' filepath='include/linux/sysctl.h' line='142' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='unregistering' type-id='389faaf7' visibility='default' filepath='include/linux/sysctl.h' line='143' column='1'/>
+          <var-decl name='unregistering' type-id='389faaf7' visibility='default' filepath='include/linux/sysctl.h' line='151' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='ctl_table_arg' type-id='631dc3c1' visibility='default' filepath='include/linux/sysctl.h' line='144' column='1'/>
+          <var-decl name='ctl_table_arg' type-id='631dc3c1' visibility='default' filepath='include/linux/sysctl.h' line='152' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='root' type-id='2993adbc' visibility='default' filepath='include/linux/sysctl.h' line='145' column='1'/>
+          <var-decl name='root' type-id='2993adbc' visibility='default' filepath='include/linux/sysctl.h' line='153' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='set' type-id='42988600' visibility='default' filepath='include/linux/sysctl.h' line='146' column='1'/>
+          <var-decl name='set' type-id='42988600' visibility='default' filepath='include/linux/sysctl.h' line='154' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='parent' type-id='1c66bddc' visibility='default' filepath='include/linux/sysctl.h' line='147' column='1'/>
+          <var-decl name='parent' type-id='1c66bddc' visibility='default' filepath='include/linux/sysctl.h' line='155' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='node' type-id='a586bbcf' visibility='default' filepath='include/linux/sysctl.h' line='148' column='1'/>
+          <var-decl name='node' type-id='a586bbcf' visibility='default' filepath='include/linux/sysctl.h' line='156' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='inodes' type-id='e151255a' visibility='default' filepath='include/linux/sysctl.h' line='149' column='1'/>
+          <var-decl name='inodes' type-id='e151255a' visibility='default' filepath='include/linux/sysctl.h' line='157' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='mii_bus' size-in-bits='22528' is-struct='yes' visibility='default' filepath='include/linux/phy.h' line='302' column='1' id='ed5381db'>
@@ -109794,21 +109808,21 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='5900d865' size-in-bits='64' id='ef872b61'/>
-      <class-decl name='work_struct' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/workqueue.h' line='103' column='1' id='ef9025d0'>
+      <class-decl name='work_struct' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/workqueue.h' line='104' column='1' id='ef9025d0'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='data' type-id='f22a8abb' visibility='default' filepath='include/linux/workqueue.h' line='104' column='1'/>
+          <var-decl name='data' type-id='f22a8abb' visibility='default' filepath='include/linux/workqueue.h' line='105' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='entry' type-id='72f469ec' visibility='default' filepath='include/linux/workqueue.h' line='105' column='1'/>
+          <var-decl name='entry' type-id='72f469ec' visibility='default' filepath='include/linux/workqueue.h' line='106' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='func' type-id='72666d3f' visibility='default' filepath='include/linux/workqueue.h' line='106' column='1'/>
+          <var-decl name='func' type-id='72666d3f' visibility='default' filepath='include/linux/workqueue.h' line='107' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/workqueue.h' line='110' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/workqueue.h' line='111' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/workqueue.h' line='111' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/workqueue.h' line='112' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='0112baf0' size-in-bits='64' id='ef9eae4d'/>
@@ -110109,9 +110123,9 @@
       </function-type>
       <pointer-type-def type-id='20919507' size-in-bits='64' id='f03e9a5b'/>
       <pointer-type-def type-id='09bcad51' size-in-bits='64' id='f03f21e9'/>
-      <class-decl name='__anonymous_struct__' size-in-bits='32' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4453' column='1' id='f052f7e3'>
+      <class-decl name='__anonymous_struct__' size-in-bits='32' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4455' column='1' id='f052f7e3'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='ifindex' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4454' column='1'/>
+          <var-decl name='ifindex' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/bpf.h' line='4456' column='1'/>
         </data-member>
       </class-decl>
       <array-type-def dimensions='1' type-id='7359adad' size-in-bits='128' id='f05e8e77'>
@@ -110218,7 +110232,7 @@
       <typedef-decl name='Elf64_Rela' type-id='6be0de6b' filepath='include/uapi/linux/elf.h' line='182' column='1' id='f08a8a46'/>
       <pointer-type-def type-id='b69e3ec6' size-in-bits='64' id='f08d4e50'/>
       <pointer-type-def type-id='4904ecea' size-in-bits='64' id='f0934dcb'/>
-      <typedef-decl name='rpmsg_rx_cb_t' type-id='2a873f51' filepath='include/linux/rpmsg.h' line='63' column='1' id='f0966175'/>
+      <typedef-decl name='rpmsg_rx_cb_t' type-id='2a873f51' filepath='include/linux/rpmsg.h' line='65' column='1' id='f0966175'/>
       <class-decl name='queue_limits' size-in-bits='960' is-struct='yes' visibility='default' filepath='include/linux/blkdev.h' line='330' column='1' id='f0966d3d'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='bounce_pfn' type-id='7359adad' visibility='default' filepath='include/linux/blkdev.h' line='331' column='1'/>
@@ -111946,30 +111960,30 @@
       <pointer-type-def type-id='85832c21' size-in-bits='64' id='f4dd5cc5'/>
       <typedef-decl name='blk_status_t' type-id='f9b06939' filepath='include/linux/blk_types.h' line='65' column='1' id='f4e2facd'/>
       <pointer-type-def type-id='78b081ff' size-in-bits='64' id='f4ef52eb'/>
-      <class-decl name='rpmsg_endpoint' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/rpmsg.h' line='90' column='1' id='f4f25674'>
+      <class-decl name='rpmsg_endpoint' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/rpmsg.h' line='92' column='1' id='f4f25674'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='rpdev' type-id='41ebc58b' visibility='default' filepath='include/linux/rpmsg.h' line='91' column='1'/>
+          <var-decl name='rpdev' type-id='41ebc58b' visibility='default' filepath='include/linux/rpmsg.h' line='93' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='refcount' type-id='400fb07b' visibility='default' filepath='include/linux/rpmsg.h' line='92' column='1'/>
+          <var-decl name='refcount' type-id='400fb07b' visibility='default' filepath='include/linux/rpmsg.h' line='94' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='cb' type-id='f0966175' visibility='default' filepath='include/linux/rpmsg.h' line='93' column='1'/>
+          <var-decl name='cb' type-id='f0966175' visibility='default' filepath='include/linux/rpmsg.h' line='95' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='cb_lock' type-id='925167dc' visibility='default' filepath='include/linux/rpmsg.h' line='94' column='1'/>
+          <var-decl name='cb_lock' type-id='925167dc' visibility='default' filepath='include/linux/rpmsg.h' line='96' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='sig_cb' type-id='646ceeb7' visibility='default' filepath='include/linux/rpmsg.h' line='95' column='1'/>
+          <var-decl name='sig_cb' type-id='646ceeb7' visibility='default' filepath='include/linux/rpmsg.h' line='97' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='addr' type-id='19c2251e' visibility='default' filepath='include/linux/rpmsg.h' line='96' column='1'/>
+          <var-decl name='addr' type-id='19c2251e' visibility='default' filepath='include/linux/rpmsg.h' line='98' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='priv' type-id='eaa32e2f' visibility='default' filepath='include/linux/rpmsg.h' line='97' column='1'/>
+          <var-decl name='priv' type-id='eaa32e2f' visibility='default' filepath='include/linux/rpmsg.h' line='99' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='ops' type-id='50233074' visibility='default' filepath='include/linux/rpmsg.h' line='99' column='1'/>
+          <var-decl name='ops' type-id='50233074' visibility='default' filepath='include/linux/rpmsg.h' line='101' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='10143522' size-in-bits='64' id='f4f46ed0'/>
@@ -112206,15 +112220,15 @@
           <var-decl name='k' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/filter.h' line='28' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='__anonymous_struct__' size-in-bits='192' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/net/cfg80211.h' line='5068' column='1' id='f58927cb'>
+      <class-decl name='__anonymous_struct__' size-in-bits='192' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/net/cfg80211.h' line='5071' column='1' id='f58927cb'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='peer' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='5069' column='1'/>
+          <var-decl name='peer' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='5072' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='vif' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='5069' column='1'/>
+          <var-decl name='vif' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='5072' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='max_retry' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5070' column='1'/>
+          <var-decl name='max_retry' type-id='f9b06939' visibility='default' filepath='include/net/cfg80211.h' line='5073' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='f58c1a1b'>
@@ -112507,12 +112521,12 @@
           <var-decl name='data' type-id='eaa32e2f' visibility='default' filepath='include/linux/alarmtimer.h' line='48' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='qc_state' size-in-bits='1408' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='415' column='1' id='f6be3c23'>
+      <class-decl name='qc_state' size-in-bits='1408' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='417' column='1' id='f6be3c23'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='s_incoredqs' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='416' column='1'/>
+          <var-decl name='s_incoredqs' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='418' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='s_state' type-id='55d1e02d' visibility='default' filepath='include/linux/quota.h' line='417' column='1'/>
+          <var-decl name='s_state' type-id='55d1e02d' visibility='default' filepath='include/linux/quota.h' line='419' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='e56bc2e5' size-in-bits='64' id='f6c3a7a5'/>
@@ -112636,15 +112650,15 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='cdd79d4e' size-in-bits='64' id='f77c2568'/>
-      <class-decl name='tcp_fastopen_context' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1705' column='1' id='f77d4717'>
+      <class-decl name='tcp_fastopen_context' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1722' column='1' id='f77d4717'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='key' type-id='5b02a6fc' visibility='default' filepath='include/net/tcp.h' line='1706' column='1'/>
+          <var-decl name='key' type-id='5b02a6fc' visibility='default' filepath='include/net/tcp.h' line='1723' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='num' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1707' column='1'/>
+          <var-decl name='num' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1724' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/tcp.h' line='1708' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/tcp.h' line='1725' column='1'/>
         </data-member>
       </class-decl>
       <qualified-type-def type-id='e0584be6' const='yes' id='f7803e3d'/>
@@ -114766,27 +114780,27 @@
           <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/pci.h' line='755' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='wiphy_vendor_command' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4658' column='1' id='fc206ed1'>
+      <class-decl name='wiphy_vendor_command' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/cfg80211.h' line='4661' column='1' id='fc206ed1'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='info' type-id='e223f110' visibility='default' filepath='include/net/cfg80211.h' line='4659' column='1'/>
+          <var-decl name='info' type-id='e223f110' visibility='default' filepath='include/net/cfg80211.h' line='4662' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4660' column='1'/>
+          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/cfg80211.h' line='4663' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='doit' type-id='a9032da3' visibility='default' filepath='include/net/cfg80211.h' line='4661' column='1'/>
+          <var-decl name='doit' type-id='a9032da3' visibility='default' filepath='include/net/cfg80211.h' line='4664' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='dumpit' type-id='dcf81beb' visibility='default' filepath='include/net/cfg80211.h' line='4663' column='1'/>
+          <var-decl name='dumpit' type-id='dcf81beb' visibility='default' filepath='include/net/cfg80211.h' line='4666' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='policy' type-id='109cdb66' visibility='default' filepath='include/net/cfg80211.h' line='4666' column='1'/>
+          <var-decl name='policy' type-id='109cdb66' visibility='default' filepath='include/net/cfg80211.h' line='4669' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='maxattr' type-id='f0981eeb' visibility='default' filepath='include/net/cfg80211.h' line='4667' column='1'/>
+          <var-decl name='maxattr' type-id='f0981eeb' visibility='default' filepath='include/net/cfg80211.h' line='4670' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='4669' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/cfg80211.h' line='4672' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='fc224242'>
@@ -114939,33 +114953,33 @@
       </class-decl>
       <pointer-type-def type-id='1f54f780' size-in-bits='64' id='fcc1e09e'/>
       <pointer-type-def type-id='37d5ca21' size-in-bits='64' id='fcca6c75'/>
-      <class-decl name='tcp_ulp_ops' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='2199' column='1' id='fccb029f'>
+      <class-decl name='tcp_ulp_ops' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='2220' column='1' id='fccb029f'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/tcp.h' line='2200' column='1'/>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/tcp.h' line='2221' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='init' type-id='55530c47' visibility='default' filepath='include/net/tcp.h' line='2203' column='1'/>
+          <var-decl name='init' type-id='55530c47' visibility='default' filepath='include/net/tcp.h' line='2224' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='update' type-id='58220cf1' visibility='default' filepath='include/net/tcp.h' line='2205' column='1'/>
+          <var-decl name='update' type-id='58220cf1' visibility='default' filepath='include/net/tcp.h' line='2226' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='release' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='2208' column='1'/>
+          <var-decl name='release' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='2229' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='get_info' type-id='684afc90' visibility='default' filepath='include/net/tcp.h' line='2210' column='1'/>
+          <var-decl name='get_info' type-id='684afc90' visibility='default' filepath='include/net/tcp.h' line='2231' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='get_info_size' type-id='08a11828' visibility='default' filepath='include/net/tcp.h' line='2211' column='1'/>
+          <var-decl name='get_info_size' type-id='08a11828' visibility='default' filepath='include/net/tcp.h' line='2232' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='clone' type-id='e9e8c0f8' visibility='default' filepath='include/net/tcp.h' line='2213' column='1'/>
+          <var-decl name='clone' type-id='e9e8c0f8' visibility='default' filepath='include/net/tcp.h' line='2234' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/net/tcp.h' line='2216' column='1'/>
+          <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/net/tcp.h' line='2237' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/tcp.h' line='2217' column='1'/>
+          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/tcp.h' line='2238' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='c12c58ce' size-in-bits='64' id='fccfeeec'/>
@@ -116227,36 +116241,36 @@
           <var-decl name='f_spare' type-id='5d4602e8' visibility='default' filepath='include/linux/statfs.h' line='20' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='tcpci_data' size-in-bits='512' is-struct='yes' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='186' column='1' id='ff22cb55'>
+      <class-decl name='tcpci_data' size-in-bits='512' is-struct='yes' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='187' column='1' id='ff22cb55'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='regmap' type-id='29af9a71' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='187' column='1'/>
+          <var-decl name='regmap' type-id='29af9a71' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='188' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='TX_BUF_BYTE_x_hidden' type-id='002ac4a6' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='188' column='1'/>
+          <var-decl name='TX_BUF_BYTE_x_hidden' type-id='002ac4a6' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='189' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='auto_discharge_disconnect' type-id='002ac4a6' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='189' column='1'/>
+          <var-decl name='auto_discharge_disconnect' type-id='002ac4a6' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='190' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2'>
-          <var-decl name='vbus_vsafe0v' type-id='002ac4a6' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='190' column='1'/>
+          <var-decl name='vbus_vsafe0v' type-id='002ac4a6' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='191' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='init' type-id='203080e2' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='192' column='1'/>
+          <var-decl name='init' type-id='203080e2' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='193' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='set_vconn' type-id='1314e51b' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='193' column='1'/>
+          <var-decl name='set_vconn' type-id='1314e51b' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='194' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='start_drp_toggling' type-id='3b0c4914' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='195' column='1'/>
+          <var-decl name='start_drp_toggling' type-id='3b0c4914' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='196' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='set_vbus' type-id='b975d8ee' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='197' column='1'/>
+          <var-decl name='set_vbus' type-id='b975d8ee' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='198' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='frs_sourcing_vbus' type-id='943544a5' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='198' column='1'/>
+          <var-decl name='frs_sourcing_vbus' type-id='943544a5' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='199' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='set_partner_usb_comm_capable' type-id='b1ab1f20' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='199' column='1'/>
+          <var-decl name='set_partner_usb_comm_capable' type-id='b1ab1f20' visibility='default' filepath='drivers/usb/typec/tcpm/tcpci.h' line='200' column='1'/>
         </data-member>
       </class-decl>
       <array-type-def dimensions='1' type-id='8efea9e5' size-in-bits='48' id='ff2536e2'>
@@ -116837,49 +116851,49 @@
         <parameter type-id='7359adad' name='xloops' filepath='arch/arm64/lib/delay.c' line='43' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <var-decl name='__cpu_active_mask' type-id='1354385d' mangled-name='__cpu_active_mask' visibility='default' filepath='kernel/cpu.c' line='2822' column='1' elf-symbol-id='__cpu_active_mask'/>
-      <var-decl name='__cpu_online_mask' type-id='1354385d' mangled-name='__cpu_online_mask' visibility='default' filepath='kernel/cpu.c' line='2816' column='1' elf-symbol-id='__cpu_online_mask'/>
-      <var-decl name='__cpu_possible_mask' type-id='1354385d' mangled-name='__cpu_possible_mask' visibility='default' filepath='kernel/cpu.c' line='2812' column='1' elf-symbol-id='__cpu_possible_mask'/>
-      <var-decl name='__cpu_present_mask' type-id='1354385d' mangled-name='__cpu_present_mask' visibility='default' filepath='kernel/cpu.c' line='2819' column='1' elf-symbol-id='__cpu_present_mask'/>
-      <function-decl name='__cpufreq_driver_target' mangled-name='__cpufreq_driver_target' filepath='drivers/cpufreq/cpufreq.c' line='2208' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpufreq_driver_target'>
-        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='2208' column='1'/>
-        <parameter type-id='f0981eeb' name='target_freq' filepath='drivers/cpufreq/cpufreq.c' line='2209' column='1'/>
-        <parameter type-id='f0981eeb' name='relation' filepath='drivers/cpufreq/cpufreq.c' line='2210' column='1'/>
+      <var-decl name='__cpu_active_mask' type-id='1354385d' mangled-name='__cpu_active_mask' visibility='default' filepath='kernel/cpu.c' line='2821' column='1' elf-symbol-id='__cpu_active_mask'/>
+      <var-decl name='__cpu_online_mask' type-id='1354385d' mangled-name='__cpu_online_mask' visibility='default' filepath='kernel/cpu.c' line='2815' column='1' elf-symbol-id='__cpu_online_mask'/>
+      <var-decl name='__cpu_possible_mask' type-id='1354385d' mangled-name='__cpu_possible_mask' visibility='default' filepath='kernel/cpu.c' line='2811' column='1' elf-symbol-id='__cpu_possible_mask'/>
+      <var-decl name='__cpu_present_mask' type-id='1354385d' mangled-name='__cpu_present_mask' visibility='default' filepath='kernel/cpu.c' line='2818' column='1' elf-symbol-id='__cpu_present_mask'/>
+      <function-decl name='__cpufreq_driver_target' mangled-name='__cpufreq_driver_target' filepath='drivers/cpufreq/cpufreq.c' line='2210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpufreq_driver_target'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='2210' column='1'/>
+        <parameter type-id='f0981eeb' name='target_freq' filepath='drivers/cpufreq/cpufreq.c' line='2211' column='1'/>
+        <parameter type-id='f0981eeb' name='relation' filepath='drivers/cpufreq/cpufreq.c' line='2212' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__cpuhp_remove_state' mangled-name='__cpuhp_remove_state' filepath='kernel/cpu.c' line='2418' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpuhp_remove_state'>
-        <parameter type-id='245a0e38' name='state' filepath='kernel/cpu.c' line='2418' column='1'/>
-        <parameter type-id='b50a4934' name='invoke' filepath='kernel/cpu.c' line='2418' column='1'/>
+      <function-decl name='__cpuhp_remove_state' mangled-name='__cpuhp_remove_state' filepath='kernel/cpu.c' line='2417' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpuhp_remove_state'>
+        <parameter type-id='245a0e38' name='state' filepath='kernel/cpu.c' line='2417' column='1'/>
+        <parameter type-id='b50a4934' name='invoke' filepath='kernel/cpu.c' line='2417' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__cpuhp_setup_state' mangled-name='__cpuhp_setup_state' filepath='kernel/cpu.c' line='2316' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpuhp_setup_state'>
-        <parameter type-id='245a0e38' name='state' filepath='kernel/cpu.c' line='2316' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='kernel/cpu.c' line='2317' column='1'/>
-        <parameter type-id='b50a4934' name='invoke' filepath='kernel/cpu.c' line='2317' column='1'/>
-        <parameter type-id='f02a5e83' name='startup' filepath='kernel/cpu.c' line='2318' column='1'/>
-        <parameter type-id='f02a5e83' name='teardown' filepath='kernel/cpu.c' line='2319' column='1'/>
-        <parameter type-id='b50a4934' name='multi_instance' filepath='kernel/cpu.c' line='2320' column='1'/>
+      <function-decl name='__cpuhp_setup_state' mangled-name='__cpuhp_setup_state' filepath='kernel/cpu.c' line='2315' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpuhp_setup_state'>
+        <parameter type-id='245a0e38' name='state' filepath='kernel/cpu.c' line='2315' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='kernel/cpu.c' line='2316' column='1'/>
+        <parameter type-id='b50a4934' name='invoke' filepath='kernel/cpu.c' line='2316' column='1'/>
+        <parameter type-id='f02a5e83' name='startup' filepath='kernel/cpu.c' line='2317' column='1'/>
+        <parameter type-id='f02a5e83' name='teardown' filepath='kernel/cpu.c' line='2318' column='1'/>
+        <parameter type-id='b50a4934' name='multi_instance' filepath='kernel/cpu.c' line='2319' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__cpuhp_setup_state_cpuslocked' mangled-name='__cpuhp_setup_state_cpuslocked' filepath='kernel/cpu.c' line='2257' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpuhp_setup_state_cpuslocked'>
-        <parameter type-id='245a0e38' name='state' filepath='kernel/cpu.c' line='2257' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='kernel/cpu.c' line='2258' column='1'/>
-        <parameter type-id='b50a4934' name='invoke' filepath='kernel/cpu.c' line='2258' column='1'/>
-        <parameter type-id='f02a5e83' name='startup' filepath='kernel/cpu.c' line='2259' column='1'/>
-        <parameter type-id='f02a5e83' name='teardown' filepath='kernel/cpu.c' line='2260' column='1'/>
-        <parameter type-id='b50a4934' name='multi_instance' filepath='kernel/cpu.c' line='2261' column='1'/>
+      <function-decl name='__cpuhp_setup_state_cpuslocked' mangled-name='__cpuhp_setup_state_cpuslocked' filepath='kernel/cpu.c' line='2256' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpuhp_setup_state_cpuslocked'>
+        <parameter type-id='245a0e38' name='state' filepath='kernel/cpu.c' line='2256' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='kernel/cpu.c' line='2257' column='1'/>
+        <parameter type-id='b50a4934' name='invoke' filepath='kernel/cpu.c' line='2257' column='1'/>
+        <parameter type-id='f02a5e83' name='startup' filepath='kernel/cpu.c' line='2258' column='1'/>
+        <parameter type-id='f02a5e83' name='teardown' filepath='kernel/cpu.c' line='2259' column='1'/>
+        <parameter type-id='b50a4934' name='multi_instance' filepath='kernel/cpu.c' line='2260' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__cpuhp_state_add_instance' mangled-name='__cpuhp_state_add_instance' filepath='kernel/cpu.c' line='2228' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpuhp_state_add_instance'>
-        <parameter type-id='245a0e38' name='state' filepath='kernel/cpu.c' line='2228' column='1'/>
-        <parameter type-id='08cbad52' name='node' filepath='kernel/cpu.c' line='2228' column='1'/>
-        <parameter type-id='b50a4934' name='invoke' filepath='kernel/cpu.c' line='2229' column='1'/>
+      <function-decl name='__cpuhp_state_add_instance' mangled-name='__cpuhp_state_add_instance' filepath='kernel/cpu.c' line='2227' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpuhp_state_add_instance'>
+        <parameter type-id='245a0e38' name='state' filepath='kernel/cpu.c' line='2227' column='1'/>
+        <parameter type-id='08cbad52' name='node' filepath='kernel/cpu.c' line='2227' column='1'/>
+        <parameter type-id='b50a4934' name='invoke' filepath='kernel/cpu.c' line='2228' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__cpuhp_state_remove_instance' mangled-name='__cpuhp_state_remove_instance' filepath='kernel/cpu.c' line='2332' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpuhp_state_remove_instance'>
-        <parameter type-id='245a0e38' name='state' filepath='kernel/cpu.c' line='2332' column='1'/>
-        <parameter type-id='08cbad52' name='node' filepath='kernel/cpu.c' line='2333' column='1'/>
-        <parameter type-id='b50a4934' name='invoke' filepath='kernel/cpu.c' line='2333' column='1'/>
+      <function-decl name='__cpuhp_state_remove_instance' mangled-name='__cpuhp_state_remove_instance' filepath='kernel/cpu.c' line='2331' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__cpuhp_state_remove_instance'>
+        <parameter type-id='245a0e38' name='state' filepath='kernel/cpu.c' line='2331' column='1'/>
+        <parameter type-id='08cbad52' name='node' filepath='kernel/cpu.c' line='2332' column='1'/>
+        <parameter type-id='b50a4934' name='invoke' filepath='kernel/cpu.c' line='2332' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__crypto_memneq' mangled-name='__crypto_memneq' filepath='lib/memneq.c' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__crypto_memneq'>
@@ -117036,21 +117050,21 @@
         <parameter type-id='1d2c2b85' name='flags' filepath='lib/once.c' line='37' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='__dquot_alloc_space' mangled-name='__dquot_alloc_space' filepath='fs/quota/dquot.c' line='1665' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_alloc_space'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1665' column='1'/>
-        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1665' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='fs/quota/dquot.c' line='1665' column='1'/>
+      <function-decl name='__dquot_alloc_space' mangled-name='__dquot_alloc_space' filepath='fs/quota/dquot.c' line='1735' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_alloc_space'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1735' column='1'/>
+        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1735' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='fs/quota/dquot.c' line='1735' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__dquot_free_space' mangled-name='__dquot_free_space' filepath='fs/quota/dquot.c' line='1864' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_free_space'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1864' column='1'/>
-        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1864' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='fs/quota/dquot.c' line='1864' column='1'/>
+      <function-decl name='__dquot_free_space' mangled-name='__dquot_free_space' filepath='fs/quota/dquot.c' line='1934' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_free_space'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1934' column='1'/>
+        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1934' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='fs/quota/dquot.c' line='1934' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__dquot_transfer' mangled-name='__dquot_transfer' filepath='fs/quota/dquot.c' line='1964' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_transfer'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1964' column='1'/>
-        <parameter type-id='30677246' name='transfer_to' filepath='fs/quota/dquot.c' line='1964' column='1'/>
+      <function-decl name='__dquot_transfer' mangled-name='__dquot_transfer' filepath='fs/quota/dquot.c' line='2034' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_transfer'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2034' column='1'/>
+        <parameter type-id='30677246' name='transfer_to' filepath='fs/quota/dquot.c' line='2034' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__drm_atomic_helper_connector_destroy_state' mangled-name='__drm_atomic_helper_connector_destroy_state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='514' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__drm_atomic_helper_connector_destroy_state'>
@@ -117081,9 +117095,9 @@
         <parameter type-id='35078cb9' name='crtc_state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='92' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__drm_atomic_helper_disable_plane' mangled-name='__drm_atomic_helper_disable_plane' filepath='drivers/gpu/drm/drm_atomic.c' line='1380' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__drm_atomic_helper_disable_plane'>
-        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_atomic.c' line='1380' column='1'/>
-        <parameter type-id='d0835005' name='plane_state' filepath='drivers/gpu/drm/drm_atomic.c' line='1381' column='1'/>
+      <function-decl name='__drm_atomic_helper_disable_plane' mangled-name='__drm_atomic_helper_disable_plane' filepath='drivers/gpu/drm/drm_atomic.c' line='1389' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__drm_atomic_helper_disable_plane'>
+        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_atomic.c' line='1389' column='1'/>
+        <parameter type-id='d0835005' name='plane_state' filepath='drivers/gpu/drm/drm_atomic.c' line='1390' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__drm_atomic_helper_plane_destroy_state' mangled-name='__drm_atomic_helper_plane_destroy_state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='348' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__drm_atomic_helper_plane_destroy_state'>
@@ -117105,8 +117119,8 @@
         <parameter type-id='4ea020ae' name='state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='554' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__drm_atomic_state_free' mangled-name='__drm_atomic_state_free' filepath='drivers/gpu/drm/drm_atomic.c' line='257' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__drm_atomic_state_free'>
-        <parameter type-id='aa29ecab' name='ref' filepath='drivers/gpu/drm/drm_atomic.c' line='257' column='1'/>
+      <function-decl name='__drm_atomic_state_free' mangled-name='__drm_atomic_state_free' filepath='drivers/gpu/drm/drm_atomic.c' line='263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__drm_atomic_state_free'>
+        <parameter type-id='aa29ecab' name='ref' filepath='drivers/gpu/drm/drm_atomic.c' line='263' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='__drm_crtc_commit_free' mangled-name='__drm_crtc_commit_free' filepath='drivers/gpu/drm/drm_atomic.c' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__drm_crtc_commit_free'>
@@ -117222,9 +117236,9 @@
         <parameter type-id='ab7bbd67' name='attr' filepath='fs/crypto/hooks.c' line='120' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__generic_file_write_iter' mangled-name='__generic_file_write_iter' filepath='mm/filemap.c' line='3572' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__generic_file_write_iter'>
-        <parameter type-id='80f25feb' name='iocb' filepath='mm/filemap.c' line='3572' column='1'/>
-        <parameter type-id='4fa10f9e' name='from' filepath='mm/filemap.c' line='3572' column='1'/>
+      <function-decl name='__generic_file_write_iter' mangled-name='__generic_file_write_iter' filepath='mm/filemap.c' line='3575' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__generic_file_write_iter'>
+        <parameter type-id='80f25feb' name='iocb' filepath='mm/filemap.c' line='3575' column='1'/>
+        <parameter type-id='4fa10f9e' name='from' filepath='mm/filemap.c' line='3575' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
       <function-decl name='__genphy_config_aneg' mangled-name='__genphy_config_aneg' filepath='drivers/net/phy/phy_device.c' line='2092' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__genphy_config_aneg'>
@@ -117675,9 +117689,9 @@
         <parameter type-id='7359adad' name='nsecs' filepath='arch/arm64/lib/delay.c' line='55' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__neigh_event_send' mangled-name='__neigh_event_send' filepath='net/core/neighbour.c' line='1107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__neigh_event_send'>
-        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='1107' column='1'/>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='1107' column='1'/>
+      <function-decl name='__neigh_event_send' mangled-name='__neigh_event_send' filepath='net/core/neighbour.c' line='1111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__neigh_event_send'>
+        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='1111' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='1111' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__netdev_alloc_skb' mangled-name='__netdev_alloc_skb' filepath='net/core/skbuff.c' line='431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__netdev_alloc_skb'>
@@ -117697,11 +117711,11 @@
         <parameter type-id='b50a4934' name='is_rxqs_map' filepath='net/core/dev.c' line='2628' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__netlink_kernel_create' mangled-name='__netlink_kernel_create' filepath='net/netlink/af_netlink.c' line='2022' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__netlink_kernel_create'>
-        <parameter type-id='a2bff676' name='net' filepath='net/netlink/af_netlink.c' line='2022' column='1'/>
-        <parameter type-id='95e97e5e' name='unit' filepath='net/netlink/af_netlink.c' line='2022' column='1'/>
-        <parameter type-id='2730d015' name='module' filepath='net/netlink/af_netlink.c' line='2022' column='1'/>
-        <parameter type-id='8438f281' name='cfg' filepath='net/netlink/af_netlink.c' line='2023' column='1'/>
+      <function-decl name='__netlink_kernel_create' mangled-name='__netlink_kernel_create' filepath='net/netlink/af_netlink.c' line='2023' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__netlink_kernel_create'>
+        <parameter type-id='a2bff676' name='net' filepath='net/netlink/af_netlink.c' line='2023' column='1'/>
+        <parameter type-id='95e97e5e' name='unit' filepath='net/netlink/af_netlink.c' line='2023' column='1'/>
+        <parameter type-id='2730d015' name='module' filepath='net/netlink/af_netlink.c' line='2023' column='1'/>
+        <parameter type-id='8438f281' name='cfg' filepath='net/netlink/af_netlink.c' line='2024' column='1'/>
         <return type-id='f772df6d'/>
       </function-decl>
       <function-decl name='__next_zones_zonelist' mangled-name='__next_zones_zonelist' filepath='mm/mmzone.c' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__next_zones_zonelist'>
@@ -117729,16 +117743,16 @@
         <parameter type-id='5799dc94' name='extack' filepath='lib/nlattr.c' line='631' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__nlmsg_put' mangled-name='__nlmsg_put' filepath='net/netlink/af_netlink.c' line='2162' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__nlmsg_put'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/netlink/af_netlink.c' line='2162' column='1'/>
-        <parameter type-id='19c2251e' name='portid' filepath='net/netlink/af_netlink.c' line='2162' column='1'/>
-        <parameter type-id='19c2251e' name='seq' filepath='net/netlink/af_netlink.c' line='2162' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='net/netlink/af_netlink.c' line='2162' column='1'/>
-        <parameter type-id='95e97e5e' name='len' filepath='net/netlink/af_netlink.c' line='2162' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='net/netlink/af_netlink.c' line='2162' column='1'/>
+      <function-decl name='__nlmsg_put' mangled-name='__nlmsg_put' filepath='net/netlink/af_netlink.c' line='2163' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__nlmsg_put'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/netlink/af_netlink.c' line='2163' column='1'/>
+        <parameter type-id='19c2251e' name='portid' filepath='net/netlink/af_netlink.c' line='2163' column='1'/>
+        <parameter type-id='19c2251e' name='seq' filepath='net/netlink/af_netlink.c' line='2163' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='net/netlink/af_netlink.c' line='2163' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='net/netlink/af_netlink.c' line='2163' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/netlink/af_netlink.c' line='2163' column='1'/>
         <return type-id='c2074578'/>
       </function-decl>
-      <var-decl name='__num_online_cpus' type-id='49178f86' mangled-name='__num_online_cpus' visibility='default' filepath='kernel/cpu.c' line='2825' column='1' elf-symbol-id='__num_online_cpus'/>
+      <var-decl name='__num_online_cpus' type-id='49178f86' mangled-name='__num_online_cpus' visibility='default' filepath='kernel/cpu.c' line='2824' column='1' elf-symbol-id='__num_online_cpus'/>
       <function-decl name='__of_reset_control_get' mangled-name='__of_reset_control_get' filepath='drivers/reset/core.c' line='605' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__of_reset_control_get'>
         <parameter type-id='9a537bbe' name='node' filepath='drivers/reset/core.c' line='605' column='1'/>
         <parameter type-id='80f4b756' name='id' filepath='drivers/reset/core.c' line='606' column='1'/>
@@ -117830,34 +117844,34 @@
         <parameter type-id='1ea237a6' name='ws' filepath='drivers/base/power/wakeup.c' line='757' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__pm_runtime_disable' mangled-name='__pm_runtime_disable' filepath='drivers/base/power/runtime.c' line='1411' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_disable'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1411' column='1'/>
-        <parameter type-id='b50a4934' name='check_resume' filepath='drivers/base/power/runtime.c' line='1411' column='1'/>
+      <function-decl name='__pm_runtime_disable' mangled-name='__pm_runtime_disable' filepath='drivers/base/power/runtime.c' line='1413' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_disable'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1413' column='1'/>
+        <parameter type-id='b50a4934' name='check_resume' filepath='drivers/base/power/runtime.c' line='1413' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__pm_runtime_idle' mangled-name='__pm_runtime_idle' filepath='drivers/base/power/runtime.c' line='1059' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_idle'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1059' column='1'/>
-        <parameter type-id='95e97e5e' name='rpmflags' filepath='drivers/base/power/runtime.c' line='1059' column='1'/>
+      <function-decl name='__pm_runtime_idle' mangled-name='__pm_runtime_idle' filepath='drivers/base/power/runtime.c' line='1061' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_idle'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1061' column='1'/>
+        <parameter type-id='95e97e5e' name='rpmflags' filepath='drivers/base/power/runtime.c' line='1061' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__pm_runtime_resume' mangled-name='__pm_runtime_resume' filepath='drivers/base/power/runtime.c' line='1126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_resume'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1126' column='1'/>
-        <parameter type-id='95e97e5e' name='rpmflags' filepath='drivers/base/power/runtime.c' line='1126' column='1'/>
+      <function-decl name='__pm_runtime_resume' mangled-name='__pm_runtime_resume' filepath='drivers/base/power/runtime.c' line='1128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_resume'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1128' column='1'/>
+        <parameter type-id='95e97e5e' name='rpmflags' filepath='drivers/base/power/runtime.c' line='1128' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__pm_runtime_set_status' mangled-name='__pm_runtime_set_status' filepath='drivers/base/power/runtime.c' line='1214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_set_status'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1214' column='1'/>
-        <parameter type-id='f0981eeb' name='status' filepath='drivers/base/power/runtime.c' line='1214' column='1'/>
+      <function-decl name='__pm_runtime_set_status' mangled-name='__pm_runtime_set_status' filepath='drivers/base/power/runtime.c' line='1216' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_set_status'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1216' column='1'/>
+        <parameter type-id='f0981eeb' name='status' filepath='drivers/base/power/runtime.c' line='1216' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__pm_runtime_suspend' mangled-name='__pm_runtime_suspend' filepath='drivers/base/power/runtime.c' line='1093' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_suspend'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1093' column='1'/>
-        <parameter type-id='95e97e5e' name='rpmflags' filepath='drivers/base/power/runtime.c' line='1093' column='1'/>
+      <function-decl name='__pm_runtime_suspend' mangled-name='__pm_runtime_suspend' filepath='drivers/base/power/runtime.c' line='1095' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_suspend'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1095' column='1'/>
+        <parameter type-id='95e97e5e' name='rpmflags' filepath='drivers/base/power/runtime.c' line='1095' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__pm_runtime_use_autosuspend' mangled-name='__pm_runtime_use_autosuspend' filepath='drivers/base/power/runtime.c' line='1634' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_use_autosuspend'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1634' column='1'/>
-        <parameter type-id='b50a4934' name='use' filepath='drivers/base/power/runtime.c' line='1634' column='1'/>
+      <function-decl name='__pm_runtime_use_autosuspend' mangled-name='__pm_runtime_use_autosuspend' filepath='drivers/base/power/runtime.c' line='1636' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_runtime_use_autosuspend'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1636' column='1'/>
+        <parameter type-id='b50a4934' name='use' filepath='drivers/base/power/runtime.c' line='1636' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='__pm_stay_awake' mangled-name='__pm_stay_awake' filepath='drivers/base/power/wakeup.c' line='640' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pm_stay_awake'>
@@ -117922,9 +117936,9 @@
         <parameter type-id='61758ee5' name='fops' filepath='fs/char_dev.c' line='270' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__register_rpmsg_driver' mangled-name='__register_rpmsg_driver' filepath='drivers/rpmsg/rpmsg_core.c' line='616' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__register_rpmsg_driver'>
-        <parameter type-id='7331a99f' name='rpdrv' filepath='drivers/rpmsg/rpmsg_core.c' line='616' column='1'/>
-        <parameter type-id='2730d015' name='owner' filepath='drivers/rpmsg/rpmsg_core.c' line='616' column='1'/>
+      <function-decl name='__register_rpmsg_driver' mangled-name='__register_rpmsg_driver' filepath='drivers/rpmsg/rpmsg_core.c' line='645' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__register_rpmsg_driver'>
+        <parameter type-id='7331a99f' name='rpdrv' filepath='drivers/rpmsg/rpmsg_core.c' line='645' column='1'/>
+        <parameter type-id='2730d015' name='owner' filepath='drivers/rpmsg/rpmsg_core.c' line='645' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__regmap_init' mangled-name='__regmap_init' filepath='drivers/base/regmap/regmap.c' line='702' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__regmap_init'>
@@ -118108,8 +118122,8 @@
         <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='2887' column='1'/>
         <return type-id='7dac1e36'/>
       </function-decl>
-      <function-decl name='__skb_ext_put' mangled-name='__skb_ext_put' filepath='net/core/skbuff.c' line='6380' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__skb_ext_put'>
-        <parameter type-id='374692c7' name='ext' filepath='net/core/skbuff.c' line='6380' column='1'/>
+      <function-decl name='__skb_ext_put' mangled-name='__skb_ext_put' filepath='net/core/skbuff.c' line='6391' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__skb_ext_put'>
+        <parameter type-id='374692c7' name='ext' filepath='net/core/skbuff.c' line='6391' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='__skb_flow_dissect' mangled-name='__skb_flow_dissect' filepath='net/core/flow_dissector.c' line='904' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__skb_flow_dissect'>
@@ -118124,8 +118138,8 @@
         <parameter type-id='f0981eeb' name='flags' filepath='net/core/flow_dissector.c' line='909' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='__skb_get_hash' mangled-name='__skb_get_hash' filepath='net/core/flow_dissector.c' line='1608' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__skb_get_hash'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/flow_dissector.c' line='1608' column='1'/>
+      <function-decl name='__skb_get_hash' mangled-name='__skb_get_hash' filepath='net/core/flow_dissector.c' line='1607' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__skb_get_hash'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/flow_dissector.c' line='1607' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='__skb_gso_segment' mangled-name='__skb_gso_segment' filepath='net/core/dev.c' line='3391' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__skb_gso_segment'>
@@ -118140,13 +118154,13 @@
         <parameter type-id='b50a4934' name='free_on_error' filepath='net/core/skbuff.c' line='1833' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__sock_create' mangled-name='__sock_create' filepath='net/socket.c' line='1346' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__sock_create'>
-        <parameter type-id='a2bff676' name='net' filepath='net/socket.c' line='1346' column='1'/>
-        <parameter type-id='95e97e5e' name='family' filepath='net/socket.c' line='1346' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='net/socket.c' line='1346' column='1'/>
-        <parameter type-id='95e97e5e' name='protocol' filepath='net/socket.c' line='1346' column='1'/>
-        <parameter type-id='1a7bb5c8' name='res' filepath='net/socket.c' line='1347' column='1'/>
-        <parameter type-id='95e97e5e' name='kern' filepath='net/socket.c' line='1347' column='1'/>
+      <function-decl name='__sock_create' mangled-name='__sock_create' filepath='net/socket.c' line='1363' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__sock_create'>
+        <parameter type-id='a2bff676' name='net' filepath='net/socket.c' line='1363' column='1'/>
+        <parameter type-id='95e97e5e' name='family' filepath='net/socket.c' line='1363' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='net/socket.c' line='1363' column='1'/>
+        <parameter type-id='95e97e5e' name='protocol' filepath='net/socket.c' line='1363' column='1'/>
+        <parameter type-id='1a7bb5c8' name='res' filepath='net/socket.c' line='1364' column='1'/>
+        <parameter type-id='95e97e5e' name='kern' filepath='net/socket.c' line='1364' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__spi_alloc_controller' mangled-name='__spi_alloc_controller' filepath='drivers/spi/spi.c' line='2443' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__spi_alloc_controller'>
@@ -121079,15 +121093,15 @@
         <parameter type-id='9c313c2d' name='size' filepath='include/trace/events/gpu_mem.h' line='30' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_hrtimer_expire_entry' mangled-name='__traceiter_hrtimer_expire_entry' filepath='include/trace/events/timer.h' line='232' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_hrtimer_expire_entry'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/events/timer.h' line='232' column='1'/>
-        <parameter type-id='08c8d0fa' name='hrtimer' filepath='include/trace/events/timer.h' line='232' column='1'/>
-        <parameter type-id='44372936' name='now' filepath='include/trace/events/timer.h' line='232' column='1'/>
+      <function-decl name='__traceiter_hrtimer_expire_entry' mangled-name='__traceiter_hrtimer_expire_entry' filepath='include/trace/events/timer.h' line='236' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_hrtimer_expire_entry'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/events/timer.h' line='236' column='1'/>
+        <parameter type-id='08c8d0fa' name='hrtimer' filepath='include/trace/events/timer.h' line='236' column='1'/>
+        <parameter type-id='44372936' name='now' filepath='include/trace/events/timer.h' line='236' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_hrtimer_expire_exit' mangled-name='__traceiter_hrtimer_expire_exit' filepath='include/trace/events/timer.h' line='279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_hrtimer_expire_exit'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/events/timer.h' line='279' column='1'/>
-        <parameter type-id='08c8d0fa' name='hrtimer' filepath='include/trace/events/timer.h' line='279' column='1'/>
+      <function-decl name='__traceiter_hrtimer_expire_exit' mangled-name='__traceiter_hrtimer_expire_exit' filepath='include/trace/events/timer.h' line='283' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_hrtimer_expire_exit'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/events/timer.h' line='283' column='1'/>
+        <parameter type-id='08c8d0fa' name='hrtimer' filepath='include/trace/events/timer.h' line='283' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__traceiter_ipi_entry' mangled-name='__traceiter_ipi_entry' filepath='include/trace/events/ipi.h' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_ipi_entry'>
@@ -121787,8 +121801,8 @@
       <var-decl name='__tracepoint_dwc3_readl' type-id='4ca0c298' mangled-name='__tracepoint_dwc3_readl' visibility='default' filepath='drivers/usb/dwc3/./trace.h' line='39' column='1' elf-symbol-id='__tracepoint_dwc3_readl'/>
       <var-decl name='__tracepoint_dwc3_writel' type-id='4ca0c298' mangled-name='__tracepoint_dwc3_writel' visibility='default' filepath='drivers/usb/dwc3/./trace.h' line='44' column='1' elf-symbol-id='__tracepoint_dwc3_writel'/>
       <var-decl name='__tracepoint_gpu_mem_total' type-id='4ca0c298' mangled-name='__tracepoint_gpu_mem_total' visibility='default' filepath='include/trace/events/gpu_mem.h' line='30' column='1' elf-symbol-id='__tracepoint_gpu_mem_total'/>
-      <var-decl name='__tracepoint_hrtimer_expire_entry' type-id='4ca0c298' mangled-name='__tracepoint_hrtimer_expire_entry' visibility='default' filepath='include/trace/events/timer.h' line='232' column='1' elf-symbol-id='__tracepoint_hrtimer_expire_entry'/>
-      <var-decl name='__tracepoint_hrtimer_expire_exit' type-id='4ca0c298' mangled-name='__tracepoint_hrtimer_expire_exit' visibility='default' filepath='include/trace/events/timer.h' line='279' column='1' elf-symbol-id='__tracepoint_hrtimer_expire_exit'/>
+      <var-decl name='__tracepoint_hrtimer_expire_entry' type-id='4ca0c298' mangled-name='__tracepoint_hrtimer_expire_entry' visibility='default' filepath='include/trace/events/timer.h' line='236' column='1' elf-symbol-id='__tracepoint_hrtimer_expire_entry'/>
+      <var-decl name='__tracepoint_hrtimer_expire_exit' type-id='4ca0c298' mangled-name='__tracepoint_hrtimer_expire_exit' visibility='default' filepath='include/trace/events/timer.h' line='283' column='1' elf-symbol-id='__tracepoint_hrtimer_expire_exit'/>
       <var-decl name='__tracepoint_ipi_entry' type-id='4ca0c298' mangled-name='__tracepoint_ipi_entry' visibility='default' filepath='include/trace/events/ipi.h' line='64' column='1' elf-symbol-id='__tracepoint_ipi_entry'/>
       <var-decl name='__tracepoint_ipi_exit' type-id='4ca0c298' mangled-name='__tracepoint_ipi_exit' visibility='default' filepath='include/trace/events/ipi.h' line='80' column='1' elf-symbol-id='__tracepoint_ipi_exit'/>
       <var-decl name='__tracepoint_ipi_raise' type-id='4ca0c298' mangled-name='__tracepoint_ipi_raise' visibility='default' filepath='include/trace/events/ipi.h' line='19' column='1' elf-symbol-id='__tracepoint_ipi_raise'/>
@@ -121844,37 +121858,37 @@
         <parameter type-id='a84c031d' name='flag' filepath='drivers/tty/tty_buffer.c' line='380' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__typec_altmode_register_driver' mangled-name='__typec_altmode_register_driver' filepath='drivers/usb/typec/bus.c' line='244' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__typec_altmode_register_driver'>
-        <parameter type-id='e1932af2' name='drv' filepath='drivers/usb/typec/bus.c' line='244' column='1'/>
-        <parameter type-id='2730d015' name='module' filepath='drivers/usb/typec/bus.c' line='245' column='1'/>
+      <function-decl name='__typec_altmode_register_driver' mangled-name='__typec_altmode_register_driver' filepath='drivers/usb/typec/bus.c' line='252' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__typec_altmode_register_driver'>
+        <parameter type-id='e1932af2' name='drv' filepath='drivers/usb/typec/bus.c' line='252' column='1'/>
+        <parameter type-id='2730d015' name='module' filepath='drivers/usb/typec/bus.c' line='253' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__udelay' mangled-name='__udelay' filepath='arch/arm64/lib/delay.c' line='49' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__udelay'>
         <parameter type-id='7359adad' name='usecs' filepath='arch/arm64/lib/delay.c' line='49' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__udp4_lib_lookup' mangled-name='__udp4_lib_lookup' filepath='net/ipv4/udp.c' line='486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__udp4_lib_lookup'>
-        <parameter type-id='a2bff676' name='net' filepath='net/ipv4/udp.c' line='486' column='1'/>
-        <parameter type-id='78a133c2' name='saddr' filepath='net/ipv4/udp.c' line='486' column='1'/>
-        <parameter type-id='84a5c3d4' name='sport' filepath='net/ipv4/udp.c' line='487' column='1'/>
-        <parameter type-id='78a133c2' name='daddr' filepath='net/ipv4/udp.c' line='487' column='1'/>
-        <parameter type-id='84a5c3d4' name='dport' filepath='net/ipv4/udp.c' line='487' column='1'/>
-        <parameter type-id='95e97e5e' name='dif' filepath='net/ipv4/udp.c' line='487' column='1'/>
-        <parameter type-id='95e97e5e' name='sdif' filepath='net/ipv4/udp.c' line='488' column='1'/>
-        <parameter type-id='115daa23' name='udptable' filepath='net/ipv4/udp.c' line='488' column='1'/>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/ipv4/udp.c' line='488' column='1'/>
+      <function-decl name='__udp4_lib_lookup' mangled-name='__udp4_lib_lookup' filepath='net/ipv4/udp.c' line='496' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__udp4_lib_lookup'>
+        <parameter type-id='a2bff676' name='net' filepath='net/ipv4/udp.c' line='496' column='1'/>
+        <parameter type-id='78a133c2' name='saddr' filepath='net/ipv4/udp.c' line='496' column='1'/>
+        <parameter type-id='84a5c3d4' name='sport' filepath='net/ipv4/udp.c' line='497' column='1'/>
+        <parameter type-id='78a133c2' name='daddr' filepath='net/ipv4/udp.c' line='497' column='1'/>
+        <parameter type-id='84a5c3d4' name='dport' filepath='net/ipv4/udp.c' line='497' column='1'/>
+        <parameter type-id='95e97e5e' name='dif' filepath='net/ipv4/udp.c' line='497' column='1'/>
+        <parameter type-id='95e97e5e' name='sdif' filepath='net/ipv4/udp.c' line='498' column='1'/>
+        <parameter type-id='115daa23' name='udptable' filepath='net/ipv4/udp.c' line='498' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/ipv4/udp.c' line='498' column='1'/>
         <return type-id='f772df6d'/>
       </function-decl>
-      <function-decl name='__udp6_lib_lookup' mangled-name='__udp6_lib_lookup' filepath='net/ipv6/udp.c' line='231' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__udp6_lib_lookup'>
-        <parameter type-id='a2bff676' name='net' filepath='net/ipv6/udp.c' line='231' column='1'/>
-        <parameter type-id='fea9c20b' name='saddr' filepath='net/ipv6/udp.c' line='232' column='1'/>
-        <parameter type-id='84a5c3d4' name='sport' filepath='net/ipv6/udp.c' line='232' column='1'/>
-        <parameter type-id='fea9c20b' name='daddr' filepath='net/ipv6/udp.c' line='233' column='1'/>
-        <parameter type-id='84a5c3d4' name='dport' filepath='net/ipv6/udp.c' line='233' column='1'/>
-        <parameter type-id='95e97e5e' name='dif' filepath='net/ipv6/udp.c' line='234' column='1'/>
-        <parameter type-id='95e97e5e' name='sdif' filepath='net/ipv6/udp.c' line='234' column='1'/>
-        <parameter type-id='115daa23' name='udptable' filepath='net/ipv6/udp.c' line='234' column='1'/>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/ipv6/udp.c' line='235' column='1'/>
+      <function-decl name='__udp6_lib_lookup' mangled-name='__udp6_lib_lookup' filepath='net/ipv6/udp.c' line='240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__udp6_lib_lookup'>
+        <parameter type-id='a2bff676' name='net' filepath='net/ipv6/udp.c' line='240' column='1'/>
+        <parameter type-id='fea9c20b' name='saddr' filepath='net/ipv6/udp.c' line='241' column='1'/>
+        <parameter type-id='84a5c3d4' name='sport' filepath='net/ipv6/udp.c' line='241' column='1'/>
+        <parameter type-id='fea9c20b' name='daddr' filepath='net/ipv6/udp.c' line='242' column='1'/>
+        <parameter type-id='84a5c3d4' name='dport' filepath='net/ipv6/udp.c' line='242' column='1'/>
+        <parameter type-id='95e97e5e' name='dif' filepath='net/ipv6/udp.c' line='243' column='1'/>
+        <parameter type-id='95e97e5e' name='sdif' filepath='net/ipv6/udp.c' line='243' column='1'/>
+        <parameter type-id='115daa23' name='udptable' filepath='net/ipv6/udp.c' line='243' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/ipv6/udp.c' line='244' column='1'/>
         <return type-id='f772df6d'/>
       </function-decl>
       <function-decl name='__uio_register_device' mangled-name='__uio_register_device' filepath='drivers/uio/uio.c' line='916' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__uio_register_device'>
@@ -121895,12 +121909,12 @@
         <parameter type-id='ff2b3d10' name='se' filepath='kernel/sched/pelt.c' line='358' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__usb_create_hcd' mangled-name='__usb_create_hcd' filepath='drivers/usb/core/hcd.c' line='2437' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__usb_create_hcd'>
-        <parameter type-id='5aa12c86' name='driver' filepath='drivers/usb/core/hcd.c' line='2437' column='1'/>
-        <parameter type-id='fa0b179b' name='sysdev' filepath='drivers/usb/core/hcd.c' line='2438' column='1'/>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/core/hcd.c' line='2438' column='1'/>
-        <parameter type-id='80f4b756' name='bus_name' filepath='drivers/usb/core/hcd.c' line='2438' column='1'/>
-        <parameter type-id='fc4f83c1' name='primary_hcd' filepath='drivers/usb/core/hcd.c' line='2439' column='1'/>
+      <function-decl name='__usb_create_hcd' mangled-name='__usb_create_hcd' filepath='drivers/usb/core/hcd.c' line='2441' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__usb_create_hcd'>
+        <parameter type-id='5aa12c86' name='driver' filepath='drivers/usb/core/hcd.c' line='2441' column='1'/>
+        <parameter type-id='fa0b179b' name='sysdev' filepath='drivers/usb/core/hcd.c' line='2442' column='1'/>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/core/hcd.c' line='2442' column='1'/>
+        <parameter type-id='80f4b756' name='bus_name' filepath='drivers/usb/core/hcd.c' line='2442' column='1'/>
+        <parameter type-id='fc4f83c1' name='primary_hcd' filepath='drivers/usb/core/hcd.c' line='2443' column='1'/>
         <return type-id='fc4f83c1'/>
       </function-decl>
       <function-decl name='__usb_get_extra_descriptor' mangled-name='__usb_get_extra_descriptor' filepath='drivers/usb/core/usb.c' line='948' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__usb_get_extra_descriptor'>
@@ -121966,9 +121980,9 @@
         <parameter type-id='2730d015' name='owner' filepath='drivers/media/v4l2-core/v4l2-dev.c' line='879' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__vmalloc' mangled-name='__vmalloc' filepath='mm/vmalloc.c' line='2625' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__vmalloc'>
-        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2625' column='1'/>
-        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/vmalloc.c' line='2625' column='1'/>
+      <function-decl name='__vmalloc' mangled-name='__vmalloc' filepath='mm/vmalloc.c' line='2629' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__vmalloc'>
+        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2629' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/vmalloc.c' line='2629' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='__wait_on_buffer' mangled-name='__wait_on_buffer' filepath='fs/buffer.c' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__wait_on_buffer'>
@@ -122047,11 +122061,11 @@
         <parameter type-id='3eb7c31c' name='gfp' filepath='lib/xarray.c' line='1639' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__xfrm_decode_session' mangled-name='__xfrm_decode_session' filepath='net/xfrm/xfrm_policy.c' line='3516' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__xfrm_decode_session'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/xfrm/xfrm_policy.c' line='3516' column='1'/>
-        <parameter type-id='b1fd62ba' name='fl' filepath='net/xfrm/xfrm_policy.c' line='3516' column='1'/>
-        <parameter type-id='f0981eeb' name='family' filepath='net/xfrm/xfrm_policy.c' line='3517' column='1'/>
-        <parameter type-id='95e97e5e' name='reverse' filepath='net/xfrm/xfrm_policy.c' line='3517' column='1'/>
+      <function-decl name='__xfrm_decode_session' mangled-name='__xfrm_decode_session' filepath='net/xfrm/xfrm_policy.c' line='3523' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__xfrm_decode_session'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/xfrm/xfrm_policy.c' line='3523' column='1'/>
+        <parameter type-id='b1fd62ba' name='fl' filepath='net/xfrm/xfrm_policy.c' line='3523' column='1'/>
+        <parameter type-id='f0981eeb' name='family' filepath='net/xfrm/xfrm_policy.c' line='3524' column='1'/>
+        <parameter type-id='95e97e5e' name='reverse' filepath='net/xfrm/xfrm_policy.c' line='3524' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__xfrm_state_destroy' mangled-name='__xfrm_state_destroy' filepath='net/xfrm/xfrm_state.c' line='640' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__xfrm_state_destroy'>
@@ -122296,8 +122310,8 @@
         <parameter type-id='95e97e5e' name='flags' filepath='kernel/sched/core.c' line='1685' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='add_cpu' mangled-name='add_cpu' filepath='kernel/cpu.c' line='1651' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_cpu'>
-        <parameter type-id='f0981eeb' name='cpu' filepath='kernel/cpu.c' line='1651' column='1'/>
+      <function-decl name='add_cpu' mangled-name='add_cpu' filepath='kernel/cpu.c' line='1650' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_cpu'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='kernel/cpu.c' line='1650' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='add_device_randomness' mangled-name='add_device_randomness' filepath='drivers/char/random.c' line='861' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_device_randomness'>
@@ -122503,18 +122517,18 @@
         <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/page_alloc.c' line='5443' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='alloc_skb_with_frags' mangled-name='alloc_skb_with_frags' filepath='net/core/skbuff.c' line='5899' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_skb_with_frags'>
-        <parameter type-id='7359adad' name='header_len' filepath='net/core/skbuff.c' line='5899' column='1'/>
-        <parameter type-id='7359adad' name='data_len' filepath='net/core/skbuff.c' line='5900' column='1'/>
-        <parameter type-id='95e97e5e' name='max_page_order' filepath='net/core/skbuff.c' line='5901' column='1'/>
-        <parameter type-id='7292109c' name='errcode' filepath='net/core/skbuff.c' line='5902' column='1'/>
-        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='net/core/skbuff.c' line='5903' column='1'/>
+      <function-decl name='alloc_skb_with_frags' mangled-name='alloc_skb_with_frags' filepath='net/core/skbuff.c' line='5910' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_skb_with_frags'>
+        <parameter type-id='7359adad' name='header_len' filepath='net/core/skbuff.c' line='5910' column='1'/>
+        <parameter type-id='7359adad' name='data_len' filepath='net/core/skbuff.c' line='5911' column='1'/>
+        <parameter type-id='95e97e5e' name='max_page_order' filepath='net/core/skbuff.c' line='5912' column='1'/>
+        <parameter type-id='7292109c' name='errcode' filepath='net/core/skbuff.c' line='5913' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='net/core/skbuff.c' line='5914' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='alloc_workqueue' mangled-name='alloc_workqueue' filepath='kernel/workqueue.c' line='4276' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_workqueue'>
-        <parameter type-id='80f4b756' name='fmt' filepath='kernel/workqueue.c' line='4276' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='kernel/workqueue.c' line='4277' column='1'/>
-        <parameter type-id='95e97e5e' name='max_active' filepath='kernel/workqueue.c' line='4278' column='1'/>
+      <function-decl name='alloc_workqueue' mangled-name='alloc_workqueue' filepath='kernel/workqueue.c' line='4279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_workqueue'>
+        <parameter type-id='80f4b756' name='fmt' filepath='kernel/workqueue.c' line='4279' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='kernel/workqueue.c' line='4280' column='1'/>
+        <parameter type-id='95e97e5e' name='max_active' filepath='kernel/workqueue.c' line='4281' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='242e3d19'/>
       </function-decl>
@@ -122527,18 +122541,18 @@
         <parameter type-id='6e829429' name='drv' filepath='drivers/amba/bus.c' line='356' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='amba_release_regions' mangled-name='amba_release_regions' filepath='drivers/amba/bus.c' line='816' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='amba_release_regions'>
-        <parameter type-id='ddd322c1' name='dev' filepath='drivers/amba/bus.c' line='816' column='1'/>
+      <function-decl name='amba_release_regions' mangled-name='amba_release_regions' filepath='drivers/amba/bus.c' line='817' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='amba_release_regions'>
+        <parameter type-id='ddd322c1' name='dev' filepath='drivers/amba/bus.c' line='817' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='amba_request_regions' mangled-name='amba_request_regions' filepath='drivers/amba/bus.c' line='794' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='amba_request_regions'>
-        <parameter type-id='ddd322c1' name='dev' filepath='drivers/amba/bus.c' line='794' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='drivers/amba/bus.c' line='794' column='1'/>
+      <function-decl name='amba_request_regions' mangled-name='amba_request_regions' filepath='drivers/amba/bus.c' line='795' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='amba_request_regions'>
+        <parameter type-id='ddd322c1' name='dev' filepath='drivers/amba/bus.c' line='795' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/amba/bus.c' line='795' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='android_debug_for_each_module' mangled-name='android_debug_for_each_module' filepath='kernel/module.c' line='4801' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='android_debug_for_each_module'>
-        <parameter type-id='841286fc' name='fn' filepath='kernel/module.c' line='4801' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='kernel/module.c' line='4802' column='1'/>
+      <function-decl name='android_debug_for_each_module' mangled-name='android_debug_for_each_module' filepath='kernel/module.c' line='4812' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='android_debug_for_each_module'>
+        <parameter type-id='841286fc' name='fn' filepath='kernel/module.c' line='4812' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='kernel/module.c' line='4813' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='android_debug_per_cpu_symbol' mangled-name='android_debug_per_cpu_symbol' filepath='drivers/android/debug_symbols.c' line='110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='android_debug_per_cpu_symbol'>
@@ -122969,8 +122983,8 @@
         <parameter type-id='3eb7c31c' name='flags' filepath='lib/bitmap.c' line='1255' column='1'/>
         <return type-id='1d2c2b85'/>
       </function-decl>
-      <function-decl name='blk_alloc_queue' mangled-name='blk_alloc_queue' filepath='block/blk-core.c' line='523' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_alloc_queue'>
-        <parameter type-id='95e97e5e' name='node_id' filepath='block/blk-core.c' line='523' column='1'/>
+      <function-decl name='blk_alloc_queue' mangled-name='blk_alloc_queue' filepath='block/blk-core.c' line='521' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_alloc_queue'>
+        <parameter type-id='95e97e5e' name='node_id' filepath='block/blk-core.c' line='521' column='1'/>
         <return type-id='e7d2a5fc'/>
       </function-decl>
       <function-decl name='blk_bio_list_merge' mangled-name='blk_bio_list_merge' filepath='block/blk-merge.c' line='1094' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_bio_list_merge'>
@@ -122980,10 +122994,10 @@
         <parameter type-id='f0981eeb' name='nr_segs' filepath='block/blk-merge.c' line='1095' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='blk_check_plugged' mangled-name='blk_check_plugged' filepath='block/blk-core.c' line='1739' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_check_plugged'>
-        <parameter type-id='f31816b5' name='unplug' filepath='block/blk-core.c' line='1739' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='block/blk-core.c' line='1739' column='1'/>
-        <parameter type-id='95e97e5e' name='size' filepath='block/blk-core.c' line='1740' column='1'/>
+      <function-decl name='blk_check_plugged' mangled-name='blk_check_plugged' filepath='block/blk-core.c' line='1737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_check_plugged'>
+        <parameter type-id='f31816b5' name='unplug' filepath='block/blk-core.c' line='1737' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='block/blk-core.c' line='1737' column='1'/>
+        <parameter type-id='95e97e5e' name='size' filepath='block/blk-core.c' line='1738' column='1'/>
         <return type-id='39914f13'/>
       </function-decl>
       <function-decl name='blk_cleanup_queue' mangled-name='blk_cleanup_queue' filepath='block/blk-core.c' line='376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_cleanup_queue'>
@@ -123005,27 +123019,27 @@
         <parameter type-id='5afdaa66' name='done' filepath='block/blk-exec.c' line='50' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_finish_plug' mangled-name='blk_finish_plug' filepath='block/blk-core.c' line='1782' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_finish_plug'>
-        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1782' column='1'/>
+      <function-decl name='blk_finish_plug' mangled-name='blk_finish_plug' filepath='block/blk-core.c' line='1780' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_finish_plug'>
+        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1780' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_freeze_queue_start' mangled-name='blk_freeze_queue_start' filepath='block/blk-mq.c' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_freeze_queue_start'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='136' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_get_queue' mangled-name='blk_get_queue' filepath='block/blk-core.c' line='616' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_queue'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='616' column='1'/>
+      <function-decl name='blk_get_queue' mangled-name='blk_get_queue' filepath='block/blk-core.c' line='614' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='614' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='blk_get_request' mangled-name='blk_get_request' filepath='block/blk-core.c' line='633' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_request'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='633' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='633' column='1'/>
-        <parameter type-id='346d62be' name='flags' filepath='block/blk-core.c' line='634' column='1'/>
+      <function-decl name='blk_get_request' mangled-name='blk_get_request' filepath='block/blk-core.c' line='631' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_request'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='631' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='631' column='1'/>
+        <parameter type-id='346d62be' name='flags' filepath='block/blk-core.c' line='632' column='1'/>
         <return type-id='3dad1a48'/>
       </function-decl>
-      <function-decl name='blk_insert_cloned_request' mangled-name='blk_insert_cloned_request' filepath='block/blk-core.c' line='1197' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_insert_cloned_request'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='1197' column='1'/>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1197' column='1'/>
+      <function-decl name='blk_insert_cloned_request' mangled-name='blk_insert_cloned_request' filepath='block/blk-core.c' line='1195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_insert_cloned_request'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='1195' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1195' column='1'/>
         <return type-id='f4e2facd'/>
       </function-decl>
       <function-decl name='blk_ksm_get_slot_idx' mangled-name='blk_ksm_get_slot_idx' filepath='block/keyslot-manager.c' line='211' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_ksm_get_slot_idx'>
@@ -123244,8 +123258,8 @@
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='342' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_put_request' mangled-name='blk_put_request' filepath='block/blk-core.c' line='649' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_request'>
-        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='649' column='1'/>
+      <function-decl name='blk_put_request' mangled-name='blk_put_request' filepath='block/blk-core.c' line='647' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_request'>
+        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='647' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_queue_alignment_offset' mangled-name='blk_queue_alignment_offset' filepath='block/blk-settings.c' line='367' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_alignment_offset'>
@@ -123424,8 +123438,8 @@
         <parameter type-id='7604ff1d' name='lim' filepath='block/blk-settings.c' line='74' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_start_plug' mangled-name='blk_start_plug' filepath='block/blk-core.c' line='1698' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_start_plug'>
-        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1698' column='1'/>
+      <function-decl name='blk_start_plug' mangled-name='blk_start_plug' filepath='block/blk-core.c' line='1696' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_start_plug'>
+        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1696' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_stat_enable_accounting' mangled-name='blk_stat_enable_accounting' filepath='block/blk-stat.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_stat_enable_accounting'>
@@ -123445,10 +123459,10 @@
         <parameter type-id='7359adad' name='range' filepath='block/genhd.c' line='659' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_update_request' mangled-name='blk_update_request' filepath='block/blk-core.c' line='1437' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_update_request'>
-        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='1437' column='1'/>
-        <parameter type-id='f4e2facd' name='error' filepath='block/blk-core.c' line='1437' column='1'/>
-        <parameter type-id='f0981eeb' name='nr_bytes' filepath='block/blk-core.c' line='1438' column='1'/>
+      <function-decl name='blk_update_request' mangled-name='blk_update_request' filepath='block/blk-core.c' line='1435' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_update_request'>
+        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='1435' column='1'/>
+        <parameter type-id='f4e2facd' name='error' filepath='block/blk-core.c' line='1435' column='1'/>
+        <parameter type-id='f0981eeb' name='nr_bytes' filepath='block/blk-core.c' line='1436' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='blk_verify_command' mangled-name='blk_verify_command' filepath='block/scsi_ioctl.c' line='200' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_verify_command'>
@@ -123559,15 +123573,15 @@
         <parameter type-id='d504f73d' name='n' filepath='kernel/notifier.c' line='271' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bmap' mangled-name='bmap' filepath='fs/inode.c' line='1701' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bmap'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1701' column='1'/>
-        <parameter type-id='5c39fc92' name='block' filepath='fs/inode.c' line='1701' column='1'/>
+      <function-decl name='bmap' mangled-name='bmap' filepath='fs/inode.c' line='1743' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bmap'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1743' column='1'/>
+        <parameter type-id='5c39fc92' name='block' filepath='fs/inode.c' line='1743' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bpf_dispatcher_xdp_func' mangled-name='bpf_dispatcher_xdp_func' filepath='net/core/filter.c' line='10341' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_dispatcher_xdp_func'>
-        <parameter type-id='eaa32e2f' name='ctx' filepath='net/core/filter.c' line='10341' column='1'/>
-        <parameter type-id='acada613' name='insnsi' filepath='net/core/filter.c' line='10341' column='1'/>
-        <parameter type-id='531a7450' name='bpf_func' filepath='net/core/filter.c' line='10341' column='1'/>
+      <function-decl name='bpf_dispatcher_xdp_func' mangled-name='bpf_dispatcher_xdp_func' filepath='net/core/filter.c' line='10343' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_dispatcher_xdp_func'>
+        <parameter type-id='eaa32e2f' name='ctx' filepath='net/core/filter.c' line='10343' column='1'/>
+        <parameter type-id='acada613' name='insnsi' filepath='net/core/filter.c' line='10343' column='1'/>
+        <parameter type-id='531a7450' name='bpf_func' filepath='net/core/filter.c' line='10343' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='bpf_prog_add' mangled-name='bpf_prog_add' filepath='kernel/bpf/syscall.c' line='1878' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_prog_add'>
@@ -123585,12 +123599,87 @@
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='bpf_stats_enabled_key' type-id='237c0d27' mangled-name='bpf_stats_enabled_key' visibility='default' filepath='kernel/bpf/core.c' line='2344' column='1' elf-symbol-id='bpf_stats_enabled_key'/>
-      <function-decl name='bpf_trace_run1' mangled-name='bpf_trace_run1' filepath='kernel/trace/bpf_trace.c' line='2093' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run1'>
-        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2093' column='1'/>
-        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2093' column='1'/>
+      <function-decl name='bpf_trace_run1' mangled-name='bpf_trace_run1' filepath='kernel/trace/bpf_trace.c' line='2097' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run1'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2097' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2097' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run10' mangled-name='bpf_trace_run10' filepath='kernel/trace/bpf_trace.c' line='2102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run10'>
+      <function-decl name='bpf_trace_run10' mangled-name='bpf_trace_run10' filepath='kernel/trace/bpf_trace.c' line='2106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run10'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2106' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2106' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2106' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2106' column='1'/>
+        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2106' column='1'/>
+        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2106' column='1'/>
+        <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2106' column='1'/>
+        <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2106' column='1'/>
+        <parameter type-id='91ce1af9' name='arg7' filepath='kernel/trace/bpf_trace.c' line='2106' column='1'/>
+        <parameter type-id='91ce1af9' name='arg8' filepath='kernel/trace/bpf_trace.c' line='2106' column='1'/>
+        <parameter type-id='91ce1af9' name='arg9' filepath='kernel/trace/bpf_trace.c' line='2106' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='bpf_trace_run11' mangled-name='bpf_trace_run11' filepath='kernel/trace/bpf_trace.c' line='2107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run11'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <parameter type-id='91ce1af9' name='arg7' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <parameter type-id='91ce1af9' name='arg8' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <parameter type-id='91ce1af9' name='arg9' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <parameter type-id='91ce1af9' name='arg10' filepath='kernel/trace/bpf_trace.c' line='2107' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='bpf_trace_run12' mangled-name='bpf_trace_run12' filepath='kernel/trace/bpf_trace.c' line='2108' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run12'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg7' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg8' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg9' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg10' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <parameter type-id='91ce1af9' name='arg11' filepath='kernel/trace/bpf_trace.c' line='2108' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='bpf_trace_run2' mangled-name='bpf_trace_run2' filepath='kernel/trace/bpf_trace.c' line='2098' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run2'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2098' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2098' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2098' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='bpf_trace_run3' mangled-name='bpf_trace_run3' filepath='kernel/trace/bpf_trace.c' line='2099' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run3'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='bpf_trace_run4' mangled-name='bpf_trace_run4' filepath='kernel/trace/bpf_trace.c' line='2100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run4'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
+        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='bpf_trace_run5' mangled-name='bpf_trace_run5' filepath='kernel/trace/bpf_trace.c' line='2101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run5'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
+        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
+        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='bpf_trace_run6' mangled-name='bpf_trace_run6' filepath='kernel/trace/bpf_trace.c' line='2102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run6'>
         <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2102' column='1'/>
         <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2102' column='1'/>
         <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2102' column='1'/>
@@ -123598,13 +123687,9 @@
         <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2102' column='1'/>
         <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2102' column='1'/>
         <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2102' column='1'/>
-        <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2102' column='1'/>
-        <parameter type-id='91ce1af9' name='arg7' filepath='kernel/trace/bpf_trace.c' line='2102' column='1'/>
-        <parameter type-id='91ce1af9' name='arg8' filepath='kernel/trace/bpf_trace.c' line='2102' column='1'/>
-        <parameter type-id='91ce1af9' name='arg9' filepath='kernel/trace/bpf_trace.c' line='2102' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run11' mangled-name='bpf_trace_run11' filepath='kernel/trace/bpf_trace.c' line='2103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run11'>
+      <function-decl name='bpf_trace_run7' mangled-name='bpf_trace_run7' filepath='kernel/trace/bpf_trace.c' line='2103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run7'>
         <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2103' column='1'/>
         <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2103' column='1'/>
         <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2103' column='1'/>
@@ -123613,13 +123698,9 @@
         <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2103' column='1'/>
         <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2103' column='1'/>
         <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2103' column='1'/>
-        <parameter type-id='91ce1af9' name='arg7' filepath='kernel/trace/bpf_trace.c' line='2103' column='1'/>
-        <parameter type-id='91ce1af9' name='arg8' filepath='kernel/trace/bpf_trace.c' line='2103' column='1'/>
-        <parameter type-id='91ce1af9' name='arg9' filepath='kernel/trace/bpf_trace.c' line='2103' column='1'/>
-        <parameter type-id='91ce1af9' name='arg10' filepath='kernel/trace/bpf_trace.c' line='2103' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run12' mangled-name='bpf_trace_run12' filepath='kernel/trace/bpf_trace.c' line='2104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run12'>
+      <function-decl name='bpf_trace_run8' mangled-name='bpf_trace_run8' filepath='kernel/trace/bpf_trace.c' line='2104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run8'>
         <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2104' column='1'/>
         <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2104' column='1'/>
         <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2104' column='1'/>
@@ -123629,90 +123710,23 @@
         <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2104' column='1'/>
         <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2104' column='1'/>
         <parameter type-id='91ce1af9' name='arg7' filepath='kernel/trace/bpf_trace.c' line='2104' column='1'/>
-        <parameter type-id='91ce1af9' name='arg8' filepath='kernel/trace/bpf_trace.c' line='2104' column='1'/>
-        <parameter type-id='91ce1af9' name='arg9' filepath='kernel/trace/bpf_trace.c' line='2104' column='1'/>
-        <parameter type-id='91ce1af9' name='arg10' filepath='kernel/trace/bpf_trace.c' line='2104' column='1'/>
-        <parameter type-id='91ce1af9' name='arg11' filepath='kernel/trace/bpf_trace.c' line='2104' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run2' mangled-name='bpf_trace_run2' filepath='kernel/trace/bpf_trace.c' line='2094' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run2'>
-        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2094' column='1'/>
-        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2094' column='1'/>
-        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2094' column='1'/>
+      <function-decl name='bpf_trace_run9' mangled-name='bpf_trace_run9' filepath='kernel/trace/bpf_trace.c' line='2105' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run9'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2105' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2105' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2105' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2105' column='1'/>
+        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2105' column='1'/>
+        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2105' column='1'/>
+        <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2105' column='1'/>
+        <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2105' column='1'/>
+        <parameter type-id='91ce1af9' name='arg7' filepath='kernel/trace/bpf_trace.c' line='2105' column='1'/>
+        <parameter type-id='91ce1af9' name='arg8' filepath='kernel/trace/bpf_trace.c' line='2105' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run3' mangled-name='bpf_trace_run3' filepath='kernel/trace/bpf_trace.c' line='2095' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run3'>
-        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2095' column='1'/>
-        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2095' column='1'/>
-        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2095' column='1'/>
-        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2095' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='bpf_trace_run4' mangled-name='bpf_trace_run4' filepath='kernel/trace/bpf_trace.c' line='2096' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run4'>
-        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2096' column='1'/>
-        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2096' column='1'/>
-        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2096' column='1'/>
-        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2096' column='1'/>
-        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2096' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='bpf_trace_run5' mangled-name='bpf_trace_run5' filepath='kernel/trace/bpf_trace.c' line='2097' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run5'>
-        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2097' column='1'/>
-        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2097' column='1'/>
-        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2097' column='1'/>
-        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2097' column='1'/>
-        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2097' column='1'/>
-        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2097' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='bpf_trace_run6' mangled-name='bpf_trace_run6' filepath='kernel/trace/bpf_trace.c' line='2098' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run6'>
-        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2098' column='1'/>
-        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2098' column='1'/>
-        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2098' column='1'/>
-        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2098' column='1'/>
-        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2098' column='1'/>
-        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2098' column='1'/>
-        <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2098' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='bpf_trace_run7' mangled-name='bpf_trace_run7' filepath='kernel/trace/bpf_trace.c' line='2099' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run7'>
-        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
-        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
-        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
-        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
-        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
-        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
-        <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
-        <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2099' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='bpf_trace_run8' mangled-name='bpf_trace_run8' filepath='kernel/trace/bpf_trace.c' line='2100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run8'>
-        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
-        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
-        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
-        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
-        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
-        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
-        <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
-        <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
-        <parameter type-id='91ce1af9' name='arg7' filepath='kernel/trace/bpf_trace.c' line='2100' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='bpf_trace_run9' mangled-name='bpf_trace_run9' filepath='kernel/trace/bpf_trace.c' line='2101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run9'>
-        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
-        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
-        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
-        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
-        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
-        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
-        <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
-        <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
-        <parameter type-id='91ce1af9' name='arg7' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
-        <parameter type-id='91ce1af9' name='arg8' filepath='kernel/trace/bpf_trace.c' line='2101' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='bpf_warn_invalid_xdp_action' mangled-name='bpf_warn_invalid_xdp_action' filepath='net/core/filter.c' line='7954' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_warn_invalid_xdp_action'>
-        <parameter type-id='19c2251e' name='act' filepath='net/core/filter.c' line='7954' column='1'/>
+      <function-decl name='bpf_warn_invalid_xdp_action' mangled-name='bpf_warn_invalid_xdp_action' filepath='net/core/filter.c' line='7956' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_warn_invalid_xdp_action'>
+        <parameter type-id='19c2251e' name='act' filepath='net/core/filter.c' line='7956' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='bsearch' mangled-name='bsearch' filepath='lib/bsearch.c' line='31' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bsearch'>
@@ -123847,9 +123861,9 @@
         <parameter type-id='4edd56e3' name='func' filepath='kernel/rcu/tasks.h' line='530' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='call_rcu_tasks_trace' mangled-name='call_rcu_tasks_trace' filepath='kernel/rcu/tasks.h' line='1168' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='call_rcu_tasks_trace'>
-        <parameter type-id='69c138b1' name='rhp' filepath='kernel/rcu/tasks.h' line='1168' column='1'/>
-        <parameter type-id='4edd56e3' name='func' filepath='kernel/rcu/tasks.h' line='1168' column='1'/>
+      <function-decl name='call_rcu_tasks_trace' mangled-name='call_rcu_tasks_trace' filepath='kernel/rcu/tasks.h' line='1171' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='call_rcu_tasks_trace'>
+        <parameter type-id='69c138b1' name='rhp' filepath='kernel/rcu/tasks.h' line='1171' column='1'/>
+        <parameter type-id='4edd56e3' name='func' filepath='kernel/rcu/tasks.h' line='1171' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='call_srcu' mangled-name='call_srcu' filepath='kernel/rcu/srcutree.c' line='909' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='call_srcu'>
@@ -123879,16 +123893,16 @@
         <parameter type-id='f0981eeb' name='idx' filepath='drivers/net/can/dev/dev.c' line='461' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cancel_delayed_work' mangled-name='cancel_delayed_work' filepath='kernel/workqueue.c' line='3273' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cancel_delayed_work'>
-        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='3273' column='1'/>
+      <function-decl name='cancel_delayed_work' mangled-name='cancel_delayed_work' filepath='kernel/workqueue.c' line='3276' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cancel_delayed_work'>
+        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='3276' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='cancel_delayed_work_sync' mangled-name='cancel_delayed_work_sync' filepath='kernel/workqueue.c' line='3288' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cancel_delayed_work_sync'>
-        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='3288' column='1'/>
+      <function-decl name='cancel_delayed_work_sync' mangled-name='cancel_delayed_work_sync' filepath='kernel/workqueue.c' line='3291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cancel_delayed_work_sync'>
+        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='3291' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='cancel_work_sync' mangled-name='cancel_work_sync' filepath='kernel/workqueue.c' line='3192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cancel_work_sync'>
-        <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='3192' column='1'/>
+      <function-decl name='cancel_work_sync' mangled-name='cancel_work_sync' filepath='kernel/workqueue.c' line='3195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cancel_work_sync'>
+        <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='3195' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='capable' mangled-name='capable' filepath='kernel/capability.c' line='447' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='capable'>
@@ -123937,11 +123951,11 @@
         <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/cdc_ncm.c' line='980' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cdc_parse_cdc_header' mangled-name='cdc_parse_cdc_header' filepath='drivers/usb/core/message.c' line='2279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdc_parse_cdc_header'>
-        <parameter type-id='16f45b2c' name='hdr' filepath='drivers/usb/core/message.c' line='2279' column='1'/>
-        <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/message.c' line='2280' column='1'/>
-        <parameter type-id='8bff8096' name='buffer' filepath='drivers/usb/core/message.c' line='2281' column='1'/>
-        <parameter type-id='95e97e5e' name='buflen' filepath='drivers/usb/core/message.c' line='2282' column='1'/>
+      <function-decl name='cdc_parse_cdc_header' mangled-name='cdc_parse_cdc_header' filepath='drivers/usb/core/message.c' line='2274' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdc_parse_cdc_header'>
+        <parameter type-id='16f45b2c' name='hdr' filepath='drivers/usb/core/message.c' line='2274' column='1'/>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/message.c' line='2275' column='1'/>
+        <parameter type-id='8bff8096' name='buffer' filepath='drivers/usb/core/message.c' line='2276' column='1'/>
+        <parameter type-id='95e97e5e' name='buflen' filepath='drivers/usb/core/message.c' line='2277' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='cdev_add' mangled-name='cdev_add' filepath='fs/char_dev.c' line='479' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdev_add'>
@@ -124043,21 +124057,21 @@
         <parameter type-id='fa0b179b' name='parent' filepath='drivers/media/cec/core/cec-core.c' line='319' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cec_s_log_addrs' mangled-name='cec_s_log_addrs' filepath='drivers/media/cec/core/cec-adap.c' line='1816' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cec_s_log_addrs'>
-        <parameter type-id='b94a2f7c' name='adap' filepath='drivers/media/cec/core/cec-adap.c' line='1816' column='1'/>
-        <parameter type-id='ebc04a66' name='log_addrs' filepath='drivers/media/cec/core/cec-adap.c' line='1817' column='1'/>
-        <parameter type-id='b50a4934' name='block' filepath='drivers/media/cec/core/cec-adap.c' line='1817' column='1'/>
+      <function-decl name='cec_s_log_addrs' mangled-name='cec_s_log_addrs' filepath='drivers/media/cec/core/cec-adap.c' line='1817' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cec_s_log_addrs'>
+        <parameter type-id='b94a2f7c' name='adap' filepath='drivers/media/cec/core/cec-adap.c' line='1817' column='1'/>
+        <parameter type-id='ebc04a66' name='log_addrs' filepath='drivers/media/cec/core/cec-adap.c' line='1818' column='1'/>
+        <parameter type-id='b50a4934' name='block' filepath='drivers/media/cec/core/cec-adap.c' line='1818' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cec_s_phys_addr' mangled-name='cec_s_phys_addr' filepath='drivers/media/cec/core/cec-adap.c' line='1612' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cec_s_phys_addr'>
-        <parameter type-id='b94a2f7c' name='adap' filepath='drivers/media/cec/core/cec-adap.c' line='1612' column='1'/>
-        <parameter type-id='1dc6a898' name='phys_addr' filepath='drivers/media/cec/core/cec-adap.c' line='1612' column='1'/>
-        <parameter type-id='b50a4934' name='block' filepath='drivers/media/cec/core/cec-adap.c' line='1612' column='1'/>
+      <function-decl name='cec_s_phys_addr' mangled-name='cec_s_phys_addr' filepath='drivers/media/cec/core/cec-adap.c' line='1613' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cec_s_phys_addr'>
+        <parameter type-id='b94a2f7c' name='adap' filepath='drivers/media/cec/core/cec-adap.c' line='1613' column='1'/>
+        <parameter type-id='1dc6a898' name='phys_addr' filepath='drivers/media/cec/core/cec-adap.c' line='1613' column='1'/>
+        <parameter type-id='b50a4934' name='block' filepath='drivers/media/cec/core/cec-adap.c' line='1613' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cec_s_phys_addr_from_edid' mangled-name='cec_s_phys_addr_from_edid' filepath='drivers/media/cec/core/cec-adap.c' line='1623' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cec_s_phys_addr_from_edid'>
-        <parameter type-id='b94a2f7c' name='adap' filepath='drivers/media/cec/core/cec-adap.c' line='1623' column='1'/>
-        <parameter type-id='776adf76' name='edid' filepath='drivers/media/cec/core/cec-adap.c' line='1624' column='1'/>
+      <function-decl name='cec_s_phys_addr_from_edid' mangled-name='cec_s_phys_addr_from_edid' filepath='drivers/media/cec/core/cec-adap.c' line='1624' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cec_s_phys_addr_from_edid'>
+        <parameter type-id='b94a2f7c' name='adap' filepath='drivers/media/cec/core/cec-adap.c' line='1624' column='1'/>
+        <parameter type-id='776adf76' name='edid' filepath='drivers/media/cec/core/cec-adap.c' line='1625' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='cec_transmit_attempt_done_ts' mangled-name='cec_transmit_attempt_done_ts' filepath='drivers/media/cec/core/cec-adap.c' line='690' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cec_transmit_attempt_done_ts'>
@@ -124080,31 +124094,31 @@
         <parameter type-id='b94a2f7c' name='adap' filepath='drivers/media/cec/core/cec-core.c' line='377' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cgroup_add_dfl_cftypes' mangled-name='cgroup_add_dfl_cftypes' filepath='kernel/cgroup/cgroup.c' line='4214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_add_dfl_cftypes'>
-        <parameter type-id='dc91d125' name='ss' filepath='kernel/cgroup/cgroup.c' line='4214' column='1'/>
-        <parameter type-id='03054cfa' name='cfts' filepath='kernel/cgroup/cgroup.c' line='4214' column='1'/>
+      <function-decl name='cgroup_add_dfl_cftypes' mangled-name='cgroup_add_dfl_cftypes' filepath='kernel/cgroup/cgroup.c' line='4229' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_add_dfl_cftypes'>
+        <parameter type-id='dc91d125' name='ss' filepath='kernel/cgroup/cgroup.c' line='4229' column='1'/>
+        <parameter type-id='03054cfa' name='cfts' filepath='kernel/cgroup/cgroup.c' line='4229' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cgroup_add_legacy_cftypes' mangled-name='cgroup_add_legacy_cftypes' filepath='kernel/cgroup/cgroup.c' line='4232' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_add_legacy_cftypes'>
-        <parameter type-id='dc91d125' name='ss' filepath='kernel/cgroup/cgroup.c' line='4232' column='1'/>
-        <parameter type-id='03054cfa' name='cfts' filepath='kernel/cgroup/cgroup.c' line='4232' column='1'/>
+      <function-decl name='cgroup_add_legacy_cftypes' mangled-name='cgroup_add_legacy_cftypes' filepath='kernel/cgroup/cgroup.c' line='4247' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_add_legacy_cftypes'>
+        <parameter type-id='dc91d125' name='ss' filepath='kernel/cgroup/cgroup.c' line='4247' column='1'/>
+        <parameter type-id='03054cfa' name='cfts' filepath='kernel/cgroup/cgroup.c' line='4247' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cgroup_path_ns' mangled-name='cgroup_path_ns' filepath='kernel/cgroup/cgroup.c' line='2275' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_path_ns'>
-        <parameter type-id='46ff135d' name='cgrp' filepath='kernel/cgroup/cgroup.c' line='2275' column='1'/>
-        <parameter type-id='26a90f95' name='buf' filepath='kernel/cgroup/cgroup.c' line='2275' column='1'/>
-        <parameter type-id='b59d7dce' name='buflen' filepath='kernel/cgroup/cgroup.c' line='2275' column='1'/>
-        <parameter type-id='f774a955' name='ns' filepath='kernel/cgroup/cgroup.c' line='2276' column='1'/>
+      <function-decl name='cgroup_path_ns' mangled-name='cgroup_path_ns' filepath='kernel/cgroup/cgroup.c' line='2290' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_path_ns'>
+        <parameter type-id='46ff135d' name='cgrp' filepath='kernel/cgroup/cgroup.c' line='2290' column='1'/>
+        <parameter type-id='26a90f95' name='buf' filepath='kernel/cgroup/cgroup.c' line='2290' column='1'/>
+        <parameter type-id='b59d7dce' name='buflen' filepath='kernel/cgroup/cgroup.c' line='2290' column='1'/>
+        <parameter type-id='f774a955' name='ns' filepath='kernel/cgroup/cgroup.c' line='2291' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cgroup_taskset_first' mangled-name='cgroup_taskset_first' filepath='kernel/cgroup/cgroup.c' line='2418' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_taskset_first'>
-        <parameter type-id='8cffa561' name='tset' filepath='kernel/cgroup/cgroup.c' line='2418' column='1'/>
-        <parameter type-id='e7f9d97b' name='dst_cssp' filepath='kernel/cgroup/cgroup.c' line='2419' column='1'/>
+      <function-decl name='cgroup_taskset_first' mangled-name='cgroup_taskset_first' filepath='kernel/cgroup/cgroup.c' line='2433' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_taskset_first'>
+        <parameter type-id='8cffa561' name='tset' filepath='kernel/cgroup/cgroup.c' line='2433' column='1'/>
+        <parameter type-id='e7f9d97b' name='dst_cssp' filepath='kernel/cgroup/cgroup.c' line='2434' column='1'/>
         <return type-id='f23e2572'/>
       </function-decl>
-      <function-decl name='cgroup_taskset_next' mangled-name='cgroup_taskset_next' filepath='kernel/cgroup/cgroup.c' line='2436' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_taskset_next'>
-        <parameter type-id='8cffa561' name='tset' filepath='kernel/cgroup/cgroup.c' line='2436' column='1'/>
-        <parameter type-id='e7f9d97b' name='dst_cssp' filepath='kernel/cgroup/cgroup.c' line='2437' column='1'/>
+      <function-decl name='cgroup_taskset_next' mangled-name='cgroup_taskset_next' filepath='kernel/cgroup/cgroup.c' line='2451' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_taskset_next'>
+        <parameter type-id='8cffa561' name='tset' filepath='kernel/cgroup/cgroup.c' line='2451' column='1'/>
+        <parameter type-id='e7f9d97b' name='dst_cssp' filepath='kernel/cgroup/cgroup.c' line='2452' column='1'/>
         <return type-id='f23e2572'/>
       </function-decl>
       <function-decl name='check_cache_active' mangled-name='check_cache_active' filepath='mm/swap_slots.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='check_cache_active'>
@@ -124299,9 +124313,9 @@
         <parameter type-id='9e6d4b4e' name='hw' filepath='drivers/clk/clk.c' line='522' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='clk_hw_register' mangled-name='clk_hw_register' filepath='drivers/clk/clk.c' line='4076' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_register'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4076' column='1'/>
-        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4076' column='1'/>
+      <function-decl name='clk_hw_register' mangled-name='clk_hw_register' filepath='drivers/clk/clk.c' line='4079' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4079' column='1'/>
+        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4079' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='clk_hw_register_composite' mangled-name='clk_hw_register_composite' filepath='drivers/clk/clk-composite.c' line='319' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_register_composite'>
@@ -124343,8 +124357,8 @@
         <parameter type-id='7359adad' name='max_rate' filepath='drivers/clk/clk.c' line='666' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_hw_unregister' mangled-name='clk_hw_unregister' filepath='drivers/clk/clk.c' line='4241' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_unregister'>
-        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4241' column='1'/>
+      <function-decl name='clk_hw_unregister' mangled-name='clk_hw_unregister' filepath='drivers/clk/clk.c' line='4244' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_unregister'>
+        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4244' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='clk_hw_unregister_divider' mangled-name='clk_hw_unregister_divider' filepath='drivers/clk/clk-divider.c' line='576' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_unregister_divider'>
@@ -124376,14 +124390,14 @@
       </function-decl>
       <var-decl name='clk_mux_ops' type-id='92072f8b' mangled-name='clk_mux_ops' visibility='default' filepath='drivers/clk/clk-mux.c' line='136' column='1' elf-symbol-id='clk_mux_ops'/>
       <var-decl name='clk_mux_ro_ops' type-id='92072f8b' mangled-name='clk_mux_ro_ops' visibility='default' filepath='drivers/clk/clk-mux.c' line='143' column='1' elf-symbol-id='clk_mux_ro_ops'/>
-      <function-decl name='clk_notifier_register' mangled-name='clk_notifier_register' filepath='drivers/clk/clk.c' line='4471' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_notifier_register'>
-        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4471' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/clk/clk.c' line='4471' column='1'/>
+      <function-decl name='clk_notifier_register' mangled-name='clk_notifier_register' filepath='drivers/clk/clk.c' line='4474' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_notifier_register'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4474' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/clk/clk.c' line='4474' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='clk_notifier_unregister' mangled-name='clk_notifier_unregister' filepath='drivers/clk/clk.c' line='4519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_notifier_unregister'>
-        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4519' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/clk/clk.c' line='4519' column='1'/>
+      <function-decl name='clk_notifier_unregister' mangled-name='clk_notifier_unregister' filepath='drivers/clk/clk.c' line='4522' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_notifier_unregister'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4522' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/clk/clk.c' line='4522' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='clk_prepare' mangled-name='clk_prepare' filepath='drivers/clk/clk.c' line='966' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_prepare'>
@@ -124394,9 +124408,9 @@
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clkdev.c' line='115' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_register' mangled-name='clk_register' filepath='drivers/clk/clk.c' line='4060' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_register'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4060' column='1'/>
-        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4060' column='1'/>
+      <function-decl name='clk_register' mangled-name='clk_register' filepath='drivers/clk/clk.c' line='4063' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4063' column='1'/>
+        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4063' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
       <function-decl name='clk_register_clkdev' mangled-name='clk_register_clkdev' filepath='drivers/clk/clkdev.c' line='341' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_register_clkdev'>
@@ -124508,8 +124522,8 @@
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='885' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_unregister' mangled-name='clk_unregister' filepath='drivers/clk/clk.c' line='4179' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_unregister'>
-        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4179' column='1'/>
+      <function-decl name='clk_unregister' mangled-name='clk_unregister' filepath='drivers/clk/clk.c' line='4182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_unregister'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4182' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='clockevents_config_and_register' mangled-name='clockevents_config_and_register' filepath='kernel/time/clockevents.c' line='505' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clockevents_config_and_register'>
@@ -124731,16 +124745,16 @@
         <parameter type-id='b59d7dce' name='count' filepath='sound/core/memory.c' line='23' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <var-decl name='cpu_all_bits' type-id='afe549fd' mangled-name='cpu_all_bits' visibility='default' filepath='kernel/cpu.c' line='2805' column='1' elf-symbol-id='cpu_all_bits'/>
-      <var-decl name='cpu_bit_bitmap' type-id='f959706c' mangled-name='cpu_bit_bitmap' visibility='default' filepath='kernel/cpu.c' line='2794' column='1' elf-symbol-id='cpu_bit_bitmap'/>
+      <var-decl name='cpu_all_bits' type-id='afe549fd' mangled-name='cpu_all_bits' visibility='default' filepath='kernel/cpu.c' line='2804' column='1' elf-symbol-id='cpu_all_bits'/>
+      <var-decl name='cpu_bit_bitmap' type-id='f959706c' mangled-name='cpu_bit_bitmap' visibility='default' filepath='kernel/cpu.c' line='2793' column='1' elf-symbol-id='cpu_bit_bitmap'/>
       <function-decl name='cpu_have_feature' mangled-name='cpu_have_feature' filepath='arch/arm64/kernel/cpufeature.c' line='2893' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_have_feature'>
         <parameter type-id='f0981eeb' name='num' filepath='arch/arm64/kernel/cpufeature.c' line='2893' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='cpu_hotplug_disable' mangled-name='cpu_hotplug_disable' filepath='kernel/cpu.c' line='360' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_hotplug_disable'>
+      <function-decl name='cpu_hotplug_disable' mangled-name='cpu_hotplug_disable' filepath='kernel/cpu.c' line='361' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_hotplug_disable'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpu_hotplug_enable' mangled-name='cpu_hotplug_enable' filepath='kernel/cpu.c' line='375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_hotplug_enable'>
+      <function-decl name='cpu_hotplug_enable' mangled-name='cpu_hotplug_enable' filepath='kernel/cpu.c' line='376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_hotplug_enable'>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='cpu_hwcap_keys' type-id='cee5a038' mangled-name='cpu_hwcap_keys' visibility='default' filepath='arch/arm64/kernel/cpufeature.c' line='156' column='1' elf-symbol-id='cpu_hwcap_keys'/>
@@ -124768,10 +124782,10 @@
         <parameter type-id='a7832498' name='new_value' filepath='kernel/power/qos.c' line='293' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpu_maps_update_begin' mangled-name='cpu_maps_update_begin' filepath='kernel/cpu.c' line='279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_maps_update_begin'>
+      <function-decl name='cpu_maps_update_begin' mangled-name='cpu_maps_update_begin' filepath='kernel/cpu.c' line='280' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_maps_update_begin'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpu_maps_update_done' mangled-name='cpu_maps_update_done' filepath='kernel/cpu.c' line='285' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_maps_update_done'>
+      <function-decl name='cpu_maps_update_done' mangled-name='cpu_maps_update_done' filepath='kernel/cpu.c' line='286' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_maps_update_done'>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='cpu_number' type-id='95e97e5e' mangled-name='cpu_number' visibility='default' filepath='arch/arm64/kernel/smp.c' line='59' column='1' elf-symbol-id='cpu_number'/>
@@ -124828,31 +124842,31 @@
         <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq_governor.c' line='543' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpufreq_disable_fast_switch' mangled-name='cpufreq_disable_fast_switch' filepath='drivers/cpufreq/cpufreq.c' line='520' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_disable_fast_switch'>
-        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='520' column='1'/>
+      <function-decl name='cpufreq_disable_fast_switch' mangled-name='cpufreq_disable_fast_switch' filepath='drivers/cpufreq/cpufreq.c' line='522' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_disable_fast_switch'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='522' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpufreq_driver_fast_switch' mangled-name='cpufreq_driver_fast_switch' filepath='drivers/cpufreq/cpufreq.c' line='2095' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_driver_fast_switch'>
-        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='2095' column='1'/>
-        <parameter type-id='f0981eeb' name='target_freq' filepath='drivers/cpufreq/cpufreq.c' line='2096' column='1'/>
+      <function-decl name='cpufreq_driver_fast_switch' mangled-name='cpufreq_driver_fast_switch' filepath='drivers/cpufreq/cpufreq.c' line='2097' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_driver_fast_switch'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='2097' column='1'/>
+        <parameter type-id='f0981eeb' name='target_freq' filepath='drivers/cpufreq/cpufreq.c' line='2098' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='cpufreq_driver_resolve_freq' mangled-name='cpufreq_driver_resolve_freq' filepath='drivers/cpufreq/cpufreq.c' line='543' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_driver_resolve_freq'>
-        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='543' column='1'/>
-        <parameter type-id='f0981eeb' name='target_freq' filepath='drivers/cpufreq/cpufreq.c' line='544' column='1'/>
+      <function-decl name='cpufreq_driver_resolve_freq' mangled-name='cpufreq_driver_resolve_freq' filepath='drivers/cpufreq/cpufreq.c' line='545' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_driver_resolve_freq'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='545' column='1'/>
+        <parameter type-id='f0981eeb' name='target_freq' filepath='drivers/cpufreq/cpufreq.c' line='546' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='cpufreq_driver_target' mangled-name='cpufreq_driver_target' filepath='drivers/cpufreq/cpufreq.c' line='2250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_driver_target'>
-        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='2250' column='1'/>
-        <parameter type-id='f0981eeb' name='target_freq' filepath='drivers/cpufreq/cpufreq.c' line='2251' column='1'/>
-        <parameter type-id='f0981eeb' name='relation' filepath='drivers/cpufreq/cpufreq.c' line='2252' column='1'/>
+      <function-decl name='cpufreq_driver_target' mangled-name='cpufreq_driver_target' filepath='drivers/cpufreq/cpufreq.c' line='2252' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_driver_target'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='2252' column='1'/>
+        <parameter type-id='f0981eeb' name='target_freq' filepath='drivers/cpufreq/cpufreq.c' line='2253' column='1'/>
+        <parameter type-id='f0981eeb' name='relation' filepath='drivers/cpufreq/cpufreq.c' line='2254' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_enable_boost_support' mangled-name='cpufreq_enable_boost_support' filepath='drivers/cpufreq/cpufreq.c' line='2689' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_enable_boost_support'>
+      <function-decl name='cpufreq_enable_boost_support' mangled-name='cpufreq_enable_boost_support' filepath='drivers/cpufreq/cpufreq.c' line='2691' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_enable_boost_support'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_enable_fast_switch' mangled-name='cpufreq_enable_fast_switch' filepath='drivers/cpufreq/cpufreq.c' line='496' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_enable_fast_switch'>
-        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='496' column='1'/>
+      <function-decl name='cpufreq_enable_fast_switch' mangled-name='cpufreq_enable_fast_switch' filepath='drivers/cpufreq/cpufreq.c' line='498' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_enable_fast_switch'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='498' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='cpufreq_freq_attr_scaling_available_freqs' type-id='9f2d4ea3' mangled-name='cpufreq_freq_attr_scaling_available_freqs' visibility='default' filepath='drivers/cpufreq/freq_table.c' line='280' column='1' elf-symbol-id='cpufreq_freq_attr_scaling_available_freqs'/>
@@ -124887,45 +124901,45 @@
         <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='195' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='cpufreq_generic_suspend' mangled-name='cpufreq_generic_suspend' filepath='drivers/cpufreq/cpufreq.c' line='1836' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_generic_suspend'>
-        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='1836' column='1'/>
+      <function-decl name='cpufreq_generic_suspend' mangled-name='cpufreq_generic_suspend' filepath='drivers/cpufreq/cpufreq.c' line='1838' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_generic_suspend'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='1838' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_get' mangled-name='cpufreq_get' filepath='drivers/cpufreq/cpufreq.c' line='1807' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_get'>
-        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='1807' column='1'/>
+      <function-decl name='cpufreq_get' mangled-name='cpufreq_get' filepath='drivers/cpufreq/cpufreq.c' line='1809' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_get'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='1809' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='cpufreq_get_driver_data' mangled-name='cpufreq_get_driver_data' filepath='drivers/cpufreq/cpufreq.c' line='1967' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_get_driver_data'>
+      <function-decl name='cpufreq_get_driver_data' mangled-name='cpufreq_get_driver_data' filepath='drivers/cpufreq/cpufreq.c' line='1969' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_get_driver_data'>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='cpufreq_get_policy' mangled-name='cpufreq_get_policy' filepath='drivers/cpufreq/cpufreq.c' line='2442' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_get_policy'>
-        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='2442' column='1'/>
-        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='2442' column='1'/>
+      <function-decl name='cpufreq_get_policy' mangled-name='cpufreq_get_policy' filepath='drivers/cpufreq/cpufreq.c' line='2444' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_get_policy'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='2444' column='1'/>
+        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='2444' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_policy_transition_delay_us' mangled-name='cpufreq_policy_transition_delay_us' filepath='drivers/cpufreq/cpufreq.c' line='568' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_policy_transition_delay_us'>
-        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='568' column='1'/>
+      <function-decl name='cpufreq_policy_transition_delay_us' mangled-name='cpufreq_policy_transition_delay_us' filepath='drivers/cpufreq/cpufreq.c' line='570' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_policy_transition_delay_us'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='570' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='cpufreq_quick_get' mangled-name='cpufreq_quick_get' filepath='drivers/cpufreq/cpufreq.c' line='1727' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_quick_get'>
-        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='1727' column='1'/>
+      <function-decl name='cpufreq_quick_get' mangled-name='cpufreq_quick_get' filepath='drivers/cpufreq/cpufreq.c' line='1729' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_quick_get'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='1729' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='cpufreq_quick_get_max' mangled-name='cpufreq_quick_get_max' filepath='drivers/cpufreq/cpufreq.c' line='1759' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_quick_get_max'>
-        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='1759' column='1'/>
+      <function-decl name='cpufreq_quick_get_max' mangled-name='cpufreq_quick_get_max' filepath='drivers/cpufreq/cpufreq.c' line='1761' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_quick_get_max'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='1761' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='cpufreq_register_driver' mangled-name='cpufreq_register_driver' filepath='drivers/cpufreq/cpufreq.c' line='2739' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_register_driver'>
-        <parameter type-id='eb90c228' name='driver_data' filepath='drivers/cpufreq/cpufreq.c' line='2739' column='1'/>
+      <function-decl name='cpufreq_register_driver' mangled-name='cpufreq_register_driver' filepath='drivers/cpufreq/cpufreq.c' line='2741' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_register_driver'>
+        <parameter type-id='eb90c228' name='driver_data' filepath='drivers/cpufreq/cpufreq.c' line='2741' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_register_governor' mangled-name='cpufreq_register_governor' filepath='drivers/cpufreq/cpufreq.c' line='2379' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_register_governor'>
-        <parameter type-id='6925355c' name='governor' filepath='drivers/cpufreq/cpufreq.c' line='2379' column='1'/>
+      <function-decl name='cpufreq_register_governor' mangled-name='cpufreq_register_governor' filepath='drivers/cpufreq/cpufreq.c' line='2381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_register_governor'>
+        <parameter type-id='6925355c' name='governor' filepath='drivers/cpufreq/cpufreq.c' line='2381' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_register_notifier' mangled-name='cpufreq_register_notifier' filepath='drivers/cpufreq/cpufreq.c' line='1993' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_register_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/cpufreq/cpufreq.c' line='1993' column='1'/>
-        <parameter type-id='f0981eeb' name='list' filepath='drivers/cpufreq/cpufreq.c' line='1993' column='1'/>
+      <function-decl name='cpufreq_register_notifier' mangled-name='cpufreq_register_notifier' filepath='drivers/cpufreq/cpufreq.c' line='1995' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_register_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/cpufreq/cpufreq.c' line='1995' column='1'/>
+        <parameter type-id='f0981eeb' name='list' filepath='drivers/cpufreq/cpufreq.c' line='1995' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='cpufreq_remove_update_util_hook' mangled-name='cpufreq_remove_update_util_hook' filepath='kernel/sched/cpufreq.c' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_remove_update_util_hook'>
@@ -124942,29 +124956,29 @@
         <parameter type-id='343c3ae4' name='policy' filepath='kernel/sched/cpufreq.c' line='73' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='cpufreq_unregister_driver' mangled-name='cpufreq_unregister_driver' filepath='drivers/cpufreq/cpufreq.c' line='2842' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_unregister_driver'>
-        <parameter type-id='eb90c228' name='driver' filepath='drivers/cpufreq/cpufreq.c' line='2842' column='1'/>
+      <function-decl name='cpufreq_unregister_driver' mangled-name='cpufreq_unregister_driver' filepath='drivers/cpufreq/cpufreq.c' line='2844' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_unregister_driver'>
+        <parameter type-id='eb90c228' name='driver' filepath='drivers/cpufreq/cpufreq.c' line='2844' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_unregister_governor' mangled-name='cpufreq_unregister_governor' filepath='drivers/cpufreq/cpufreq.c' line='2402' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_unregister_governor'>
-        <parameter type-id='6925355c' name='governor' filepath='drivers/cpufreq/cpufreq.c' line='2402' column='1'/>
+      <function-decl name='cpufreq_unregister_governor' mangled-name='cpufreq_unregister_governor' filepath='drivers/cpufreq/cpufreq.c' line='2404' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_unregister_governor'>
+        <parameter type-id='6925355c' name='governor' filepath='drivers/cpufreq/cpufreq.c' line='2404' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpufreq_unregister_notifier' mangled-name='cpufreq_unregister_notifier' filepath='drivers/cpufreq/cpufreq.c' line='2037' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_unregister_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/cpufreq/cpufreq.c' line='2037' column='1'/>
-        <parameter type-id='f0981eeb' name='list' filepath='drivers/cpufreq/cpufreq.c' line='2037' column='1'/>
+      <function-decl name='cpufreq_unregister_notifier' mangled-name='cpufreq_unregister_notifier' filepath='drivers/cpufreq/cpufreq.c' line='2039' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_unregister_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/cpufreq/cpufreq.c' line='2039' column='1'/>
+        <parameter type-id='f0981eeb' name='list' filepath='drivers/cpufreq/cpufreq.c' line='2039' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_update_limits' mangled-name='cpufreq_update_limits' filepath='drivers/cpufreq/cpufreq.c' line='2598' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_update_limits'>
-        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='2598' column='1'/>
+      <function-decl name='cpufreq_update_limits' mangled-name='cpufreq_update_limits' filepath='drivers/cpufreq/cpufreq.c' line='2600' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_update_limits'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='2600' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpufreq_update_policy' mangled-name='cpufreq_update_policy' filepath='drivers/cpufreq/cpufreq.c' line='2569' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_update_policy'>
-        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='2569' column='1'/>
+      <function-decl name='cpufreq_update_policy' mangled-name='cpufreq_update_policy' filepath='drivers/cpufreq/cpufreq.c' line='2571' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_update_policy'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='2571' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='cpufreq_update_util_data' type-id='f681f934' mangled-name='cpufreq_update_util_data' visibility='default' filepath='kernel/sched/cpufreq.c' line='12' column='1' elf-symbol-id='cpufreq_update_util_data'/>
-      <var-decl name='cpuhp_tasks_frozen' type-id='b50a4934' mangled-name='cpuhp_tasks_frozen' visibility='default' filepath='kernel/cpu.c' line='272' column='1' elf-symbol-id='cpuhp_tasks_frozen'/>
+      <var-decl name='cpuhp_tasks_frozen' type-id='b50a4934' mangled-name='cpuhp_tasks_frozen' visibility='default' filepath='kernel/cpu.c' line='273' column='1' elf-symbol-id='cpuhp_tasks_frozen'/>
       <function-decl name='cpuidle_driver_state_disabled' mangled-name='cpuidle_driver_state_disabled' filepath='drivers/cpuidle/driver.c' line='353' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpuidle_driver_state_disabled'>
         <parameter type-id='809cdefc' name='drv' filepath='drivers/cpuidle/driver.c' line='353' column='1'/>
         <parameter type-id='95e97e5e' name='idx' filepath='drivers/cpuidle/driver.c' line='353' column='1'/>
@@ -125022,15 +125036,15 @@
         <parameter type-id='cf77d29f' name='fitness_fn' filepath='kernel/sched/cpupri.c' line='149' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpus_read_lock' mangled-name='cpus_read_lock' filepath='kernel/cpu.c' line='301' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpus_read_lock'>
+      <function-decl name='cpus_read_lock' mangled-name='cpus_read_lock' filepath='kernel/cpu.c' line='302' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpus_read_lock'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpus_read_unlock' mangled-name='cpus_read_unlock' filepath='kernel/cpu.c' line='313' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpus_read_unlock'>
+      <function-decl name='cpus_read_unlock' mangled-name='cpus_read_unlock' filepath='kernel/cpu.c' line='314' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpus_read_unlock'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpuset_cpus_allowed' mangled-name='cpuset_cpus_allowed' filepath='kernel/cgroup/cpuset.c' line='3371' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpuset_cpus_allowed'>
-        <parameter type-id='f23e2572' name='tsk' filepath='kernel/cgroup/cpuset.c' line='3371' column='1'/>
-        <parameter type-id='74bccedd' name='pmask' filepath='kernel/cgroup/cpuset.c' line='3371' column='1'/>
+      <function-decl name='cpuset_cpus_allowed' mangled-name='cpuset_cpus_allowed' filepath='kernel/cgroup/cpuset.c' line='3453' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpuset_cpus_allowed'>
+        <parameter type-id='f23e2572' name='tsk' filepath='kernel/cgroup/cpuset.c' line='3453' column='1'/>
+        <parameter type-id='74bccedd' name='pmask' filepath='kernel/cgroup/cpuset.c' line='3453' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='crc16' mangled-name='crc16' filepath='lib/crc16.c' line='55' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crc16'>
@@ -125530,14 +125544,14 @@
         <parameter type-id='95e97e5e' name='count' filepath='crypto/algapi.c' line='567' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='css_next_child' mangled-name='css_next_child' filepath='kernel/cgroup/cgroup.c' line='4284' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='css_next_child'>
-        <parameter type-id='cfff5953' name='pos' filepath='kernel/cgroup/cgroup.c' line='4284' column='1'/>
-        <parameter type-id='cfff5953' name='parent' filepath='kernel/cgroup/cgroup.c' line='4285' column='1'/>
+      <function-decl name='css_next_child' mangled-name='css_next_child' filepath='kernel/cgroup/cgroup.c' line='4299' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='css_next_child'>
+        <parameter type-id='cfff5953' name='pos' filepath='kernel/cgroup/cgroup.c' line='4299' column='1'/>
+        <parameter type-id='cfff5953' name='parent' filepath='kernel/cgroup/cgroup.c' line='4300' column='1'/>
         <return type-id='cfff5953'/>
       </function-decl>
-      <function-decl name='css_next_descendant_pre' mangled-name='css_next_descendant_pre' filepath='kernel/cgroup/cgroup.c' line='4354' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='css_next_descendant_pre'>
-        <parameter type-id='cfff5953' name='pos' filepath='kernel/cgroup/cgroup.c' line='4354' column='1'/>
-        <parameter type-id='cfff5953' name='root' filepath='kernel/cgroup/cgroup.c' line='4355' column='1'/>
+      <function-decl name='css_next_descendant_pre' mangled-name='css_next_descendant_pre' filepath='kernel/cgroup/cgroup.c' line='4369' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='css_next_descendant_pre'>
+        <parameter type-id='cfff5953' name='pos' filepath='kernel/cgroup/cgroup.c' line='4369' column='1'/>
+        <parameter type-id='cfff5953' name='root' filepath='kernel/cgroup/cgroup.c' line='4370' column='1'/>
         <return type-id='cfff5953'/>
       </function-decl>
       <function-decl name='csum_ipv6_magic' mangled-name='csum_ipv6_magic' filepath='arch/arm64/lib/csum.c' line='132' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='csum_ipv6_magic'>
@@ -125562,14 +125576,14 @@
         <parameter type-id='fbd88bba' name='sum' filepath='lib/checksum.c' line='159' column='1'/>
         <return type-id='fbd88bba'/>
       </function-decl>
-      <function-decl name='current_time' mangled-name='current_time' filepath='fs/inode.c' line='2252' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='current_time'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2252' column='1'/>
+      <function-decl name='current_time' mangled-name='current_time' filepath='fs/inode.c' line='2294' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='current_time'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2294' column='1'/>
         <return type-id='40a816ad'/>
       </function-decl>
       <function-decl name='current_umask' mangled-name='current_umask' filepath='fs/fs_struct.c' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='current_umask'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='current_work' mangled-name='current_work' filepath='kernel/workqueue.c' line='4522' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='current_work'>
+      <function-decl name='current_work' mangled-name='current_work' filepath='kernel/workqueue.c' line='4525' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='current_work'>
         <return type-id='83c1bde6'/>
       </function-decl>
       <function-decl name='d_add' mangled-name='d_add' filepath='fs/dcache.c' line='2695' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='d_add'>
@@ -125899,8 +125913,8 @@
         <parameter type-id='9248e67f' name='timer' filepath='kernel/time/timer.c' line='1358' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='delayed_work_timer_fn' mangled-name='delayed_work_timer_fn' filepath='kernel/workqueue.c' line='1634' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='delayed_work_timer_fn'>
-        <parameter type-id='9248e67f' name='t' filepath='kernel/workqueue.c' line='1634' column='1'/>
+      <function-decl name='delayed_work_timer_fn' mangled-name='delayed_work_timer_fn' filepath='kernel/workqueue.c' line='1637' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='delayed_work_timer_fn'>
+        <parameter type-id='9248e67f' name='t' filepath='kernel/workqueue.c' line='1637' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='delete_from_page_cache' mangled-name='delete_from_page_cache' filepath='mm/filemap.c' line='272' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='delete_from_page_cache'>
@@ -125923,8 +125937,8 @@
         <parameter type-id='5bed570d' name='desc' filepath='drivers/gpio/gpiolib.c' line='164' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='destroy_workqueue' mangled-name='destroy_workqueue' filepath='kernel/workqueue.c' line='4395' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='destroy_workqueue'>
-        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='4395' column='1'/>
+      <function-decl name='destroy_workqueue' mangled-name='destroy_workqueue' filepath='kernel/workqueue.c' line='4398' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='destroy_workqueue'>
+        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='4398' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dev_alloc_name' mangled-name='dev_alloc_name' filepath='net/core/dev.c' line='1271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_alloc_name'>
@@ -126333,9 +126347,9 @@
         <parameter type-id='a7832498' name='val' filepath='drivers/base/power/qos.c' line='905' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_set_dedicated_wake_irq' mangled-name='dev_pm_set_dedicated_wake_irq' filepath='drivers/base/power/wakeirq.c' line='165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_set_dedicated_wake_irq'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeirq.c' line='165' column='1'/>
-        <parameter type-id='95e97e5e' name='irq' filepath='drivers/base/power/wakeirq.c' line='165' column='1'/>
+      <function-decl name='dev_pm_set_dedicated_wake_irq' mangled-name='dev_pm_set_dedicated_wake_irq' filepath='drivers/base/power/wakeirq.c' line='218' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_set_dedicated_wake_irq'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeirq.c' line='218' column='1'/>
+        <parameter type-id='95e97e5e' name='irq' filepath='drivers/base/power/wakeirq.c' line='218' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='dev_pm_set_wake_irq' mangled-name='dev_pm_set_wake_irq' filepath='drivers/base/power/wakeirq.c' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_set_wake_irq'>
@@ -126399,15 +126413,15 @@
         <parameter type-id='2aee9912' name='args' filepath='drivers/base/core.c' line='4434' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_add_device' mangled-name='devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='746' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_device'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='746' column='1'/>
-        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='747' column='1'/>
-        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='748' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='749' column='1'/>
+      <function-decl name='devfreq_add_device' mangled-name='devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='747' column='1'/>
+        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='748' column='1'/>
+        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='749' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='750' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
-      <function-decl name='devfreq_add_governor' mangled-name='devfreq_add_governor' filepath='drivers/devfreq/devfreq.c' line='1193' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_governor'>
-        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1193' column='1'/>
+      <function-decl name='devfreq_add_governor' mangled-name='devfreq_add_governor' filepath='drivers/devfreq/devfreq.c' line='1194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_governor'>
+        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1194' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devfreq_cooling_unregister' mangled-name='devfreq_cooling_unregister' filepath='drivers/thermal/devfreq_cooling.c' line='557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_cooling_unregister'>
@@ -126438,14 +126452,14 @@
         <parameter type-id='d6184118' name='edata' filepath='drivers/devfreq/devfreq-event.c' line='161' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_get_devfreq_by_node' mangled-name='devfreq_get_devfreq_by_node' filepath='drivers/devfreq/devfreq.c' line='994' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_node'>
-        <parameter type-id='9a537bbe' name='node' filepath='drivers/devfreq/devfreq.c' line='994' column='1'/>
+      <function-decl name='devfreq_get_devfreq_by_node' mangled-name='devfreq_get_devfreq_by_node' filepath='drivers/devfreq/devfreq.c' line='995' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_node'>
+        <parameter type-id='9a537bbe' name='node' filepath='drivers/devfreq/devfreq.c' line='995' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
-      <function-decl name='devfreq_get_devfreq_by_phandle' mangled-name='devfreq_get_devfreq_by_phandle' filepath='drivers/devfreq/devfreq.c' line='1022' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_phandle'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1022' column='1'/>
-        <parameter type-id='80f4b756' name='phandle_name' filepath='drivers/devfreq/devfreq.c' line='1023' column='1'/>
-        <parameter type-id='95e97e5e' name='index' filepath='drivers/devfreq/devfreq.c' line='1023' column='1'/>
+      <function-decl name='devfreq_get_devfreq_by_phandle' mangled-name='devfreq_get_devfreq_by_phandle' filepath='drivers/devfreq/devfreq.c' line='1023' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_phandle'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1023' column='1'/>
+        <parameter type-id='80f4b756' name='phandle_name' filepath='drivers/devfreq/devfreq.c' line='1024' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/devfreq/devfreq.c' line='1024' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
       <function-decl name='devfreq_monitor_resume' mangled-name='devfreq_monitor_resume' filepath='drivers/devfreq/devfreq.c' line='535' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_resume'>
@@ -126464,36 +126478,36 @@
         <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='508' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devfreq_recommended_opp' mangled-name='devfreq_recommended_opp' filepath='drivers/devfreq/devfreq.c' line='1899' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_recommended_opp'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1899' column='1'/>
-        <parameter type-id='1d2c2b85' name='freq' filepath='drivers/devfreq/devfreq.c' line='1900' column='1'/>
-        <parameter type-id='19c2251e' name='flags' filepath='drivers/devfreq/devfreq.c' line='1901' column='1'/>
+      <function-decl name='devfreq_recommended_opp' mangled-name='devfreq_recommended_opp' filepath='drivers/devfreq/devfreq.c' line='1900' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_recommended_opp'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1900' column='1'/>
+        <parameter type-id='1d2c2b85' name='freq' filepath='drivers/devfreq/devfreq.c' line='1901' column='1'/>
+        <parameter type-id='19c2251e' name='flags' filepath='drivers/devfreq/devfreq.c' line='1902' column='1'/>
         <return type-id='02e48bc6'/>
       </function-decl>
-      <function-decl name='devfreq_register_opp_notifier' mangled-name='devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1932' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_register_opp_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1932' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1932' column='1'/>
+      <function-decl name='devfreq_register_opp_notifier' mangled-name='devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1933' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_register_opp_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1933' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1933' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_remove_device' mangled-name='devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='922' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_device'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='922' column='1'/>
+      <function-decl name='devfreq_remove_device' mangled-name='devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='923' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='923' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_remove_governor' mangled-name='devfreq_remove_governor' filepath='drivers/devfreq/devfreq.c' line='1258' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_governor'>
-        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1258' column='1'/>
+      <function-decl name='devfreq_remove_governor' mangled-name='devfreq_remove_governor' filepath='drivers/devfreq/devfreq.c' line='1259' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_governor'>
+        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1259' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_resume_device' mangled-name='devfreq_resume_device' filepath='drivers/devfreq/devfreq.c' line='1116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_resume_device'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1116' column='1'/>
+      <function-decl name='devfreq_resume_device' mangled-name='devfreq_resume_device' filepath='drivers/devfreq/devfreq.c' line='1117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_resume_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1117' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_suspend_device' mangled-name='devfreq_suspend_device' filepath='drivers/devfreq/devfreq.c' line='1079' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_suspend_device'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1079' column='1'/>
+      <function-decl name='devfreq_suspend_device' mangled-name='devfreq_suspend_device' filepath='drivers/devfreq/devfreq.c' line='1080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_suspend_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1080' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_unregister_opp_notifier' mangled-name='devfreq_unregister_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1948' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_unregister_opp_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1948' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1948' column='1'/>
+      <function-decl name='devfreq_unregister_opp_notifier' mangled-name='devfreq_unregister_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1949' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_unregister_opp_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1949' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1949' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devfreq_update_interval' mangled-name='devfreq_update_interval' filepath='drivers/devfreq/devfreq.c' line='572' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_update_interval'>
@@ -126834,9 +126848,9 @@
         <parameter type-id='80f4b756' name='id' filepath='drivers/clk/clk-devres.c' line='82' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='devm_clk_hw_register' mangled-name='devm_clk_hw_register' filepath='drivers/clk/clk.c' line='4297' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_hw_register'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4297' column='1'/>
-        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4297' column='1'/>
+      <function-decl name='devm_clk_hw_register' mangled-name='devm_clk_hw_register' filepath='drivers/clk/clk.c' line='4300' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_hw_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4300' column='1'/>
+        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4300' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_clk_hw_register_clkdev' mangled-name='devm_clk_hw_register_clkdev' filepath='drivers/clk/clkdev.c' line='431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_hw_register_clkdev'>
@@ -126851,16 +126865,16 @@
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk-devres.c' line='195' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devm_clk_register' mangled-name='devm_clk_register' filepath='drivers/clk/clk.c' line='4267' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_register'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4267' column='1'/>
-        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4267' column='1'/>
+      <function-decl name='devm_clk_register' mangled-name='devm_clk_register' filepath='drivers/clk/clk.c' line='4270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4270' column='1'/>
+        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4270' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='devm_devfreq_add_device' mangled-name='devm_devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='963' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_add_device'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='963' column='1'/>
-        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='964' column='1'/>
-        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='965' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='966' column='1'/>
+      <function-decl name='devm_devfreq_add_device' mangled-name='devm_devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='964' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_add_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='964' column='1'/>
+        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='965' column='1'/>
+        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='966' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='967' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
       <function-decl name='devm_devfreq_event_add_edev' mangled-name='devm_devfreq_event_add_edev' filepath='drivers/devfreq/devfreq-event.c' line='397' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_event_add_edev'>
@@ -126868,28 +126882,28 @@
         <parameter type-id='72742e5b' name='desc' filepath='drivers/devfreq/devfreq-event.c' line='398' column='1'/>
         <return type-id='88146159'/>
       </function-decl>
-      <function-decl name='devm_devfreq_register_notifier' mangled-name='devm_devfreq_register_notifier' filepath='drivers/devfreq/devfreq.c' line='2079' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2079' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2080' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2081' column='1'/>
-        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2082' column='1'/>
+      <function-decl name='devm_devfreq_register_notifier' mangled-name='devm_devfreq_register_notifier' filepath='drivers/devfreq/devfreq.c' line='2080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2080' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2081' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2082' column='1'/>
+        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2083' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_devfreq_register_opp_notifier' mangled-name='devm_devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1965' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_opp_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1965' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1966' column='1'/>
+      <function-decl name='devm_devfreq_register_opp_notifier' mangled-name='devm_devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1966' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_opp_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1966' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1967' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_devfreq_remove_device' mangled-name='devm_devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='1064' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_remove_device'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1064' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1064' column='1'/>
+      <function-decl name='devm_devfreq_remove_device' mangled-name='devm_devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='1065' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_remove_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1065' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1065' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devm_devfreq_unregister_notifier' mangled-name='devm_devfreq_unregister_notifier' filepath='drivers/devfreq/devfreq.c' line='2115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_unregister_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2115' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2116' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2117' column='1'/>
-        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2118' column='1'/>
+      <function-decl name='devm_devfreq_unregister_notifier' mangled-name='devm_devfreq_unregister_notifier' filepath='drivers/devfreq/devfreq.c' line='2116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_unregister_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2116' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2117' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2118' column='1'/>
+        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2119' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='devm_device_add_group' mangled-name='devm_device_add_group' filepath='drivers/base/core.c' line='2392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_device_add_group'>
@@ -127245,10 +127259,10 @@
         <parameter type-id='7bb280fa' name='config' filepath='drivers/nvmem/core.c' line='775' column='1'/>
         <return type-id='8179bc49'/>
       </function-decl>
-      <function-decl name='devm_of_clk_add_hw_provider' mangled-name='devm_of_clk_add_hw_provider' filepath='drivers/clk/clk.c' line='4785' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_of_clk_add_hw_provider'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4785' column='1'/>
-        <parameter type-id='a5186342' name='get' filepath='drivers/clk/clk.c' line='4786' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4788' column='1'/>
+      <function-decl name='devm_of_clk_add_hw_provider' mangled-name='devm_of_clk_add_hw_provider' filepath='drivers/clk/clk.c' line='4788' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_of_clk_add_hw_provider'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4788' column='1'/>
+        <parameter type-id='a5186342' name='get' filepath='drivers/clk/clk.c' line='4789' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4791' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_of_icc_get' mangled-name='devm_of_icc_get' filepath='drivers/interconnect/core.c' line='402' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_of_icc_get'>
@@ -127643,10 +127657,10 @@
         <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='2334' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='disk_end_io_acct' mangled-name='disk_end_io_acct' filepath='block/blk-core.c' line='1383' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_end_io_acct'>
-        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1383' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1383' column='1'/>
-        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1384' column='1'/>
+      <function-decl name='disk_end_io_acct' mangled-name='disk_end_io_acct' filepath='block/blk-core.c' line='1381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_end_io_acct'>
+        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1381' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1381' column='1'/>
+        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1382' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='disk_stack_limits' mangled-name='disk_stack_limits' filepath='block/blk-settings.c' line='648' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_stack_limits'>
@@ -127655,10 +127669,10 @@
         <parameter type-id='a42536cd' name='offset' filepath='block/blk-settings.c' line='649' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='disk_start_io_acct' mangled-name='disk_start_io_acct' filepath='block/blk-core.c' line='1354' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_start_io_acct'>
-        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1354' column='1'/>
-        <parameter type-id='f0981eeb' name='sectors' filepath='block/blk-core.c' line='1354' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1355' column='1'/>
+      <function-decl name='disk_start_io_acct' mangled-name='disk_start_io_acct' filepath='block/blk-core.c' line='1352' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_start_io_acct'>
+        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1352' column='1'/>
+        <parameter type-id='f0981eeb' name='sectors' filepath='block/blk-core.c' line='1352' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1353' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='display_timings_release' mangled-name='display_timings_release' filepath='drivers/video/display_timing.c' line='12' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='display_timings_release'>
@@ -128324,9 +128338,9 @@
         <parameter type-id='27675065' name='dentry' filepath='fs/dcache.c' line='859' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dqget' mangled-name='dqget' filepath='fs/quota/dquot.c' line='862' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dqget'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='862' column='1'/>
-        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='862' column='1'/>
+      <function-decl name='dqget' mangled-name='dqget' filepath='fs/quota/dquot.c' line='932' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dqget'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='932' column='1'/>
+        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='932' column='1'/>
         <return type-id='e9a4c848'/>
       </function-decl>
       <function-decl name='dql_completed' mangled-name='dql_completed' filepath='lib/dynamic_queue_limits.c' line='18' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dql_completed'>
@@ -128338,182 +128352,182 @@
         <parameter type-id='6fe0e73c' name='dql' filepath='lib/dynamic_queue_limits.c' line='116' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dqput' mangled-name='dqput' filepath='fs/quota/dquot.c' line='768' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dqput'>
-        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='768' column='1'/>
+      <function-decl name='dqput' mangled-name='dqput' filepath='fs/quota/dquot.c' line='859' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dqput'>
+        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='859' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dquot_acquire' mangled-name='dquot_acquire' filepath='fs/quota/dquot.c' line='428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_acquire'>
-        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='428' column='1'/>
+      <function-decl name='dquot_acquire' mangled-name='dquot_acquire' filepath='fs/quota/dquot.c' line='454' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_acquire'>
+        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='454' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_alloc' mangled-name='dquot_alloc' filepath='fs/quota/dquot.c' line='827' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_alloc'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='827' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='827' column='1'/>
+      <function-decl name='dquot_alloc' mangled-name='dquot_alloc' filepath='fs/quota/dquot.c' line='897' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_alloc'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='897' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='897' column='1'/>
         <return type-id='e9a4c848'/>
       </function-decl>
-      <function-decl name='dquot_alloc_inode' mangled-name='dquot_alloc_inode' filepath='fs/quota/dquot.c' line='1736' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_alloc_inode'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1736' column='1'/>
+      <function-decl name='dquot_alloc_inode' mangled-name='dquot_alloc_inode' filepath='fs/quota/dquot.c' line='1806' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_alloc_inode'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1806' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_claim_space_nodirty' mangled-name='dquot_claim_space_nodirty' filepath='fs/quota/dquot.c' line='1780' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_claim_space_nodirty'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1780' column='1'/>
-        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1780' column='1'/>
+      <function-decl name='dquot_claim_space_nodirty' mangled-name='dquot_claim_space_nodirty' filepath='fs/quota/dquot.c' line='1850' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_claim_space_nodirty'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1850' column='1'/>
+        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1850' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_commit' mangled-name='dquot_commit' filepath='fs/quota/dquot.c' line='475' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_commit'>
-        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='475' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_commit_info' mangled-name='dquot_commit_info' filepath='fs/quota/dquot.c' line='2132' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_commit_info'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2132' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2132' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_destroy' mangled-name='dquot_destroy' filepath='fs/quota/dquot.c' line='530' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_destroy'>
-        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='530' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='dquot_disable' mangled-name='dquot_disable' filepath='fs/quota/dquot.c' line='2200' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_disable'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2200' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2200' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='fs/quota/dquot.c' line='2200' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_drop' mangled-name='dquot_drop' filepath='fs/quota/dquot.c' line='1595' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_drop'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1595' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='dquot_file_open' mangled-name='dquot_file_open' filepath='fs/quota/dquot.c' line='2170' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_file_open'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2170' column='1'/>
-        <parameter type-id='77e79a4b' name='file' filepath='fs/quota/dquot.c' line='2170' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_free_inode' mangled-name='dquot_free_inode' filepath='fs/quota/dquot.c' line='1919' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_free_inode'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1919' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='dquot_get_dqblk' mangled-name='dquot_get_dqblk' filepath='fs/quota/dquot.c' line='2627' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_dqblk'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2627' column='1'/>
-        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='2627' column='1'/>
-        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2628' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_get_next_dqblk' mangled-name='dquot_get_next_dqblk' filepath='fs/quota/dquot.c' line='2642' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_next_dqblk'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2642' column='1'/>
-        <parameter type-id='cc8d835a' name='qid' filepath='fs/quota/dquot.c' line='2642' column='1'/>
-        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2643' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_get_next_id' mangled-name='dquot_get_next_id' filepath='fs/quota/dquot.c' line='2140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_next_id'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2140' column='1'/>
-        <parameter type-id='cc8d835a' name='qid' filepath='fs/quota/dquot.c' line='2140' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_get_state' mangled-name='dquot_get_state' filepath='fs/quota/dquot.c' line='2779' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_state'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2779' column='1'/>
-        <parameter type-id='6dcf57f3' name='state' filepath='fs/quota/dquot.c' line='2779' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_initialize' mangled-name='dquot_initialize' filepath='fs/quota/dquot.c' line='1550' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_initialize'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1550' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_initialize_needed' mangled-name='dquot_initialize_needed' filepath='fs/quota/dquot.c' line='1556' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_initialize_needed'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1556' column='1'/>
-        <return type-id='b50a4934'/>
-      </function-decl>
-      <function-decl name='dquot_load_quota_inode' mangled-name='dquot_load_quota_inode' filepath='fs/quota/dquot.c' line='2432' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_load_quota_inode'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2432' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2432' column='1'/>
-        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2432' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='fs/quota/dquot.c' line='2433' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_mark_dquot_dirty' mangled-name='dquot_mark_dquot_dirty' filepath='fs/quota/dquot.c' line='352' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_mark_dquot_dirty'>
-        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='352' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_quota_off' mangled-name='dquot_quota_off' filepath='fs/quota/dquot.c' line='2306' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_off'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2306' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2306' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_quota_on' mangled-name='dquot_quota_on' filepath='fs/quota/dquot.c' line='2482' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_on'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2482' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2482' column='1'/>
-        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2482' column='1'/>
-        <parameter type-id='a77efac3' name='path' filepath='fs/quota/dquot.c' line='2483' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_quota_on_mount' mangled-name='dquot_quota_on_mount' filepath='fs/quota/dquot.c' line='2503' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_on_mount'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2503' column='1'/>
-        <parameter type-id='26a90f95' name='qf_name' filepath='fs/quota/dquot.c' line='2503' column='1'/>
-        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2504' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2504' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='dquot_release' mangled-name='dquot_release' filepath='fs/quota/dquot.c' line='501' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_release'>
+      <function-decl name='dquot_commit' mangled-name='dquot_commit' filepath='fs/quota/dquot.c' line='501' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_commit'>
         <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='501' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_resume' mangled-name='dquot_resume' filepath='fs/quota/dquot.c' line='2448' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_resume'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2448' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2448' column='1'/>
+      <function-decl name='dquot_commit_info' mangled-name='dquot_commit_info' filepath='fs/quota/dquot.c' line='2202' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_commit_info'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2202' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2202' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_set_dqblk' mangled-name='dquot_set_dqblk' filepath='fs/quota/dquot.c' line='2760' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_set_dqblk'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2760' column='1'/>
-        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='2760' column='1'/>
-        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2761' column='1'/>
+      <function-decl name='dquot_destroy' mangled-name='dquot_destroy' filepath='fs/quota/dquot.c' line='556' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_destroy'>
+        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='556' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='dquot_disable' mangled-name='dquot_disable' filepath='fs/quota/dquot.c' line='2270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_disable'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2270' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2270' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='fs/quota/dquot.c' line='2270' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_set_dqinfo' mangled-name='dquot_set_dqinfo' filepath='fs/quota/dquot.c' line='2814' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_set_dqinfo'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2814' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2814' column='1'/>
-        <parameter type-id='66b0cee4' name='ii' filepath='fs/quota/dquot.c' line='2814' column='1'/>
+      <function-decl name='dquot_drop' mangled-name='dquot_drop' filepath='fs/quota/dquot.c' line='1665' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_drop'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1665' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='dquot_file_open' mangled-name='dquot_file_open' filepath='fs/quota/dquot.c' line='2240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_file_open'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2240' column='1'/>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/quota/dquot.c' line='2240' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_transfer' mangled-name='dquot_transfer' filepath='fs/quota/dquot.c' line='2090' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_transfer'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2090' column='1'/>
-        <parameter type-id='ab7bbd67' name='iattr' filepath='fs/quota/dquot.c' line='2090' column='1'/>
+      <function-decl name='dquot_free_inode' mangled-name='dquot_free_inode' filepath='fs/quota/dquot.c' line='1989' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_free_inode'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1989' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='dquot_get_dqblk' mangled-name='dquot_get_dqblk' filepath='fs/quota/dquot.c' line='2698' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_dqblk'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2698' column='1'/>
+        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='2698' column='1'/>
+        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2699' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_writeback_dquots' mangled-name='dquot_writeback_dquots' filepath='fs/quota/dquot.c' line='634' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_writeback_dquots'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='634' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='634' column='1'/>
+      <function-decl name='dquot_get_next_dqblk' mangled-name='dquot_get_next_dqblk' filepath='fs/quota/dquot.c' line='2713' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_next_dqblk'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2713' column='1'/>
+        <parameter type-id='cc8d835a' name='qid' filepath='fs/quota/dquot.c' line='2713' column='1'/>
+        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2714' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drain_workqueue' mangled-name='drain_workqueue' filepath='kernel/workqueue.c' line='2957' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drain_workqueue'>
-        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='2957' column='1'/>
+      <function-decl name='dquot_get_next_id' mangled-name='dquot_get_next_id' filepath='fs/quota/dquot.c' line='2210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_next_id'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2210' column='1'/>
+        <parameter type-id='cc8d835a' name='qid' filepath='fs/quota/dquot.c' line='2210' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_get_state' mangled-name='dquot_get_state' filepath='fs/quota/dquot.c' line='2850' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_state'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2850' column='1'/>
+        <parameter type-id='6dcf57f3' name='state' filepath='fs/quota/dquot.c' line='2850' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_initialize' mangled-name='dquot_initialize' filepath='fs/quota/dquot.c' line='1620' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_initialize'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1620' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_initialize_needed' mangled-name='dquot_initialize_needed' filepath='fs/quota/dquot.c' line='1626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_initialize_needed'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1626' column='1'/>
+        <return type-id='b50a4934'/>
+      </function-decl>
+      <function-decl name='dquot_load_quota_inode' mangled-name='dquot_load_quota_inode' filepath='fs/quota/dquot.c' line='2503' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_load_quota_inode'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2503' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2503' column='1'/>
+        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2503' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='fs/quota/dquot.c' line='2504' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_mark_dquot_dirty' mangled-name='dquot_mark_dquot_dirty' filepath='fs/quota/dquot.c' line='378' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_mark_dquot_dirty'>
+        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='378' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_quota_off' mangled-name='dquot_quota_off' filepath='fs/quota/dquot.c' line='2376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_off'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2376' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2376' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_quota_on' mangled-name='dquot_quota_on' filepath='fs/quota/dquot.c' line='2553' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_on'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2553' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2553' column='1'/>
+        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2553' column='1'/>
+        <parameter type-id='a77efac3' name='path' filepath='fs/quota/dquot.c' line='2554' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_quota_on_mount' mangled-name='dquot_quota_on_mount' filepath='fs/quota/dquot.c' line='2574' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_on_mount'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2574' column='1'/>
+        <parameter type-id='26a90f95' name='qf_name' filepath='fs/quota/dquot.c' line='2574' column='1'/>
+        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2575' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2575' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_release' mangled-name='dquot_release' filepath='fs/quota/dquot.c' line='527' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_release'>
+        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='527' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_resume' mangled-name='dquot_resume' filepath='fs/quota/dquot.c' line='2519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_resume'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2519' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2519' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_set_dqblk' mangled-name='dquot_set_dqblk' filepath='fs/quota/dquot.c' line='2831' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_set_dqblk'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2831' column='1'/>
+        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='2831' column='1'/>
+        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2832' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_set_dqinfo' mangled-name='dquot_set_dqinfo' filepath='fs/quota/dquot.c' line='2885' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_set_dqinfo'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2885' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2885' column='1'/>
+        <parameter type-id='66b0cee4' name='ii' filepath='fs/quota/dquot.c' line='2885' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_transfer' mangled-name='dquot_transfer' filepath='fs/quota/dquot.c' line='2160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_transfer'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2160' column='1'/>
+        <parameter type-id='ab7bbd67' name='iattr' filepath='fs/quota/dquot.c' line='2160' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='dquot_writeback_dquots' mangled-name='dquot_writeback_dquots' filepath='fs/quota/dquot.c' line='683' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_writeback_dquots'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='683' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='683' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='drain_workqueue' mangled-name='drain_workqueue' filepath='kernel/workqueue.c' line='2960' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drain_workqueue'>
+        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='2960' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='driver_attach' mangled-name='driver_attach' filepath='drivers/base/dd.c' line='1138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_attach'>
         <parameter type-id='00c7b870' name='drv' filepath='drivers/base/dd.c' line='1138' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='driver_create_file' mangled-name='driver_create_file' filepath='drivers/base/driver.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_create_file'>
-        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='101' column='1'/>
-        <parameter type-id='1a5996d5' name='attr' filepath='drivers/base/driver.c' line='102' column='1'/>
+      <function-decl name='driver_create_file' mangled-name='driver_create_file' filepath='drivers/base/driver.c' line='170' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_create_file'>
+        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='170' column='1'/>
+        <parameter type-id='1a5996d5' name='attr' filepath='drivers/base/driver.c' line='171' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='driver_find_device' mangled-name='driver_find_device' filepath='drivers/base/driver.c' line='76' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_find_device'>
-        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='76' column='1'/>
-        <parameter type-id='fa0b179b' name='start' filepath='drivers/base/driver.c' line='77' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/base/driver.c' line='77' column='1'/>
-        <parameter type-id='92d15ae9' name='match' filepath='drivers/base/driver.c' line='78' column='1'/>
+      <function-decl name='driver_find_device' mangled-name='driver_find_device' filepath='drivers/base/driver.c' line='145' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_find_device'>
+        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='145' column='1'/>
+        <parameter type-id='fa0b179b' name='start' filepath='drivers/base/driver.c' line='146' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/base/driver.c' line='146' column='1'/>
+        <parameter type-id='92d15ae9' name='match' filepath='drivers/base/driver.c' line='147' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='driver_register' mangled-name='driver_register' filepath='drivers/base/driver.c' line='147' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_register'>
-        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='147' column='1'/>
+      <function-decl name='driver_register' mangled-name='driver_register' filepath='drivers/base/driver.c' line='216' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_register'>
+        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='216' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='driver_remove_file' mangled-name='driver_remove_file' filepath='drivers/base/driver.c' line='119' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_remove_file'>
-        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='119' column='1'/>
-        <parameter type-id='1a5996d5' name='attr' filepath='drivers/base/driver.c' line='120' column='1'/>
+      <function-decl name='driver_remove_file' mangled-name='driver_remove_file' filepath='drivers/base/driver.c' line='188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_remove_file'>
+        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='188' column='1'/>
+        <parameter type-id='1a5996d5' name='attr' filepath='drivers/base/driver.c' line='189' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='driver_unregister' mangled-name='driver_unregister' filepath='drivers/base/driver.c' line='191' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_unregister'>
-        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='191' column='1'/>
+      <function-decl name='driver_unregister' mangled-name='driver_unregister' filepath='drivers/base/driver.c' line='260' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_unregister'>
+        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='260' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_add_edid_modes' mangled-name='drm_add_edid_modes' filepath='drivers/gpu/drm/drm_edid.c' line='5320' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_add_edid_modes'>
@@ -128527,14 +128541,14 @@
         <parameter type-id='95e97e5e' name='vdisplay' filepath='drivers/gpu/drm/drm_edid.c' line='5400' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_add_affected_connectors' mangled-name='drm_atomic_add_affected_connectors' filepath='drivers/gpu/drm/drm_atomic.c' line='1157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_add_affected_connectors'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1157' column='1'/>
-        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic.c' line='1158' column='1'/>
+      <function-decl name='drm_atomic_add_affected_connectors' mangled-name='drm_atomic_add_affected_connectors' filepath='drivers/gpu/drm/drm_atomic.c' line='1166' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_add_affected_connectors'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1166' column='1'/>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic.c' line='1167' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_add_affected_planes' mangled-name='drm_atomic_add_affected_planes' filepath='drivers/gpu/drm/drm_atomic.c' line='1220' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_add_affected_planes'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1220' column='1'/>
-        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic.c' line='1221' column='1'/>
+      <function-decl name='drm_atomic_add_affected_planes' mangled-name='drm_atomic_add_affected_planes' filepath='drivers/gpu/drm/drm_atomic.c' line='1229' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_add_affected_planes'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1229' column='1'/>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic.c' line='1230' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_atomic_bridge_chain_enable' mangled-name='drm_atomic_bridge_chain_enable' filepath='drivers/gpu/drm/drm_bridge.c' line='697' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_bridge_chain_enable'>
@@ -128547,43 +128561,43 @@
         <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_bridge.c' line='655' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_commit' mangled-name='drm_atomic_commit' filepath='drivers/gpu/drm/drm_atomic.c' line='1335' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_commit'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1335' column='1'/>
+      <function-decl name='drm_atomic_commit' mangled-name='drm_atomic_commit' filepath='drivers/gpu/drm/drm_atomic.c' line='1344' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_commit'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1344' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_get_connector_state' mangled-name='drm_atomic_get_connector_state' filepath='drivers/gpu/drm/drm_atomic.c' line='944' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_connector_state'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='944' column='1'/>
-        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_atomic.c' line='945' column='1'/>
+      <function-decl name='drm_atomic_get_connector_state' mangled-name='drm_atomic_get_connector_state' filepath='drivers/gpu/drm/drm_atomic.c' line='953' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_connector_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='953' column='1'/>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_atomic.c' line='954' column='1'/>
         <return type-id='249ef586'/>
       </function-decl>
-      <function-decl name='drm_atomic_get_crtc_state' mangled-name='drm_atomic_get_crtc_state' filepath='drivers/gpu/drm/drm_atomic.c' line='291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_crtc_state'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='291' column='1'/>
-        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic.c' line='292' column='1'/>
+      <function-decl name='drm_atomic_get_crtc_state' mangled-name='drm_atomic_get_crtc_state' filepath='drivers/gpu/drm/drm_atomic.c' line='300' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_crtc_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='300' column='1'/>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic.c' line='301' column='1'/>
         <return type-id='35078cb9'/>
       </function-decl>
-      <function-decl name='drm_atomic_get_new_bridge_state' mangled-name='drm_atomic_get_new_bridge_state' filepath='drivers/gpu/drm/drm_atomic.c' line='1083' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_new_bridge_state'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1083' column='1'/>
-        <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_atomic.c' line='1084' column='1'/>
+      <function-decl name='drm_atomic_get_new_bridge_state' mangled-name='drm_atomic_get_new_bridge_state' filepath='drivers/gpu/drm/drm_atomic.c' line='1092' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_new_bridge_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1092' column='1'/>
+        <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_atomic.c' line='1093' column='1'/>
         <return type-id='67bbaeda'/>
       </function-decl>
-      <function-decl name='drm_atomic_get_new_connector_for_encoder' mangled-name='drm_atomic_get_new_connector_for_encoder' filepath='drivers/gpu/drm/drm_atomic.c' line='912' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_new_connector_for_encoder'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='912' column='1'/>
-        <parameter type-id='74d89ebd' name='encoder' filepath='drivers/gpu/drm/drm_atomic.c' line='913' column='1'/>
+      <function-decl name='drm_atomic_get_new_connector_for_encoder' mangled-name='drm_atomic_get_new_connector_for_encoder' filepath='drivers/gpu/drm/drm_atomic.c' line='921' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_new_connector_for_encoder'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='921' column='1'/>
+        <parameter type-id='74d89ebd' name='encoder' filepath='drivers/gpu/drm/drm_atomic.c' line='922' column='1'/>
         <return type-id='4db02c58'/>
       </function-decl>
-      <function-decl name='drm_atomic_get_old_connector_for_encoder' mangled-name='drm_atomic_get_old_connector_for_encoder' filepath='drivers/gpu/drm/drm_atomic.c' line='878' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_old_connector_for_encoder'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='878' column='1'/>
-        <parameter type-id='74d89ebd' name='encoder' filepath='drivers/gpu/drm/drm_atomic.c' line='879' column='1'/>
+      <function-decl name='drm_atomic_get_old_connector_for_encoder' mangled-name='drm_atomic_get_old_connector_for_encoder' filepath='drivers/gpu/drm/drm_atomic.c' line='887' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_old_connector_for_encoder'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='887' column='1'/>
+        <parameter type-id='74d89ebd' name='encoder' filepath='drivers/gpu/drm/drm_atomic.c' line='888' column='1'/>
         <return type-id='4db02c58'/>
       </function-decl>
-      <function-decl name='drm_atomic_get_plane_state' mangled-name='drm_atomic_get_plane_state' filepath='drivers/gpu/drm/drm_atomic.c' line='464' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_plane_state'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='464' column='1'/>
-        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_atomic.c' line='465' column='1'/>
+      <function-decl name='drm_atomic_get_plane_state' mangled-name='drm_atomic_get_plane_state' filepath='drivers/gpu/drm/drm_atomic.c' line='473' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_plane_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='473' column='1'/>
+        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_atomic.c' line='474' column='1'/>
         <return type-id='d0835005'/>
       </function-decl>
-      <function-decl name='drm_atomic_get_private_obj_state' mangled-name='drm_atomic_get_private_obj_state' filepath='drivers/gpu/drm/drm_atomic.c' line='770' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_private_obj_state'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='770' column='1'/>
-        <parameter type-id='11c98e9a' name='obj' filepath='drivers/gpu/drm/drm_atomic.c' line='771' column='1'/>
+      <function-decl name='drm_atomic_get_private_obj_state' mangled-name='drm_atomic_get_private_obj_state' filepath='drivers/gpu/drm/drm_atomic.c' line='779' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_private_obj_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='779' column='1'/>
+        <parameter type-id='11c98e9a' name='obj' filepath='drivers/gpu/drm/drm_atomic.c' line='780' column='1'/>
         <return type-id='4ea020ae'/>
       </function-decl>
       <function-decl name='drm_atomic_helper_bridge_destroy_state' mangled-name='drm_atomic_helper_bridge_destroy_state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='613' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_bridge_destroy_state'>
@@ -128595,13 +128609,13 @@
         <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='587' column='1'/>
         <return type-id='67bbaeda'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_bridge_propagate_bus_fmt' mangled-name='drm_atomic_helper_bridge_propagate_bus_fmt' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_bridge_propagate_bus_fmt'>
-        <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3588' column='1'/>
-        <parameter type-id='67bbaeda' name='bridge_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3589' column='1'/>
-        <parameter type-id='35078cb9' name='crtc_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3590' column='1'/>
-        <parameter type-id='249ef586' name='conn_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3591' column='1'/>
-        <parameter type-id='19c2251e' name='output_fmt' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3592' column='1'/>
-        <parameter type-id='807869d3' name='num_input_fmts' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3593' column='1'/>
+      <function-decl name='drm_atomic_helper_bridge_propagate_bus_fmt' mangled-name='drm_atomic_helper_bridge_propagate_bus_fmt' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3597' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_bridge_propagate_bus_fmt'>
+        <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3597' column='1'/>
+        <parameter type-id='67bbaeda' name='bridge_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3598' column='1'/>
+        <parameter type-id='35078cb9' name='crtc_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3599' column='1'/>
+        <parameter type-id='249ef586' name='conn_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3600' column='1'/>
+        <parameter type-id='19c2251e' name='output_fmt' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3601' column='1'/>
+        <parameter type-id='807869d3' name='num_input_fmts' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3602' column='1'/>
         <return type-id='f9409001'/>
       </function-decl>
       <function-decl name='drm_atomic_helper_bridge_reset' mangled-name='drm_atomic_helper_bridge_reset' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='648' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_bridge_reset'>
@@ -128632,52 +128646,52 @@
         <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='883' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_cleanup_planes' mangled-name='drm_atomic_helper_cleanup_planes' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2703' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_cleanup_planes'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2703' column='1'/>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2704' column='1'/>
+      <function-decl name='drm_atomic_helper_cleanup_planes' mangled-name='drm_atomic_helper_cleanup_planes' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2712' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_cleanup_planes'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2712' column='1'/>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2713' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_commit' mangled-name='drm_atomic_helper_commit' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1822' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1822' column='1'/>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1823' column='1'/>
-        <parameter type-id='b50a4934' name='nonblock' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1824' column='1'/>
+      <function-decl name='drm_atomic_helper_commit' mangled-name='drm_atomic_helper_commit' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1831' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1831' column='1'/>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1832' column='1'/>
+        <parameter type-id='b50a4934' name='nonblock' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1833' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_commit_cleanup_done' mangled-name='drm_atomic_helper_commit_cleanup_done' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2362' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_cleanup_done'>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2362' column='1'/>
+      <function-decl name='drm_atomic_helper_commit_cleanup_done' mangled-name='drm_atomic_helper_commit_cleanup_done' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2371' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_cleanup_done'>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2371' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_commit_duplicated_state' mangled-name='drm_atomic_helper_commit_duplicated_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3299' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_duplicated_state'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3299' column='1'/>
-        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3300' column='1'/>
+      <function-decl name='drm_atomic_helper_commit_duplicated_state' mangled-name='drm_atomic_helper_commit_duplicated_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3308' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_duplicated_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3308' column='1'/>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3309' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_commit_hw_done' mangled-name='drm_atomic_helper_commit_hw_done' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2317' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_hw_done'>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2317' column='1'/>
+      <function-decl name='drm_atomic_helper_commit_hw_done' mangled-name='drm_atomic_helper_commit_hw_done' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2326' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_hw_done'>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2326' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_commit_modeset_disables' mangled-name='drm_atomic_helper_commit_modeset_disables' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1298' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_modeset_disables'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1298' column='1'/>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1299' column='1'/>
+      <function-decl name='drm_atomic_helper_commit_modeset_disables' mangled-name='drm_atomic_helper_commit_modeset_disables' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1307' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_modeset_disables'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1307' column='1'/>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1308' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_commit_modeset_enables' mangled-name='drm_atomic_helper_commit_modeset_enables' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_modeset_enables'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1345' column='1'/>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1346' column='1'/>
+      <function-decl name='drm_atomic_helper_commit_modeset_enables' mangled-name='drm_atomic_helper_commit_modeset_enables' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1354' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_modeset_enables'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1354' column='1'/>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1355' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_commit_planes' mangled-name='drm_atomic_helper_commit_planes' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2497' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_planes'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2497' column='1'/>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2498' column='1'/>
-        <parameter type-id='8f92235e' name='flags' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2499' column='1'/>
+      <function-decl name='drm_atomic_helper_commit_planes' mangled-name='drm_atomic_helper_commit_planes' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2506' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_planes'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2506' column='1'/>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2507' column='1'/>
+        <parameter type-id='8f92235e' name='flags' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2508' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_commit_tail' mangled-name='drm_atomic_helper_commit_tail' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1584' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_tail'>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1584' column='1'/>
+      <function-decl name='drm_atomic_helper_commit_tail' mangled-name='drm_atomic_helper_commit_tail' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1593' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_tail'>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1593' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_commit_tail_rpm' mangled-name='drm_atomic_helper_commit_tail_rpm' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1614' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_tail_rpm'>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1614' column='1'/>
+      <function-decl name='drm_atomic_helper_commit_tail_rpm' mangled-name='drm_atomic_helper_commit_tail_rpm' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1623' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_commit_tail_rpm'>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1623' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_atomic_helper_connector_destroy_state' mangled-name='drm_atomic_helper_connector_destroy_state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='537' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_connector_destroy_state'>
@@ -128721,45 +128735,45 @@
         <parameter type-id='f0981eeb' name='num_clips' filepath='drivers/gpu/drm/drm_damage_helper.c' line='163' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_disable_all' mangled-name='drm_atomic_helper_disable_all' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3053' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_disable_all'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3053' column='1'/>
-        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3054' column='1'/>
+      <function-decl name='drm_atomic_helper_disable_all' mangled-name='drm_atomic_helper_disable_all' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3062' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_disable_all'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3062' column='1'/>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3063' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_disable_plane' mangled-name='drm_atomic_helper_disable_plane' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2954' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_disable_plane'>
-        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2954' column='1'/>
-        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2955' column='1'/>
+      <function-decl name='drm_atomic_helper_disable_plane' mangled-name='drm_atomic_helper_disable_plane' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2963' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_disable_plane'>
+        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2963' column='1'/>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2964' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_disable_planes_on_crtc' mangled-name='drm_atomic_helper_disable_planes_on_crtc' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2663' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_disable_planes_on_crtc'>
-        <parameter type-id='35078cb9' name='old_crtc_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2663' column='1'/>
-        <parameter type-id='b50a4934' name='atomic' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2664' column='1'/>
+      <function-decl name='drm_atomic_helper_disable_planes_on_crtc' mangled-name='drm_atomic_helper_disable_planes_on_crtc' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2672' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_disable_planes_on_crtc'>
+        <parameter type-id='35078cb9' name='old_crtc_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2672' column='1'/>
+        <parameter type-id='b50a4934' name='atomic' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2673' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_duplicate_state' mangled-name='drm_atomic_helper_duplicate_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_duplicate_state'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3165' column='1'/>
-        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3166' column='1'/>
+      <function-decl name='drm_atomic_helper_duplicate_state' mangled-name='drm_atomic_helper_duplicate_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3174' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_duplicate_state'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3174' column='1'/>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3175' column='1'/>
         <return type-id='e3dd029e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_fake_vblank' mangled-name='drm_atomic_helper_fake_vblank' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_fake_vblank'>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2279' column='1'/>
+      <function-decl name='drm_atomic_helper_fake_vblank' mangled-name='drm_atomic_helper_fake_vblank' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2288' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_fake_vblank'>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2288' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_legacy_gamma_set' mangled-name='drm_atomic_helper_legacy_gamma_set' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3512' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_legacy_gamma_set'>
-        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3512' column='1'/>
-        <parameter type-id='26d4d46f' name='red' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3513' column='1'/>
-        <parameter type-id='26d4d46f' name='green' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3513' column='1'/>
-        <parameter type-id='26d4d46f' name='blue' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3513' column='1'/>
-        <parameter type-id='8f92235e' name='size' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3514' column='1'/>
-        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3515' column='1'/>
+      <function-decl name='drm_atomic_helper_legacy_gamma_set' mangled-name='drm_atomic_helper_legacy_gamma_set' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3521' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_legacy_gamma_set'>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3521' column='1'/>
+        <parameter type-id='26d4d46f' name='red' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3522' column='1'/>
+        <parameter type-id='26d4d46f' name='green' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3522' column='1'/>
+        <parameter type-id='26d4d46f' name='blue' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3522' column='1'/>
+        <parameter type-id='8f92235e' name='size' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3523' column='1'/>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3524' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_page_flip' mangled-name='drm_atomic_helper_page_flip' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3419' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_page_flip'>
-        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3419' column='1'/>
-        <parameter type-id='7b332e1c' name='fb' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3420' column='1'/>
-        <parameter type-id='6301fad2' name='event' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3421' column='1'/>
-        <parameter type-id='8f92235e' name='flags' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3422' column='1'/>
-        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3423' column='1'/>
+      <function-decl name='drm_atomic_helper_page_flip' mangled-name='drm_atomic_helper_page_flip' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_page_flip'>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3428' column='1'/>
+        <parameter type-id='7b332e1c' name='fb' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3429' column='1'/>
+        <parameter type-id='6301fad2' name='event' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3430' column='1'/>
+        <parameter type-id='8f92235e' name='flags' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3431' column='1'/>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3432' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_atomic_helper_plane_destroy_state' mangled-name='drm_atomic_helper_plane_destroy_state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='371' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_plane_destroy_state'>
@@ -128775,81 +128789,81 @@
         <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='283' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_prepare_planes' mangled-name='drm_atomic_helper_prepare_planes' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2402' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_prepare_planes'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2402' column='1'/>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2403' column='1'/>
+      <function-decl name='drm_atomic_helper_prepare_planes' mangled-name='drm_atomic_helper_prepare_planes' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2411' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_prepare_planes'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2411' column='1'/>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2412' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_resume' mangled-name='drm_atomic_helper_resume' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_resume'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3345' column='1'/>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3346' column='1'/>
+      <function-decl name='drm_atomic_helper_resume' mangled-name='drm_atomic_helper_resume' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3354' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_resume'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3354' column='1'/>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3355' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_set_config' mangled-name='drm_atomic_helper_set_config' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3002' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_set_config'>
-        <parameter type-id='8106240b' name='set' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3002' column='1'/>
-        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3003' column='1'/>
+      <function-decl name='drm_atomic_helper_set_config' mangled-name='drm_atomic_helper_set_config' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3011' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_set_config'>
+        <parameter type-id='8106240b' name='set' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3011' column='1'/>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3012' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_setup_commit' mangled-name='drm_atomic_helper_setup_commit' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_setup_commit'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2080' column='1'/>
-        <parameter type-id='b50a4934' name='nonblock' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2081' column='1'/>
+      <function-decl name='drm_atomic_helper_setup_commit' mangled-name='drm_atomic_helper_setup_commit' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2089' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_setup_commit'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2089' column='1'/>
+        <parameter type-id='b50a4934' name='nonblock' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2090' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_shutdown' mangled-name='drm_atomic_helper_shutdown' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_shutdown'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3125' column='1'/>
+      <function-decl name='drm_atomic_helper_shutdown' mangled-name='drm_atomic_helper_shutdown' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3134' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_shutdown'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3134' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_suspend' mangled-name='drm_atomic_helper_suspend' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3253' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_suspend'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3253' column='1'/>
+      <function-decl name='drm_atomic_helper_suspend' mangled-name='drm_atomic_helper_suspend' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3262' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_suspend'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='3262' column='1'/>
         <return type-id='e3dd029e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_swap_state' mangled-name='drm_atomic_helper_swap_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2766' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_swap_state'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2766' column='1'/>
-        <parameter type-id='b50a4934' name='stall' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2767' column='1'/>
+      <function-decl name='drm_atomic_helper_swap_state' mangled-name='drm_atomic_helper_swap_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2775' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_swap_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2775' column='1'/>
+        <parameter type-id='b50a4934' name='stall' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2776' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_update_legacy_modeset_state' mangled-name='drm_atomic_helper_update_legacy_modeset_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_update_legacy_modeset_state'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1140' column='1'/>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1141' column='1'/>
+      <function-decl name='drm_atomic_helper_update_legacy_modeset_state' mangled-name='drm_atomic_helper_update_legacy_modeset_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_update_legacy_modeset_state'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1149' column='1'/>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1150' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_update_plane' mangled-name='drm_atomic_helper_update_plane' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2897' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_update_plane'>
-        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2897' column='1'/>
-        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2898' column='1'/>
-        <parameter type-id='7b332e1c' name='fb' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2899' column='1'/>
-        <parameter type-id='95e97e5e' name='crtc_x' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2900' column='1'/>
-        <parameter type-id='95e97e5e' name='crtc_y' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2900' column='1'/>
-        <parameter type-id='f0981eeb' name='crtc_w' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2901' column='1'/>
-        <parameter type-id='f0981eeb' name='crtc_h' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2901' column='1'/>
-        <parameter type-id='8f92235e' name='src_x' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2902' column='1'/>
-        <parameter type-id='8f92235e' name='src_y' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2902' column='1'/>
-        <parameter type-id='8f92235e' name='src_w' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2903' column='1'/>
-        <parameter type-id='8f92235e' name='src_h' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2903' column='1'/>
-        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2904' column='1'/>
+      <function-decl name='drm_atomic_helper_update_plane' mangled-name='drm_atomic_helper_update_plane' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2906' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_update_plane'>
+        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2906' column='1'/>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2907' column='1'/>
+        <parameter type-id='7b332e1c' name='fb' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2908' column='1'/>
+        <parameter type-id='95e97e5e' name='crtc_x' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2909' column='1'/>
+        <parameter type-id='95e97e5e' name='crtc_y' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2909' column='1'/>
+        <parameter type-id='f0981eeb' name='crtc_w' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2910' column='1'/>
+        <parameter type-id='f0981eeb' name='crtc_h' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2910' column='1'/>
+        <parameter type-id='8f92235e' name='src_x' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2911' column='1'/>
+        <parameter type-id='8f92235e' name='src_y' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2911' column='1'/>
+        <parameter type-id='8f92235e' name='src_w' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2912' column='1'/>
+        <parameter type-id='8f92235e' name='src_h' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2912' column='1'/>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2913' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_wait_for_dependencies' mangled-name='drm_atomic_helper_wait_for_dependencies' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_wait_for_dependencies'>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2184' column='1'/>
+      <function-decl name='drm_atomic_helper_wait_for_dependencies' mangled-name='drm_atomic_helper_wait_for_dependencies' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2193' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_wait_for_dependencies'>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='2193' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_wait_for_fences' mangled-name='drm_atomic_helper_wait_for_fences' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1439' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_wait_for_fences'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1439' column='1'/>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1440' column='1'/>
-        <parameter type-id='b50a4934' name='pre_swap' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1441' column='1'/>
+      <function-decl name='drm_atomic_helper_wait_for_fences' mangled-name='drm_atomic_helper_wait_for_fences' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1448' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_wait_for_fences'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1448' column='1'/>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1449' column='1'/>
+        <parameter type-id='b50a4934' name='pre_swap' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1450' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_wait_for_flip_done' mangled-name='drm_atomic_helper_wait_for_flip_done' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1545' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_wait_for_flip_done'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1545' column='1'/>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1546' column='1'/>
+      <function-decl name='drm_atomic_helper_wait_for_flip_done' mangled-name='drm_atomic_helper_wait_for_flip_done' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1554' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_wait_for_flip_done'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1554' column='1'/>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1555' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_wait_for_vblanks' mangled-name='drm_atomic_helper_wait_for_vblanks' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_wait_for_vblanks'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1486' column='1'/>
-        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1487' column='1'/>
+      <function-decl name='drm_atomic_helper_wait_for_vblanks' mangled-name='drm_atomic_helper_wait_for_vblanks' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1495' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_wait_for_vblanks'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1495' column='1'/>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1496' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_nonblocking_commit' mangled-name='drm_atomic_nonblocking_commit' filepath='drivers/gpu/drm/drm_atomic.c' line='1364' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_nonblocking_commit'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1364' column='1'/>
+      <function-decl name='drm_atomic_nonblocking_commit' mangled-name='drm_atomic_nonblocking_commit' filepath='drivers/gpu/drm/drm_atomic.c' line='1373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_nonblocking_commit'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1373' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_atomic_normalize_zpos' mangled-name='drm_atomic_normalize_zpos' filepath='drivers/gpu/drm/drm_blend.c' line='504' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_normalize_zpos'>
@@ -128857,15 +128871,15 @@
         <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_blend.c' line='505' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_private_obj_fini' mangled-name='drm_atomic_private_obj_fini' filepath='drivers/gpu/drm/drm_atomic.c' line='748' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_private_obj_fini'>
-        <parameter type-id='11c98e9a' name='obj' filepath='drivers/gpu/drm/drm_atomic.c' line='748' column='1'/>
+      <function-decl name='drm_atomic_private_obj_fini' mangled-name='drm_atomic_private_obj_fini' filepath='drivers/gpu/drm/drm_atomic.c' line='757' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_private_obj_fini'>
+        <parameter type-id='11c98e9a' name='obj' filepath='drivers/gpu/drm/drm_atomic.c' line='757' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_private_obj_init' mangled-name='drm_atomic_private_obj_init' filepath='drivers/gpu/drm/drm_atomic.c' line='726' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_private_obj_init'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic.c' line='726' column='1'/>
-        <parameter type-id='11c98e9a' name='obj' filepath='drivers/gpu/drm/drm_atomic.c' line='727' column='1'/>
-        <parameter type-id='4ea020ae' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='728' column='1'/>
-        <parameter type-id='515fa1af' name='funcs' filepath='drivers/gpu/drm/drm_atomic.c' line='729' column='1'/>
+      <function-decl name='drm_atomic_private_obj_init' mangled-name='drm_atomic_private_obj_init' filepath='drivers/gpu/drm/drm_atomic.c' line='735' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_private_obj_init'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic.c' line='735' column='1'/>
+        <parameter type-id='11c98e9a' name='obj' filepath='drivers/gpu/drm/drm_atomic.c' line='736' column='1'/>
+        <parameter type-id='4ea020ae' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='737' column='1'/>
+        <parameter type-id='515fa1af' name='funcs' filepath='drivers/gpu/drm/drm_atomic.c' line='738' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_atomic_set_crtc_for_connector' mangled-name='drm_atomic_set_crtc_for_connector' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='298' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_crtc_for_connector'>
@@ -128898,16 +128912,16 @@
         <parameter type-id='c4126d52' name='blob' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='117' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_state_alloc' mangled-name='drm_atomic_state_alloc' filepath='drivers/gpu/drm/drm_atomic.c' line='119' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_alloc'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic.c' line='119' column='1'/>
+      <function-decl name='drm_atomic_state_alloc' mangled-name='drm_atomic_state_alloc' filepath='drivers/gpu/drm/drm_atomic.c' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_alloc'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic.c' line='125' column='1'/>
         <return type-id='e3dd029e'/>
       </function-decl>
-      <function-decl name='drm_atomic_state_clear' mangled-name='drm_atomic_state_clear' filepath='drivers/gpu/drm/drm_atomic.c' line='238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_clear'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='238' column='1'/>
+      <function-decl name='drm_atomic_state_clear' mangled-name='drm_atomic_state_clear' filepath='drivers/gpu/drm/drm_atomic.c' line='244' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_clear'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='244' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_state_default_clear' mangled-name='drm_atomic_state_default_clear' filepath='drivers/gpu/drm/drm_atomic.c' line='148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_default_clear'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='148' column='1'/>
+      <function-decl name='drm_atomic_state_default_clear' mangled-name='drm_atomic_state_default_clear' filepath='drivers/gpu/drm/drm_atomic.c' line='154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_default_clear'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='154' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_atomic_state_default_release' mangled-name='drm_atomic_state_default_release' filepath='drivers/gpu/drm/drm_atomic.c' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_default_release'>
@@ -129005,8 +129019,8 @@
         <parameter type-id='67ede465' name='funcs' filepath='drivers/gpu/drm/drm_client.c' line='79' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_client_modeset_commit_locked' mangled-name='drm_client_modeset_commit_locked' filepath='drivers/gpu/drm/drm_client_modeset.c' line='1138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_client_modeset_commit_locked'>
-        <parameter type-id='cc1804ea' name='client' filepath='drivers/gpu/drm/drm_client_modeset.c' line='1138' column='1'/>
+      <function-decl name='drm_client_modeset_commit_locked' mangled-name='drm_client_modeset_commit_locked' filepath='drivers/gpu/drm/drm_client_modeset.c' line='1144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_client_modeset_commit_locked'>
+        <parameter type-id='cc1804ea' name='client' filepath='drivers/gpu/drm/drm_client_modeset.c' line='1144' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_client_register' mangled-name='drm_client_register' filepath='drivers/gpu/drm/drm_client.c' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_client_register'>
@@ -129967,8 +129981,8 @@
         <parameter type-id='abd62a96' name='obj' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='119' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_gem_shmem_get_sg_table' mangled-name='drm_gem_shmem_get_sg_table' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='678' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_shmem_get_sg_table'>
-        <parameter type-id='abd62a96' name='obj' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='678' column='1'/>
+      <function-decl name='drm_gem_shmem_get_sg_table' mangled-name='drm_gem_shmem_get_sg_table' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='684' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_shmem_get_sg_table'>
+        <parameter type-id='abd62a96' name='obj' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='684' column='1'/>
         <return type-id='4adb0e6a'/>
       </function-decl>
       <function-decl name='drm_gem_shmem_mmap' mangled-name='drm_gem_shmem_mmap' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='611' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_shmem_mmap'>
@@ -129980,10 +129994,10 @@
         <parameter type-id='abd62a96' name='obj' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='234' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_gem_shmem_print_info' mangled-name='drm_gem_shmem_print_info' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='651' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_shmem_print_info'>
-        <parameter type-id='7ac48c21' name='p' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='651' column='1'/>
-        <parameter type-id='f0981eeb' name='indent' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='651' column='1'/>
-        <parameter type-id='e8a41089' name='obj' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='652' column='1'/>
+      <function-decl name='drm_gem_shmem_print_info' mangled-name='drm_gem_shmem_print_info' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='657' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_shmem_print_info'>
+        <parameter type-id='7ac48c21' name='p' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='657' column='1'/>
+        <parameter type-id='f0981eeb' name='indent' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='657' column='1'/>
+        <parameter type-id='e8a41089' name='obj' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='658' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_gem_shmem_unpin' mangled-name='drm_gem_shmem_unpin' filepath='drivers/gpu/drm/drm_gem_shmem_helper.c' line='251' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_shmem_unpin'>
@@ -130812,9 +130826,9 @@
         <parameter type-id='95e97e5e' name='encoder_type' filepath='drivers/gpu/drm/drm_simple_kms_helper.c' line='66' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_state_dump' mangled-name='drm_state_dump' filepath='drivers/gpu/drm/drm_atomic.c' line='1623' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_state_dump'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic.c' line='1623' column='1'/>
-        <parameter type-id='7ac48c21' name='p' filepath='drivers/gpu/drm/drm_atomic.c' line='1623' column='1'/>
+      <function-decl name='drm_state_dump' mangled-name='drm_state_dump' filepath='drivers/gpu/drm/drm_atomic.c' line='1632' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_state_dump'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic.c' line='1632' column='1'/>
+        <parameter type-id='7ac48c21' name='p' filepath='drivers/gpu/drm/drm_atomic.c' line='1632' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_syncobj_add_point' mangled-name='drm_syncobj_add_point' filepath='drivers/gpu/drm/drm_syncobj.c' line='285' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_syncobj_add_point'>
@@ -130863,8 +130877,8 @@
         <parameter type-id='28271da3' name='fence' filepath='drivers/gpu/drm/drm_syncobj.c' line='322' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_sysfs_hotplug_event' mangled-name='drm_sysfs_hotplug_event' filepath='drivers/gpu/drm/drm_sysfs.c' line='336' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_sysfs_hotplug_event'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_sysfs.c' line='336' column='1'/>
+      <function-decl name='drm_sysfs_hotplug_event' mangled-name='drm_sysfs_hotplug_event' filepath='drivers/gpu/drm/drm_sysfs.c' line='365' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_sysfs_hotplug_event'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_sysfs.c' line='365' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_universal_plane_init' mangled-name='drm_universal_plane_init' filepath='drivers/gpu/drm/drm_plane.c' line='173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_universal_plane_init'>
@@ -131342,22 +131356,22 @@
         <parameter type-id='3275e929' name='event' filepath='kernel/trace/trace_events_trigger.c' line='57' column='1'/>
         <return type-id='21b4096c'/>
       </function-decl>
-      <function-decl name='eventfd_ctx_fdget' mangled-name='eventfd_ctx_fdget' filepath='fs/eventfd.c' line='375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_fdget'>
-        <parameter type-id='95e97e5e' name='fd' filepath='fs/eventfd.c' line='375' column='1'/>
+      <function-decl name='eventfd_ctx_fdget' mangled-name='eventfd_ctx_fdget' filepath='fs/eventfd.c' line='378' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_fdget'>
+        <parameter type-id='95e97e5e' name='fd' filepath='fs/eventfd.c' line='378' column='1'/>
         <return type-id='71f2e203'/>
       </function-decl>
-      <function-decl name='eventfd_ctx_fileget' mangled-name='eventfd_ctx_fileget' filepath='fs/eventfd.c' line='396' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_fileget'>
-        <parameter type-id='77e79a4b' name='file' filepath='fs/eventfd.c' line='396' column='1'/>
+      <function-decl name='eventfd_ctx_fileget' mangled-name='eventfd_ctx_fileget' filepath='fs/eventfd.c' line='399' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_fileget'>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/eventfd.c' line='399' column='1'/>
         <return type-id='71f2e203'/>
       </function-decl>
       <function-decl name='eventfd_ctx_put' mangled-name='eventfd_ctx_put' filepath='fs/eventfd.c' line='117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_put'>
         <parameter type-id='71f2e203' name='ctx' filepath='fs/eventfd.c' line='117' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='eventfd_ctx_remove_wait_queue' mangled-name='eventfd_ctx_remove_wait_queue' filepath='fs/eventfd.c' line='209' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_remove_wait_queue'>
-        <parameter type-id='71f2e203' name='ctx' filepath='fs/eventfd.c' line='209' column='1'/>
-        <parameter type-id='ba9aa326' name='wait' filepath='fs/eventfd.c' line='209' column='1'/>
-        <parameter type-id='30dcd536' name='cnt' filepath='fs/eventfd.c' line='210' column='1'/>
+      <function-decl name='eventfd_ctx_remove_wait_queue' mangled-name='eventfd_ctx_remove_wait_queue' filepath='fs/eventfd.c' line='212' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_remove_wait_queue'>
+        <parameter type-id='71f2e203' name='ctx' filepath='fs/eventfd.c' line='212' column='1'/>
+        <parameter type-id='ba9aa326' name='wait' filepath='fs/eventfd.c' line='212' column='1'/>
+        <parameter type-id='30dcd536' name='cnt' filepath='fs/eventfd.c' line='213' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='eventfd_signal' mangled-name='eventfd_signal' filepath='fs/eventfd.c' line='90' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_signal'>
@@ -131369,81 +131383,81 @@
         <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='626' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='extcon_find_edev_by_node' mangled-name='extcon_find_edev_by_node' filepath='drivers/extcon/extcon.c' line='1342' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_find_edev_by_node'>
-        <parameter type-id='9a537bbe' name='node' filepath='drivers/extcon/extcon.c' line='1342' column='1'/>
+      <function-decl name='extcon_find_edev_by_node' mangled-name='extcon_find_edev_by_node' filepath='drivers/extcon/extcon.c' line='1350' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_find_edev_by_node'>
+        <parameter type-id='9a537bbe' name='node' filepath='drivers/extcon/extcon.c' line='1350' column='1'/>
         <return type-id='c0d6fada'/>
       </function-decl>
-      <function-decl name='extcon_get_edev_by_phandle' mangled-name='extcon_get_edev_by_phandle' filepath='drivers/extcon/extcon.c' line='1364' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_edev_by_phandle'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/extcon/extcon.c' line='1364' column='1'/>
-        <parameter type-id='95e97e5e' name='index' filepath='drivers/extcon/extcon.c' line='1364' column='1'/>
+      <function-decl name='extcon_get_edev_by_phandle' mangled-name='extcon_get_edev_by_phandle' filepath='drivers/extcon/extcon.c' line='1372' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_edev_by_phandle'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/extcon/extcon.c' line='1372' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/extcon/extcon.c' line='1372' column='1'/>
         <return type-id='c0d6fada'/>
       </function-decl>
-      <function-decl name='extcon_get_edev_name' mangled-name='extcon_get_edev_name' filepath='drivers/extcon/extcon.c' line='1411' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_edev_name'>
-        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='1411' column='1'/>
+      <function-decl name='extcon_get_edev_name' mangled-name='extcon_get_edev_name' filepath='drivers/extcon/extcon.c' line='1419' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_edev_name'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='1419' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='extcon_get_extcon_dev' mangled-name='extcon_get_extcon_dev' filepath='drivers/extcon/extcon.c' line='867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_extcon_dev'>
-        <parameter type-id='80f4b756' name='extcon_name' filepath='drivers/extcon/extcon.c' line='867' column='1'/>
+      <function-decl name='extcon_get_extcon_dev' mangled-name='extcon_get_extcon_dev' filepath='drivers/extcon/extcon.c' line='875' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_extcon_dev'>
+        <parameter type-id='80f4b756' name='extcon_name' filepath='drivers/extcon/extcon.c' line='875' column='1'/>
         <return type-id='c0d6fada'/>
       </function-decl>
-      <function-decl name='extcon_get_property' mangled-name='extcon_get_property' filepath='drivers/extcon/extcon.c' line='615' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_property'>
-        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='615' column='1'/>
-        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='615' column='1'/>
-        <parameter type-id='f0981eeb' name='prop' filepath='drivers/extcon/extcon.c' line='616' column='1'/>
-        <parameter type-id='50842338' name='prop_val' filepath='drivers/extcon/extcon.c' line='617' column='1'/>
+      <function-decl name='extcon_get_property' mangled-name='extcon_get_property' filepath='drivers/extcon/extcon.c' line='623' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_property'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='623' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='623' column='1'/>
+        <parameter type-id='f0981eeb' name='prop' filepath='drivers/extcon/extcon.c' line='624' column='1'/>
+        <parameter type-id='50842338' name='prop_val' filepath='drivers/extcon/extcon.c' line='625' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_get_property_capability' mangled-name='extcon_get_property_capability' filepath='drivers/extcon/extcon.c' line='782' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_property_capability'>
-        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='782' column='1'/>
-        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='782' column='1'/>
-        <parameter type-id='f0981eeb' name='prop' filepath='drivers/extcon/extcon.c' line='783' column='1'/>
+      <function-decl name='extcon_get_property_capability' mangled-name='extcon_get_property_capability' filepath='drivers/extcon/extcon.c' line='790' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_property_capability'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='790' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='790' column='1'/>
+        <parameter type-id='f0981eeb' name='prop' filepath='drivers/extcon/extcon.c' line='791' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_get_state' mangled-name='extcon_get_state' filepath='drivers/extcon/extcon.c' line='489' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_state'>
-        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='489' column='1'/>
-        <parameter type-id='20f5f452' name='id' filepath='drivers/extcon/extcon.c' line='489' column='1'/>
+      <function-decl name='extcon_get_state' mangled-name='extcon_get_state' filepath='drivers/extcon/extcon.c' line='497' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_state'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='497' column='1'/>
+        <parameter type-id='20f5f452' name='id' filepath='drivers/extcon/extcon.c' line='497' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_register_notifier' mangled-name='extcon_register_notifier' filepath='drivers/extcon/extcon.c' line='899' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_register_notifier'>
-        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='899' column='1'/>
-        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='899' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/extcon/extcon.c' line='900' column='1'/>
+      <function-decl name='extcon_register_notifier' mangled-name='extcon_register_notifier' filepath='drivers/extcon/extcon.c' line='907' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_register_notifier'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='907' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='907' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/extcon/extcon.c' line='908' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_set_property' mangled-name='extcon_set_property' filepath='drivers/extcon/extcon.c' line='694' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_set_property'>
-        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='694' column='1'/>
-        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='694' column='1'/>
-        <parameter type-id='f0981eeb' name='prop' filepath='drivers/extcon/extcon.c' line='695' column='1'/>
-        <parameter type-id='282b2805' name='prop_val' filepath='drivers/extcon/extcon.c' line='696' column='1'/>
+      <function-decl name='extcon_set_property' mangled-name='extcon_set_property' filepath='drivers/extcon/extcon.c' line='702' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_set_property'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='702' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='702' column='1'/>
+        <parameter type-id='f0981eeb' name='prop' filepath='drivers/extcon/extcon.c' line='703' column='1'/>
+        <parameter type-id='282b2805' name='prop_val' filepath='drivers/extcon/extcon.c' line='704' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_set_property_capability' mangled-name='extcon_set_property_capability' filepath='drivers/extcon/extcon.c' line='816' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_set_property_capability'>
-        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='816' column='1'/>
-        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='816' column='1'/>
-        <parameter type-id='f0981eeb' name='prop' filepath='drivers/extcon/extcon.c' line='817' column='1'/>
+      <function-decl name='extcon_set_property_capability' mangled-name='extcon_set_property_capability' filepath='drivers/extcon/extcon.c' line='824' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_set_property_capability'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='824' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='824' column='1'/>
+        <parameter type-id='f0981eeb' name='prop' filepath='drivers/extcon/extcon.c' line='825' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_set_state' mangled-name='extcon_set_state' filepath='drivers/extcon/extcon.c' line='522' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_set_state'>
-        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='522' column='1'/>
-        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='522' column='1'/>
-        <parameter type-id='b50a4934' name='state' filepath='drivers/extcon/extcon.c' line='522' column='1'/>
+      <function-decl name='extcon_set_state' mangled-name='extcon_set_state' filepath='drivers/extcon/extcon.c' line='530' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_set_state'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='530' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='530' column='1'/>
+        <parameter type-id='b50a4934' name='state' filepath='drivers/extcon/extcon.c' line='530' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_set_state_sync' mangled-name='extcon_set_state_sync' filepath='drivers/extcon/extcon.c' line='577' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_set_state_sync'>
-        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='577' column='1'/>
-        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='577' column='1'/>
-        <parameter type-id='b50a4934' name='state' filepath='drivers/extcon/extcon.c' line='577' column='1'/>
+      <function-decl name='extcon_set_state_sync' mangled-name='extcon_set_state_sync' filepath='drivers/extcon/extcon.c' line='585' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_set_state_sync'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='585' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='585' column='1'/>
+        <parameter type-id='b50a4934' name='state' filepath='drivers/extcon/extcon.c' line='585' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_sync' mangled-name='extcon_sync' filepath='drivers/extcon/extcon.c' line='408' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_sync'>
-        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='408' column='1'/>
-        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='408' column='1'/>
+      <function-decl name='extcon_sync' mangled-name='extcon_sync' filepath='drivers/extcon/extcon.c' line='416' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_sync'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='416' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='416' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_unregister_notifier' mangled-name='extcon_unregister_notifier' filepath='drivers/extcon/extcon.c' line='928' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_unregister_notifier'>
-        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='928' column='1'/>
-        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='928' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/extcon/extcon.c' line='929' column='1'/>
+      <function-decl name='extcon_unregister_notifier' mangled-name='extcon_unregister_notifier' filepath='drivers/extcon/extcon.c' line='936' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_unregister_notifier'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='936' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='936' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/extcon/extcon.c' line='937' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='failure_tracking' type-id='49a0ad34' mangled-name='failure_tracking' visibility='default' filepath='mm/page_pinner.c' line='62' column='1' elf-symbol-id='failure_tracking'/>
@@ -131495,12 +131509,12 @@
         <parameter type-id='f57039f0' name='mapping' filepath='mm/readahead.c' line='35' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='file_remove_privs' mangled-name='file_remove_privs' filepath='fs/inode.c' line='1896' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='file_remove_privs'>
-        <parameter type-id='77e79a4b' name='file' filepath='fs/inode.c' line='1896' column='1'/>
+      <function-decl name='file_remove_privs' mangled-name='file_remove_privs' filepath='fs/inode.c' line='1938' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='file_remove_privs'>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/inode.c' line='1938' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='file_update_time' mangled-name='file_update_time' filepath='fs/inode.c' line='1937' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='file_update_time'>
-        <parameter type-id='77e79a4b' name='file' filepath='fs/inode.c' line='1937' column='1'/>
+      <function-decl name='file_update_time' mangled-name='file_update_time' filepath='fs/inode.c' line='1979' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='file_update_time'>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/inode.c' line='1979' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='file_write_and_wait_range' mangled-name='file_write_and_wait_range' filepath='mm/filemap.c' line='760' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='file_write_and_wait_range'>
@@ -131509,15 +131523,15 @@
         <parameter type-id='69bf7bee' name='lend' filepath='mm/filemap.c' line='760' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='filemap_allow_speculation' mangled-name='filemap_allow_speculation' filepath='mm/filemap.c' line='3006' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filemap_allow_speculation'>
+      <function-decl name='filemap_allow_speculation' mangled-name='filemap_allow_speculation' filepath='mm/filemap.c' line='3009' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filemap_allow_speculation'>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='filemap_check_errors' mangled-name='filemap_check_errors' filepath='mm/filemap.c' line='370' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filemap_check_errors'>
         <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='370' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='filemap_fault' mangled-name='filemap_fault' filepath='mm/filemap.c' line='2725' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filemap_fault'>
-        <parameter type-id='d02f4143' name='vmf' filepath='mm/filemap.c' line='2725' column='1'/>
+      <function-decl name='filemap_fault' mangled-name='filemap_fault' filepath='mm/filemap.c' line='2728' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filemap_fault'>
+        <parameter type-id='d02f4143' name='vmf' filepath='mm/filemap.c' line='2728' column='1'/>
         <return type-id='e9265215'/>
       </function-decl>
       <function-decl name='filemap_fdatawait_range' mangled-name='filemap_fdatawait_range' filepath='mm/filemap.c' line='556' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filemap_fdatawait_range'>
@@ -131534,10 +131548,10 @@
         <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='460' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='filemap_map_pages' mangled-name='filemap_map_pages' filepath='mm/filemap.c' line='3013' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filemap_map_pages'>
-        <parameter type-id='d02f4143' name='vmf' filepath='mm/filemap.c' line='3013' column='1'/>
-        <parameter type-id='7359adad' name='start_pgoff' filepath='mm/filemap.c' line='3014' column='1'/>
-        <parameter type-id='7359adad' name='end_pgoff' filepath='mm/filemap.c' line='3014' column='1'/>
+      <function-decl name='filemap_map_pages' mangled-name='filemap_map_pages' filepath='mm/filemap.c' line='3016' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filemap_map_pages'>
+        <parameter type-id='d02f4143' name='vmf' filepath='mm/filemap.c' line='3016' column='1'/>
+        <parameter type-id='7359adad' name='start_pgoff' filepath='mm/filemap.c' line='3017' column='1'/>
+        <parameter type-id='7359adad' name='end_pgoff' filepath='mm/filemap.c' line='3017' column='1'/>
         <return type-id='e9265215'/>
       </function-decl>
       <function-decl name='filemap_write_and_wait_range' mangled-name='filemap_write_and_wait_range' filepath='mm/filemap.c' line='654' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filemap_write_and_wait_range'>
@@ -131572,11 +131586,11 @@
         <parameter type-id='587f89d2' name='nr' filepath='kernel/pid.c' line='461' column='1'/>
         <return type-id='b94e5398'/>
       </function-decl>
-      <function-decl name='find_inode_nowait' mangled-name='find_inode_nowait' filepath='fs/inode.c' line='1430' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_inode_nowait'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1430' column='1'/>
-        <parameter type-id='7359adad' name='hashval' filepath='fs/inode.c' line='1431' column='1'/>
-        <parameter type-id='16e253c0' name='match' filepath='fs/inode.c' line='1432' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='fs/inode.c' line='1434' column='1'/>
+      <function-decl name='find_inode_nowait' mangled-name='find_inode_nowait' filepath='fs/inode.c' line='1472' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_inode_nowait'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1472' column='1'/>
+        <parameter type-id='7359adad' name='hashval' filepath='fs/inode.c' line='1473' column='1'/>
+        <parameter type-id='16e253c0' name='match' filepath='fs/inode.c' line='1474' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='fs/inode.c' line='1476' column='1'/>
         <return type-id='7e666abe'/>
       </function-decl>
       <function-decl name='find_last_bit' mangled-name='find_last_bit' filepath='lib/find_bit.c' line='140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_last_bit'>
@@ -131663,7 +131677,7 @@
         <parameter type-id='b50a4934' name='ingress_only' filepath='net/core/flow_offload.c' line='285' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <var-decl name='flow_keys_basic_dissector' type-id='379be6ec' mangled-name='flow_keys_basic_dissector' visibility='default' filepath='net/core/flow_dissector.c' line='1796' column='1' elf-symbol-id='flow_keys_basic_dissector'/>
+      <var-decl name='flow_keys_basic_dissector' type-id='379be6ec' mangled-name='flow_keys_basic_dissector' visibility='default' filepath='net/core/flow_dissector.c' line='1795' column='1' elf-symbol-id='flow_keys_basic_dissector'/>
       <function-decl name='flow_rule_match_basic' mangled-name='flow_rule_match_basic' filepath='net/core/flow_offload.c' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flow_rule_match_basic'>
         <parameter type-id='c9242457' name='rule' filepath='net/core/flow_offload.c' line='44' column='1'/>
         <parameter type-id='dcf452cc' name='out' filepath='net/core/flow_offload.c' line='45' column='1'/>
@@ -131686,20 +131700,20 @@
       <function-decl name='flush_delayed_fput' mangled-name='flush_delayed_fput' filepath='fs/file_table.c' line='327' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_delayed_fput'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='flush_delayed_work' mangled-name='flush_delayed_work' filepath='kernel/workqueue.c' line='3210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_delayed_work'>
-        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='3210' column='1'/>
+      <function-decl name='flush_delayed_work' mangled-name='flush_delayed_work' filepath='kernel/workqueue.c' line='3213' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_delayed_work'>
+        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='3213' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='flush_signals' mangled-name='flush_signals' filepath='kernel/signal.c' line='479' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_signals'>
         <parameter type-id='f23e2572' name='t' filepath='kernel/signal.c' line='479' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='flush_work' mangled-name='flush_work' filepath='kernel/workqueue.c' line='3090' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_work'>
-        <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='3090' column='1'/>
+      <function-decl name='flush_work' mangled-name='flush_work' filepath='kernel/workqueue.c' line='3093' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_work'>
+        <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='3093' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='flush_workqueue' mangled-name='flush_workqueue' filepath='kernel/workqueue.c' line='2795' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_workqueue'>
-        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='2795' column='1'/>
+      <function-decl name='flush_workqueue' mangled-name='flush_workqueue' filepath='kernel/workqueue.c' line='2798' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_workqueue'>
+        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='2798' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='follow_pfn' mangled-name='follow_pfn' filepath='mm/memory.c' line='5494' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='follow_pfn'>
@@ -131719,20 +131733,20 @@
         <parameter type-id='77e79a4b' name='file' filepath='fs/file_table.c' line='356' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='frame_vector_create' mangled-name='frame_vector_create' filepath='mm/frame_vector.c' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='frame_vector_create'>
-        <parameter type-id='f0981eeb' name='nr_frames' filepath='mm/frame_vector.c' line='183' column='1'/>
+      <function-decl name='frame_vector_create' mangled-name='frame_vector_create' filepath='mm/frame_vector.c' line='185' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='frame_vector_create'>
+        <parameter type-id='f0981eeb' name='nr_frames' filepath='mm/frame_vector.c' line='185' column='1'/>
         <return type-id='d9fbdc06'/>
       </function-decl>
-      <function-decl name='frame_vector_destroy' mangled-name='frame_vector_destroy' filepath='mm/frame_vector.c' line='215' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='frame_vector_destroy'>
-        <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='215' column='1'/>
+      <function-decl name='frame_vector_destroy' mangled-name='frame_vector_destroy' filepath='mm/frame_vector.c' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='frame_vector_destroy'>
+        <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='217' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='frame_vector_to_pages' mangled-name='frame_vector_to_pages' filepath='mm/frame_vector.c' line='134' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='frame_vector_to_pages'>
-        <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='134' column='1'/>
+      <function-decl name='frame_vector_to_pages' mangled-name='frame_vector_to_pages' filepath='mm/frame_vector.c' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='frame_vector_to_pages'>
+        <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='136' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='frame_vector_to_pfns' mangled-name='frame_vector_to_pfns' filepath='mm/frame_vector.c' line='160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='frame_vector_to_pfns'>
-        <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='160' column='1'/>
+      <function-decl name='frame_vector_to_pfns' mangled-name='frame_vector_to_pfns' filepath='mm/frame_vector.c' line='162' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='frame_vector_to_pfns'>
+        <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='162' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='free_buffer_head' mangled-name='free_buffer_head' filepath='fs/buffer.c' line='3377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_buffer_head'>
@@ -131789,8 +131803,8 @@
         <parameter type-id='b88dd945' name='bdev' filepath='fs/block_dev.c' line='572' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='freeze_super' mangled-name='freeze_super' filepath='fs/super.c' line='1710' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='freeze_super'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='1710' column='1'/>
+      <function-decl name='freeze_super' mangled-name='freeze_super' filepath='fs/super.c' line='1719' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='freeze_super'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='1719' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='freezer_cgrp_subsys' type-id='1d115fd5' mangled-name='freezer_cgrp_subsys' visibility='default' filepath='kernel/cgroup/legacy_freezer.c' line='473' column='1' elf-symbol-id='freezer_cgrp_subsys'/>
@@ -132081,8 +132095,8 @@
         <parameter type-id='b88dd945' name='bdev' filepath='fs/block_dev.c' line='548' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ftrace_dump' mangled-name='ftrace_dump' filepath='kernel/trace/trace.c' line='9373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ftrace_dump'>
-        <parameter type-id='9be0e7e4' name='oops_dump_mode' filepath='kernel/trace/trace.c' line='9373' column='1'/>
+      <function-decl name='ftrace_dump' mangled-name='ftrace_dump' filepath='kernel/trace/trace.c' line='9453' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ftrace_dump'>
+        <parameter type-id='9be0e7e4' name='oops_dump_mode' filepath='kernel/trace/trace.c' line='9453' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='full_name_hash' mangled-name='full_name_hash' filepath='fs/namei.c' line='2067' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='full_name_hash'>
@@ -132313,8 +132327,8 @@
         <parameter type-id='cf536864' name='uuid' filepath='lib/uuid.c' line='33' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='generic_delete_inode' mangled-name='generic_delete_inode' filepath='fs/inode.c' line='1599' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_delete_inode'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1599' column='1'/>
+      <function-decl name='generic_delete_inode' mangled-name='generic_delete_inode' filepath='fs/inode.c' line='1641' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_delete_inode'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1641' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='generic_device_group' mangled-name='generic_device_group' filepath='drivers/iommu/iommu.c' line='1403' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_device_group'>
@@ -132342,9 +132356,9 @@
         <parameter type-id='14a7c87f' name='get_inode' filepath='fs/libfs.c' line='1054' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
-      <function-decl name='generic_file_direct_write' mangled-name='generic_file_direct_write' filepath='mm/filemap.c' line='3364' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_file_direct_write'>
-        <parameter type-id='80f25feb' name='iocb' filepath='mm/filemap.c' line='3364' column='1'/>
-        <parameter type-id='4fa10f9e' name='from' filepath='mm/filemap.c' line='3364' column='1'/>
+      <function-decl name='generic_file_direct_write' mangled-name='generic_file_direct_write' filepath='mm/filemap.c' line='3367' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_file_direct_write'>
+        <parameter type-id='80f25feb' name='iocb' filepath='mm/filemap.c' line='3367' column='1'/>
+        <parameter type-id='4fa10f9e' name='from' filepath='mm/filemap.c' line='3367' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
       <function-decl name='generic_file_llseek' mangled-name='generic_file_llseek' filepath='fs/read_write.c' line='144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_file_llseek'>
@@ -132361,9 +132375,9 @@
         <parameter type-id='69bf7bee' name='eof' filepath='fs/read_write.c' line='87' column='1'/>
         <return type-id='69bf7bee'/>
       </function-decl>
-      <function-decl name='generic_file_mmap' mangled-name='generic_file_mmap' filepath='mm/filemap.c' line='3118' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_file_mmap'>
-        <parameter type-id='77e79a4b' name='file' filepath='mm/filemap.c' line='3118' column='1'/>
-        <parameter type-id='2ae08426' name='vma' filepath='mm/filemap.c' line='3118' column='1'/>
+      <function-decl name='generic_file_mmap' mangled-name='generic_file_mmap' filepath='mm/filemap.c' line='3121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_file_mmap'>
+        <parameter type-id='77e79a4b' name='file' filepath='mm/filemap.c' line='3121' column='1'/>
+        <parameter type-id='2ae08426' name='vma' filepath='mm/filemap.c' line='3121' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='generic_file_open' mangled-name='generic_file_open' filepath='fs/open.c' line='1392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_file_open'>
@@ -132371,9 +132385,9 @@
         <parameter type-id='77e79a4b' name='filp' filepath='fs/open.c' line='1392' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='generic_file_read_iter' mangled-name='generic_file_read_iter' filepath='mm/filemap.c' line='2515' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_file_read_iter'>
-        <parameter type-id='80f25feb' name='iocb' filepath='mm/filemap.c' line='2515' column='1'/>
-        <parameter type-id='4fa10f9e' name='iter' filepath='mm/filemap.c' line='2515' column='1'/>
+      <function-decl name='generic_file_read_iter' mangled-name='generic_file_read_iter' filepath='mm/filemap.c' line='2518' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_file_read_iter'>
+        <parameter type-id='80f25feb' name='iocb' filepath='mm/filemap.c' line='2518' column='1'/>
+        <parameter type-id='4fa10f9e' name='iter' filepath='mm/filemap.c' line='2518' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
       <function-decl name='generic_file_splice_read' mangled-name='generic_file_splice_read' filepath='fs/splice.c' line='298' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_file_splice_read'>
@@ -132405,10 +132419,10 @@
         <parameter type-id='807869d3' name='duplex_chg_out' filepath='drivers/net/mii.c' line='586' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='generic_perform_write' mangled-name='generic_perform_write' filepath='mm/filemap.c' line='3467' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_perform_write'>
-        <parameter type-id='77e79a4b' name='file' filepath='mm/filemap.c' line='3467' column='1'/>
-        <parameter type-id='4fa10f9e' name='i' filepath='mm/filemap.c' line='3468' column='1'/>
-        <parameter type-id='69bf7bee' name='pos' filepath='mm/filemap.c' line='3468' column='1'/>
+      <function-decl name='generic_perform_write' mangled-name='generic_perform_write' filepath='mm/filemap.c' line='3470' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_perform_write'>
+        <parameter type-id='77e79a4b' name='file' filepath='mm/filemap.c' line='3470' column='1'/>
+        <parameter type-id='4fa10f9e' name='i' filepath='mm/filemap.c' line='3471' column='1'/>
+        <parameter type-id='69bf7bee' name='pos' filepath='mm/filemap.c' line='3471' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
       <function-decl name='generic_read_dir' mangled-name='generic_read_dir' filepath='fs/libfs.c' line='224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_read_dir'>
@@ -132523,14 +132537,14 @@
         <parameter type-id='95e97e5e' name='io_busy' filepath='drivers/cpufreq/cpufreq.c' line='152' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='get_cpu_idle_time_us' mangled-name='get_cpu_idle_time_us' filepath='kernel/time/tick-sched.c' line='621' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_cpu_idle_time_us'>
-        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/time/tick-sched.c' line='621' column='1'/>
-        <parameter type-id='3df9fd28' name='last_update_time' filepath='kernel/time/tick-sched.c' line='621' column='1'/>
+      <function-decl name='get_cpu_idle_time_us' mangled-name='get_cpu_idle_time_us' filepath='kernel/time/tick-sched.c' line='649' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_cpu_idle_time_us'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/time/tick-sched.c' line='649' column='1'/>
+        <parameter type-id='3df9fd28' name='last_update_time' filepath='kernel/time/tick-sched.c' line='649' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='get_cpu_iowait_time_us' mangled-name='get_cpu_iowait_time_us' filepath='kernel/time/tick-sched.c' line='662' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_cpu_iowait_time_us'>
-        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/time/tick-sched.c' line='662' column='1'/>
-        <parameter type-id='3df9fd28' name='last_update_time' filepath='kernel/time/tick-sched.c' line='662' column='1'/>
+      <function-decl name='get_cpu_iowait_time_us' mangled-name='get_cpu_iowait_time_us' filepath='kernel/time/tick-sched.c' line='690' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_cpu_iowait_time_us'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/time/tick-sched.c' line='690' column='1'/>
+        <parameter type-id='3df9fd28' name='last_update_time' filepath='kernel/time/tick-sched.c' line='690' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
       <function-decl name='get_device' mangled-name='get_device' filepath='drivers/base/core.c' line='3333' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_device'>
@@ -132649,12 +132663,12 @@
       <function-decl name='get_state_synchronize_rcu' mangled-name='get_state_synchronize_rcu' filepath='kernel/rcu/tree.c' line='3723' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_state_synchronize_rcu'>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='get_task_exe_file' mangled-name='get_task_exe_file' filepath='kernel/fork.c' line='1238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_exe_file'>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/fork.c' line='1238' column='1'/>
+      <function-decl name='get_task_exe_file' mangled-name='get_task_exe_file' filepath='kernel/fork.c' line='1246' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_exe_file'>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/fork.c' line='1246' column='1'/>
         <return type-id='77e79a4b'/>
       </function-decl>
-      <function-decl name='get_task_mm' mangled-name='get_task_mm' filepath='kernel/fork.c' line='1263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_mm'>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/fork.c' line='1263' column='1'/>
+      <function-decl name='get_task_mm' mangled-name='get_task_mm' filepath='kernel/fork.c' line='1271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_mm'>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/fork.c' line='1271' column='1'/>
         <return type-id='df4b7819'/>
       </function-decl>
       <function-decl name='get_task_pid' mangled-name='get_task_pid' filepath='kernel/pid.c' line='439' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_pid'>
@@ -132668,9 +132682,9 @@
         <parameter type-id='95e97e5e' name='trip' filepath='drivers/thermal/thermal_helpers.c' line='46' column='1'/>
         <return type-id='7bf821a0'/>
       </function-decl>
-      <function-decl name='get_tree_single' mangled-name='get_tree_single' filepath='fs/super.c' line='1226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_tree_single'>
-        <parameter type-id='5760dcb0' name='fc' filepath='fs/super.c' line='1226' column='1'/>
-        <parameter type-id='30341fa1' name='fill_super' filepath='fs/super.c' line='1227' column='1'/>
+      <function-decl name='get_tree_single' mangled-name='get_tree_single' filepath='fs/super.c' line='1235' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_tree_single'>
+        <parameter type-id='5760dcb0' name='fc' filepath='fs/super.c' line='1235' column='1'/>
+        <parameter type-id='30341fa1' name='fill_super' filepath='fs/super.c' line='1236' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='get_unmapped_area' mangled-name='get_unmapped_area' filepath='mm/mmap.c' line='2335' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_unmapped_area'>
@@ -132710,11 +132724,11 @@
         <parameter type-id='7292109c' name='locked' filepath='mm/gup.c' line='1862' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='get_vaddr_frames' mangled-name='get_vaddr_frames' filepath='mm/frame_vector.c' line='34' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_vaddr_frames'>
-        <parameter type-id='7359adad' name='start' filepath='mm/frame_vector.c' line='34' column='1'/>
-        <parameter type-id='f0981eeb' name='nr_frames' filepath='mm/frame_vector.c' line='34' column='1'/>
-        <parameter type-id='f0981eeb' name='gup_flags' filepath='mm/frame_vector.c' line='35' column='1'/>
-        <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='35' column='1'/>
+      <function-decl name='get_vaddr_frames' mangled-name='get_vaddr_frames' filepath='mm/frame_vector.c' line='38' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_vaddr_frames'>
+        <parameter type-id='7359adad' name='start' filepath='mm/frame_vector.c' line='38' column='1'/>
+        <parameter type-id='f0981eeb' name='nr_frames' filepath='mm/frame_vector.c' line='38' column='1'/>
+        <parameter type-id='f0981eeb' name='gup_flags' filepath='mm/frame_vector.c' line='39' column='1'/>
+        <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='39' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='get_wchan' mangled-name='get_wchan' filepath='arch/arm64/kernel/process.c' line='593' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_wchan'>
@@ -133002,10 +133016,10 @@
         <parameter type-id='5bed570d' name='desc' filepath='drivers/gpio/gpiolib.c' line='3212' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='grab_cache_page_write_begin' mangled-name='grab_cache_page_write_begin' filepath='mm/filemap.c' line='3449' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='grab_cache_page_write_begin'>
-        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3449' column='1'/>
-        <parameter type-id='7359adad' name='index' filepath='mm/filemap.c' line='3450' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='mm/filemap.c' line='3450' column='1'/>
+      <function-decl name='grab_cache_page_write_begin' mangled-name='grab_cache_page_write_begin' filepath='mm/filemap.c' line='3452' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='grab_cache_page_write_begin'>
+        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3452' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='mm/filemap.c' line='3453' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='mm/filemap.c' line='3453' column='1'/>
         <return type-id='02f11ed4'/>
       </function-decl>
       <function-decl name='gro_cells_destroy' mangled-name='gro_cells_destroy' filepath='net/core/gro_cells.c' line='92' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gro_cells_destroy'>
@@ -133033,29 +133047,29 @@
         <parameter type-id='1a494567' name='req' filepath='drivers/usb/gadget/function/u_serial.c' line='189' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gserial_alloc_line' mangled-name='gserial_alloc_line' filepath='drivers/usb/gadget/function/u_serial.c' line='1264' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_alloc_line'>
-        <parameter type-id='cf536864' name='line_num' filepath='drivers/usb/gadget/function/u_serial.c' line='1264' column='1'/>
+      <function-decl name='gserial_alloc_line' mangled-name='gserial_alloc_line' filepath='drivers/usb/gadget/function/u_serial.c' line='1267' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_alloc_line'>
+        <parameter type-id='cf536864' name='line_num' filepath='drivers/usb/gadget/function/u_serial.c' line='1267' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='gserial_connect' mangled-name='gserial_connect' filepath='drivers/usb/gadget/function/u_serial.c' line='1296' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_connect'>
-        <parameter type-id='3921c1a0' name='gser' filepath='drivers/usb/gadget/function/u_serial.c' line='1296' column='1'/>
-        <parameter type-id='f9b06939' name='port_num' filepath='drivers/usb/gadget/function/u_serial.c' line='1296' column='1'/>
+      <function-decl name='gserial_connect' mangled-name='gserial_connect' filepath='drivers/usb/gadget/function/u_serial.c' line='1299' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_connect'>
+        <parameter type-id='3921c1a0' name='gser' filepath='drivers/usb/gadget/function/u_serial.c' line='1299' column='1'/>
+        <parameter type-id='f9b06939' name='port_num' filepath='drivers/usb/gadget/function/u_serial.c' line='1299' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='gserial_disconnect' mangled-name='gserial_disconnect' filepath='drivers/usb/gadget/function/u_serial.c' line='1372' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_disconnect'>
-        <parameter type-id='3921c1a0' name='gser' filepath='drivers/usb/gadget/function/u_serial.c' line='1372' column='1'/>
+      <function-decl name='gserial_disconnect' mangled-name='gserial_disconnect' filepath='drivers/usb/gadget/function/u_serial.c' line='1375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_disconnect'>
+        <parameter type-id='3921c1a0' name='gser' filepath='drivers/usb/gadget/function/u_serial.c' line='1375' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gserial_free_line' mangled-name='gserial_free_line' filepath='drivers/usb/gadget/function/u_serial.c' line='1199' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_free_line'>
-        <parameter type-id='002ac4a6' name='port_num' filepath='drivers/usb/gadget/function/u_serial.c' line='1199' column='1'/>
+      <function-decl name='gserial_free_line' mangled-name='gserial_free_line' filepath='drivers/usb/gadget/function/u_serial.c' line='1202' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_free_line'>
+        <parameter type-id='002ac4a6' name='port_num' filepath='drivers/usb/gadget/function/u_serial.c' line='1202' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gserial_resume' mangled-name='gserial_resume' filepath='drivers/usb/gadget/function/u_serial.c' line='1431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_resume'>
-        <parameter type-id='3921c1a0' name='gser' filepath='drivers/usb/gadget/function/u_serial.c' line='1431' column='1'/>
+      <function-decl name='gserial_resume' mangled-name='gserial_resume' filepath='drivers/usb/gadget/function/u_serial.c' line='1443' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_resume'>
+        <parameter type-id='3921c1a0' name='gser' filepath='drivers/usb/gadget/function/u_serial.c' line='1443' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gserial_suspend' mangled-name='gserial_suspend' filepath='drivers/usb/gadget/function/u_serial.c' line='1420' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_suspend'>
-        <parameter type-id='3921c1a0' name='gser' filepath='drivers/usb/gadget/function/u_serial.c' line='1420' column='1'/>
+      <function-decl name='gserial_suspend' mangled-name='gserial_suspend' filepath='drivers/usb/gadget/function/u_serial.c' line='1423' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_suspend'>
+        <parameter type-id='3921c1a0' name='gser' filepath='drivers/usb/gadget/function/u_serial.c' line='1423' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='guid_gen' mangled-name='guid_gen' filepath='lib/uuid.c' line='60' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='guid_gen'>
@@ -133796,8 +133810,8 @@
         <parameter type-id='3eb7c31c' name='gfp' filepath='lib/idr.c' line='34' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='idr_destroy' mangled-name='idr_destroy' filepath='lib/radix-tree.c' line='1557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_destroy'>
-        <parameter type-id='301185b4' name='idr' filepath='lib/radix-tree.c' line='1557' column='1'/>
+      <function-decl name='idr_destroy' mangled-name='idr_destroy' filepath='lib/radix-tree.c' line='1556' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_destroy'>
+        <parameter type-id='301185b4' name='idr' filepath='lib/radix-tree.c' line='1556' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='idr_find' mangled-name='idr_find' filepath='lib/idr.c' line='172' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_find'>
@@ -133816,8 +133830,8 @@
         <parameter type-id='7292109c' name='nextid' filepath='lib/idr.c' line='264' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='idr_preload' mangled-name='idr_preload' filepath='lib/radix-tree.c' line='1467' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_preload'>
-        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='lib/radix-tree.c' line='1467' column='1'/>
+      <function-decl name='idr_preload' mangled-name='idr_preload' filepath='lib/radix-tree.c' line='1466' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_preload'>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='lib/radix-tree.c' line='1466' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='idr_remove' mangled-name='idr_remove' filepath='lib/idr.c' line='152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_remove'>
@@ -133864,26 +133878,26 @@
         <parameter type-id='b50a4934' name='ifs_handling' filepath='net/mac802154/util.c' line='59' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='iget5_locked' mangled-name='iget5_locked' filepath='fs/inode.c' line='1142' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iget5_locked'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1142' column='1'/>
-        <parameter type-id='7359adad' name='hashval' filepath='fs/inode.c' line='1142' column='1'/>
-        <parameter type-id='1b7a05dc' name='test' filepath='fs/inode.c' line='1143' column='1'/>
-        <parameter type-id='1b7a05dc' name='set' filepath='fs/inode.c' line='1144' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='fs/inode.c' line='1144' column='1'/>
+      <function-decl name='iget5_locked' mangled-name='iget5_locked' filepath='fs/inode.c' line='1184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iget5_locked'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1184' column='1'/>
+        <parameter type-id='7359adad' name='hashval' filepath='fs/inode.c' line='1184' column='1'/>
+        <parameter type-id='1b7a05dc' name='test' filepath='fs/inode.c' line='1185' column='1'/>
+        <parameter type-id='1b7a05dc' name='set' filepath='fs/inode.c' line='1186' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='fs/inode.c' line='1186' column='1'/>
         <return type-id='7e666abe'/>
       </function-decl>
       <function-decl name='iget_failed' mangled-name='iget_failed' filepath='fs/bad_inode.c' line='238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iget_failed'>
         <parameter type-id='7e666abe' name='inode' filepath='fs/bad_inode.c' line='238' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='iget_locked' mangled-name='iget_locked' filepath='fs/inode.c' line='1175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iget_locked'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1175' column='1'/>
-        <parameter type-id='7359adad' name='ino' filepath='fs/inode.c' line='1175' column='1'/>
+      <function-decl name='iget_locked' mangled-name='iget_locked' filepath='fs/inode.c' line='1217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iget_locked'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1217' column='1'/>
+        <parameter type-id='7359adad' name='ino' filepath='fs/inode.c' line='1217' column='1'/>
         <return type-id='7e666abe'/>
       </function-decl>
       <var-decl name='ignore_console_lock_warning' type-id='49178f86' mangled-name='ignore_console_lock_warning' visibility='default' filepath='kernel/printk/printk.c' line='74' column='1' elf-symbol-id='ignore_console_lock_warning'/>
-      <function-decl name='igrab' mangled-name='igrab' filepath='fs/inode.c' line='1294' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='igrab'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1294' column='1'/>
+      <function-decl name='igrab' mangled-name='igrab' filepath='fs/inode.c' line='1336' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='igrab'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1336' column='1'/>
         <return type-id='7e666abe'/>
       </function-decl>
       <function-decl name='ihold' mangled-name='ihold' filepath='fs/inode.c' line='421' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ihold'>
@@ -134045,16 +134059,16 @@
         <parameter type-id='95e97e5e' name='val' filepath='drivers/iio/inkern.c' line='878' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ilookup' mangled-name='ilookup' filepath='fs/inode.c' line='1385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ilookup'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1385' column='1'/>
-        <parameter type-id='7359adad' name='ino' filepath='fs/inode.c' line='1385' column='1'/>
+      <function-decl name='ilookup' mangled-name='ilookup' filepath='fs/inode.c' line='1427' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ilookup'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1427' column='1'/>
+        <parameter type-id='7359adad' name='ino' filepath='fs/inode.c' line='1427' column='1'/>
         <return type-id='7e666abe'/>
       </function-decl>
-      <function-decl name='ilookup5' mangled-name='ilookup5' filepath='fs/inode.c' line='1360' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ilookup5'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1360' column='1'/>
-        <parameter type-id='7359adad' name='hashval' filepath='fs/inode.c' line='1360' column='1'/>
-        <parameter type-id='1b7a05dc' name='test' filepath='fs/inode.c' line='1361' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='fs/inode.c' line='1361' column='1'/>
+      <function-decl name='ilookup5' mangled-name='ilookup5' filepath='fs/inode.c' line='1402' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ilookup5'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1402' column='1'/>
+        <parameter type-id='7359adad' name='hashval' filepath='fs/inode.c' line='1402' column='1'/>
+        <parameter type-id='1b7a05dc' name='test' filepath='fs/inode.c' line='1403' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='fs/inode.c' line='1403' column='1'/>
         <return type-id='7e666abe'/>
       </function-decl>
       <function-decl name='import_iovec' mangled-name='import_iovec' filepath='lib/iov_iter.c' line='1801' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='import_iovec'>
@@ -134143,10 +134157,10 @@
         <parameter type-id='7359adad' name='magic' filepath='fs/libfs.c' line='369' column='1'/>
         <return type-id='79f85ebf'/>
       </function-decl>
-      <function-decl name='init_special_inode' mangled-name='init_special_inode' filepath='fs/inode.c' line='2085' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_special_inode'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2085' column='1'/>
-        <parameter type-id='2594b00f' name='mode' filepath='fs/inode.c' line='2085' column='1'/>
-        <parameter type-id='8504f260' name='rdev' filepath='fs/inode.c' line='2085' column='1'/>
+      <function-decl name='init_special_inode' mangled-name='init_special_inode' filepath='fs/inode.c' line='2127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_special_inode'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2127' column='1'/>
+        <parameter type-id='2594b00f' name='mode' filepath='fs/inode.c' line='2127' column='1'/>
+        <parameter type-id='8504f260' name='rdev' filepath='fs/inode.c' line='2127' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='init_srcu_struct' mangled-name='init_srcu_struct' filepath='kernel/rcu/srcutree.c' line='213' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_srcu_struct'>
@@ -134168,18 +134182,18 @@
         <parameter type-id='95e97e5e' name='flags' filepath='kernel/sched/wait.c' line='282' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='inode_dio_wait' mangled-name='inode_dio_wait' filepath='fs/inode.c' line='2174' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_dio_wait'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2174' column='1'/>
+      <function-decl name='inode_dio_wait' mangled-name='inode_dio_wait' filepath='fs/inode.c' line='2216' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_dio_wait'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2216' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='inode_init_once' mangled-name='inode_init_once' filepath='fs/inode.c' line='390' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_init_once'>
         <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='390' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='inode_init_owner' mangled-name='inode_init_owner' filepath='fs/inode.c' line='2111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_init_owner'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2111' column='1'/>
-        <parameter type-id='c5a4eb7f' name='dir' filepath='fs/inode.c' line='2111' column='1'/>
-        <parameter type-id='2594b00f' name='mode' filepath='fs/inode.c' line='2112' column='1'/>
+      <function-decl name='inode_init_owner' mangled-name='inode_init_owner' filepath='fs/inode.c' line='2153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_init_owner'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2153' column='1'/>
+        <parameter type-id='c5a4eb7f' name='dir' filepath='fs/inode.c' line='2153' column='1'/>
+        <parameter type-id='2594b00f' name='mode' filepath='fs/inode.c' line='2154' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='inode_newsize_ok' mangled-name='inode_newsize_ok' filepath='fs/attr.c' line='193' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_newsize_ok'>
@@ -134187,12 +134201,12 @@
         <parameter type-id='69bf7bee' name='offset' filepath='fs/attr.c' line='193' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='inode_nohighmem' mangled-name='inode_nohighmem' filepath='fs/inode.c' line='2205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_nohighmem'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2205' column='1'/>
+      <function-decl name='inode_nohighmem' mangled-name='inode_nohighmem' filepath='fs/inode.c' line='2247' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_nohighmem'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2247' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='inode_owner_or_capable' mangled-name='inode_owner_or_capable' filepath='fs/inode.c' line='2134' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_owner_or_capable'>
-        <parameter type-id='c5a4eb7f' name='inode' filepath='fs/inode.c' line='2134' column='1'/>
+      <function-decl name='inode_owner_or_capable' mangled-name='inode_owner_or_capable' filepath='fs/inode.c' line='2176' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_owner_or_capable'>
+        <parameter type-id='c5a4eb7f' name='inode' filepath='fs/inode.c' line='2176' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='inode_permission' mangled-name='inode_permission' filepath='fs/namei.c' line='442' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_permission'>
@@ -134200,10 +134214,10 @@
         <parameter type-id='95e97e5e' name='mask' filepath='fs/namei.c' line='442' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='inode_set_flags' mangled-name='inode_set_flags' filepath='fs/inode.c' line='2197' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_set_flags'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2197' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='fs/inode.c' line='2197' column='1'/>
-        <parameter type-id='f0981eeb' name='mask' filepath='fs/inode.c' line='2198' column='1'/>
+      <function-decl name='inode_set_flags' mangled-name='inode_set_flags' filepath='fs/inode.c' line='2239' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_set_flags'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2239' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='fs/inode.c' line='2239' column='1'/>
+        <parameter type-id='f0981eeb' name='mask' filepath='fs/inode.c' line='2240' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='input_alloc_absinfo' mangled-name='input_alloc_absinfo' filepath='drivers/input/input.c' line='497' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_alloc_absinfo'>
@@ -134343,8 +134357,8 @@
         <parameter type-id='4938abae' name='handler' filepath='drivers/input/input.c' line='2336' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='insert_inode_locked' mangled-name='insert_inode_locked' filepath='fs/inode.c' line='1535' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='insert_inode_locked'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1535' column='1'/>
+      <function-decl name='insert_inode_locked' mangled-name='insert_inode_locked' filepath='fs/inode.c' line='1577' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='insert_inode_locked'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1577' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='int_pow' mangled-name='int_pow' filepath='lib/math/int_pow.c' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='int_pow'>
@@ -134388,11 +134402,11 @@
         <parameter type-id='7359adad' name='end' filepath='mm/truncate.c' line='630' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='io_schedule' mangled-name='io_schedule' filepath='kernel/sched/core.c' line='6559' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='io_schedule'>
+      <function-decl name='io_schedule' mangled-name='io_schedule' filepath='kernel/sched/core.c' line='6576' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='io_schedule'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='io_schedule_timeout' mangled-name='io_schedule_timeout' filepath='kernel/sched/core.c' line='6546' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='io_schedule_timeout'>
-        <parameter type-id='bd54fe1a' name='timeout' filepath='kernel/sched/core.c' line='6546' column='1'/>
+      <function-decl name='io_schedule_timeout' mangled-name='io_schedule_timeout' filepath='kernel/sched/core.c' line='6563' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='io_schedule_timeout'>
+        <parameter type-id='bd54fe1a' name='timeout' filepath='kernel/sched/core.c' line='6563' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
       <var-decl name='iomem_resource' type-id='5218160d' mangled-name='iomem_resource' visibility='default' filepath='kernel/resource.c' line='38' column='1' elf-symbol-id='iomem_resource'/>
@@ -134715,10 +134729,10 @@
         <parameter type-id='f0981eeb' name='addr_type' filepath='net/ipv4/netfilter.c' line='20' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ip_route_output_flow' mangled-name='ip_route_output_flow' filepath='net/ipv4/route.c' line='2782' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ip_route_output_flow'>
-        <parameter type-id='a2bff676' name='net' filepath='net/ipv4/route.c' line='2782' column='1'/>
-        <parameter type-id='a198549e' name='flp4' filepath='net/ipv4/route.c' line='2782' column='1'/>
-        <parameter type-id='78e7cf52' name='sk' filepath='net/ipv4/route.c' line='2783' column='1'/>
+      <function-decl name='ip_route_output_flow' mangled-name='ip_route_output_flow' filepath='net/ipv4/route.c' line='2785' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ip_route_output_flow'>
+        <parameter type-id='a2bff676' name='net' filepath='net/ipv4/route.c' line='2785' column='1'/>
+        <parameter type-id='a198549e' name='flp4' filepath='net/ipv4/route.c' line='2785' column='1'/>
+        <parameter type-id='78e7cf52' name='sk' filepath='net/ipv4/route.c' line='2786' column='1'/>
         <return type-id='c8f5869f'/>
       </function-decl>
       <function-decl name='ip_send_check' mangled-name='ip_send_check' filepath='net/ipv4/ip_output.c' line='92' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ip_send_check'>
@@ -134728,8 +134742,8 @@
       <function-decl name='ipi_desc_get' mangled-name='ipi_desc_get' filepath='arch/arm64/kernel/smp.c' line='1153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ipi_desc_get'>
         <return type-id='9d9a0573'/>
       </function-decl>
-      <function-decl name='iput' mangled-name='iput' filepath='fs/inode.c' line='1667' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iput'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1667' column='1'/>
+      <function-decl name='iput' mangled-name='iput' filepath='fs/inode.c' line='1709' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iput'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1709' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ipv6_ext_hdr' mangled-name='ipv6_ext_hdr' filepath='net/ipv6/exthdrs_core.c' line='13' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ipv6_ext_hdr'>
@@ -135126,11 +135140,11 @@
         <parameter type-id='f0981eeb' name='flags' filepath='fs/splice.c' line='619' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='iterate_fd' mangled-name='iterate_fd' filepath='fs/file.c' line='1264' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iterate_fd'>
-        <parameter type-id='16c53416' name='files' filepath='fs/file.c' line='1264' column='1'/>
-        <parameter type-id='f0981eeb' name='n' filepath='fs/file.c' line='1264' column='1'/>
-        <parameter type-id='d092647b' name='f' filepath='fs/file.c' line='1265' column='1'/>
-        <parameter type-id='eaa32e2f' name='p' filepath='fs/file.c' line='1266' column='1'/>
+      <function-decl name='iterate_fd' mangled-name='iterate_fd' filepath='fs/file.c' line='1278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iterate_fd'>
+        <parameter type-id='16c53416' name='files' filepath='fs/file.c' line='1278' column='1'/>
+        <parameter type-id='f0981eeb' name='n' filepath='fs/file.c' line='1278' column='1'/>
+        <parameter type-id='d092647b' name='f' filepath='fs/file.c' line='1279' column='1'/>
+        <parameter type-id='eaa32e2f' name='p' filepath='fs/file.c' line='1280' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='iterate_supers_type' mangled-name='iterate_supers_type' filepath='fs/super.c' line='717' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iterate_supers_type'>
@@ -135139,9 +135153,9 @@
         <parameter type-id='eaa32e2f' name='arg' filepath='fs/super.c' line='718' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='iunique' mangled-name='iunique' filepath='fs/inode.c' line='1269' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iunique'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1269' column='1'/>
-        <parameter type-id='2aa75eef' name='max_reserved' filepath='fs/inode.c' line='1269' column='1'/>
+      <function-decl name='iunique' mangled-name='iunique' filepath='fs/inode.c' line='1311' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iunique'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='1311' column='1'/>
+        <parameter type-id='2aa75eef' name='max_reserved' filepath='fs/inode.c' line='1311' column='1'/>
         <return type-id='2aa75eef'/>
       </function-decl>
       <function-decl name='iw_handler_get_spy' mangled-name='iw_handler_get_spy' filepath='net/wireless/wext-spy.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iw_handler_get_spy'>
@@ -135172,29 +135186,29 @@
         <parameter type-id='26a90f95' name='extra' filepath='net/wireless/wext-spy.c' line='113' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='iwe_stream_add_event' mangled-name='iwe_stream_add_event' filepath='net/wireless/wext-core.c' line='1124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iwe_stream_add_event'>
-        <parameter type-id='4780e252' name='info' filepath='net/wireless/wext-core.c' line='1124' column='1'/>
-        <parameter type-id='26a90f95' name='stream' filepath='net/wireless/wext-core.c' line='1124' column='1'/>
-        <parameter type-id='26a90f95' name='ends' filepath='net/wireless/wext-core.c' line='1125' column='1'/>
-        <parameter type-id='4f46bd9c' name='iwe' filepath='net/wireless/wext-core.c' line='1125' column='1'/>
-        <parameter type-id='95e97e5e' name='event_len' filepath='net/wireless/wext-core.c' line='1125' column='1'/>
+      <function-decl name='iwe_stream_add_event' mangled-name='iwe_stream_add_event' filepath='net/wireless/wext-core.c' line='1130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iwe_stream_add_event'>
+        <parameter type-id='4780e252' name='info' filepath='net/wireless/wext-core.c' line='1130' column='1'/>
+        <parameter type-id='26a90f95' name='stream' filepath='net/wireless/wext-core.c' line='1130' column='1'/>
+        <parameter type-id='26a90f95' name='ends' filepath='net/wireless/wext-core.c' line='1131' column='1'/>
+        <parameter type-id='4f46bd9c' name='iwe' filepath='net/wireless/wext-core.c' line='1131' column='1'/>
+        <parameter type-id='95e97e5e' name='event_len' filepath='net/wireless/wext-core.c' line='1131' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='iwe_stream_add_point' mangled-name='iwe_stream_add_point' filepath='net/wireless/wext-core.c' line='1145' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iwe_stream_add_point'>
-        <parameter type-id='4780e252' name='info' filepath='net/wireless/wext-core.c' line='1145' column='1'/>
-        <parameter type-id='26a90f95' name='stream' filepath='net/wireless/wext-core.c' line='1145' column='1'/>
-        <parameter type-id='26a90f95' name='ends' filepath='net/wireless/wext-core.c' line='1146' column='1'/>
-        <parameter type-id='4f46bd9c' name='iwe' filepath='net/wireless/wext-core.c' line='1146' column='1'/>
-        <parameter type-id='26a90f95' name='extra' filepath='net/wireless/wext-core.c' line='1146' column='1'/>
+      <function-decl name='iwe_stream_add_point' mangled-name='iwe_stream_add_point' filepath='net/wireless/wext-core.c' line='1151' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iwe_stream_add_point'>
+        <parameter type-id='4780e252' name='info' filepath='net/wireless/wext-core.c' line='1151' column='1'/>
+        <parameter type-id='26a90f95' name='stream' filepath='net/wireless/wext-core.c' line='1151' column='1'/>
+        <parameter type-id='26a90f95' name='ends' filepath='net/wireless/wext-core.c' line='1152' column='1'/>
+        <parameter type-id='4f46bd9c' name='iwe' filepath='net/wireless/wext-core.c' line='1152' column='1'/>
+        <parameter type-id='26a90f95' name='extra' filepath='net/wireless/wext-core.c' line='1152' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='iwe_stream_add_value' mangled-name='iwe_stream_add_value' filepath='net/wireless/wext-core.c' line='1168' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iwe_stream_add_value'>
-        <parameter type-id='4780e252' name='info' filepath='net/wireless/wext-core.c' line='1168' column='1'/>
-        <parameter type-id='26a90f95' name='event' filepath='net/wireless/wext-core.c' line='1168' column='1'/>
-        <parameter type-id='26a90f95' name='value' filepath='net/wireless/wext-core.c' line='1169' column='1'/>
-        <parameter type-id='26a90f95' name='ends' filepath='net/wireless/wext-core.c' line='1169' column='1'/>
-        <parameter type-id='4f46bd9c' name='iwe' filepath='net/wireless/wext-core.c' line='1169' column='1'/>
-        <parameter type-id='95e97e5e' name='event_len' filepath='net/wireless/wext-core.c' line='1170' column='1'/>
+      <function-decl name='iwe_stream_add_value' mangled-name='iwe_stream_add_value' filepath='net/wireless/wext-core.c' line='1174' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iwe_stream_add_value'>
+        <parameter type-id='4780e252' name='info' filepath='net/wireless/wext-core.c' line='1174' column='1'/>
+        <parameter type-id='26a90f95' name='event' filepath='net/wireless/wext-core.c' line='1174' column='1'/>
+        <parameter type-id='26a90f95' name='value' filepath='net/wireless/wext-core.c' line='1175' column='1'/>
+        <parameter type-id='26a90f95' name='ends' filepath='net/wireless/wext-core.c' line='1175' column='1'/>
+        <parameter type-id='4f46bd9c' name='iwe' filepath='net/wireless/wext-core.c' line='1175' column='1'/>
+        <parameter type-id='95e97e5e' name='event_len' filepath='net/wireless/wext-core.c' line='1176' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
       <function-decl name='jiffies64_to_msecs' mangled-name='jiffies64_to_msecs' filepath='kernel/time/time.c' line='701' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='jiffies64_to_msecs'>
@@ -135235,23 +135249,23 @@
         <parameter type-id='549da823' name='mnt' filepath='fs/namespace.c' line='3896' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kernel_bind' mangled-name='kernel_bind' filepath='net/socket.c' line='3396' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_bind'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3396' column='1'/>
-        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3396' column='1'/>
-        <parameter type-id='95e97e5e' name='addrlen' filepath='net/socket.c' line='3396' column='1'/>
+      <function-decl name='kernel_bind' mangled-name='kernel_bind' filepath='net/socket.c' line='3413' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_bind'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3413' column='1'/>
+        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3413' column='1'/>
+        <parameter type-id='95e97e5e' name='addrlen' filepath='net/socket.c' line='3413' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kernel_connect' mangled-name='kernel_connect' filepath='net/socket.c' line='3465' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_connect'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3465' column='1'/>
-        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3465' column='1'/>
-        <parameter type-id='95e97e5e' name='addrlen' filepath='net/socket.c' line='3465' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='net/socket.c' line='3466' column='1'/>
+      <function-decl name='kernel_connect' mangled-name='kernel_connect' filepath='net/socket.c' line='3486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_connect'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3486' column='1'/>
+        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3486' column='1'/>
+        <parameter type-id='95e97e5e' name='addrlen' filepath='net/socket.c' line='3486' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/socket.c' line='3487' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='kernel_cpustat' type-id='7b5f27b3' mangled-name='kernel_cpustat' visibility='default' filepath='kernel/sched/core.c' line='4178' column='1' elf-symbol-id='kernel_cpustat'/>
-      <function-decl name='kernel_getsockname' mangled-name='kernel_getsockname' filepath='net/socket.c' line='3481' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_getsockname'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3481' column='1'/>
-        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3481' column='1'/>
+      <function-decl name='kernel_getsockname' mangled-name='kernel_getsockname' filepath='net/socket.c' line='3506' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_getsockname'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3506' column='1'/>
+        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3506' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='kernel_kobj' type-id='d30bdc51' mangled-name='kernel_kobj' visibility='default' filepath='kernel/ksysfs.c' line='213' column='1' elf-symbol-id='kernel_kobj'/>
@@ -135272,25 +135286,25 @@
       <function-decl name='kernel_power_off' mangled-name='kernel_power_off' filepath='kernel/reboot.c' line='289' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_power_off'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kernel_recvmsg' mangled-name='kernel_recvmsg' filepath='net/socket.c' line='924' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_recvmsg'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='924' column='1'/>
-        <parameter type-id='6b9b777a' name='msg' filepath='net/socket.c' line='924' column='1'/>
-        <parameter type-id='9c68341e' name='vec' filepath='net/socket.c' line='925' column='1'/>
-        <parameter type-id='b59d7dce' name='num' filepath='net/socket.c' line='925' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='net/socket.c' line='925' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='net/socket.c' line='925' column='1'/>
+      <function-decl name='kernel_recvmsg' mangled-name='kernel_recvmsg' filepath='net/socket.c' line='941' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_recvmsg'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='941' column='1'/>
+        <parameter type-id='6b9b777a' name='msg' filepath='net/socket.c' line='941' column='1'/>
+        <parameter type-id='9c68341e' name='vec' filepath='net/socket.c' line='942' column='1'/>
+        <parameter type-id='b59d7dce' name='num' filepath='net/socket.c' line='942' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='net/socket.c' line='942' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/socket.c' line='942' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='kernel_restart' mangled-name='kernel_restart' filepath='kernel/reboot.c' line='246' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_restart'>
         <parameter type-id='26a90f95' name='cmd' filepath='kernel/reboot.c' line='246' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kernel_sendmsg' mangled-name='kernel_sendmsg' filepath='net/socket.c' line='688' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_sendmsg'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='688' column='1'/>
-        <parameter type-id='6b9b777a' name='msg' filepath='net/socket.c' line='688' column='1'/>
-        <parameter type-id='9c68341e' name='vec' filepath='net/socket.c' line='689' column='1'/>
-        <parameter type-id='b59d7dce' name='num' filepath='net/socket.c' line='689' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='net/socket.c' line='689' column='1'/>
+      <function-decl name='kernel_sendmsg' mangled-name='kernel_sendmsg' filepath='net/socket.c' line='705' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_sendmsg'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='705' column='1'/>
+        <parameter type-id='6b9b777a' name='msg' filepath='net/socket.c' line='705' column='1'/>
+        <parameter type-id='9c68341e' name='vec' filepath='net/socket.c' line='706' column='1'/>
+        <parameter type-id='b59d7dce' name='num' filepath='net/socket.c' line='706' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='net/socket.c' line='706' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='kernel_sigaction' mangled-name='kernel_sigaction' filepath='kernel/signal.c' line='3979' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_sigaction'>
@@ -135298,15 +135312,15 @@
         <parameter type-id='8cdd9566' name='action' filepath='kernel/signal.c' line='3979' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kernel_sock_shutdown' mangled-name='kernel_sock_shutdown' filepath='net/socket.c' line='3558' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_sock_shutdown'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3558' column='1'/>
-        <parameter type-id='45c08bac' name='how' filepath='net/socket.c' line='3558' column='1'/>
+      <function-decl name='kernel_sock_shutdown' mangled-name='kernel_sock_shutdown' filepath='net/socket.c' line='3583' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_sock_shutdown'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3583' column='1'/>
+        <parameter type-id='45c08bac' name='how' filepath='net/socket.c' line='3583' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kernfs_find_and_get_ns' mangled-name='kernfs_find_and_get_ns' filepath='fs/kernfs/dir.c' line='907' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernfs_find_and_get_ns'>
-        <parameter type-id='150efd3f' name='parent' filepath='fs/kernfs/dir.c' line='907' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='fs/kernfs/dir.c' line='908' column='1'/>
-        <parameter type-id='eaa32e2f' name='ns' filepath='fs/kernfs/dir.c' line='908' column='1'/>
+      <function-decl name='kernfs_find_and_get_ns' mangled-name='kernfs_find_and_get_ns' filepath='fs/kernfs/dir.c' line='909' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernfs_find_and_get_ns'>
+        <parameter type-id='150efd3f' name='parent' filepath='fs/kernfs/dir.c' line='909' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='fs/kernfs/dir.c' line='910' column='1'/>
+        <parameter type-id='eaa32e2f' name='ns' filepath='fs/kernfs/dir.c' line='910' column='1'/>
         <return type-id='150efd3f'/>
       </function-decl>
       <function-decl name='kernfs_notify' mangled-name='kernfs_notify' filepath='fs/kernfs/file.c' line='913' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernfs_notify'>
@@ -135372,12 +135386,12 @@
       <function-decl name='kick_all_cpus_sync' mangled-name='kick_all_cpus_sync' filepath='kernel/smp.c' line='938' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kick_all_cpus_sync'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kill_anon_super' mangled-name='kill_anon_super' filepath='fs/super.c' line='1106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_anon_super'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='1106' column='1'/>
+      <function-decl name='kill_anon_super' mangled-name='kill_anon_super' filepath='fs/super.c' line='1115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_anon_super'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='1115' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kill_block_super' mangled-name='kill_block_super' filepath='fs/super.c' line='1441' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_block_super'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='1441' column='1'/>
+      <function-decl name='kill_block_super' mangled-name='kill_block_super' filepath='fs/super.c' line='1450' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_block_super'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='1450' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kill_fasync' mangled-name='kill_fasync' filepath='fs/fcntl.c' line='1027' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_fasync'>
@@ -135386,8 +135400,8 @@
         <parameter type-id='95e97e5e' name='band' filepath='fs/fcntl.c' line='1027' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kill_litter_super' mangled-name='kill_litter_super' filepath='fs/super.c' line='1114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_litter_super'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='1114' column='1'/>
+      <function-decl name='kill_litter_super' mangled-name='kill_litter_super' filepath='fs/super.c' line='1123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_litter_super'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='1123' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kill_pid' mangled-name='kill_pid' filepath='kernel/signal.c' line='1805' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_pid'>
@@ -135493,47 +135507,47 @@
         <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3204' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <var-decl name='kobj_sysfs_ops' type-id='0f840455' mangled-name='kobj_sysfs_ops' visibility='default' filepath='lib/kobject.c' line='860' column='1' elf-symbol-id='kobj_sysfs_ops'/>
-      <function-decl name='kobject_add' mangled-name='kobject_add' filepath='lib/kobject.c' line='426' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_add'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='426' column='1'/>
-        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='426' column='1'/>
-        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='427' column='1'/>
+      <var-decl name='kobj_sysfs_ops' type-id='0f840455' mangled-name='kobj_sysfs_ops' visibility='default' filepath='lib/kobject.c' line='868' column='1' elf-symbol-id='kobj_sysfs_ops'/>
+      <function-decl name='kobject_add' mangled-name='kobject_add' filepath='lib/kobject.c' line='434' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_add'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='434' column='1'/>
+        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='434' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='435' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kobject_create_and_add' mangled-name='kobject_create_and_add' filepath='lib/kobject.c' line='805' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_create_and_add'>
-        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='805' column='1'/>
-        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='805' column='1'/>
+      <function-decl name='kobject_create_and_add' mangled-name='kobject_create_and_add' filepath='lib/kobject.c' line='813' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_create_and_add'>
+        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='813' column='1'/>
+        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='813' column='1'/>
         <return type-id='d30bdc51'/>
       </function-decl>
-      <function-decl name='kobject_del' mangled-name='kobject_del' filepath='lib/kobject.c' line='635' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_del'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='635' column='1'/>
+      <function-decl name='kobject_del' mangled-name='kobject_del' filepath='lib/kobject.c' line='643' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_del'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='643' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kobject_get' mangled-name='kobject_get' filepath='lib/kobject.c' line='652' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_get'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='652' column='1'/>
+      <function-decl name='kobject_get' mangled-name='kobject_get' filepath='lib/kobject.c' line='660' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_get'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='660' column='1'/>
         <return type-id='d30bdc51'/>
       </function-decl>
-      <function-decl name='kobject_init' mangled-name='kobject_init' filepath='lib/kobject.c' line='349' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='349' column='1'/>
-        <parameter type-id='c48b394e' name='ktype' filepath='lib/kobject.c' line='349' column='1'/>
+      <function-decl name='kobject_init' mangled-name='kobject_init' filepath='lib/kobject.c' line='357' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='357' column='1'/>
+        <parameter type-id='c48b394e' name='ktype' filepath='lib/kobject.c' line='357' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kobject_init_and_add' mangled-name='kobject_init_and_add' filepath='lib/kobject.c' line='464' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init_and_add'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='464' column='1'/>
-        <parameter type-id='c48b394e' name='ktype' filepath='lib/kobject.c' line='464' column='1'/>
-        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='465' column='1'/>
-        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='465' column='1'/>
+      <function-decl name='kobject_init_and_add' mangled-name='kobject_init_and_add' filepath='lib/kobject.c' line='472' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init_and_add'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='472' column='1'/>
+        <parameter type-id='c48b394e' name='ktype' filepath='lib/kobject.c' line='472' column='1'/>
+        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='473' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='473' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kobject_put' mangled-name='kobject_put' filepath='lib/kobject.c' line='746' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_put'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='746' column='1'/>
+      <function-decl name='kobject_put' mangled-name='kobject_put' filepath='lib/kobject.c' line='754' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_put'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='754' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kobject_set_name' mangled-name='kobject_set_name' filepath='lib/kobject.c' line='324' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_set_name'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='324' column='1'/>
-        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='324' column='1'/>
+      <function-decl name='kobject_set_name' mangled-name='kobject_set_name' filepath='lib/kobject.c' line='332' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_set_name'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='332' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='332' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -135554,23 +135568,23 @@
         <parameter type-id='3eb7c31c' name='flags' filepath='mm/slab_common.c' line='1132' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='kset_create_and_add' mangled-name='kset_create_and_add' filepath='lib/kobject.c' line='1005' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_create_and_add'>
-        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='1005' column='1'/>
-        <parameter type-id='86462700' name='uevent_ops' filepath='lib/kobject.c' line='1006' column='1'/>
-        <parameter type-id='d30bdc51' name='parent_kobj' filepath='lib/kobject.c' line='1007' column='1'/>
+      <function-decl name='kset_create_and_add' mangled-name='kset_create_and_add' filepath='lib/kobject.c' line='1018' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_create_and_add'>
+        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='1018' column='1'/>
+        <parameter type-id='86462700' name='uevent_ops' filepath='lib/kobject.c' line='1019' column='1'/>
+        <parameter type-id='d30bdc51' name='parent_kobj' filepath='lib/kobject.c' line='1020' column='1'/>
         <return type-id='89b70200'/>
       </function-decl>
-      <function-decl name='kset_find_obj' mangled-name='kset_find_obj' filepath='lib/kobject.c' line='908' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_find_obj'>
-        <parameter type-id='89b70200' name='kset' filepath='lib/kobject.c' line='908' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='908' column='1'/>
+      <function-decl name='kset_find_obj' mangled-name='kset_find_obj' filepath='lib/kobject.c' line='921' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_find_obj'>
+        <parameter type-id='89b70200' name='kset' filepath='lib/kobject.c' line='921' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='921' column='1'/>
         <return type-id='d30bdc51'/>
       </function-decl>
-      <function-decl name='kset_register' mangled-name='kset_register' filepath='lib/kobject.c' line='870' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_register'>
-        <parameter type-id='89b70200' name='k' filepath='lib/kobject.c' line='870' column='1'/>
+      <function-decl name='kset_register' mangled-name='kset_register' filepath='lib/kobject.c' line='878' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_register'>
+        <parameter type-id='89b70200' name='k' filepath='lib/kobject.c' line='878' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kset_unregister' mangled-name='kset_unregister' filepath='lib/kobject.c' line='890' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_unregister'>
-        <parameter type-id='89b70200' name='k' filepath='lib/kobject.c' line='890' column='1'/>
+      <function-decl name='kset_unregister' mangled-name='kset_unregister' filepath='lib/kobject.c' line='903' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_unregister'>
+        <parameter type-id='89b70200' name='k' filepath='lib/kobject.c' line='903' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ksize' mangled-name='ksize' filepath='mm/slab_common.c' line='1186' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ksize'>
@@ -136045,9 +136059,9 @@
       <function-decl name='load_nls_default' mangled-name='load_nls_default' filepath='fs/nls/nls_base.c' line='532' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='load_nls_default'>
         <return type-id='b084f8bb'/>
       </function-decl>
-      <function-decl name='lock_sock_nested' mangled-name='lock_sock_nested' filepath='net/core/sock.c' line='3081' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lock_sock_nested'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3081' column='1'/>
-        <parameter type-id='95e97e5e' name='subclass' filepath='net/core/sock.c' line='3081' column='1'/>
+      <function-decl name='lock_sock_nested' mangled-name='lock_sock_nested' filepath='net/core/sock.c' line='3096' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lock_sock_nested'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3096' column='1'/>
+        <parameter type-id='95e97e5e' name='subclass' filepath='net/core/sock.c' line='3096' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='lockref_get' mangled-name='lockref_get' filepath='lib/lockref.c' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lockref_get'>
@@ -136086,7 +136100,7 @@
         <parameter type-id='b72f2447' name='page' filepath='mm/page_ext.c' line='256' column='1'/>
         <return type-id='459ae684'/>
       </function-decl>
-      <var-decl name='loops_per_jiffy' type-id='7359adad' mangled-name='loops_per_jiffy' visibility='default' filepath='init/main.c' line='231' column='1' elf-symbol-id='loops_per_jiffy'/>
+      <var-decl name='loops_per_jiffy' type-id='7359adad' mangled-name='loops_per_jiffy' visibility='default' filepath='init/main.c' line='229' column='1' elf-symbol-id='loops_per_jiffy'/>
       <function-decl name='lru_cache_add' mangled-name='lru_cache_add' filepath='mm/swap.c' line='477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lru_cache_add'>
         <parameter type-id='02f11ed4' name='page' filepath='mm/swap.c' line='477' column='1'/>
         <return type-id='48b5725f'/>
@@ -136785,8 +136799,8 @@
         <parameter type-id='bd54fe1a' name='value' filepath='mm/memory.c' line='184' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_add_host' mangled-name='mmc_add_host' filepath='drivers/mmc/core/host.c' line='535' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_add_host'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/host.c' line='535' column='1'/>
+      <function-decl name='mmc_add_host' mangled-name='mmc_add_host' filepath='drivers/mmc/core/host.c' line='561' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_add_host'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/host.c' line='561' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_alloc_host' mangled-name='mmc_alloc_host' filepath='drivers/mmc/core/host.c' line='448' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_alloc_host'>
@@ -136881,8 +136895,8 @@
         <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='987' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_free_host' mangled-name='mmc_free_host' filepath='drivers/mmc/core/host.c' line='588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_free_host'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/host.c' line='588' column='1'/>
+      <function-decl name='mmc_free_host' mangled-name='mmc_free_host' filepath='drivers/mmc/core/host.c' line='614' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_free_host'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/host.c' line='614' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmc_get_card' mangled-name='mmc_get_card' filepath='drivers/mmc/core/core.c' line='857' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_get_card'>
@@ -136985,8 +136999,8 @@
         <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='828' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_remove_host' mangled-name='mmc_remove_host' filepath='drivers/mmc/core/host.c' line='567' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_remove_host'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/host.c' line='567' column='1'/>
+      <function-decl name='mmc_remove_host' mangled-name='mmc_remove_host' filepath='drivers/mmc/core/host.c' line='593' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_remove_host'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/host.c' line='593' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmc_request_done' mangled-name='mmc_request_done' filepath='drivers/mmc/core/core.c' line='139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_request_done'>
@@ -137105,8 +137119,8 @@
         <parameter type-id='47f117d4' name='mrq' filepath='drivers/mmc/core/core.c' line='603' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmput' mangled-name='mmput' filepath='kernel/fork.c' line='1153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmput'>
-        <parameter type-id='df4b7819' name='mm' filepath='kernel/fork.c' line='1153' column='1'/>
+      <function-decl name='mmput' mangled-name='mmput' filepath='kernel/fork.c' line='1161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmput'>
+        <parameter type-id='df4b7819' name='mm' filepath='kernel/fork.c' line='1161' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmu_interval_notifier_insert' mangled-name='mmu_interval_notifier_insert' filepath='mm/mmu_notifier.c' line='1040' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmu_interval_notifier_insert'>
@@ -137136,11 +137150,11 @@
         <parameter type-id='77e79a4b' name='file' filepath='fs/namespace.c' line='408' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mod_delayed_work_on' mangled-name='mod_delayed_work_on' filepath='kernel/workqueue.c' line='1731' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mod_delayed_work_on'>
-        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/workqueue.c' line='1731' column='1'/>
-        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='1731' column='1'/>
-        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='1732' column='1'/>
-        <parameter type-id='7359adad' name='delay' filepath='kernel/workqueue.c' line='1732' column='1'/>
+      <function-decl name='mod_delayed_work_on' mangled-name='mod_delayed_work_on' filepath='kernel/workqueue.c' line='1734' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mod_delayed_work_on'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/workqueue.c' line='1734' column='1'/>
+        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='1734' column='1'/>
+        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='1735' column='1'/>
+        <parameter type-id='7359adad' name='delay' filepath='kernel/workqueue.c' line='1735' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='mod_node_page_state' mangled-name='mod_node_page_state' filepath='mm/vmstat.c' line='589' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mod_node_page_state'>
@@ -137159,24 +137173,24 @@
         <parameter type-id='7359adad' name='expires' filepath='kernel/time/timer.c' line='1086' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='module_layout' mangled-name='module_layout' filepath='kernel/module.c' line='4820' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='module_layout'>
-        <parameter type-id='2730d015' name='mod' filepath='kernel/module.c' line='4820' column='1'/>
-        <parameter type-id='3a498c74' name='ver' filepath='kernel/module.c' line='4821' column='1'/>
-        <parameter type-id='a7c6e908' name='kp' filepath='kernel/module.c' line='4822' column='1'/>
-        <parameter type-id='eefd7061' name='ks' filepath='kernel/module.c' line='4823' column='1'/>
-        <parameter type-id='e525e121' name='tp' filepath='kernel/module.c' line='4824' column='1'/>
+      <function-decl name='module_layout' mangled-name='module_layout' filepath='kernel/module.c' line='4831' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='module_layout'>
+        <parameter type-id='2730d015' name='mod' filepath='kernel/module.c' line='4831' column='1'/>
+        <parameter type-id='3a498c74' name='ver' filepath='kernel/module.c' line='4832' column='1'/>
+        <parameter type-id='a7c6e908' name='kp' filepath='kernel/module.c' line='4833' column='1'/>
+        <parameter type-id='eefd7061' name='ks' filepath='kernel/module.c' line='4834' column='1'/>
+        <parameter type-id='e525e121' name='tp' filepath='kernel/module.c' line='4835' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='module_put' mangled-name='module_put' filepath='kernel/module.c' line='1158' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='module_put'>
         <parameter type-id='2730d015' name='module' filepath='kernel/module.c' line='1158' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mount_bdev' mangled-name='mount_bdev' filepath='fs/super.c' line='1366' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mount_bdev'>
-        <parameter type-id='21e53d44' name='fs_type' filepath='fs/super.c' line='1366' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='fs/super.c' line='1367' column='1'/>
-        <parameter type-id='80f4b756' name='dev_name' filepath='fs/super.c' line='1367' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='fs/super.c' line='1367' column='1'/>
-        <parameter type-id='e18b930d' name='fill_super' filepath='fs/super.c' line='1368' column='1'/>
+      <function-decl name='mount_bdev' mangled-name='mount_bdev' filepath='fs/super.c' line='1375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mount_bdev'>
+        <parameter type-id='21e53d44' name='fs_type' filepath='fs/super.c' line='1375' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='fs/super.c' line='1376' column='1'/>
+        <parameter type-id='80f4b756' name='dev_name' filepath='fs/super.c' line='1376' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='fs/super.c' line='1376' column='1'/>
+        <parameter type-id='e18b930d' name='fill_super' filepath='fs/super.c' line='1377' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
       <function-decl name='mpage_readahead' mangled-name='mpage_readahead' filepath='fs/mpage.c' line='415' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mpage_readahead'>
@@ -137266,26 +137280,26 @@
         <return type-id='b50a4934'/>
       </function-decl>
       <var-decl name='nd_tbl' type-id='aebe1cff' mangled-name='nd_tbl' visibility='default' filepath='net/ipv6/ndisc.c' line='109' column='1' elf-symbol-id='nd_tbl'/>
-      <function-decl name='neigh_destroy' mangled-name='neigh_destroy' filepath='net/core/neighbour.c' line='828' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_destroy'>
-        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='828' column='1'/>
+      <function-decl name='neigh_destroy' mangled-name='neigh_destroy' filepath='net/core/neighbour.c' line='829' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_destroy'>
+        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='829' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='neigh_lookup' mangled-name='neigh_lookup' filepath='net/core/neighbour.c' line='554' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_lookup'>
-        <parameter type-id='6bbe39a7' name='tbl' filepath='net/core/neighbour.c' line='554' column='1'/>
-        <parameter type-id='eaa32e2f' name='pkey' filepath='net/core/neighbour.c' line='554' column='1'/>
-        <parameter type-id='68a2d05b' name='dev' filepath='net/core/neighbour.c' line='555' column='1'/>
+      <function-decl name='neigh_lookup' mangled-name='neigh_lookup' filepath='net/core/neighbour.c' line='555' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_lookup'>
+        <parameter type-id='6bbe39a7' name='tbl' filepath='net/core/neighbour.c' line='555' column='1'/>
+        <parameter type-id='eaa32e2f' name='pkey' filepath='net/core/neighbour.c' line='555' column='1'/>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/neighbour.c' line='556' column='1'/>
         <return type-id='3c330066'/>
       </function-decl>
-      <function-decl name='neigh_resolve_output' mangled-name='neigh_resolve_output' filepath='net/core/neighbour.c' line='1478' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_resolve_output'>
-        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='1478' column='1'/>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='1478' column='1'/>
+      <function-decl name='neigh_resolve_output' mangled-name='neigh_resolve_output' filepath='net/core/neighbour.c' line='1482' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_resolve_output'>
+        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='1482' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='1482' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='neigh_xmit' mangled-name='neigh_xmit' filepath='net/core/neighbour.c' line='2992' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_xmit'>
-        <parameter type-id='95e97e5e' name='index' filepath='net/core/neighbour.c' line='2992' column='1'/>
-        <parameter type-id='68a2d05b' name='dev' filepath='net/core/neighbour.c' line='2992' column='1'/>
-        <parameter type-id='eaa32e2f' name='addr' filepath='net/core/neighbour.c' line='2993' column='1'/>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='2993' column='1'/>
+      <function-decl name='neigh_xmit' mangled-name='neigh_xmit' filepath='net/core/neighbour.c' line='2997' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_xmit'>
+        <parameter type-id='95e97e5e' name='index' filepath='net/core/neighbour.c' line='2997' column='1'/>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/neighbour.c' line='2997' column='1'/>
+        <parameter type-id='eaa32e2f' name='addr' filepath='net/core/neighbour.c' line='2998' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='2998' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='net_namespace_list' type-id='72f469ec' mangled-name='net_namespace_list' visibility='default' filepath='net/core/net_namespace.c' line='36' column='1' elf-symbol-id='net_namespace_list'/>
@@ -137475,11 +137489,11 @@
         <parameter type-id='35b28c4f' name='dev_queue' filepath='net/core/dev.c' line='3090' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netlink_ack' mangled-name='netlink_ack' filepath='net/netlink/af_netlink.c' line='2398' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_ack'>
-        <parameter type-id='0fbf3cfd' name='in_skb' filepath='net/netlink/af_netlink.c' line='2398' column='1'/>
-        <parameter type-id='c2074578' name='nlh' filepath='net/netlink/af_netlink.c' line='2398' column='1'/>
-        <parameter type-id='95e97e5e' name='err' filepath='net/netlink/af_netlink.c' line='2398' column='1'/>
-        <parameter type-id='f1dc7839' name='extack' filepath='net/netlink/af_netlink.c' line='2399' column='1'/>
+      <function-decl name='netlink_ack' mangled-name='netlink_ack' filepath='net/netlink/af_netlink.c' line='2399' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_ack'>
+        <parameter type-id='0fbf3cfd' name='in_skb' filepath='net/netlink/af_netlink.c' line='2399' column='1'/>
+        <parameter type-id='c2074578' name='nlh' filepath='net/netlink/af_netlink.c' line='2399' column='1'/>
+        <parameter type-id='95e97e5e' name='err' filepath='net/netlink/af_netlink.c' line='2399' column='1'/>
+        <parameter type-id='f1dc7839' name='extack' filepath='net/netlink/af_netlink.c' line='2400' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='netlink_broadcast' mangled-name='netlink_broadcast' filepath='net/netlink/af_netlink.c' line='1551' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_broadcast'>
@@ -137500,12 +137514,12 @@
         <parameter type-id='f0981eeb' name='group' filepath='net/netlink/af_netlink.c' line='1367' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='netlink_kernel_release' mangled-name='netlink_kernel_release' filepath='net/netlink/af_netlink.c' line='2097' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_kernel_release'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/netlink/af_netlink.c' line='2097' column='1'/>
+      <function-decl name='netlink_kernel_release' mangled-name='netlink_kernel_release' filepath='net/netlink/af_netlink.c' line='2098' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_kernel_release'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/netlink/af_netlink.c' line='2098' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netlink_register_notifier' mangled-name='netlink_register_notifier' filepath='net/netlink/af_netlink.c' line='2736' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_register_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='net/netlink/af_netlink.c' line='2736' column='1'/>
+      <function-decl name='netlink_register_notifier' mangled-name='netlink_register_notifier' filepath='net/netlink/af_netlink.c' line='2737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_register_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='net/netlink/af_netlink.c' line='2737' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='netlink_unicast' mangled-name='netlink_unicast' filepath='net/netlink/af_netlink.c' line='1331' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_unicast'>
@@ -137515,8 +137529,8 @@
         <parameter type-id='95e97e5e' name='nonblock' filepath='net/netlink/af_netlink.c' line='1332' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='netlink_unregister_notifier' mangled-name='netlink_unregister_notifier' filepath='net/netlink/af_netlink.c' line='2742' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_unregister_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='net/netlink/af_netlink.c' line='2742' column='1'/>
+      <function-decl name='netlink_unregister_notifier' mangled-name='netlink_unregister_notifier' filepath='net/netlink/af_netlink.c' line='2743' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_unregister_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='net/netlink/af_netlink.c' line='2743' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='new_inode' mangled-name='new_inode' filepath='fs/inode.c' line='952' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='new_inode'>
@@ -137763,59 +137777,59 @@
         <parameter type-id='80f4b756' name='stem' filepath='drivers/of/base.c' line='2059' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_clk_add_hw_provider' mangled-name='of_clk_add_hw_provider' filepath='drivers/clk/clk.c' line='4713' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_add_hw_provider'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4713' column='1'/>
-        <parameter type-id='a5186342' name='get' filepath='drivers/clk/clk.c' line='4714' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4716' column='1'/>
+      <function-decl name='of_clk_add_hw_provider' mangled-name='of_clk_add_hw_provider' filepath='drivers/clk/clk.c' line='4716' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_add_hw_provider'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4716' column='1'/>
+        <parameter type-id='a5186342' name='get' filepath='drivers/clk/clk.c' line='4717' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4719' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_clk_add_provider' mangled-name='of_clk_add_provider' filepath='drivers/clk/clk.c' line='4671' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_add_provider'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4671' column='1'/>
-        <parameter type-id='f1c652ac' name='clk_src_get' filepath='drivers/clk/clk.c' line='4672' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4674' column='1'/>
+      <function-decl name='of_clk_add_provider' mangled-name='of_clk_add_provider' filepath='drivers/clk/clk.c' line='4674' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_add_provider'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4674' column='1'/>
+        <parameter type-id='f1c652ac' name='clk_src_get' filepath='drivers/clk/clk.c' line='4675' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4677' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_clk_del_provider' mangled-name='of_clk_del_provider' filepath='drivers/clk/clk.c' line='4815' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_del_provider'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4815' column='1'/>
+      <function-decl name='of_clk_del_provider' mangled-name='of_clk_del_provider' filepath='drivers/clk/clk.c' line='4818' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_del_provider'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4818' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='of_clk_get' mangled-name='of_clk_get' filepath='drivers/clk/clk.c' line='5015' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5015' column='1'/>
-        <parameter type-id='95e97e5e' name='index' filepath='drivers/clk/clk.c' line='5015' column='1'/>
+      <function-decl name='of_clk_get' mangled-name='of_clk_get' filepath='drivers/clk/clk.c' line='5018' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5018' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/clk/clk.c' line='5018' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='of_clk_get_by_name' mangled-name='of_clk_get_by_name' filepath='drivers/clk/clk.c' line='5030' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_by_name'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5030' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='drivers/clk/clk.c' line='5030' column='1'/>
+      <function-decl name='of_clk_get_by_name' mangled-name='of_clk_get_by_name' filepath='drivers/clk/clk.c' line='5033' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_by_name'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5033' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/clk/clk.c' line='5033' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='of_clk_get_from_provider' mangled-name='of_clk_get_from_provider' filepath='drivers/clk/clk.c' line='4981' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_from_provider'>
-        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4981' column='1'/>
+      <function-decl name='of_clk_get_from_provider' mangled-name='of_clk_get_from_provider' filepath='drivers/clk/clk.c' line='4984' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_from_provider'>
+        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4984' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='of_clk_get_parent_count' mangled-name='of_clk_get_parent_count' filepath='drivers/clk/clk.c' line='5045' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_parent_count'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/clk/clk.c' line='5045' column='1'/>
+      <function-decl name='of_clk_get_parent_count' mangled-name='of_clk_get_parent_count' filepath='drivers/clk/clk.c' line='5048' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_parent_count'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/clk/clk.c' line='5048' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='of_clk_get_parent_name' mangled-name='of_clk_get_parent_name' filepath='drivers/clk/clk.c' line='5057' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_parent_name'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/clk/clk.c' line='5057' column='1'/>
-        <parameter type-id='95e97e5e' name='index' filepath='drivers/clk/clk.c' line='5057' column='1'/>
+      <function-decl name='of_clk_get_parent_name' mangled-name='of_clk_get_parent_name' filepath='drivers/clk/clk.c' line='5060' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_parent_name'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/clk/clk.c' line='5060' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/clk/clk.c' line='5060' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='of_clk_hw_onecell_get' mangled-name='of_clk_hw_onecell_get' filepath='drivers/clk/clk.c' line='4649' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_hw_onecell_get'>
-        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4649' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4649' column='1'/>
+      <function-decl name='of_clk_hw_onecell_get' mangled-name='of_clk_hw_onecell_get' filepath='drivers/clk/clk.c' line='4652' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_hw_onecell_get'>
+        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4652' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4652' column='1'/>
         <return type-id='3aaeef89'/>
       </function-decl>
-      <function-decl name='of_clk_hw_simple_get' mangled-name='of_clk_hw_simple_get' filepath='drivers/clk/clk.c' line='4628' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_hw_simple_get'>
-        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4628' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4628' column='1'/>
+      <function-decl name='of_clk_hw_simple_get' mangled-name='of_clk_hw_simple_get' filepath='drivers/clk/clk.c' line='4631' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_hw_simple_get'>
+        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4631' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4631' column='1'/>
         <return type-id='3aaeef89'/>
       </function-decl>
-      <function-decl name='of_clk_parent_fill' mangled-name='of_clk_parent_fill' filepath='drivers/clk/clk.c' line='5126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_parent_fill'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5126' column='1'/>
-        <parameter type-id='7d3cd834' name='parents' filepath='drivers/clk/clk.c' line='5126' column='1'/>
-        <parameter type-id='f0981eeb' name='size' filepath='drivers/clk/clk.c' line='5127' column='1'/>
+      <function-decl name='of_clk_parent_fill' mangled-name='of_clk_parent_fill' filepath='drivers/clk/clk.c' line='5129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_parent_fill'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5129' column='1'/>
+        <parameter type-id='7d3cd834' name='parents' filepath='drivers/clk/clk.c' line='5129' column='1'/>
+        <parameter type-id='f0981eeb' name='size' filepath='drivers/clk/clk.c' line='5130' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_clk_set_defaults' mangled-name='of_clk_set_defaults' filepath='drivers/clk/clk-conf.c' line='139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_set_defaults'>
@@ -137823,14 +137837,14 @@
         <parameter type-id='b50a4934' name='clk_supplier' filepath='drivers/clk/clk-conf.c' line='139' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_clk_src_onecell_get' mangled-name='of_clk_src_onecell_get' filepath='drivers/clk/clk.c' line='4634' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_src_onecell_get'>
-        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4634' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4634' column='1'/>
+      <function-decl name='of_clk_src_onecell_get' mangled-name='of_clk_src_onecell_get' filepath='drivers/clk/clk.c' line='4637' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_src_onecell_get'>
+        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4637' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4637' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='of_clk_src_simple_get' mangled-name='of_clk_src_simple_get' filepath='drivers/clk/clk.c' line='4621' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_src_simple_get'>
-        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4621' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4622' column='1'/>
+      <function-decl name='of_clk_src_simple_get' mangled-name='of_clk_src_simple_get' filepath='drivers/clk/clk.c' line='4624' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_src_simple_get'>
+        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4624' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4625' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
       <function-decl name='of_count_phandle_with_args' mangled-name='of_count_phandle_with_args' filepath='drivers/of/base.c' line='1770' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_count_phandle_with_args'>
@@ -137847,8 +137861,8 @@
         <parameter type-id='343c3ae4' name='policy' filepath='drivers/thermal/cpufreq_cooling.c' line='626' column='1'/>
         <return type-id='2feec21f'/>
       </function-decl>
-      <function-decl name='of_css' mangled-name='of_css' filepath='kernel/cgroup/cgroup.c' line='642' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_css'>
-        <parameter type-id='8212a608' name='of' filepath='kernel/cgroup/cgroup.c' line='642' column='1'/>
+      <function-decl name='of_css' mangled-name='of_css' filepath='kernel/cgroup/cgroup.c' line='643' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_css'>
+        <parameter type-id='8212a608' name='of' filepath='kernel/cgroup/cgroup.c' line='643' column='1'/>
         <return type-id='cfff5953'/>
       </function-decl>
       <function-decl name='of_devfreq_cooling_register' mangled-name='of_devfreq_cooling_register' filepath='drivers/thermal/devfreq_cooling.c' line='537' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_devfreq_cooling_register'>
@@ -138628,10 +138642,10 @@
         <parameter type-id='eaa32e2f' name='addr' filepath='mm/page_alloc.c' line='5403' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='page_get_link' mangled-name='page_get_link' filepath='fs/namei.c' line='4737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_get_link'>
-        <parameter type-id='27675065' name='dentry' filepath='fs/namei.c' line='4737' column='1'/>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/namei.c' line='4737' column='1'/>
-        <parameter type-id='26cad514' name='callback' filepath='fs/namei.c' line='4738' column='1'/>
+      <function-decl name='page_get_link' mangled-name='page_get_link' filepath='fs/namei.c' line='4742' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_get_link'>
+        <parameter type-id='27675065' name='dentry' filepath='fs/namei.c' line='4742' column='1'/>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/namei.c' line='4742' column='1'/>
+        <parameter type-id='26cad514' name='callback' filepath='fs/namei.c' line='4743' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
       <function-decl name='page_mapped' mangled-name='page_mapped' filepath='mm/util.c' line='712' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_mapped'>
@@ -138688,10 +138702,10 @@
         <parameter type-id='b99d5f36' name='prdev' filepath='mm/page_reporting.c' line='349' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='page_symlink' mangled-name='page_symlink' filepath='fs/namei.c' line='4818' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_symlink'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/namei.c' line='4818' column='1'/>
-        <parameter type-id='80f4b756' name='symname' filepath='fs/namei.c' line='4818' column='1'/>
-        <parameter type-id='95e97e5e' name='len' filepath='fs/namei.c' line='4818' column='1'/>
+      <function-decl name='page_symlink' mangled-name='page_symlink' filepath='fs/namei.c' line='4823' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_symlink'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/namei.c' line='4823' column='1'/>
+        <parameter type-id='80f4b756' name='symname' filepath='fs/namei.c' line='4823' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='fs/namei.c' line='4823' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='page_to_lruvec' mangled-name='page_to_lruvec' filepath='mm/memcontrol.c' line='1377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_to_lruvec'>
@@ -138712,24 +138726,24 @@
         <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/filemap.c' line='1797' column='1'/>
         <return type-id='02f11ed4'/>
       </function-decl>
-      <function-decl name='pagecache_write_begin' mangled-name='pagecache_write_begin' filepath='mm/filemap.c' line='3321' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pagecache_write_begin'>
-        <parameter type-id='77e79a4b' name='file' filepath='mm/filemap.c' line='3321' column='1'/>
-        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3321' column='1'/>
-        <parameter type-id='69bf7bee' name='pos' filepath='mm/filemap.c' line='3322' column='1'/>
-        <parameter type-id='f0981eeb' name='len' filepath='mm/filemap.c' line='3322' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='mm/filemap.c' line='3322' column='1'/>
-        <parameter type-id='9f93c9da' name='pagep' filepath='mm/filemap.c' line='3323' column='1'/>
-        <parameter type-id='63e171df' name='fsdata' filepath='mm/filemap.c' line='3323' column='1'/>
+      <function-decl name='pagecache_write_begin' mangled-name='pagecache_write_begin' filepath='mm/filemap.c' line='3324' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pagecache_write_begin'>
+        <parameter type-id='77e79a4b' name='file' filepath='mm/filemap.c' line='3324' column='1'/>
+        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3324' column='1'/>
+        <parameter type-id='69bf7bee' name='pos' filepath='mm/filemap.c' line='3325' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='mm/filemap.c' line='3325' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='mm/filemap.c' line='3325' column='1'/>
+        <parameter type-id='9f93c9da' name='pagep' filepath='mm/filemap.c' line='3326' column='1'/>
+        <parameter type-id='63e171df' name='fsdata' filepath='mm/filemap.c' line='3326' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pagecache_write_end' mangled-name='pagecache_write_end' filepath='mm/filemap.c' line='3332' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pagecache_write_end'>
-        <parameter type-id='77e79a4b' name='file' filepath='mm/filemap.c' line='3332' column='1'/>
-        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3332' column='1'/>
-        <parameter type-id='69bf7bee' name='pos' filepath='mm/filemap.c' line='3333' column='1'/>
-        <parameter type-id='f0981eeb' name='len' filepath='mm/filemap.c' line='3333' column='1'/>
-        <parameter type-id='f0981eeb' name='copied' filepath='mm/filemap.c' line='3333' column='1'/>
-        <parameter type-id='02f11ed4' name='page' filepath='mm/filemap.c' line='3334' column='1'/>
-        <parameter type-id='eaa32e2f' name='fsdata' filepath='mm/filemap.c' line='3334' column='1'/>
+      <function-decl name='pagecache_write_end' mangled-name='pagecache_write_end' filepath='mm/filemap.c' line='3335' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pagecache_write_end'>
+        <parameter type-id='77e79a4b' name='file' filepath='mm/filemap.c' line='3335' column='1'/>
+        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3335' column='1'/>
+        <parameter type-id='69bf7bee' name='pos' filepath='mm/filemap.c' line='3336' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='mm/filemap.c' line='3336' column='1'/>
+        <parameter type-id='f0981eeb' name='copied' filepath='mm/filemap.c' line='3336' column='1'/>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/filemap.c' line='3337' column='1'/>
+        <parameter type-id='eaa32e2f' name='fsdata' filepath='mm/filemap.c' line='3337' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pagevec_lookup_range' mangled-name='pagevec_lookup_range' filepath='mm/swap.c' line='1278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pagevec_lookup_range'>
@@ -138833,16 +138847,16 @@
         <parameter type-id='edcbd723' name='kp' filepath='kernel/params.c' line='242' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='part_end_io_acct' mangled-name='part_end_io_acct' filepath='block/blk-core.c' line='1375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_end_io_acct'>
-        <parameter type-id='84dc82b7' name='part' filepath='block/blk-core.c' line='1375' column='1'/>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1375' column='1'/>
-        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1376' column='1'/>
+      <function-decl name='part_end_io_acct' mangled-name='part_end_io_acct' filepath='block/blk-core.c' line='1373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_end_io_acct'>
+        <parameter type-id='84dc82b7' name='part' filepath='block/blk-core.c' line='1373' column='1'/>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1373' column='1'/>
+        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1374' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='part_start_io_acct' mangled-name='part_start_io_acct' filepath='block/blk-core.c' line='1345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_start_io_acct'>
-        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1345' column='1'/>
-        <parameter type-id='c4219d27' name='part' filepath='block/blk-core.c' line='1345' column='1'/>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1346' column='1'/>
+      <function-decl name='part_start_io_acct' mangled-name='part_start_io_acct' filepath='block/blk-core.c' line='1343' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_start_io_acct'>
+        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1343' column='1'/>
+        <parameter type-id='c4219d27' name='part' filepath='block/blk-core.c' line='1343' column='1'/>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1344' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='passthru_features_check' mangled-name='passthru_features_check' filepath='net/core/dev.c' line='3507' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='passthru_features_check'>
@@ -138855,8 +138869,8 @@
         <parameter type-id='a77efac3' name='path' filepath='fs/namei.c' line='497' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pause_cpus' mangled-name='pause_cpus' filepath='kernel/cpu.c' line='1217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pause_cpus'>
-        <parameter type-id='74bccedd' name='cpus' filepath='kernel/cpu.c' line='1217' column='1'/>
+      <function-decl name='pause_cpus' mangled-name='pause_cpus' filepath='kernel/cpu.c' line='1216' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pause_cpus'>
+        <parameter type-id='74bccedd' name='cpus' filepath='kernel/cpu.c' line='1216' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_aer_clear_nonfatal_status' mangled-name='pci_aer_clear_nonfatal_status' filepath='drivers/pci/pcie/aer.c' line='254' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_aer_clear_nonfatal_status'>
@@ -138919,9 +138933,9 @@
         <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='2142' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_disable_link_state' mangled-name='pci_disable_link_state' filepath='drivers/pci/pcie/aspm.c' line='1137' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_link_state'>
-        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pcie/aspm.c' line='1137' column='1'/>
-        <parameter type-id='95e97e5e' name='state' filepath='drivers/pci/pcie/aspm.c' line='1137' column='1'/>
+      <function-decl name='pci_disable_link_state' mangled-name='pci_disable_link_state' filepath='drivers/pci/pcie/aspm.c' line='1155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_link_state'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pcie/aspm.c' line='1155' column='1'/>
+        <parameter type-id='95e97e5e' name='state' filepath='drivers/pci/pcie/aspm.c' line='1155' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_disable_msi' mangled-name='pci_disable_msi' filepath='drivers/pci/msi.c' line='984' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_msi'>
@@ -139371,8 +139385,8 @@
         <parameter type-id='c9d64c0d' name='res' filepath='drivers/pci/host-bridge.c' line='51' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pcie_aspm_enabled' mangled-name='pcie_aspm_enabled' filepath='drivers/pci/pcie/aspm.c' line='1193' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_aspm_enabled'>
-        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pcie/aspm.c' line='1193' column='1'/>
+      <function-decl name='pcie_aspm_enabled' mangled-name='pcie_aspm_enabled' filepath='drivers/pci/pcie/aspm.c' line='1211' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_aspm_enabled'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pcie/aspm.c' line='1211' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='pcie_bandwidth_available' mangled-name='pcie_bandwidth_available' filepath='drivers/pci/pci.c' line='5823' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_bandwidth_available'>
@@ -139491,50 +139505,50 @@
         <parameter type-id='91ce1af9' name='flags' filepath='kernel/events/ring_buffer.c' line='334' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_addr_filters_sync' mangled-name='perf_event_addr_filters_sync' filepath='kernel/events/core.c' line='3124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_addr_filters_sync'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3124' column='1'/>
+      <function-decl name='perf_event_addr_filters_sync' mangled-name='perf_event_addr_filters_sync' filepath='kernel/events/core.c' line='3129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_addr_filters_sync'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3129' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_create_kernel_counter' mangled-name='perf_event_create_kernel_counter' filepath='kernel/events/core.c' line='12188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_create_kernel_counter'>
-        <parameter type-id='20862e61' name='attr' filepath='kernel/events/core.c' line='12188' column='1'/>
-        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/events/core.c' line='12188' column='1'/>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='12189' column='1'/>
-        <parameter type-id='20a2e4e6' name='overflow_handler' filepath='kernel/events/core.c' line='12190' column='1'/>
-        <parameter type-id='eaa32e2f' name='context' filepath='kernel/events/core.c' line='12191' column='1'/>
+      <function-decl name='perf_event_create_kernel_counter' mangled-name='perf_event_create_kernel_counter' filepath='kernel/events/core.c' line='12192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_create_kernel_counter'>
+        <parameter type-id='20862e61' name='attr' filepath='kernel/events/core.c' line='12192' column='1'/>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/events/core.c' line='12192' column='1'/>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='12193' column='1'/>
+        <parameter type-id='20a2e4e6' name='overflow_handler' filepath='kernel/events/core.c' line='12194' column='1'/>
+        <parameter type-id='eaa32e2f' name='context' filepath='kernel/events/core.c' line='12195' column='1'/>
         <return type-id='2bf16f59'/>
       </function-decl>
-      <function-decl name='perf_event_disable' mangled-name='perf_event_disable' filepath='kernel/events/core.c' line='2453' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_disable'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='2453' column='1'/>
+      <function-decl name='perf_event_disable' mangled-name='perf_event_disable' filepath='kernel/events/core.c' line='2458' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_disable'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='2458' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_enable' mangled-name='perf_event_enable' filepath='kernel/events/core.c' line='3024' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_enable'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3024' column='1'/>
+      <function-decl name='perf_event_enable' mangled-name='perf_event_enable' filepath='kernel/events/core.c' line='3029' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_enable'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3029' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_pause' mangled-name='perf_event_pause' filepath='kernel/events/core.c' line='5363' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_pause'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5363' column='1'/>
-        <parameter type-id='b50a4934' name='reset' filepath='kernel/events/core.c' line='5363' column='1'/>
+      <function-decl name='perf_event_pause' mangled-name='perf_event_pause' filepath='kernel/events/core.c' line='5368' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_pause'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5368' column='1'/>
+        <parameter type-id='b50a4934' name='reset' filepath='kernel/events/core.c' line='5368' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='perf_event_read_local' mangled-name='perf_event_read_local' filepath='kernel/events/core.c' line='4336' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_local'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='4336' column='1'/>
-        <parameter type-id='3df9fd28' name='value' filepath='kernel/events/core.c' line='4336' column='1'/>
-        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='4337' column='1'/>
-        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='4337' column='1'/>
+      <function-decl name='perf_event_read_local' mangled-name='perf_event_read_local' filepath='kernel/events/core.c' line='4341' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_local'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='4341' column='1'/>
+        <parameter type-id='3df9fd28' name='value' filepath='kernel/events/core.c' line='4341' column='1'/>
+        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='4342' column='1'/>
+        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='4342' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_event_read_value' mangled-name='perf_event_read_value' filepath='kernel/events/core.c' line='5145' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_value'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5145' column='1'/>
-        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='5145' column='1'/>
-        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='5145' column='1'/>
+      <function-decl name='perf_event_read_value' mangled-name='perf_event_read_value' filepath='kernel/events/core.c' line='5150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_value'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5150' column='1'/>
+        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='5150' column='1'/>
+        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='5150' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='perf_event_release_kernel' mangled-name='perf_event_release_kernel' filepath='kernel/events/core.c' line='4995' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_release_kernel'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='4995' column='1'/>
+      <function-decl name='perf_event_release_kernel' mangled-name='perf_event_release_kernel' filepath='kernel/events/core.c' line='5000' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_release_kernel'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5000' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_event_update_userpage' mangled-name='perf_event_update_userpage' filepath='kernel/events/core.c' line='5742' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_update_userpage'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5742' column='1'/>
+      <function-decl name='perf_event_update_userpage' mangled-name='perf_event_update_userpage' filepath='kernel/events/core.c' line='5747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_update_userpage'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5747' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='perf_get_aux' mangled-name='perf_get_aux' filepath='kernel/events/ring_buffer.c' line='557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_get_aux'>
@@ -139544,20 +139558,20 @@
       <function-decl name='perf_num_counters' mangled-name='perf_num_counters' filepath='drivers/perf/arm_pmu.c' line='598' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_num_counters'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_pmu_migrate_context' mangled-name='perf_pmu_migrate_context' filepath='kernel/events/core.c' line='12267' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_migrate_context'>
-        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='12267' column='1'/>
-        <parameter type-id='95e97e5e' name='src_cpu' filepath='kernel/events/core.c' line='12267' column='1'/>
-        <parameter type-id='95e97e5e' name='dst_cpu' filepath='kernel/events/core.c' line='12267' column='1'/>
+      <function-decl name='perf_pmu_migrate_context' mangled-name='perf_pmu_migrate_context' filepath='kernel/events/core.c' line='12271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_migrate_context'>
+        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='12271' column='1'/>
+        <parameter type-id='95e97e5e' name='src_cpu' filepath='kernel/events/core.c' line='12271' column='1'/>
+        <parameter type-id='95e97e5e' name='dst_cpu' filepath='kernel/events/core.c' line='12271' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_pmu_register' mangled-name='perf_pmu_register' filepath='kernel/events/core.c' line='10808' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_register'>
-        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10808' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='kernel/events/core.c' line='10808' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='kernel/events/core.c' line='10808' column='1'/>
+      <function-decl name='perf_pmu_register' mangled-name='perf_pmu_register' filepath='kernel/events/core.c' line='10812' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_register'>
+        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10812' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='kernel/events/core.c' line='10812' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='kernel/events/core.c' line='10812' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_pmu_unregister' mangled-name='perf_pmu_unregister' filepath='kernel/events/core.c' line='10944' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_unregister'>
-        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10944' column='1'/>
+      <function-decl name='perf_pmu_unregister' mangled-name='perf_pmu_unregister' filepath='kernel/events/core.c' line='10948' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_unregister'>
+        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10948' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='perf_trace_buf_alloc' mangled-name='perf_trace_buf_alloc' filepath='kernel/trace/trace_event_perf.c' line='395' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_buf_alloc'>
@@ -139566,15 +139580,15 @@
         <parameter type-id='7292109c' name='rctxp' filepath='kernel/trace/trace_event_perf.c' line='395' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='perf_trace_run_bpf_submit' mangled-name='perf_trace_run_bpf_submit' filepath='kernel/events/core.c' line='9438' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_run_bpf_submit'>
-        <parameter type-id='eaa32e2f' name='raw_data' filepath='kernel/events/core.c' line='9438' column='1'/>
-        <parameter type-id='95e97e5e' name='size' filepath='kernel/events/core.c' line='9438' column='1'/>
-        <parameter type-id='95e97e5e' name='rctx' filepath='kernel/events/core.c' line='9438' column='1'/>
-        <parameter type-id='23d6768c' name='call' filepath='kernel/events/core.c' line='9439' column='1'/>
-        <parameter type-id='91ce1af9' name='count' filepath='kernel/events/core.c' line='9439' column='1'/>
-        <parameter type-id='4616a179' name='regs' filepath='kernel/events/core.c' line='9440' column='1'/>
-        <parameter type-id='030d0b18' name='head' filepath='kernel/events/core.c' line='9440' column='1'/>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='9441' column='1'/>
+      <function-decl name='perf_trace_run_bpf_submit' mangled-name='perf_trace_run_bpf_submit' filepath='kernel/events/core.c' line='9443' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_run_bpf_submit'>
+        <parameter type-id='eaa32e2f' name='raw_data' filepath='kernel/events/core.c' line='9443' column='1'/>
+        <parameter type-id='95e97e5e' name='size' filepath='kernel/events/core.c' line='9443' column='1'/>
+        <parameter type-id='95e97e5e' name='rctx' filepath='kernel/events/core.c' line='9443' column='1'/>
+        <parameter type-id='23d6768c' name='call' filepath='kernel/events/core.c' line='9444' column='1'/>
+        <parameter type-id='91ce1af9' name='count' filepath='kernel/events/core.c' line='9444' column='1'/>
+        <parameter type-id='4616a179' name='regs' filepath='kernel/events/core.c' line='9445' column='1'/>
+        <parameter type-id='030d0b18' name='head' filepath='kernel/events/core.c' line='9445' column='1'/>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='9446' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pfn_valid' mangled-name='pfn_valid' filepath='arch/arm64/mm/init.c' line='263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pfn_valid'>
@@ -140281,7 +140295,7 @@
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='platform_bus' type-id='66e487eb' mangled-name='platform_bus' visibility='default' filepath='drivers/base/platform.c' line='38' column='1' elf-symbol-id='platform_bus'/>
-      <var-decl name='platform_bus_type' type-id='b31bfc8a' mangled-name='platform_bus_type' visibility='default' filepath='drivers/base/platform.c' line='1360' column='1' elf-symbol-id='platform_bus_type'/>
+      <var-decl name='platform_bus_type' type-id='b31bfc8a' mangled-name='platform_bus_type' visibility='default' filepath='drivers/base/platform.c' line='1340' column='1' elf-symbol-id='platform_bus_type'/>
       <function-decl name='platform_device_add' mangled-name='platform_device_add' filepath='drivers/base/platform.c' line='550' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_add'>
         <parameter type-id='db362995' name='pdev' filepath='drivers/base/platform.c' line='550' column='1'/>
         <return type-id='95e97e5e'/>
@@ -140332,9 +140346,9 @@
         <parameter type-id='d53c2eb5' name='drv' filepath='drivers/base/platform.c' line='824' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='platform_find_device_by_driver' mangled-name='platform_find_device_by_driver' filepath='drivers/base/platform.c' line='1381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_find_device_by_driver'>
-        <parameter type-id='fa0b179b' name='start' filepath='drivers/base/platform.c' line='1381' column='1'/>
-        <parameter type-id='d5ddffb9' name='drv' filepath='drivers/base/platform.c' line='1382' column='1'/>
+      <function-decl name='platform_find_device_by_driver' mangled-name='platform_find_device_by_driver' filepath='drivers/base/platform.c' line='1361' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_find_device_by_driver'>
+        <parameter type-id='fa0b179b' name='start' filepath='drivers/base/platform.c' line='1361' column='1'/>
+        <parameter type-id='d5ddffb9' name='drv' filepath='drivers/base/platform.c' line='1362' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
       <function-decl name='platform_get_irq' mangled-name='platform_get_irq' filepath='drivers/base/platform.c' line='260' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_get_irq'>
@@ -140484,50 +140498,50 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeup.c' line='777' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pm_runtime_allow' mangled-name='pm_runtime_allow' filepath='drivers/base/power/runtime.c' line='1509' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_allow'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1509' column='1'/>
+      <function-decl name='pm_runtime_allow' mangled-name='pm_runtime_allow' filepath='drivers/base/power/runtime.c' line='1511' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_allow'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1511' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pm_runtime_autosuspend_expiration' mangled-name='pm_runtime_autosuspend_expiration' filepath='drivers/base/power/runtime.c' line='163' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_autosuspend_expiration'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='163' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='pm_runtime_barrier' mangled-name='pm_runtime_barrier' filepath='drivers/base/power/runtime.c' line='1375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_barrier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1375' column='1'/>
+      <function-decl name='pm_runtime_barrier' mangled-name='pm_runtime_barrier' filepath='drivers/base/power/runtime.c' line='1377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_barrier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1377' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pm_runtime_enable' mangled-name='pm_runtime_enable' filepath='drivers/base/power/runtime.c' line='1453' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_enable'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1453' column='1'/>
+      <function-decl name='pm_runtime_enable' mangled-name='pm_runtime_enable' filepath='drivers/base/power/runtime.c' line='1455' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_enable'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1455' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pm_runtime_forbid' mangled-name='pm_runtime_forbid' filepath='drivers/base/power/runtime.c' line='1488' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_forbid'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1488' column='1'/>
+      <function-decl name='pm_runtime_forbid' mangled-name='pm_runtime_forbid' filepath='drivers/base/power/runtime.c' line='1490' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_forbid'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1490' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pm_runtime_force_resume' mangled-name='pm_runtime_force_resume' filepath='drivers/base/power/runtime.c' line='1862' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_force_resume'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1862' column='1'/>
+      <function-decl name='pm_runtime_force_resume' mangled-name='pm_runtime_force_resume' filepath='drivers/base/power/runtime.c' line='1864' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_force_resume'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1864' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pm_runtime_force_suspend' mangled-name='pm_runtime_force_suspend' filepath='drivers/base/power/runtime.c' line='1814' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_force_suspend'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1814' column='1'/>
+      <function-decl name='pm_runtime_force_suspend' mangled-name='pm_runtime_force_suspend' filepath='drivers/base/power/runtime.c' line='1816' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_force_suspend'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1816' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pm_runtime_get_if_active' mangled-name='pm_runtime_get_if_active' filepath='drivers/base/power/runtime.c' line='1167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_get_if_active'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1167' column='1'/>
-        <parameter type-id='b50a4934' name='ign_usage_count' filepath='drivers/base/power/runtime.c' line='1167' column='1'/>
+      <function-decl name='pm_runtime_get_if_active' mangled-name='pm_runtime_get_if_active' filepath='drivers/base/power/runtime.c' line='1169' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_get_if_active'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1169' column='1'/>
+        <parameter type-id='b50a4934' name='ign_usage_count' filepath='drivers/base/power/runtime.c' line='1169' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pm_runtime_irq_safe' mangled-name='pm_runtime_irq_safe' filepath='drivers/base/power/runtime.c' line='1555' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_irq_safe'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1555' column='1'/>
+      <function-decl name='pm_runtime_irq_safe' mangled-name='pm_runtime_irq_safe' filepath='drivers/base/power/runtime.c' line='1557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_irq_safe'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1557' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pm_runtime_no_callbacks' mangled-name='pm_runtime_no_callbacks' filepath='drivers/base/power/runtime.c' line='1534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_no_callbacks'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1534' column='1'/>
+      <function-decl name='pm_runtime_no_callbacks' mangled-name='pm_runtime_no_callbacks' filepath='drivers/base/power/runtime.c' line='1536' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_no_callbacks'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1536' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pm_runtime_set_autosuspend_delay' mangled-name='pm_runtime_set_autosuspend_delay' filepath='drivers/base/power/runtime.c' line='1613' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_set_autosuspend_delay'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1613' column='1'/>
-        <parameter type-id='95e97e5e' name='delay' filepath='drivers/base/power/runtime.c' line='1613' column='1'/>
+      <function-decl name='pm_runtime_set_autosuspend_delay' mangled-name='pm_runtime_set_autosuspend_delay' filepath='drivers/base/power/runtime.c' line='1615' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_set_autosuspend_delay'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1615' column='1'/>
+        <parameter type-id='95e97e5e' name='delay' filepath='drivers/base/power/runtime.c' line='1615' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pm_stay_awake' mangled-name='pm_stay_awake' filepath='drivers/base/power/wakeup.c' line='668' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_stay_awake'>
@@ -140772,36 +140786,36 @@
         <parameter type-id='eaa32e2f' name='data' filepath='fs/proc/generic.c' line='654' column='1'/>
         <return type-id='d077e928'/>
       </function-decl>
-      <function-decl name='proc_dointvec' mangled-name='proc_dointvec' filepath='kernel/sysctl.c' line='830' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_dointvec'>
-        <parameter type-id='631dc3c1' name='table' filepath='kernel/sysctl.c' line='830' column='1'/>
-        <parameter type-id='95e97e5e' name='write' filepath='kernel/sysctl.c' line='830' column='1'/>
-        <parameter type-id='eaa32e2f' name='buffer' filepath='kernel/sysctl.c' line='830' column='1'/>
-        <parameter type-id='78c01427' name='lenp' filepath='kernel/sysctl.c' line='831' column='1'/>
-        <parameter type-id='b53e8dbb' name='ppos' filepath='kernel/sysctl.c' line='831' column='1'/>
+      <function-decl name='proc_dointvec' mangled-name='proc_dointvec' filepath='kernel/sysctl.c' line='824' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_dointvec'>
+        <parameter type-id='631dc3c1' name='table' filepath='kernel/sysctl.c' line='824' column='1'/>
+        <parameter type-id='95e97e5e' name='write' filepath='kernel/sysctl.c' line='824' column='1'/>
+        <parameter type-id='eaa32e2f' name='buffer' filepath='kernel/sysctl.c' line='824' column='1'/>
+        <parameter type-id='78c01427' name='lenp' filepath='kernel/sysctl.c' line='825' column='1'/>
+        <parameter type-id='b53e8dbb' name='ppos' filepath='kernel/sysctl.c' line='825' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='proc_dointvec_minmax' mangled-name='proc_dointvec_minmax' filepath='kernel/sysctl.c' line='987' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_dointvec_minmax'>
-        <parameter type-id='631dc3c1' name='table' filepath='kernel/sysctl.c' line='987' column='1'/>
-        <parameter type-id='95e97e5e' name='write' filepath='kernel/sysctl.c' line='987' column='1'/>
-        <parameter type-id='eaa32e2f' name='buffer' filepath='kernel/sysctl.c' line='988' column='1'/>
-        <parameter type-id='78c01427' name='lenp' filepath='kernel/sysctl.c' line='988' column='1'/>
-        <parameter type-id='b53e8dbb' name='ppos' filepath='kernel/sysctl.c' line='988' column='1'/>
+      <function-decl name='proc_dointvec_minmax' mangled-name='proc_dointvec_minmax' filepath='kernel/sysctl.c' line='981' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_dointvec_minmax'>
+        <parameter type-id='631dc3c1' name='table' filepath='kernel/sysctl.c' line='981' column='1'/>
+        <parameter type-id='95e97e5e' name='write' filepath='kernel/sysctl.c' line='981' column='1'/>
+        <parameter type-id='eaa32e2f' name='buffer' filepath='kernel/sysctl.c' line='982' column='1'/>
+        <parameter type-id='78c01427' name='lenp' filepath='kernel/sysctl.c' line='982' column='1'/>
+        <parameter type-id='b53e8dbb' name='ppos' filepath='kernel/sysctl.c' line='982' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='proc_dostring' mangled-name='proc_dostring' filepath='kernel/sysctl.c' line='387' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_dostring'>
-        <parameter type-id='631dc3c1' name='table' filepath='kernel/sysctl.c' line='387' column='1'/>
-        <parameter type-id='95e97e5e' name='write' filepath='kernel/sysctl.c' line='387' column='1'/>
-        <parameter type-id='eaa32e2f' name='buffer' filepath='kernel/sysctl.c' line='388' column='1'/>
-        <parameter type-id='78c01427' name='lenp' filepath='kernel/sysctl.c' line='388' column='1'/>
-        <parameter type-id='b53e8dbb' name='ppos' filepath='kernel/sysctl.c' line='388' column='1'/>
+      <function-decl name='proc_dostring' mangled-name='proc_dostring' filepath='kernel/sysctl.c' line='381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_dostring'>
+        <parameter type-id='631dc3c1' name='table' filepath='kernel/sysctl.c' line='381' column='1'/>
+        <parameter type-id='95e97e5e' name='write' filepath='kernel/sysctl.c' line='381' column='1'/>
+        <parameter type-id='eaa32e2f' name='buffer' filepath='kernel/sysctl.c' line='382' column='1'/>
+        <parameter type-id='78c01427' name='lenp' filepath='kernel/sysctl.c' line='382' column='1'/>
+        <parameter type-id='b53e8dbb' name='ppos' filepath='kernel/sysctl.c' line='382' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='proc_douintvec_minmax' mangled-name='proc_douintvec_minmax' filepath='kernel/sysctl.c' line='1056' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_douintvec_minmax'>
-        <parameter type-id='631dc3c1' name='table' filepath='kernel/sysctl.c' line='1056' column='1'/>
-        <parameter type-id='95e97e5e' name='write' filepath='kernel/sysctl.c' line='1056' column='1'/>
-        <parameter type-id='eaa32e2f' name='buffer' filepath='kernel/sysctl.c' line='1057' column='1'/>
-        <parameter type-id='78c01427' name='lenp' filepath='kernel/sysctl.c' line='1057' column='1'/>
-        <parameter type-id='b53e8dbb' name='ppos' filepath='kernel/sysctl.c' line='1057' column='1'/>
+      <function-decl name='proc_douintvec_minmax' mangled-name='proc_douintvec_minmax' filepath='kernel/sysctl.c' line='1050' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_douintvec_minmax'>
+        <parameter type-id='631dc3c1' name='table' filepath='kernel/sysctl.c' line='1050' column='1'/>
+        <parameter type-id='95e97e5e' name='write' filepath='kernel/sysctl.c' line='1050' column='1'/>
+        <parameter type-id='eaa32e2f' name='buffer' filepath='kernel/sysctl.c' line='1051' column='1'/>
+        <parameter type-id='78c01427' name='lenp' filepath='kernel/sysctl.c' line='1051' column='1'/>
+        <parameter type-id='b53e8dbb' name='ppos' filepath='kernel/sysctl.c' line='1051' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='proc_mkdir' mangled-name='proc_mkdir' filepath='fs/proc/generic.c' line='523' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_mkdir'>
@@ -140847,13 +140861,13 @@
         <parameter type-id='d504f73d' name='n' filepath='kernel/profile.c' line='197' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='proto_register' mangled-name='proto_register' filepath='net/core/sock.c' line='3498' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_register'>
-        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='3498' column='1'/>
-        <parameter type-id='95e97e5e' name='alloc_slab' filepath='net/core/sock.c' line='3498' column='1'/>
+      <function-decl name='proto_register' mangled-name='proto_register' filepath='net/core/sock.c' line='3513' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_register'>
+        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='3513' column='1'/>
+        <parameter type-id='95e97e5e' name='alloc_slab' filepath='net/core/sock.c' line='3513' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='proto_unregister' mangled-name='proto_unregister' filepath='net/core/sock.c' line='3562' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_unregister'>
-        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='3562' column='1'/>
+      <function-decl name='proto_unregister' mangled-name='proto_unregister' filepath='net/core/sock.c' line='3577' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_unregister'>
+        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='3577' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ps2_begin_command' mangled-name='ps2_begin_command' filepath='drivers/input/serio/libps2.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ps2_begin_command'>
@@ -140963,8 +140977,8 @@
         <parameter type-id='f0981eeb' name='fd' filepath='fs/file.c' line='606' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='put_vaddr_frames' mangled-name='put_vaddr_frames' filepath='mm/frame_vector.c' line='104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_vaddr_frames'>
-        <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='104' column='1'/>
+      <function-decl name='put_vaddr_frames' mangled-name='put_vaddr_frames' filepath='mm/frame_vector.c' line='106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_vaddr_frames'>
+        <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='106' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='putback_movable_pages' mangled-name='putback_movable_pages' filepath='mm/migrate.c' line='146' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='putback_movable_pages'>
@@ -141032,35 +141046,35 @@
         <parameter type-id='ee406209' name='qdisc' filepath='net/sched/sch_generic.c' line='943' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='queue_delayed_work_on' mangled-name='queue_delayed_work_on' filepath='kernel/workqueue.c' line='1693' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='queue_delayed_work_on'>
-        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/workqueue.c' line='1693' column='1'/>
-        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='1693' column='1'/>
-        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='1694' column='1'/>
-        <parameter type-id='7359adad' name='delay' filepath='kernel/workqueue.c' line='1694' column='1'/>
+      <function-decl name='queue_delayed_work_on' mangled-name='queue_delayed_work_on' filepath='kernel/workqueue.c' line='1696' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='queue_delayed_work_on'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/workqueue.c' line='1696' column='1'/>
+        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='1696' column='1'/>
+        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='1697' column='1'/>
+        <parameter type-id='7359adad' name='delay' filepath='kernel/workqueue.c' line='1697' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='queue_work_on' mangled-name='queue_work_on' filepath='kernel/workqueue.c' line='1532' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='queue_work_on'>
-        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/workqueue.c' line='1532' column='1'/>
-        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='1532' column='1'/>
-        <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='1533' column='1'/>
+      <function-decl name='queue_work_on' mangled-name='queue_work_on' filepath='kernel/workqueue.c' line='1535' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='queue_work_on'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/workqueue.c' line='1535' column='1'/>
+        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='1535' column='1'/>
+        <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='1536' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='radix_tree_delete' mangled-name='radix_tree_delete' filepath='lib/radix-tree.c' line='1443' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_delete'>
-        <parameter type-id='60075f2a' name='root' filepath='lib/radix-tree.c' line='1443' column='1'/>
-        <parameter type-id='7359adad' name='index' filepath='lib/radix-tree.c' line='1443' column='1'/>
+      <function-decl name='radix_tree_delete' mangled-name='radix_tree_delete' filepath='lib/radix-tree.c' line='1442' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_delete'>
+        <parameter type-id='60075f2a' name='root' filepath='lib/radix-tree.c' line='1442' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='lib/radix-tree.c' line='1442' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='radix_tree_delete_item' mangled-name='radix_tree_delete_item' filepath='lib/radix-tree.c' line='1411' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_delete_item'>
-        <parameter type-id='60075f2a' name='root' filepath='lib/radix-tree.c' line='1411' column='1'/>
-        <parameter type-id='7359adad' name='index' filepath='lib/radix-tree.c' line='1412' column='1'/>
-        <parameter type-id='eaa32e2f' name='item' filepath='lib/radix-tree.c' line='1412' column='1'/>
+      <function-decl name='radix_tree_delete_item' mangled-name='radix_tree_delete_item' filepath='lib/radix-tree.c' line='1410' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_delete_item'>
+        <parameter type-id='60075f2a' name='root' filepath='lib/radix-tree.c' line='1410' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='lib/radix-tree.c' line='1411' column='1'/>
+        <parameter type-id='eaa32e2f' name='item' filepath='lib/radix-tree.c' line='1411' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='radix_tree_gang_lookup' mangled-name='radix_tree_gang_lookup' filepath='lib/radix-tree.c' line='1260' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_gang_lookup'>
-        <parameter type-id='bb0f13d1' name='root' filepath='lib/radix-tree.c' line='1260' column='1'/>
-        <parameter type-id='63e171df' name='results' filepath='lib/radix-tree.c' line='1260' column='1'/>
-        <parameter type-id='7359adad' name='first_index' filepath='lib/radix-tree.c' line='1261' column='1'/>
-        <parameter type-id='f0981eeb' name='max_items' filepath='lib/radix-tree.c' line='1261' column='1'/>
+      <function-decl name='radix_tree_gang_lookup' mangled-name='radix_tree_gang_lookup' filepath='lib/radix-tree.c' line='1259' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_gang_lookup'>
+        <parameter type-id='bb0f13d1' name='root' filepath='lib/radix-tree.c' line='1259' column='1'/>
+        <parameter type-id='63e171df' name='results' filepath='lib/radix-tree.c' line='1259' column='1'/>
+        <parameter type-id='7359adad' name='first_index' filepath='lib/radix-tree.c' line='1260' column='1'/>
+        <parameter type-id='f0981eeb' name='max_items' filepath='lib/radix-tree.c' line='1260' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='radix_tree_insert' mangled-name='radix_tree_insert' filepath='lib/radix-tree.c' line='701' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_insert'>
@@ -141069,10 +141083,10 @@
         <parameter type-id='eaa32e2f' name='item' filepath='lib/radix-tree.c' line='702' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='radix_tree_iter_delete' mangled-name='radix_tree_iter_delete' filepath='lib/radix-tree.c' line='1392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_iter_delete'>
-        <parameter type-id='60075f2a' name='root' filepath='lib/radix-tree.c' line='1392' column='1'/>
-        <parameter type-id='0cbbabe1' name='iter' filepath='lib/radix-tree.c' line='1393' column='1'/>
-        <parameter type-id='63e171df' name='slot' filepath='lib/radix-tree.c' line='1393' column='1'/>
+      <function-decl name='radix_tree_iter_delete' mangled-name='radix_tree_iter_delete' filepath='lib/radix-tree.c' line='1391' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_iter_delete'>
+        <parameter type-id='60075f2a' name='root' filepath='lib/radix-tree.c' line='1391' column='1'/>
+        <parameter type-id='0cbbabe1' name='iter' filepath='lib/radix-tree.c' line='1392' column='1'/>
+        <parameter type-id='63e171df' name='slot' filepath='lib/radix-tree.c' line='1392' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='radix_tree_iter_resume' mangled-name='radix_tree_iter_resume' filepath='lib/radix-tree.c' line='1133' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_iter_resume'>
@@ -141094,10 +141108,10 @@
         <parameter type-id='3eb7c31c' name='gfp_mask' filepath='lib/radix-tree.c' line='376' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='radix_tree_next_chunk' mangled-name='radix_tree_next_chunk' filepath='lib/radix-tree.c' line='1152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_next_chunk'>
-        <parameter type-id='bb0f13d1' name='root' filepath='lib/radix-tree.c' line='1152' column='1'/>
-        <parameter type-id='0cbbabe1' name='iter' filepath='lib/radix-tree.c' line='1153' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='lib/radix-tree.c' line='1153' column='1'/>
+      <function-decl name='radix_tree_next_chunk' mangled-name='radix_tree_next_chunk' filepath='lib/radix-tree.c' line='1151' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_next_chunk'>
+        <parameter type-id='bb0f13d1' name='root' filepath='lib/radix-tree.c' line='1151' column='1'/>
+        <parameter type-id='0cbbabe1' name='iter' filepath='lib/radix-tree.c' line='1152' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='lib/radix-tree.c' line='1152' column='1'/>
         <return type-id='63e171df'/>
       </function-decl>
       <function-decl name='radix_tree_preload' mangled-name='radix_tree_preload' filepath='lib/radix-tree.c' line='363' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_preload'>
@@ -141110,9 +141124,9 @@
         <parameter type-id='eaa32e2f' name='item' filepath='lib/radix-tree.c' line='913' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='radix_tree_tagged' mangled-name='radix_tree_tagged' filepath='lib/radix-tree.c' line='1454' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_tagged'>
-        <parameter type-id='bb0f13d1' name='root' filepath='lib/radix-tree.c' line='1454' column='1'/>
-        <parameter type-id='f0981eeb' name='tag' filepath='lib/radix-tree.c' line='1454' column='1'/>
+      <function-decl name='radix_tree_tagged' mangled-name='radix_tree_tagged' filepath='lib/radix-tree.c' line='1453' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_tagged'>
+        <parameter type-id='bb0f13d1' name='root' filepath='lib/radix-tree.c' line='1453' column='1'/>
+        <parameter type-id='f0981eeb' name='tag' filepath='lib/radix-tree.c' line='1453' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='rational_best_approximation' mangled-name='rational_best_approximation' filepath='lib/math/rational.c' line='34' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rational_best_approximation'>
@@ -141186,7 +141200,7 @@
       <function-decl name='rcu_barrier_tasks' mangled-name='rcu_barrier_tasks' filepath='kernel/rcu/tasks.h' line='566' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_barrier_tasks'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcu_barrier_tasks_trace' mangled-name='rcu_barrier_tasks_trace' filepath='kernel/rcu/tasks.h' line='1204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_barrier_tasks_trace'>
+      <function-decl name='rcu_barrier_tasks_trace' mangled-name='rcu_barrier_tasks_trace' filepath='kernel/rcu/tasks.h' line='1207' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_barrier_tasks_trace'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rcu_bind_current_to_nocb' mangled-name='rcu_bind_current_to_nocb' filepath='kernel/rcu/tree_plugin.h' line='2387' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_bind_current_to_nocb'>
@@ -141253,33 +141267,33 @@
         <parameter type-id='9b25216e' name='w' filepath='kernel/exit.c' line='280' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rdev_get_dev' mangled-name='rdev_get_dev' filepath='drivers/regulator/core.c' line='5674' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_dev'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5674' column='1'/>
+      <function-decl name='rdev_get_dev' mangled-name='rdev_get_dev' filepath='drivers/regulator/core.c' line='5666' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_dev'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5666' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='rdev_get_drvdata' mangled-name='rdev_get_drvdata' filepath='drivers/regulator/core.c' line='5634' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_drvdata'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5634' column='1'/>
+      <function-decl name='rdev_get_drvdata' mangled-name='rdev_get_drvdata' filepath='drivers/regulator/core.c' line='5626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_drvdata'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5626' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='rdev_get_id' mangled-name='rdev_get_id' filepath='drivers/regulator/core.c' line='5668' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_id'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5668' column='1'/>
+      <function-decl name='rdev_get_id' mangled-name='rdev_get_id' filepath='drivers/regulator/core.c' line='5660' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_id'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5660' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rdev_get_regmap' mangled-name='rdev_get_regmap' filepath='drivers/regulator/core.c' line='5680' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_regmap'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5680' column='1'/>
+      <function-decl name='rdev_get_regmap' mangled-name='rdev_get_regmap' filepath='drivers/regulator/core.c' line='5672' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_regmap'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5672' column='1'/>
         <return type-id='29af9a71'/>
       </function-decl>
-      <function-decl name='read_cache_page' mangled-name='read_cache_page' filepath='mm/filemap.c' line='3290' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='read_cache_page'>
-        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3290' column='1'/>
-        <parameter type-id='7359adad' name='index' filepath='mm/filemap.c' line='3291' column='1'/>
-        <parameter type-id='83ac4446' name='filler' filepath='mm/filemap.c' line='3292' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='mm/filemap.c' line='3293' column='1'/>
+      <function-decl name='read_cache_page' mangled-name='read_cache_page' filepath='mm/filemap.c' line='3293' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='read_cache_page'>
+        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3293' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='mm/filemap.c' line='3294' column='1'/>
+        <parameter type-id='83ac4446' name='filler' filepath='mm/filemap.c' line='3295' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='mm/filemap.c' line='3296' column='1'/>
         <return type-id='02f11ed4'/>
       </function-decl>
-      <function-decl name='read_cache_page_gfp' mangled-name='read_cache_page_gfp' filepath='mm/filemap.c' line='3313' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='read_cache_page_gfp'>
-        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3313' column='1'/>
-        <parameter type-id='7359adad' name='index' filepath='mm/filemap.c' line='3314' column='1'/>
-        <parameter type-id='3eb7c31c' name='gfp' filepath='mm/filemap.c' line='3315' column='1'/>
+      <function-decl name='read_cache_page_gfp' mangled-name='read_cache_page_gfp' filepath='mm/filemap.c' line='3316' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='read_cache_page_gfp'>
+        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3316' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='mm/filemap.c' line='3317' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='mm/filemap.c' line='3318' column='1'/>
         <return type-id='02f11ed4'/>
       </function-decl>
       <function-decl name='readahead_gfp_mask' mangled-name='readahead_gfp_mask' filepath='mm/readahead.c' line='118' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='readahead_gfp_mask'>
@@ -141295,8 +141309,8 @@
         <parameter type-id='e84b031a' name='page_list' filepath='mm/vmscan.c' line='2187' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='reclaim_shmem_address_space' mangled-name='reclaim_shmem_address_space' filepath='mm/shmem.c' line='4310' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reclaim_shmem_address_space'>
-        <parameter type-id='f57039f0' name='mapping' filepath='mm/shmem.c' line='4310' column='1'/>
+      <function-decl name='reclaim_shmem_address_space' mangled-name='reclaim_shmem_address_space' filepath='mm/shmem.c' line='4330' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reclaim_shmem_address_space'>
+        <parameter type-id='f57039f0' name='mapping' filepath='mm/shmem.c' line='4330' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='redirty_page_for_writepage' mangled-name='redirty_page_for_writepage' filepath='mm/page-writeback.c' line='2541' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='redirty_page_for_writepage'>
@@ -141323,8 +141337,8 @@
         <parameter type-id='ff0618be' name='t' filepath='lib/refcount.c' line='13' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='refresh_frequency_limits' mangled-name='refresh_frequency_limits' filepath='drivers/cpufreq/cpufreq.c' line='1146' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='refresh_frequency_limits'>
-        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='1146' column='1'/>
+      <function-decl name='refresh_frequency_limits' mangled-name='refresh_frequency_limits' filepath='drivers/cpufreq/cpufreq.c' line='1148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='refresh_frequency_limits'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='1148' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='regcache_cache_bypass' mangled-name='regcache_cache_bypass' filepath='drivers/base/regmap/regcache.c' line='544' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regcache_cache_bypass'>
@@ -141400,12 +141414,12 @@
         <parameter type-id='26d099e0' name='hook' filepath='arch/arm64/kernel/debug-monitors.c' line='292' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='register_kprobe' mangled-name='register_kprobe' filepath='kernel/kprobes.c' line='1684' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_kprobe'>
-        <parameter type-id='0d97a11a' name='p' filepath='kernel/kprobes.c' line='1684' column='1'/>
+      <function-decl name='register_kprobe' mangled-name='register_kprobe' filepath='kernel/kprobes.c' line='1696' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_kprobe'>
+        <parameter type-id='0d97a11a' name='p' filepath='kernel/kprobes.c' line='1696' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_kretprobe' mangled-name='register_kretprobe' filepath='kernel/kprobes.c' line='2123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_kretprobe'>
-        <parameter type-id='d15edd25' name='rp' filepath='kernel/kprobes.c' line='2123' column='1'/>
+      <function-decl name='register_kretprobe' mangled-name='register_kretprobe' filepath='kernel/kprobes.c' line='2135' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_kretprobe'>
+        <parameter type-id='d15edd25' name='rp' filepath='kernel/kprobes.c' line='2135' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='register_memory_notifier' mangled-name='register_memory_notifier' filepath='drivers/base/memory.c' line='87' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_memory_notifier'>
@@ -141474,13 +141488,13 @@
         <parameter type-id='cbd24a98' name='ops' filepath='drivers/base/syscore.c' line='22' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='register_sysctl' mangled-name='register_sysctl' filepath='fs/proc/proc_sysctl.c' line='1383' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_sysctl'>
-        <parameter type-id='80f4b756' name='path' filepath='fs/proc/proc_sysctl.c' line='1383' column='1'/>
-        <parameter type-id='631dc3c1' name='table' filepath='fs/proc/proc_sysctl.c' line='1383' column='1'/>
+      <function-decl name='register_sysctl' mangled-name='register_sysctl' filepath='fs/proc/proc_sysctl.c' line='1385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_sysctl'>
+        <parameter type-id='80f4b756' name='path' filepath='fs/proc/proc_sysctl.c' line='1385' column='1'/>
+        <parameter type-id='631dc3c1' name='table' filepath='fs/proc/proc_sysctl.c' line='1385' column='1'/>
         <return type-id='11b101bb'/>
       </function-decl>
-      <function-decl name='register_sysctl_table' mangled-name='register_sysctl_table' filepath='fs/proc/proc_sysctl.c' line='1627' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_sysctl_table'>
-        <parameter type-id='631dc3c1' name='table' filepath='fs/proc/proc_sysctl.c' line='1627' column='1'/>
+      <function-decl name='register_sysctl_table' mangled-name='register_sysctl_table' filepath='fs/proc/proc_sysctl.c' line='1629' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_sysctl_table'>
+        <parameter type-id='631dc3c1' name='table' filepath='fs/proc/proc_sysctl.c' line='1629' column='1'/>
         <return type-id='11b101bb'/>
       </function-decl>
       <function-decl name='register_tcf_proto_ops' mangled-name='register_tcf_proto_ops' filepath='net/sched/cls_api.c' line='158' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_tcf_proto_ops'>
@@ -141508,8 +141522,8 @@
         <parameter type-id='a731d0ec' name='data' filepath='drivers/base/regmap/regmap-irq.c' line='857' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_async_complete' mangled-name='regmap_async_complete' filepath='drivers/base/regmap/regmap.c' line='3155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_async_complete'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3155' column='1'/>
+      <function-decl name='regmap_async_complete' mangled-name='regmap_async_complete' filepath='drivers/base/regmap/regmap.c' line='3153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_async_complete'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3153' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regmap_attach_dev' mangled-name='regmap_attach_dev' filepath='drivers/base/regmap/regmap.c' line='611' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_attach_dev'>
@@ -141518,18 +141532,18 @@
         <parameter type-id='9d19d4a7' name='config' filepath='drivers/base/regmap/regmap.c' line='612' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_bulk_read' mangled-name='regmap_bulk_read' filepath='drivers/base/regmap/regmap.c' line='2951' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_bulk_read'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2951' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2951' column='1'/>
-        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2951' column='1'/>
-        <parameter type-id='b59d7dce' name='val_count' filepath='drivers/base/regmap/regmap.c' line='2952' column='1'/>
+      <function-decl name='regmap_bulk_read' mangled-name='regmap_bulk_read' filepath='drivers/base/regmap/regmap.c' line='2949' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_bulk_read'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2949' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2949' column='1'/>
+        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2949' column='1'/>
+        <parameter type-id='b59d7dce' name='val_count' filepath='drivers/base/regmap/regmap.c' line='2950' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_bulk_write' mangled-name='regmap_bulk_write' filepath='drivers/base/regmap/regmap.c' line='2207' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_bulk_write'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2207' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2207' column='1'/>
-        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2207' column='1'/>
-        <parameter type-id='b59d7dce' name='val_count' filepath='drivers/base/regmap/regmap.c' line='2208' column='1'/>
+      <function-decl name='regmap_bulk_write' mangled-name='regmap_bulk_write' filepath='drivers/base/regmap/regmap.c' line='2205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_bulk_write'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2205' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2205' column='1'/>
+        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2205' column='1'/>
+        <parameter type-id='b59d7dce' name='val_count' filepath='drivers/base/regmap/regmap.c' line='2206' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regmap_check_range_table' mangled-name='regmap_check_range_table' filepath='drivers/base/regmap/regmap.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_check_range_table'>
@@ -141547,18 +141561,18 @@
         <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='1476' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='regmap_field_read' mangled-name='regmap_field_read' filepath='drivers/base/regmap/regmap.c' line='2891' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_field_read'>
-        <parameter type-id='476eb32c' name='field' filepath='drivers/base/regmap/regmap.c' line='2891' column='1'/>
-        <parameter type-id='807869d3' name='val' filepath='drivers/base/regmap/regmap.c' line='2891' column='1'/>
+      <function-decl name='regmap_field_read' mangled-name='regmap_field_read' filepath='drivers/base/regmap/regmap.c' line='2889' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_field_read'>
+        <parameter type-id='476eb32c' name='field' filepath='drivers/base/regmap/regmap.c' line='2889' column='1'/>
+        <parameter type-id='807869d3' name='val' filepath='drivers/base/regmap/regmap.c' line='2889' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_field_update_bits_base' mangled-name='regmap_field_update_bits_base' filepath='drivers/base/regmap/regmap.c' line='2150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_field_update_bits_base'>
-        <parameter type-id='476eb32c' name='field' filepath='drivers/base/regmap/regmap.c' line='2150' column='1'/>
-        <parameter type-id='f0981eeb' name='mask' filepath='drivers/base/regmap/regmap.c' line='2151' column='1'/>
-        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='2151' column='1'/>
-        <parameter type-id='d8e6b335' name='change' filepath='drivers/base/regmap/regmap.c' line='2152' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='drivers/base/regmap/regmap.c' line='2152' column='1'/>
-        <parameter type-id='b50a4934' name='force' filepath='drivers/base/regmap/regmap.c' line='2152' column='1'/>
+      <function-decl name='regmap_field_update_bits_base' mangled-name='regmap_field_update_bits_base' filepath='drivers/base/regmap/regmap.c' line='2148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_field_update_bits_base'>
+        <parameter type-id='476eb32c' name='field' filepath='drivers/base/regmap/regmap.c' line='2148' column='1'/>
+        <parameter type-id='f0981eeb' name='mask' filepath='drivers/base/regmap/regmap.c' line='2149' column='1'/>
+        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='2149' column='1'/>
+        <parameter type-id='d8e6b335' name='change' filepath='drivers/base/regmap/regmap.c' line='2150' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='drivers/base/regmap/regmap.c' line='2150' column='1'/>
+        <parameter type-id='b50a4934' name='force' filepath='drivers/base/regmap/regmap.c' line='2150' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regmap_get_device' mangled-name='regmap_get_device' filepath='drivers/base/regmap/regmap.c' line='1549' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_get_device'>
@@ -141578,65 +141592,65 @@
         <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap-mmio.c' line='368' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='regmap_multi_reg_write' mangled-name='regmap_multi_reg_write' filepath='drivers/base/regmap/regmap.c' line='2514' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_multi_reg_write'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2514' column='1'/>
-        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='2514' column='1'/>
-        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='2515' column='1'/>
+      <function-decl name='regmap_multi_reg_write' mangled-name='regmap_multi_reg_write' filepath='drivers/base/regmap/regmap.c' line='2512' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_multi_reg_write'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2512' column='1'/>
+        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='2512' column='1'/>
+        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='2513' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_multi_reg_write_bypassed' mangled-name='regmap_multi_reg_write_bypassed' filepath='drivers/base/regmap/regmap.c' line='2547' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_multi_reg_write_bypassed'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2547' column='1'/>
-        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='2548' column='1'/>
-        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='2549' column='1'/>
+      <function-decl name='regmap_multi_reg_write_bypassed' mangled-name='regmap_multi_reg_write_bypassed' filepath='drivers/base/regmap/regmap.c' line='2545' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_multi_reg_write_bypassed'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2545' column='1'/>
+        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='2546' column='1'/>
+        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='2547' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_raw_read' mangled-name='regmap_raw_read' filepath='drivers/base/regmap/regmap.c' line='2744' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_read'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2744' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2744' column='1'/>
-        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2744' column='1'/>
-        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2745' column='1'/>
+      <function-decl name='regmap_raw_read' mangled-name='regmap_raw_read' filepath='drivers/base/regmap/regmap.c' line='2742' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_read'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2742' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2742' column='1'/>
+        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2742' column='1'/>
+        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2743' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_raw_write' mangled-name='regmap_raw_write' filepath='drivers/base/regmap/regmap.c' line='2050' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_write'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2050' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2050' column='1'/>
-        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2051' column='1'/>
-        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2051' column='1'/>
+      <function-decl name='regmap_raw_write' mangled-name='regmap_raw_write' filepath='drivers/base/regmap/regmap.c' line='2048' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_write'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2048' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2048' column='1'/>
+        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2049' column='1'/>
+        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2049' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_raw_write_async' mangled-name='regmap_raw_write_async' filepath='drivers/base/regmap/regmap.c' line='2591' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_write_async'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2591' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2591' column='1'/>
-        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2592' column='1'/>
-        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2592' column='1'/>
+      <function-decl name='regmap_raw_write_async' mangled-name='regmap_raw_write_async' filepath='drivers/base/regmap/regmap.c' line='2589' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_write_async'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2589' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2589' column='1'/>
+        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2590' column='1'/>
+        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2590' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_read' mangled-name='regmap_read' filepath='drivers/base/regmap/regmap.c' line='2716' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_read'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2716' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2716' column='1'/>
-        <parameter type-id='807869d3' name='val' filepath='drivers/base/regmap/regmap.c' line='2716' column='1'/>
+      <function-decl name='regmap_read' mangled-name='regmap_read' filepath='drivers/base/regmap/regmap.c' line='2714' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_read'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2714' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2714' column='1'/>
+        <parameter type-id='807869d3' name='val' filepath='drivers/base/regmap/regmap.c' line='2714' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_register_patch' mangled-name='regmap_register_patch' filepath='drivers/base/regmap/regmap.c' line='3196' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_register_patch'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3196' column='1'/>
-        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='3196' column='1'/>
-        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='3197' column='1'/>
+      <function-decl name='regmap_register_patch' mangled-name='regmap_register_patch' filepath='drivers/base/regmap/regmap.c' line='3194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_register_patch'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3194' column='1'/>
+        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='3194' column='1'/>
+        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='3195' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_test_bits' mangled-name='regmap_test_bits' filepath='drivers/base/regmap/regmap.c' line='3102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_test_bits'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3102' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='3102' column='1'/>
-        <parameter type-id='f0981eeb' name='bits' filepath='drivers/base/regmap/regmap.c' line='3102' column='1'/>
+      <function-decl name='regmap_test_bits' mangled-name='regmap_test_bits' filepath='drivers/base/regmap/regmap.c' line='3100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_test_bits'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3100' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='3100' column='1'/>
+        <parameter type-id='f0981eeb' name='bits' filepath='drivers/base/regmap/regmap.c' line='3100' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_update_bits_base' mangled-name='regmap_update_bits_base' filepath='drivers/base/regmap/regmap.c' line='3071' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_update_bits_base'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3071' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='3071' column='1'/>
-        <parameter type-id='f0981eeb' name='mask' filepath='drivers/base/regmap/regmap.c' line='3072' column='1'/>
-        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='3072' column='1'/>
-        <parameter type-id='d8e6b335' name='change' filepath='drivers/base/regmap/regmap.c' line='3073' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='drivers/base/regmap/regmap.c' line='3073' column='1'/>
-        <parameter type-id='b50a4934' name='force' filepath='drivers/base/regmap/regmap.c' line='3073' column='1'/>
+      <function-decl name='regmap_update_bits_base' mangled-name='regmap_update_bits_base' filepath='drivers/base/regmap/regmap.c' line='3069' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_update_bits_base'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3069' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='3069' column='1'/>
+        <parameter type-id='f0981eeb' name='mask' filepath='drivers/base/regmap/regmap.c' line='3070' column='1'/>
+        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='3070' column='1'/>
+        <parameter type-id='d8e6b335' name='change' filepath='drivers/base/regmap/regmap.c' line='3071' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='drivers/base/regmap/regmap.c' line='3071' column='1'/>
+        <parameter type-id='b50a4934' name='force' filepath='drivers/base/regmap/regmap.c' line='3071' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regmap_write' mangled-name='regmap_write' filepath='drivers/base/regmap/regmap.c' line='1946' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_write'>
@@ -141645,29 +141659,29 @@
         <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='1946' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_allow_bypass' mangled-name='regulator_allow_bypass' filepath='drivers/regulator/core.c' line='4573' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_allow_bypass'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4573' column='1'/>
-        <parameter type-id='b50a4934' name='enable' filepath='drivers/regulator/core.c' line='4573' column='1'/>
+      <function-decl name='regulator_allow_bypass' mangled-name='regulator_allow_bypass' filepath='drivers/regulator/core.c' line='4571' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_allow_bypass'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4571' column='1'/>
+        <parameter type-id='b50a4934' name='enable' filepath='drivers/regulator/core.c' line='4571' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_bulk_disable' mangled-name='regulator_bulk_disable' filepath='drivers/regulator/core.c' line='4781' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_bulk_disable'>
-        <parameter type-id='95e97e5e' name='num_consumers' filepath='drivers/regulator/core.c' line='4781' column='1'/>
-        <parameter type-id='776946b4' name='consumers' filepath='drivers/regulator/core.c' line='4782' column='1'/>
+      <function-decl name='regulator_bulk_disable' mangled-name='regulator_bulk_disable' filepath='drivers/regulator/core.c' line='4779' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_bulk_disable'>
+        <parameter type-id='95e97e5e' name='num_consumers' filepath='drivers/regulator/core.c' line='4779' column='1'/>
+        <parameter type-id='776946b4' name='consumers' filepath='drivers/regulator/core.c' line='4780' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_bulk_enable' mangled-name='regulator_bulk_enable' filepath='drivers/regulator/core.c' line='4732' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_bulk_enable'>
-        <parameter type-id='95e97e5e' name='num_consumers' filepath='drivers/regulator/core.c' line='4732' column='1'/>
-        <parameter type-id='776946b4' name='consumers' filepath='drivers/regulator/core.c' line='4733' column='1'/>
+      <function-decl name='regulator_bulk_enable' mangled-name='regulator_bulk_enable' filepath='drivers/regulator/core.c' line='4730' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_bulk_enable'>
+        <parameter type-id='95e97e5e' name='num_consumers' filepath='drivers/regulator/core.c' line='4730' column='1'/>
+        <parameter type-id='776946b4' name='consumers' filepath='drivers/regulator/core.c' line='4731' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_bulk_get' mangled-name='regulator_bulk_get' filepath='drivers/regulator/core.c' line='4677' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_bulk_get'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/regulator/core.c' line='4677' column='1'/>
-        <parameter type-id='95e97e5e' name='num_consumers' filepath='drivers/regulator/core.c' line='4677' column='1'/>
-        <parameter type-id='776946b4' name='consumers' filepath='drivers/regulator/core.c' line='4678' column='1'/>
+      <function-decl name='regulator_bulk_get' mangled-name='regulator_bulk_get' filepath='drivers/regulator/core.c' line='4675' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_bulk_get'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/regulator/core.c' line='4675' column='1'/>
+        <parameter type-id='95e97e5e' name='num_consumers' filepath='drivers/regulator/core.c' line='4675' column='1'/>
+        <parameter type-id='776946b4' name='consumers' filepath='drivers/regulator/core.c' line='4676' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_count_voltages' mangled-name='regulator_count_voltages' filepath='drivers/regulator/core.c' line='3138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_count_voltages'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3138' column='1'/>
+      <function-decl name='regulator_count_voltages' mangled-name='regulator_count_voltages' filepath='drivers/regulator/core.c' line='3136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_count_voltages'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3136' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_desc_list_voltage_linear_range' mangled-name='regulator_desc_list_voltage_linear_range' filepath='drivers/regulator/helpers.c' line='597' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_desc_list_voltage_linear_range'>
@@ -141675,34 +141689,34 @@
         <parameter type-id='f0981eeb' name='selector' filepath='drivers/regulator/helpers.c' line='598' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_disable' mangled-name='regulator_disable' filepath='drivers/regulator/core.c' line='2908' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_disable'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='2908' column='1'/>
+      <function-decl name='regulator_disable' mangled-name='regulator_disable' filepath='drivers/regulator/core.c' line='2906' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_disable'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='2906' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_disable_deferred' mangled-name='regulator_disable_deferred' filepath='drivers/regulator/core.c' line='3039' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_disable_deferred'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3039' column='1'/>
-        <parameter type-id='95e97e5e' name='ms' filepath='drivers/regulator/core.c' line='3039' column='1'/>
+      <function-decl name='regulator_disable_deferred' mangled-name='regulator_disable_deferred' filepath='drivers/regulator/core.c' line='3037' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_disable_deferred'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3037' column='1'/>
+        <parameter type-id='95e97e5e' name='ms' filepath='drivers/regulator/core.c' line='3037' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_disable_regmap' mangled-name='regulator_disable_regmap' filepath='drivers/regulator/helpers.c' line='85' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_disable_regmap'>
         <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='85' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_enable' mangled-name='regulator_enable' filepath='drivers/regulator/core.c' line='2798' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_enable'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='2798' column='1'/>
+      <function-decl name='regulator_enable' mangled-name='regulator_enable' filepath='drivers/regulator/core.c' line='2796' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_enable'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='2796' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_enable_regmap' mangled-name='regulator_enable_regmap' filepath='drivers/regulator/helpers.c' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_enable_regmap'>
         <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='59' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_force_disable' mangled-name='regulator_force_disable' filepath='drivers/regulator/core.c' line='2957' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_force_disable'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='2957' column='1'/>
+      <function-decl name='regulator_force_disable' mangled-name='regulator_force_disable' filepath='drivers/regulator/core.c' line='2955' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_force_disable'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='2955' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_get' mangled-name='regulator_get' filepath='drivers/regulator/core.c' line='2143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/regulator/core.c' line='2143' column='1'/>
-        <parameter type-id='80f4b756' name='id' filepath='drivers/regulator/core.c' line='2143' column='1'/>
+      <function-decl name='regulator_get' mangled-name='regulator_get' filepath='drivers/regulator/core.c' line='2141' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/regulator/core.c' line='2141' column='1'/>
+        <parameter type-id='80f4b756' name='id' filepath='drivers/regulator/core.c' line='2141' column='1'/>
         <return type-id='850c13f6'/>
       </function-decl>
       <function-decl name='regulator_get_bypass_regmap' mangled-name='regulator_get_bypass_regmap' filepath='drivers/regulator/helpers.c' line='722' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_bypass_regmap'>
@@ -141710,60 +141724,60 @@
         <parameter type-id='d8e6b335' name='enable' filepath='drivers/regulator/helpers.c' line='722' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_get_current_limit' mangled-name='regulator_get_current_limit' filepath='drivers/regulator/core.c' line='4391' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_current_limit'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4391' column='1'/>
+      <function-decl name='regulator_get_current_limit' mangled-name='regulator_get_current_limit' filepath='drivers/regulator/core.c' line='4389' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_current_limit'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4389' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_get_current_limit_regmap' mangled-name='regulator_get_current_limit_regmap' filepath='drivers/regulator/helpers.c' line='827' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_current_limit_regmap'>
         <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='827' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_get_drvdata' mangled-name='regulator_get_drvdata' filepath='drivers/regulator/core.c' line='5647' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_drvdata'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='5647' column='1'/>
+      <function-decl name='regulator_get_drvdata' mangled-name='regulator_get_drvdata' filepath='drivers/regulator/core.c' line='5639' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_drvdata'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='5639' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='regulator_get_linear_step' mangled-name='regulator_get_linear_step' filepath='drivers/regulator/core.c' line='3246' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_linear_step'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3246' column='1'/>
+      <function-decl name='regulator_get_linear_step' mangled-name='regulator_get_linear_step' filepath='drivers/regulator/core.c' line='3244' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_linear_step'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3244' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='regulator_get_mode' mangled-name='regulator_get_mode' filepath='drivers/regulator/core.c' line='4469' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_mode'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4469' column='1'/>
+      <function-decl name='regulator_get_mode' mangled-name='regulator_get_mode' filepath='drivers/regulator/core.c' line='4467' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_mode'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4467' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='regulator_get_optional' mangled-name='regulator_get_optional' filepath='drivers/regulator/core.c' line='2196' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_optional'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/regulator/core.c' line='2196' column='1'/>
-        <parameter type-id='80f4b756' name='id' filepath='drivers/regulator/core.c' line='2196' column='1'/>
+      <function-decl name='regulator_get_optional' mangled-name='regulator_get_optional' filepath='drivers/regulator/core.c' line='2194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_optional'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/regulator/core.c' line='2194' column='1'/>
+        <parameter type-id='80f4b756' name='id' filepath='drivers/regulator/core.c' line='2194' column='1'/>
         <return type-id='850c13f6'/>
       </function-decl>
-      <function-decl name='regulator_get_voltage' mangled-name='regulator_get_voltage' filepath='drivers/regulator/core.c' line='4307' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_voltage'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4307' column='1'/>
+      <function-decl name='regulator_get_voltage' mangled-name='regulator_get_voltage' filepath='drivers/regulator/core.c' line='4305' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_voltage'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4305' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_get_voltage_rdev' mangled-name='regulator_get_voltage_rdev' filepath='drivers/regulator/core.c' line='4252' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_voltage_rdev'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='4252' column='1'/>
+      <function-decl name='regulator_get_voltage_rdev' mangled-name='regulator_get_voltage_rdev' filepath='drivers/regulator/core.c' line='4250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_voltage_rdev'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='4250' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_get_voltage_sel_regmap' mangled-name='regulator_get_voltage_sel_regmap' filepath='drivers/regulator/helpers.c' line='235' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_voltage_sel_regmap'>
         <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='235' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_is_enabled' mangled-name='regulator_is_enabled' filepath='drivers/regulator/core.c' line='3115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_is_enabled'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3115' column='1'/>
+      <function-decl name='regulator_is_enabled' mangled-name='regulator_is_enabled' filepath='drivers/regulator/core.c' line='3113' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_is_enabled'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3113' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_is_enabled_regmap' mangled-name='regulator_is_enabled_regmap' filepath='drivers/regulator/helpers.c' line='27' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_is_enabled_regmap'>
         <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='27' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_is_supported_voltage' mangled-name='regulator_is_supported_voltage' filepath='drivers/regulator/core.c' line='3263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_is_supported_voltage'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3263' column='1'/>
-        <parameter type-id='95e97e5e' name='min_uV' filepath='drivers/regulator/core.c' line='3264' column='1'/>
-        <parameter type-id='95e97e5e' name='max_uV' filepath='drivers/regulator/core.c' line='3264' column='1'/>
+      <function-decl name='regulator_is_supported_voltage' mangled-name='regulator_is_supported_voltage' filepath='drivers/regulator/core.c' line='3261' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_is_supported_voltage'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3261' column='1'/>
+        <parameter type-id='95e97e5e' name='min_uV' filepath='drivers/regulator/core.c' line='3262' column='1'/>
+        <parameter type-id='95e97e5e' name='max_uV' filepath='drivers/regulator/core.c' line='3262' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_list_voltage' mangled-name='regulator_list_voltage' filepath='drivers/regulator/core.c' line='3162' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_list_voltage'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3162' column='1'/>
-        <parameter type-id='f0981eeb' name='selector' filepath='drivers/regulator/core.c' line='3162' column='1'/>
+      <function-decl name='regulator_list_voltage' mangled-name='regulator_list_voltage' filepath='drivers/regulator/core.c' line='3160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_list_voltage'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3160' column='1'/>
+        <parameter type-id='f0981eeb' name='selector' filepath='drivers/regulator/core.c' line='3160' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_list_voltage_linear' mangled-name='regulator_list_voltage_linear' filepath='drivers/regulator/helpers.c' line='521' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_list_voltage_linear'>
@@ -141805,24 +141819,24 @@
         <parameter type-id='95e97e5e' name='max_uV' filepath='drivers/regulator/helpers.c' line='408' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_notifier_call_chain' mangled-name='regulator_notifier_call_chain' filepath='drivers/regulator/core.c' line='4871' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_notifier_call_chain'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='4871' column='1'/>
-        <parameter type-id='7359adad' name='event' filepath='drivers/regulator/core.c' line='4872' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/regulator/core.c' line='4872' column='1'/>
+      <function-decl name='regulator_notifier_call_chain' mangled-name='regulator_notifier_call_chain' filepath='drivers/regulator/core.c' line='4869' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_notifier_call_chain'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='4869' column='1'/>
+        <parameter type-id='7359adad' name='event' filepath='drivers/regulator/core.c' line='4870' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/regulator/core.c' line='4870' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_put' mangled-name='regulator_put' filepath='drivers/regulator/core.c' line='2256' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_put'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='2256' column='1'/>
+      <function-decl name='regulator_put' mangled-name='regulator_put' filepath='drivers/regulator/core.c' line='2254' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_put'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='2254' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='regulator_register' mangled-name='regulator_register' filepath='drivers/regulator/core.c' line='5265' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_register'>
-        <parameter type-id='5629bd41' name='regulator_desc' filepath='drivers/regulator/core.c' line='5265' column='1'/>
-        <parameter type-id='661ccd0c' name='cfg' filepath='drivers/regulator/core.c' line='5266' column='1'/>
+      <function-decl name='regulator_register' mangled-name='regulator_register' filepath='drivers/regulator/core.c' line='5261' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_register'>
+        <parameter type-id='5629bd41' name='regulator_desc' filepath='drivers/regulator/core.c' line='5261' column='1'/>
+        <parameter type-id='661ccd0c' name='cfg' filepath='drivers/regulator/core.c' line='5262' column='1'/>
         <return type-id='43c38462'/>
       </function-decl>
-      <function-decl name='regulator_register_notifier' mangled-name='regulator_register_notifier' filepath='drivers/regulator/core.c' line='4630' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_register_notifier'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4630' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/regulator/core.c' line='4631' column='1'/>
+      <function-decl name='regulator_register_notifier' mangled-name='regulator_register_notifier' filepath='drivers/regulator/core.c' line='4628' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_register_notifier'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4628' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/regulator/core.c' line='4629' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_set_active_discharge_regmap' mangled-name='regulator_set_active_discharge_regmap' filepath='drivers/regulator/helpers.c' line='748' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_active_discharge_regmap'>
@@ -141835,10 +141849,10 @@
         <parameter type-id='b50a4934' name='enable' filepath='drivers/regulator/helpers.c' line='663' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_set_current_limit' mangled-name='regulator_set_current_limit' filepath='drivers/regulator/core.c' line='4336' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_current_limit'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4336' column='1'/>
-        <parameter type-id='95e97e5e' name='min_uA' filepath='drivers/regulator/core.c' line='4337' column='1'/>
-        <parameter type-id='95e97e5e' name='max_uA' filepath='drivers/regulator/core.c' line='4337' column='1'/>
+      <function-decl name='regulator_set_current_limit' mangled-name='regulator_set_current_limit' filepath='drivers/regulator/core.c' line='4334' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_current_limit'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4334' column='1'/>
+        <parameter type-id='95e97e5e' name='min_uA' filepath='drivers/regulator/core.c' line='4335' column='1'/>
+        <parameter type-id='95e97e5e' name='max_uA' filepath='drivers/regulator/core.c' line='4335' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_set_current_limit_regmap' mangled-name='regulator_set_current_limit_regmap' filepath='drivers/regulator/helpers.c' line='775' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_current_limit_regmap'>
@@ -141847,24 +141861,24 @@
         <parameter type-id='95e97e5e' name='max_uA' filepath='drivers/regulator/helpers.c' line='776' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_set_load' mangled-name='regulator_set_load' filepath='drivers/regulator/core.c' line='4542' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_load'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4542' column='1'/>
-        <parameter type-id='95e97e5e' name='uA_load' filepath='drivers/regulator/core.c' line='4542' column='1'/>
+      <function-decl name='regulator_set_load' mangled-name='regulator_set_load' filepath='drivers/regulator/core.c' line='4540' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_load'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4540' column='1'/>
+        <parameter type-id='95e97e5e' name='uA_load' filepath='drivers/regulator/core.c' line='4540' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_set_mode' mangled-name='regulator_set_mode' filepath='drivers/regulator/core.c' line='4408' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_mode'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4408' column='1'/>
-        <parameter type-id='f0981eeb' name='mode' filepath='drivers/regulator/core.c' line='4408' column='1'/>
+      <function-decl name='regulator_set_mode' mangled-name='regulator_set_mode' filepath='drivers/regulator/core.c' line='4406' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_mode'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4406' column='1'/>
+        <parameter type-id='f0981eeb' name='mode' filepath='drivers/regulator/core.c' line='4406' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_set_pull_down_regmap' mangled-name='regulator_set_pull_down_regmap' filepath='drivers/regulator/helpers.c' line='703' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_pull_down_regmap'>
         <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='703' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_set_voltage' mangled-name='regulator_set_voltage' filepath='drivers/regulator/core.c' line='4022' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_voltage'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4022' column='1'/>
-        <parameter type-id='95e97e5e' name='min_uV' filepath='drivers/regulator/core.c' line='4022' column='1'/>
-        <parameter type-id='95e97e5e' name='max_uV' filepath='drivers/regulator/core.c' line='4022' column='1'/>
+      <function-decl name='regulator_set_voltage' mangled-name='regulator_set_voltage' filepath='drivers/regulator/core.c' line='4020' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_voltage'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4020' column='1'/>
+        <parameter type-id='95e97e5e' name='min_uV' filepath='drivers/regulator/core.c' line='4020' column='1'/>
+        <parameter type-id='95e97e5e' name='max_uV' filepath='drivers/regulator/core.c' line='4020' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_set_voltage_sel_regmap' mangled-name='regulator_set_voltage_sel_regmap' filepath='drivers/regulator/helpers.c' line='261' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_voltage_sel_regmap'>
@@ -141872,34 +141886,34 @@
         <parameter type-id='f0981eeb' name='sel' filepath='drivers/regulator/helpers.c' line='261' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_set_voltage_time' mangled-name='regulator_set_voltage_time' filepath='drivers/regulator/core.c' line='4132' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_voltage_time'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4132' column='1'/>
-        <parameter type-id='95e97e5e' name='old_uV' filepath='drivers/regulator/core.c' line='4133' column='1'/>
-        <parameter type-id='95e97e5e' name='new_uV' filepath='drivers/regulator/core.c' line='4133' column='1'/>
+      <function-decl name='regulator_set_voltage_time' mangled-name='regulator_set_voltage_time' filepath='drivers/regulator/core.c' line='4130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_voltage_time'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4130' column='1'/>
+        <parameter type-id='95e97e5e' name='old_uV' filepath='drivers/regulator/core.c' line='4131' column='1'/>
+        <parameter type-id='95e97e5e' name='new_uV' filepath='drivers/regulator/core.c' line='4131' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_set_voltage_time_sel' mangled-name='regulator_set_voltage_time_sel' filepath='drivers/regulator/core.c' line='4183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_voltage_time_sel'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='4183' column='1'/>
-        <parameter type-id='f0981eeb' name='old_selector' filepath='drivers/regulator/core.c' line='4184' column='1'/>
-        <parameter type-id='f0981eeb' name='new_selector' filepath='drivers/regulator/core.c' line='4185' column='1'/>
+      <function-decl name='regulator_set_voltage_time_sel' mangled-name='regulator_set_voltage_time_sel' filepath='drivers/regulator/core.c' line='4181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_voltage_time_sel'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='4181' column='1'/>
+        <parameter type-id='f0981eeb' name='old_selector' filepath='drivers/regulator/core.c' line='4182' column='1'/>
+        <parameter type-id='f0981eeb' name='new_selector' filepath='drivers/regulator/core.c' line='4183' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_suspend_enable' mangled-name='regulator_suspend_enable' filepath='drivers/regulator/core.c' line='4055' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_suspend_enable'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='4055' column='1'/>
-        <parameter type-id='e884daa5' name='state' filepath='drivers/regulator/core.c' line='4056' column='1'/>
+      <function-decl name='regulator_suspend_enable' mangled-name='regulator_suspend_enable' filepath='drivers/regulator/core.c' line='4053' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_suspend_enable'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='4053' column='1'/>
+        <parameter type-id='e884daa5' name='state' filepath='drivers/regulator/core.c' line='4054' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_sync_voltage' mangled-name='regulator_sync_voltage' filepath='drivers/regulator/core.c' line='4212' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_sync_voltage'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4212' column='1'/>
+      <function-decl name='regulator_sync_voltage' mangled-name='regulator_sync_voltage' filepath='drivers/regulator/core.c' line='4210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_sync_voltage'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4210' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_unregister' mangled-name='regulator_unregister' filepath='drivers/regulator/core.c' line='5512' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_unregister'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5512' column='1'/>
+      <function-decl name='regulator_unregister' mangled-name='regulator_unregister' filepath='drivers/regulator/core.c' line='5504' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_unregister'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5504' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='regulator_unregister_notifier' mangled-name='regulator_unregister_notifier' filepath='drivers/regulator/core.c' line='4645' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_unregister_notifier'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4645' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/regulator/core.c' line='4646' column='1'/>
+      <function-decl name='regulator_unregister_notifier' mangled-name='regulator_unregister_notifier' filepath='drivers/regulator/core.c' line='4643' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_unregister_notifier'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4643' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/regulator/core.c' line='4644' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='release_firmware' mangled-name='release_firmware' filepath='drivers/base/firmware_loader/main.c' line='1050' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_firmware'>
@@ -141911,8 +141925,8 @@
         <parameter type-id='95e97e5e' name='nr' filepath='mm/swap.c' line='1000' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='release_sock' mangled-name='release_sock' filepath='net/core/sock.c' line='3097' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_sock'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3097' column='1'/>
+      <function-decl name='release_sock' mangled-name='release_sock' filepath='net/core/sock.c' line='3112' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_sock'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3112' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='remap_pfn_range' mangled-name='remap_pfn_range' filepath='mm/memory.c' line='2356' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remap_pfn_range'>
@@ -141923,14 +141937,14 @@
         <parameter type-id='2e2dcbd3' name='prot' filepath='mm/memory.c' line='2357' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='remap_vmalloc_range' mangled-name='remap_vmalloc_range' filepath='mm/vmalloc.c' line='3085' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remap_vmalloc_range'>
-        <parameter type-id='2ae08426' name='vma' filepath='mm/vmalloc.c' line='3085' column='1'/>
-        <parameter type-id='eaa32e2f' name='addr' filepath='mm/vmalloc.c' line='3085' column='1'/>
-        <parameter type-id='7359adad' name='pgoff' filepath='mm/vmalloc.c' line='3086' column='1'/>
+      <function-decl name='remap_vmalloc_range' mangled-name='remap_vmalloc_range' filepath='mm/vmalloc.c' line='3089' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remap_vmalloc_range'>
+        <parameter type-id='2ae08426' name='vma' filepath='mm/vmalloc.c' line='3089' column='1'/>
+        <parameter type-id='eaa32e2f' name='addr' filepath='mm/vmalloc.c' line='3089' column='1'/>
+        <parameter type-id='7359adad' name='pgoff' filepath='mm/vmalloc.c' line='3090' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='remove_cpu' mangled-name='remove_cpu' filepath='kernel/cpu.c' line='1150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remove_cpu'>
-        <parameter type-id='f0981eeb' name='cpu' filepath='kernel/cpu.c' line='1150' column='1'/>
+      <function-decl name='remove_cpu' mangled-name='remove_cpu' filepath='kernel/cpu.c' line='1151' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remove_cpu'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='kernel/cpu.c' line='1151' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='remove_memory_subsection' mangled-name='remove_memory_subsection' filepath='mm/memory_hotplug.c' line='1845' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remove_memory_subsection'>
@@ -142037,8 +142051,8 @@
         <parameter type-id='775147d9' name='rcdev' filepath='drivers/reset/core.c' line='120' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='resume_cpus' mangled-name='resume_cpus' filepath='kernel/cpu.c' line='1332' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='resume_cpus'>
-        <parameter type-id='74bccedd' name='cpus' filepath='kernel/cpu.c' line='1332' column='1'/>
+      <function-decl name='resume_cpus' mangled-name='resume_cpus' filepath='kernel/cpu.c' line='1331' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='resume_cpus'>
+        <parameter type-id='74bccedd' name='cpus' filepath='kernel/cpu.c' line='1331' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='return_address' mangled-name='return_address' filepath='arch/arm64/kernel/return_address.c' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='return_address'>
@@ -142197,7 +142211,7 @@
         <return type-id='b50a4934'/>
       </function-decl>
       <var-decl name='root_mem_cgroup' type-id='223696fb' mangled-name='root_mem_cgroup' visibility='default' filepath='mm/memcontrol.c' line='75' column='1' elf-symbol-id='root_mem_cgroup'/>
-      <var-decl name='root_task_group' type-id='2d863538' mangled-name='root_task_group' visibility='default' filepath='kernel/sched/core.c' line='7444' column='1' elf-symbol-id='root_task_group'/>
+      <var-decl name='root_task_group' type-id='2d863538' mangled-name='root_task_group' visibility='default' filepath='kernel/sched/core.c' line='7448' column='1' elf-symbol-id='root_task_group'/>
       <function-decl name='round_jiffies' mangled-name='round_jiffies' filepath='kernel/time/timer.c' line='390' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='round_jiffies'>
         <parameter type-id='7359adad' name='j' filepath='kernel/time/timer.c' line='390' column='1'/>
         <return type-id='7359adad'/>
@@ -142236,8 +142250,13 @@
         <parameter type-id='a54c778f' name='wait' filepath='drivers/rpmsg/rpmsg_core.c' line='244' column='1'/>
         <return type-id='8f254b08'/>
       </function-decl>
-      <function-decl name='rpmsg_register_device' mangled-name='rpmsg_register_device' filepath='drivers/rpmsg/rpmsg_core.c' line='568' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rpmsg_register_device'>
-        <parameter type-id='41ebc58b' name='rpdev' filepath='drivers/rpmsg/rpmsg_core.c' line='568' column='1'/>
+      <function-decl name='rpmsg_register_device' mangled-name='rpmsg_register_device' filepath='drivers/rpmsg/rpmsg_core.c' line='611' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rpmsg_register_device'>
+        <parameter type-id='41ebc58b' name='rpdev' filepath='drivers/rpmsg/rpmsg_core.c' line='611' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='rpmsg_register_device_override' mangled-name='rpmsg_register_device_override' filepath='drivers/rpmsg/rpmsg_core.c' line='573' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rpmsg_register_device_override'>
+        <parameter type-id='41ebc58b' name='rpdev' filepath='drivers/rpmsg/rpmsg_core.c' line='573' column='1'/>
+        <parameter type-id='80f4b756' name='driver_override' filepath='drivers/rpmsg/rpmsg_core.c' line='574' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='rpmsg_send' mangled-name='rpmsg_send' filepath='drivers/rpmsg/rpmsg_core.c' line='107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rpmsg_send'>
@@ -142272,9 +142291,9 @@
         <parameter type-id='19c2251e' name='dst' filepath='drivers/rpmsg/rpmsg_core.c' line='224' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rpmsg_unregister_device' mangled-name='rpmsg_unregister_device' filepath='drivers/rpmsg/rpmsg_core.c' line='592' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rpmsg_unregister_device'>
-        <parameter type-id='fa0b179b' name='parent' filepath='drivers/rpmsg/rpmsg_core.c' line='592' column='1'/>
-        <parameter type-id='cc769659' name='chinfo' filepath='drivers/rpmsg/rpmsg_core.c' line='593' column='1'/>
+      <function-decl name='rpmsg_unregister_device' mangled-name='rpmsg_unregister_device' filepath='drivers/rpmsg/rpmsg_core.c' line='621' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rpmsg_unregister_device'>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/rpmsg/rpmsg_core.c' line='621' column='1'/>
+        <parameter type-id='cc769659' name='chinfo' filepath='drivers/rpmsg/rpmsg_core.c' line='622' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='rproc_add' mangled-name='rproc_add' filepath='drivers/remoteproc/remoteproc_core.c' line='2076' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rproc_add'>
@@ -142430,8 +142449,8 @@
         <return type-id='4bdecfd7'/>
       </function-decl>
       <var-decl name='rps_needed' type-id='237c0d27' mangled-name='rps_needed' visibility='default' filepath='net/core/dev.c' line='4296' column='1' elf-symbol-id='rps_needed'/>
-      <function-decl name='rq_flush_dcache_pages' mangled-name='rq_flush_dcache_pages' filepath='block/blk-core.c' line='1536' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rq_flush_dcache_pages'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1536' column='1'/>
+      <function-decl name='rq_flush_dcache_pages' mangled-name='rq_flush_dcache_pages' filepath='block/blk-core.c' line='1534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rq_flush_dcache_pages'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1534' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rsa_parse_priv_key' mangled-name='rsa_parse_priv_key' filepath='crypto/rsa_helper.c' line='181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rsa_parse_priv_key'>
@@ -142664,43 +142683,43 @@
       </function-decl>
       <var-decl name='sched_feat_keys' type-id='9cc39ce1' mangled-name='sched_feat_keys' visibility='default' filepath='kernel/sched/debug.c' line='80' column='1' elf-symbol-id='sched_feat_keys'/>
       <var-decl name='sched_feat_names' type-id='3604aecf' mangled-name='sched_feat_names' visibility='default' filepath='kernel/sched/debug.c' line='51' column='1' elf-symbol-id='sched_feat_names'/>
-      <function-decl name='sched_set_fifo' mangled-name='sched_set_fifo' filepath='kernel/sched/core.c' line='5818' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_set_fifo'>
-        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5818' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='sched_set_fifo_low' mangled-name='sched_set_fifo_low' filepath='kernel/sched/core.c' line='5828' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_set_fifo_low'>
-        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5828' column='1'/>
-        <return type-id='48b5725f'/>
-      </function-decl>
-      <function-decl name='sched_set_normal' mangled-name='sched_set_normal' filepath='kernel/sched/core.c' line='5835' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_set_normal'>
+      <function-decl name='sched_set_fifo' mangled-name='sched_set_fifo' filepath='kernel/sched/core.c' line='5835' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_set_fifo'>
         <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5835' column='1'/>
-        <parameter type-id='95e97e5e' name='nice' filepath='kernel/sched/core.c' line='5835' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sched_setattr' mangled-name='sched_setattr' filepath='kernel/sched/core.c' line='5768' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_setattr'>
-        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5768' column='1'/>
-        <parameter type-id='8abbb6c3' name='attr' filepath='kernel/sched/core.c' line='5768' column='1'/>
+      <function-decl name='sched_set_fifo_low' mangled-name='sched_set_fifo_low' filepath='kernel/sched/core.c' line='5845' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_set_fifo_low'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5845' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='sched_set_normal' mangled-name='sched_set_normal' filepath='kernel/sched/core.c' line='5852' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_set_normal'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5852' column='1'/>
+        <parameter type-id='95e97e5e' name='nice' filepath='kernel/sched/core.c' line='5852' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='sched_setattr' mangled-name='sched_setattr' filepath='kernel/sched/core.c' line='5785' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_setattr'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5785' column='1'/>
+        <parameter type-id='8abbb6c3' name='attr' filepath='kernel/sched/core.c' line='5785' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sched_setattr_nocheck' mangled-name='sched_setattr_nocheck' filepath='kernel/sched/core.c' line='5774' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_setattr_nocheck'>
-        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5774' column='1'/>
-        <parameter type-id='8abbb6c3' name='attr' filepath='kernel/sched/core.c' line='5774' column='1'/>
+      <function-decl name='sched_setattr_nocheck' mangled-name='sched_setattr_nocheck' filepath='kernel/sched/core.c' line='5791' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_setattr_nocheck'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5791' column='1'/>
+        <parameter type-id='8abbb6c3' name='attr' filepath='kernel/sched/core.c' line='5791' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sched_setscheduler' mangled-name='sched_setscheduler' filepath='kernel/sched/core.c' line='5761' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_setscheduler'>
-        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5761' column='1'/>
-        <parameter type-id='95e97e5e' name='policy' filepath='kernel/sched/core.c' line='5761' column='1'/>
-        <parameter type-id='36fca399' name='param' filepath='kernel/sched/core.c' line='5762' column='1'/>
+      <function-decl name='sched_setscheduler' mangled-name='sched_setscheduler' filepath='kernel/sched/core.c' line='5778' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_setscheduler'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5778' column='1'/>
+        <parameter type-id='95e97e5e' name='policy' filepath='kernel/sched/core.c' line='5778' column='1'/>
+        <parameter type-id='36fca399' name='param' filepath='kernel/sched/core.c' line='5779' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sched_setscheduler_nocheck' mangled-name='sched_setscheduler_nocheck' filepath='kernel/sched/core.c' line='5793' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_setscheduler_nocheck'>
-        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5793' column='1'/>
-        <parameter type-id='95e97e5e' name='policy' filepath='kernel/sched/core.c' line='5793' column='1'/>
-        <parameter type-id='36fca399' name='param' filepath='kernel/sched/core.c' line='5794' column='1'/>
+      <function-decl name='sched_setscheduler_nocheck' mangled-name='sched_setscheduler_nocheck' filepath='kernel/sched/core.c' line='5810' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_setscheduler_nocheck'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5810' column='1'/>
+        <parameter type-id='95e97e5e' name='policy' filepath='kernel/sched/core.c' line='5810' column='1'/>
+        <parameter type-id='36fca399' name='param' filepath='kernel/sched/core.c' line='5811' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sched_show_task' mangled-name='sched_show_task' filepath='kernel/sched/core.c' line='6694' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_show_task'>
-        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='6694' column='1'/>
+      <function-decl name='sched_show_task' mangled-name='sched_show_task' filepath='kernel/sched/core.c' line='6711' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_show_task'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='6711' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sched_trace_cfs_rq_avg' mangled-name='sched_trace_cfs_rq_avg' filepath='kernel/sched/fair.c' line='11737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_cfs_rq_avg'>
@@ -143415,36 +143434,36 @@
         <parameter type-id='b26c7631' name='p' filepath='drivers/tty/serial/8250/8250_port.c' line='549' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_do_pm' mangled-name='serial8250_do_pm' filepath='drivers/tty/serial/8250/8250_port.c' line='2889' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_pm'>
-        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2889' column='1'/>
-        <parameter type-id='f0981eeb' name='state' filepath='drivers/tty/serial/8250/8250_port.c' line='2889' column='1'/>
-        <parameter type-id='f0981eeb' name='oldstate' filepath='drivers/tty/serial/8250/8250_port.c' line='2890' column='1'/>
+      <function-decl name='serial8250_do_pm' mangled-name='serial8250_do_pm' filepath='drivers/tty/serial/8250/8250_port.c' line='2892' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_pm'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2892' column='1'/>
+        <parameter type-id='f0981eeb' name='state' filepath='drivers/tty/serial/8250/8250_port.c' line='2892' column='1'/>
+        <parameter type-id='f0981eeb' name='oldstate' filepath='drivers/tty/serial/8250/8250_port.c' line='2893' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_do_set_divisor' mangled-name='serial8250_do_set_divisor' filepath='drivers/tty/serial/8250/8250_port.c' line='2592' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_set_divisor'>
-        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2592' column='1'/>
-        <parameter type-id='f0981eeb' name='baud' filepath='drivers/tty/serial/8250/8250_port.c' line='2592' column='1'/>
-        <parameter type-id='f0981eeb' name='quot' filepath='drivers/tty/serial/8250/8250_port.c' line='2593' column='1'/>
-        <parameter type-id='f0981eeb' name='quot_frac' filepath='drivers/tty/serial/8250/8250_port.c' line='2593' column='1'/>
+      <function-decl name='serial8250_do_set_divisor' mangled-name='serial8250_do_set_divisor' filepath='drivers/tty/serial/8250/8250_port.c' line='2595' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_set_divisor'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2595' column='1'/>
+        <parameter type-id='f0981eeb' name='baud' filepath='drivers/tty/serial/8250/8250_port.c' line='2595' column='1'/>
+        <parameter type-id='f0981eeb' name='quot' filepath='drivers/tty/serial/8250/8250_port.c' line='2596' column='1'/>
+        <parameter type-id='f0981eeb' name='quot_frac' filepath='drivers/tty/serial/8250/8250_port.c' line='2596' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_do_set_ldisc' mangled-name='serial8250_do_set_ldisc' filepath='drivers/tty/serial/8250/8250_port.c' line='2862' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_set_ldisc'>
-        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2862' column='1'/>
-        <parameter type-id='e55856e5' name='termios' filepath='drivers/tty/serial/8250/8250_port.c' line='2862' column='1'/>
+      <function-decl name='serial8250_do_set_ldisc' mangled-name='serial8250_do_set_ldisc' filepath='drivers/tty/serial/8250/8250_port.c' line='2865' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_set_ldisc'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2865' column='1'/>
+        <parameter type-id='e55856e5' name='termios' filepath='drivers/tty/serial/8250/8250_port.c' line='2865' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_do_set_termios' mangled-name='serial8250_do_set_termios' filepath='drivers/tty/serial/8250/8250_port.c' line='2715' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_set_termios'>
-        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2715' column='1'/>
-        <parameter type-id='e55856e5' name='termios' filepath='drivers/tty/serial/8250/8250_port.c' line='2715' column='1'/>
-        <parameter type-id='e55856e5' name='old' filepath='drivers/tty/serial/8250/8250_port.c' line='2716' column='1'/>
+      <function-decl name='serial8250_do_set_termios' mangled-name='serial8250_do_set_termios' filepath='drivers/tty/serial/8250/8250_port.c' line='2718' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_set_termios'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2718' column='1'/>
+        <parameter type-id='e55856e5' name='termios' filepath='drivers/tty/serial/8250/8250_port.c' line='2718' column='1'/>
+        <parameter type-id='e55856e5' name='old' filepath='drivers/tty/serial/8250/8250_port.c' line='2719' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_do_shutdown' mangled-name='serial8250_do_shutdown' filepath='drivers/tty/serial/8250/8250_port.c' line='2440' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_shutdown'>
-        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2440' column='1'/>
+      <function-decl name='serial8250_do_shutdown' mangled-name='serial8250_do_shutdown' filepath='drivers/tty/serial/8250/8250_port.c' line='2443' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_shutdown'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2443' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_do_startup' mangled-name='serial8250_do_startup' filepath='drivers/tty/serial/8250/8250_port.c' line='2154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_startup'>
-        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2154' column='1'/>
+      <function-decl name='serial8250_do_startup' mangled-name='serial8250_do_startup' filepath='drivers/tty/serial/8250/8250_port.c' line='2157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_startup'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2157' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='serial8250_get_port' mangled-name='serial8250_get_port' filepath='drivers/tty/serial/8250/8250_core.c' line='412' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_get_port'>
@@ -143480,9 +143499,9 @@
         <parameter type-id='95e97e5e' name='line' filepath='drivers/tty/serial/8250/8250_core.c' line='1142' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_update_uartclk' mangled-name='serial8250_update_uartclk' filepath='drivers/tty/serial/8250/8250_port.c' line='2663' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_update_uartclk'>
-        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2663' column='1'/>
-        <parameter type-id='f0981eeb' name='uartclk' filepath='drivers/tty/serial/8250/8250_port.c' line='2663' column='1'/>
+      <function-decl name='serial8250_update_uartclk' mangled-name='serial8250_update_uartclk' filepath='drivers/tty/serial/8250/8250_port.c' line='2666' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_update_uartclk'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2666' column='1'/>
+        <parameter type-id='f0981eeb' name='uartclk' filepath='drivers/tty/serial/8250/8250_port.c' line='2666' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='serio_close' mangled-name='serio_close' filepath='drivers/input/serio/serio.c' line='984' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serio_close'>
@@ -143758,21 +143777,21 @@
         <parameter type-id='9414c4b6' name='inst' filepath='crypto/shash.c' line='604' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='shmem_file_setup' mangled-name='shmem_file_setup' filepath='mm/shmem.c' line='4211' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shmem_file_setup'>
-        <parameter type-id='80f4b756' name='name' filepath='mm/shmem.c' line='4211' column='1'/>
-        <parameter type-id='69bf7bee' name='size' filepath='mm/shmem.c' line='4211' column='1'/>
-        <parameter type-id='7359adad' name='flags' filepath='mm/shmem.c' line='4211' column='1'/>
+      <function-decl name='shmem_file_setup' mangled-name='shmem_file_setup' filepath='mm/shmem.c' line='4231' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shmem_file_setup'>
+        <parameter type-id='80f4b756' name='name' filepath='mm/shmem.c' line='4231' column='1'/>
+        <parameter type-id='69bf7bee' name='size' filepath='mm/shmem.c' line='4231' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='mm/shmem.c' line='4231' column='1'/>
         <return type-id='77e79a4b'/>
       </function-decl>
-      <function-decl name='shmem_mark_page_lazyfree' mangled-name='shmem_mark_page_lazyfree' filepath='mm/shmem.c' line='4304' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shmem_mark_page_lazyfree'>
-        <parameter type-id='02f11ed4' name='page' filepath='mm/shmem.c' line='4304' column='1'/>
-        <parameter type-id='b50a4934' name='tail' filepath='mm/shmem.c' line='4304' column='1'/>
+      <function-decl name='shmem_mark_page_lazyfree' mangled-name='shmem_mark_page_lazyfree' filepath='mm/shmem.c' line='4324' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shmem_mark_page_lazyfree'>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/shmem.c' line='4324' column='1'/>
+        <parameter type-id='b50a4934' name='tail' filepath='mm/shmem.c' line='4324' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='shmem_read_mapping_page_gfp' mangled-name='shmem_read_mapping_page_gfp' filepath='mm/shmem.c' line='4279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shmem_read_mapping_page_gfp'>
-        <parameter type-id='f57039f0' name='mapping' filepath='mm/shmem.c' line='4279' column='1'/>
-        <parameter type-id='7359adad' name='index' filepath='mm/shmem.c' line='4280' column='1'/>
-        <parameter type-id='3eb7c31c' name='gfp' filepath='mm/shmem.c' line='4280' column='1'/>
+      <function-decl name='shmem_read_mapping_page_gfp' mangled-name='shmem_read_mapping_page_gfp' filepath='mm/shmem.c' line='4299' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shmem_read_mapping_page_gfp'>
+        <parameter type-id='f57039f0' name='mapping' filepath='mm/shmem.c' line='4299' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='mm/shmem.c' line='4300' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='mm/shmem.c' line='4300' column='1'/>
         <return type-id='02f11ed4'/>
       </function-decl>
       <function-decl name='shmem_truncate_range' mangled-name='shmem_truncate_range' filepath='mm/shmem.c' line='1068' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shmem_truncate_range'>
@@ -143913,16 +143932,16 @@
         <parameter type-id='77e79a4b' name='file' filepath='fs/seq_file.c' line='600' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sk_alloc' mangled-name='sk_alloc' filepath='net/core/sock.c' line='1748' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_alloc'>
-        <parameter type-id='a2bff676' name='net' filepath='net/core/sock.c' line='1748' column='1'/>
-        <parameter type-id='95e97e5e' name='family' filepath='net/core/sock.c' line='1748' column='1'/>
-        <parameter type-id='3eb7c31c' name='priority' filepath='net/core/sock.c' line='1748' column='1'/>
-        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='1749' column='1'/>
-        <parameter type-id='95e97e5e' name='kern' filepath='net/core/sock.c' line='1749' column='1'/>
+      <function-decl name='sk_alloc' mangled-name='sk_alloc' filepath='net/core/sock.c' line='1752' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_alloc'>
+        <parameter type-id='a2bff676' name='net' filepath='net/core/sock.c' line='1752' column='1'/>
+        <parameter type-id='95e97e5e' name='family' filepath='net/core/sock.c' line='1752' column='1'/>
+        <parameter type-id='3eb7c31c' name='priority' filepath='net/core/sock.c' line='1752' column='1'/>
+        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='1753' column='1'/>
+        <parameter type-id='95e97e5e' name='kern' filepath='net/core/sock.c' line='1753' column='1'/>
         <return type-id='f772df6d'/>
       </function-decl>
-      <function-decl name='sk_free' mangled-name='sk_free' filepath='net/core/sock.c' line='1851' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_free'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='1851' column='1'/>
+      <function-decl name='sk_free' mangled-name='sk_free' filepath='net/core/sock.c' line='1855' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_free'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='1855' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='skb_add_rx_frag' mangled-name='skb_add_rx_frag' filepath='net/core/skbuff.c' line='557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_add_rx_frag'>
@@ -143957,8 +143976,8 @@
         <parameter type-id='3eb7c31c' name='gfp_mask' filepath='net/core/skbuff.c' line='1440' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='skb_clone_sk' mangled-name='skb_clone_sk' filepath='net/core/skbuff.c' line='4658' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_clone_sk'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='4658' column='1'/>
+      <function-decl name='skb_clone_sk' mangled-name='skb_clone_sk' filepath='net/core/skbuff.c' line='4669' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_clone_sk'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='4669' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
       <function-decl name='skb_coalesce_rx_frag' mangled-name='skb_coalesce_rx_frag' filepath='net/core/skbuff.c' line='567' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_coalesce_rx_frag'>
@@ -143968,9 +143987,9 @@
         <parameter type-id='f0981eeb' name='truesize' filepath='net/core/skbuff.c' line='568' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='skb_complete_wifi_ack' mangled-name='skb_complete_wifi_ack' filepath='net/core/skbuff.c' line='4808' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_complete_wifi_ack'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='4808' column='1'/>
-        <parameter type-id='b50a4934' name='acked' filepath='net/core/skbuff.c' line='4808' column='1'/>
+      <function-decl name='skb_complete_wifi_ack' mangled-name='skb_complete_wifi_ack' filepath='net/core/skbuff.c' line='4819' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_complete_wifi_ack'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='4819' column='1'/>
+        <parameter type-id='b50a4934' name='acked' filepath='net/core/skbuff.c' line='4819' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='skb_copy' mangled-name='skb_copy' filepath='net/core/skbuff.c' line='1519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_copy'>
@@ -144025,9 +144044,9 @@
         <parameter type-id='b50a4934' name='full_pkt' filepath='net/core/skbuff.c' line='733' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='skb_ensure_writable' mangled-name='skb_ensure_writable' filepath='net/core/skbuff.c' line='5528' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_ensure_writable'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='5528' column='1'/>
-        <parameter type-id='95e97e5e' name='write_len' filepath='net/core/skbuff.c' line='5528' column='1'/>
+      <function-decl name='skb_ensure_writable' mangled-name='skb_ensure_writable' filepath='net/core/skbuff.c' line='5539' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_ensure_writable'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='5539' column='1'/>
+        <parameter type-id='95e97e5e' name='write_len' filepath='net/core/skbuff.c' line='5539' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='skb_free_datagram' mangled-name='skb_free_datagram' filepath='net/core/datagram.c' line='323' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_free_datagram'>
@@ -144035,16 +144054,16 @@
         <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/datagram.c' line='323' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='skb_page_frag_refill' mangled-name='skb_page_frag_refill' filepath='net/core/sock.c' line='2471' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_page_frag_refill'>
-        <parameter type-id='f0981eeb' name='sz' filepath='net/core/sock.c' line='2471' column='1'/>
-        <parameter type-id='a8d434b7' name='pfrag' filepath='net/core/sock.c' line='2471' column='1'/>
-        <parameter type-id='3eb7c31c' name='gfp' filepath='net/core/sock.c' line='2471' column='1'/>
+      <function-decl name='skb_page_frag_refill' mangled-name='skb_page_frag_refill' filepath='net/core/sock.c' line='2486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_page_frag_refill'>
+        <parameter type-id='f0981eeb' name='sz' filepath='net/core/sock.c' line='2486' column='1'/>
+        <parameter type-id='a8d434b7' name='pfrag' filepath='net/core/sock.c' line='2486' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='net/core/sock.c' line='2486' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='skb_partial_csum_set' mangled-name='skb_partial_csum_set' filepath='net/core/skbuff.c' line='4846' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_partial_csum_set'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='4846' column='1'/>
-        <parameter type-id='1dc6a898' name='start' filepath='net/core/skbuff.c' line='4846' column='1'/>
-        <parameter type-id='1dc6a898' name='off' filepath='net/core/skbuff.c' line='4846' column='1'/>
+      <function-decl name='skb_partial_csum_set' mangled-name='skb_partial_csum_set' filepath='net/core/skbuff.c' line='4857' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_partial_csum_set'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='4857' column='1'/>
+        <parameter type-id='1dc6a898' name='start' filepath='net/core/skbuff.c' line='4857' column='1'/>
+        <parameter type-id='1dc6a898' name='off' filepath='net/core/skbuff.c' line='4857' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='skb_pull' mangled-name='skb_pull' filepath='net/core/skbuff.c' line='1941' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_pull'>
@@ -144093,9 +144112,9 @@
         <parameter type-id='7292109c' name='err' filepath='net/core/datagram.c' line='313' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='skb_set_owner_w' mangled-name='skb_set_owner_w' filepath='net/core/sock.c' line='2087' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_set_owner_w'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2087' column='1'/>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2087' column='1'/>
+      <function-decl name='skb_set_owner_w' mangled-name='skb_set_owner_w' filepath='net/core/sock.c' line='2091' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_set_owner_w'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2091' column='1'/>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2091' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='skb_store_bits' mangled-name='skb_store_bits' filepath='net/core/skbuff.c' line='2600' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_store_bits'>
@@ -144105,11 +144124,11 @@
         <parameter type-id='95e97e5e' name='len' filepath='net/core/skbuff.c' line='2600' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='skb_to_sgvec' mangled-name='skb_to_sgvec' filepath='net/core/skbuff.c' line='4421' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_to_sgvec'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='4421' column='1'/>
-        <parameter type-id='bf3ef905' name='sg' filepath='net/core/skbuff.c' line='4421' column='1'/>
-        <parameter type-id='95e97e5e' name='offset' filepath='net/core/skbuff.c' line='4421' column='1'/>
-        <parameter type-id='95e97e5e' name='len' filepath='net/core/skbuff.c' line='4421' column='1'/>
+      <function-decl name='skb_to_sgvec' mangled-name='skb_to_sgvec' filepath='net/core/skbuff.c' line='4432' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_to_sgvec'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='4432' column='1'/>
+        <parameter type-id='bf3ef905' name='sg' filepath='net/core/skbuff.c' line='4432' column='1'/>
+        <parameter type-id='95e97e5e' name='offset' filepath='net/core/skbuff.c' line='4432' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='net/core/skbuff.c' line='4432' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='skb_trim' mangled-name='skb_trim' filepath='net/core/skbuff.c' line='1956' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_trim'>
@@ -144117,9 +144136,9 @@
         <parameter type-id='f0981eeb' name='len' filepath='net/core/skbuff.c' line='1956' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='skb_tstamp_tx' mangled-name='skb_tstamp_tx' filepath='net/core/skbuff.c' line='4800' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_tstamp_tx'>
-        <parameter type-id='0fbf3cfd' name='orig_skb' filepath='net/core/skbuff.c' line='4800' column='1'/>
-        <parameter type-id='68197365' name='hwtstamps' filepath='net/core/skbuff.c' line='4801' column='1'/>
+      <function-decl name='skb_tstamp_tx' mangled-name='skb_tstamp_tx' filepath='net/core/skbuff.c' line='4811' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_tstamp_tx'>
+        <parameter type-id='0fbf3cfd' name='orig_skb' filepath='net/core/skbuff.c' line='4811' column='1'/>
+        <parameter type-id='68197365' name='hwtstamps' filepath='net/core/skbuff.c' line='4812' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='skb_unlink' mangled-name='skb_unlink' filepath='net/core/skbuff.c' line='3214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_unlink'>
@@ -144599,8 +144618,8 @@
         <parameter type-id='2ae08426' name='area' filepath='sound/core/pcm_native.c' line='3783' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_lib_free_pages' mangled-name='snd_pcm_lib_free_pages' filepath='sound/core/pcm_memory.c' line='435' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_free_pages'>
-        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_memory.c' line='435' column='1'/>
+      <function-decl name='snd_pcm_lib_free_pages' mangled-name='snd_pcm_lib_free_pages' filepath='sound/core/pcm_memory.c' line='463' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_free_pages'>
+        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_memory.c' line='463' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_pcm_lib_ioctl' mangled-name='snd_pcm_lib_ioctl' filepath='sound/core/pcm_lib.c' line='1765' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_ioctl'>
@@ -144609,29 +144628,29 @@
         <parameter type-id='eaa32e2f' name='arg' filepath='sound/core/pcm_lib.c' line='1766' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_lib_malloc_pages' mangled-name='snd_pcm_lib_malloc_pages' filepath='sound/core/pcm_memory.c' line='381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_malloc_pages'>
-        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_memory.c' line='381' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='sound/core/pcm_memory.c' line='381' column='1'/>
+      <function-decl name='snd_pcm_lib_malloc_pages' mangled-name='snd_pcm_lib_malloc_pages' filepath='sound/core/pcm_memory.c' line='409' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_malloc_pages'>
+        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_memory.c' line='409' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='sound/core/pcm_memory.c' line='409' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_lib_preallocate_free_for_all' mangled-name='snd_pcm_lib_preallocate_free_for_all' filepath='sound/core/pcm_memory.c' line='117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_preallocate_free_for_all'>
-        <parameter type-id='4c9f335b' name='pcm' filepath='sound/core/pcm_memory.c' line='117' column='1'/>
+      <function-decl name='snd_pcm_lib_preallocate_free_for_all' mangled-name='snd_pcm_lib_preallocate_free_for_all' filepath='sound/core/pcm_memory.c' line='145' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_preallocate_free_for_all'>
+        <parameter type-id='4c9f335b' name='pcm' filepath='sound/core/pcm_memory.c' line='145' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_pcm_lib_preallocate_pages' mangled-name='snd_pcm_lib_preallocate_pages' filepath='sound/core/pcm_memory.c' line='277' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_preallocate_pages'>
-        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_memory.c' line='277' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='sound/core/pcm_memory.c' line='278' column='1'/>
-        <parameter type-id='fa0b179b' name='data' filepath='sound/core/pcm_memory.c' line='278' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='sound/core/pcm_memory.c' line='279' column='1'/>
-        <parameter type-id='b59d7dce' name='max' filepath='sound/core/pcm_memory.c' line='279' column='1'/>
+      <function-decl name='snd_pcm_lib_preallocate_pages' mangled-name='snd_pcm_lib_preallocate_pages' filepath='sound/core/pcm_memory.c' line='305' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_preallocate_pages'>
+        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_memory.c' line='305' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='sound/core/pcm_memory.c' line='306' column='1'/>
+        <parameter type-id='fa0b179b' name='data' filepath='sound/core/pcm_memory.c' line='306' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='sound/core/pcm_memory.c' line='307' column='1'/>
+        <parameter type-id='b59d7dce' name='max' filepath='sound/core/pcm_memory.c' line='307' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_pcm_lib_preallocate_pages_for_all' mangled-name='snd_pcm_lib_preallocate_pages_for_all' filepath='sound/core/pcm_memory.c' line='296' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_preallocate_pages_for_all'>
-        <parameter type-id='4c9f335b' name='pcm' filepath='sound/core/pcm_memory.c' line='296' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='sound/core/pcm_memory.c' line='297' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='sound/core/pcm_memory.c' line='297' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='sound/core/pcm_memory.c' line='298' column='1'/>
-        <parameter type-id='b59d7dce' name='max' filepath='sound/core/pcm_memory.c' line='298' column='1'/>
+      <function-decl name='snd_pcm_lib_preallocate_pages_for_all' mangled-name='snd_pcm_lib_preallocate_pages_for_all' filepath='sound/core/pcm_memory.c' line='324' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_preallocate_pages_for_all'>
+        <parameter type-id='4c9f335b' name='pcm' filepath='sound/core/pcm_memory.c' line='324' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='sound/core/pcm_memory.c' line='325' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='sound/core/pcm_memory.c' line='325' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='sound/core/pcm_memory.c' line='326' column='1'/>
+        <parameter type-id='b59d7dce' name='max' filepath='sound/core/pcm_memory.c' line='326' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='snd_pcm_new' mangled-name='snd_pcm_new' filepath='sound/core/pcm.c' line='773' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_new'>
@@ -144663,12 +144682,12 @@
         <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_native.c' line='2683' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_pcm_set_managed_buffer_all' mangled-name='snd_pcm_set_managed_buffer_all' filepath='sound/core/pcm_memory.c' line='341' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_set_managed_buffer_all'>
-        <parameter type-id='4c9f335b' name='pcm' filepath='sound/core/pcm_memory.c' line='341' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='sound/core/pcm_memory.c' line='341' column='1'/>
-        <parameter type-id='fa0b179b' name='data' filepath='sound/core/pcm_memory.c' line='342' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='sound/core/pcm_memory.c' line='343' column='1'/>
-        <parameter type-id='b59d7dce' name='max' filepath='sound/core/pcm_memory.c' line='343' column='1'/>
+      <function-decl name='snd_pcm_set_managed_buffer_all' mangled-name='snd_pcm_set_managed_buffer_all' filepath='sound/core/pcm_memory.c' line='369' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_set_managed_buffer_all'>
+        <parameter type-id='4c9f335b' name='pcm' filepath='sound/core/pcm_memory.c' line='369' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='sound/core/pcm_memory.c' line='369' column='1'/>
+        <parameter type-id='fa0b179b' name='data' filepath='sound/core/pcm_memory.c' line='370' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='sound/core/pcm_memory.c' line='371' column='1'/>
+        <parameter type-id='b59d7dce' name='max' filepath='sound/core/pcm_memory.c' line='371' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='snd_pcm_set_ops' mangled-name='snd_pcm_set_ops' filepath='sound/core/pcm_lib.c' line='481' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_set_ops'>
@@ -145346,84 +145365,84 @@
         <parameter type-id='97eb1967' name='soc_dev' filepath='drivers/base/soc.c' line='172' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sock_alloc_send_pskb' mangled-name='sock_alloc_send_pskb' filepath='net/core/sock.c' line='2326' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_alloc_send_pskb'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2326' column='1'/>
-        <parameter type-id='7359adad' name='header_len' filepath='net/core/sock.c' line='2326' column='1'/>
-        <parameter type-id='7359adad' name='data_len' filepath='net/core/sock.c' line='2327' column='1'/>
-        <parameter type-id='95e97e5e' name='noblock' filepath='net/core/sock.c' line='2327' column='1'/>
-        <parameter type-id='7292109c' name='errcode' filepath='net/core/sock.c' line='2328' column='1'/>
-        <parameter type-id='95e97e5e' name='max_page_order' filepath='net/core/sock.c' line='2328' column='1'/>
+      <function-decl name='sock_alloc_send_pskb' mangled-name='sock_alloc_send_pskb' filepath='net/core/sock.c' line='2341' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_alloc_send_pskb'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2341' column='1'/>
+        <parameter type-id='7359adad' name='header_len' filepath='net/core/sock.c' line='2341' column='1'/>
+        <parameter type-id='7359adad' name='data_len' filepath='net/core/sock.c' line='2342' column='1'/>
+        <parameter type-id='95e97e5e' name='noblock' filepath='net/core/sock.c' line='2342' column='1'/>
+        <parameter type-id='7292109c' name='errcode' filepath='net/core/sock.c' line='2343' column='1'/>
+        <parameter type-id='95e97e5e' name='max_page_order' filepath='net/core/sock.c' line='2343' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='sock_alloc_send_skb' mangled-name='sock_alloc_send_skb' filepath='net/core/sock.c' line='2370' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_alloc_send_skb'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2370' column='1'/>
-        <parameter type-id='7359adad' name='size' filepath='net/core/sock.c' line='2370' column='1'/>
-        <parameter type-id='95e97e5e' name='noblock' filepath='net/core/sock.c' line='2371' column='1'/>
-        <parameter type-id='7292109c' name='errcode' filepath='net/core/sock.c' line='2371' column='1'/>
+      <function-decl name='sock_alloc_send_skb' mangled-name='sock_alloc_send_skb' filepath='net/core/sock.c' line='2385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_alloc_send_skb'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2385' column='1'/>
+        <parameter type-id='7359adad' name='size' filepath='net/core/sock.c' line='2385' column='1'/>
+        <parameter type-id='95e97e5e' name='noblock' filepath='net/core/sock.c' line='2386' column='1'/>
+        <parameter type-id='7292109c' name='errcode' filepath='net/core/sock.c' line='2386' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='sock_create_kern' mangled-name='sock_create_kern' filepath='net/socket.c' line='1484' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_create_kern'>
-        <parameter type-id='a2bff676' name='net' filepath='net/socket.c' line='1484' column='1'/>
-        <parameter type-id='95e97e5e' name='family' filepath='net/socket.c' line='1484' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='net/socket.c' line='1484' column='1'/>
-        <parameter type-id='95e97e5e' name='protocol' filepath='net/socket.c' line='1484' column='1'/>
-        <parameter type-id='1a7bb5c8' name='res' filepath='net/socket.c' line='1484' column='1'/>
+      <function-decl name='sock_create_kern' mangled-name='sock_create_kern' filepath='net/socket.c' line='1501' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_create_kern'>
+        <parameter type-id='a2bff676' name='net' filepath='net/socket.c' line='1501' column='1'/>
+        <parameter type-id='95e97e5e' name='family' filepath='net/socket.c' line='1501' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='net/socket.c' line='1501' column='1'/>
+        <parameter type-id='95e97e5e' name='protocol' filepath='net/socket.c' line='1501' column='1'/>
+        <parameter type-id='1a7bb5c8' name='res' filepath='net/socket.c' line='1501' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_efree' mangled-name='sock_efree' filepath='net/core/sock.c' line='2157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_efree'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2157' column='1'/>
+      <function-decl name='sock_efree' mangled-name='sock_efree' filepath='net/core/sock.c' line='2161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_efree'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2161' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sock_gettstamp' mangled-name='sock_gettstamp' filepath='net/core/sock.c' line='3152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_gettstamp'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='3152' column='1'/>
-        <parameter type-id='eaa32e2f' name='userstamp' filepath='net/core/sock.c' line='3152' column='1'/>
-        <parameter type-id='b50a4934' name='timeval' filepath='net/core/sock.c' line='3153' column='1'/>
-        <parameter type-id='b50a4934' name='time32' filepath='net/core/sock.c' line='3153' column='1'/>
+      <function-decl name='sock_gettstamp' mangled-name='sock_gettstamp' filepath='net/core/sock.c' line='3167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_gettstamp'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='3167' column='1'/>
+        <parameter type-id='eaa32e2f' name='userstamp' filepath='net/core/sock.c' line='3167' column='1'/>
+        <parameter type-id='b50a4934' name='timeval' filepath='net/core/sock.c' line='3168' column='1'/>
+        <parameter type-id='b50a4934' name='time32' filepath='net/core/sock.c' line='3168' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_i_uid' mangled-name='sock_i_uid' filepath='net/core/sock.c' line='2175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_i_uid'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2175' column='1'/>
+      <function-decl name='sock_i_uid' mangled-name='sock_i_uid' filepath='net/core/sock.c' line='2179' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_i_uid'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2179' column='1'/>
         <return type-id='d80b72e6'/>
       </function-decl>
-      <function-decl name='sock_init_data' mangled-name='sock_init_data' filepath='net/core/sock.c' line='3071' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_init_data'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='3071' column='1'/>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3071' column='1'/>
+      <function-decl name='sock_init_data' mangled-name='sock_init_data' filepath='net/core/sock.c' line='3086' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_init_data'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='3086' column='1'/>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3086' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sock_no_accept' mangled-name='sock_no_accept' filepath='net/core/sock.c' line='2773' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_accept'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2773' column='1'/>
-        <parameter type-id='13103032' name='newsock' filepath='net/core/sock.c' line='2773' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='net/core/sock.c' line='2773' column='1'/>
-        <parameter type-id='b50a4934' name='kern' filepath='net/core/sock.c' line='2774' column='1'/>
+      <function-decl name='sock_no_accept' mangled-name='sock_no_accept' filepath='net/core/sock.c' line='2788' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_accept'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2788' column='1'/>
+        <parameter type-id='13103032' name='newsock' filepath='net/core/sock.c' line='2788' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/core/sock.c' line='2788' column='1'/>
+        <parameter type-id='b50a4934' name='kern' filepath='net/core/sock.c' line='2789' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_no_listen' mangled-name='sock_no_listen' filepath='net/core/sock.c' line='2793' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_listen'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2793' column='1'/>
-        <parameter type-id='95e97e5e' name='backlog' filepath='net/core/sock.c' line='2793' column='1'/>
+      <function-decl name='sock_no_listen' mangled-name='sock_no_listen' filepath='net/core/sock.c' line='2808' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_listen'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2808' column='1'/>
+        <parameter type-id='95e97e5e' name='backlog' filepath='net/core/sock.c' line='2808' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_no_mmap' mangled-name='sock_no_mmap' filepath='net/core/sock.c' line='2824' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_mmap'>
-        <parameter type-id='77e79a4b' name='file' filepath='net/core/sock.c' line='2824' column='1'/>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2824' column='1'/>
-        <parameter type-id='2ae08426' name='vma' filepath='net/core/sock.c' line='2824' column='1'/>
+      <function-decl name='sock_no_mmap' mangled-name='sock_no_mmap' filepath='net/core/sock.c' line='2839' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_mmap'>
+        <parameter type-id='77e79a4b' name='file' filepath='net/core/sock.c' line='2839' column='1'/>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2839' column='1'/>
+        <parameter type-id='2ae08426' name='vma' filepath='net/core/sock.c' line='2839' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_no_sendpage' mangled-name='sock_no_sendpage' filepath='net/core/sock.c' line='2852' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_sendpage'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2852' column='1'/>
-        <parameter type-id='02f11ed4' name='page' filepath='net/core/sock.c' line='2852' column='1'/>
-        <parameter type-id='95e97e5e' name='offset' filepath='net/core/sock.c' line='2852' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='net/core/sock.c' line='2852' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='net/core/sock.c' line='2852' column='1'/>
+      <function-decl name='sock_no_sendpage' mangled-name='sock_no_sendpage' filepath='net/core/sock.c' line='2867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_sendpage'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2867' column='1'/>
+        <parameter type-id='02f11ed4' name='page' filepath='net/core/sock.c' line='2867' column='1'/>
+        <parameter type-id='95e97e5e' name='offset' filepath='net/core/sock.c' line='2867' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='net/core/sock.c' line='2867' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/core/sock.c' line='2867' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='sock_no_shutdown' mangled-name='sock_no_shutdown' filepath='net/core/sock.c' line='2799' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_shutdown'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2799' column='1'/>
-        <parameter type-id='95e97e5e' name='how' filepath='net/core/sock.c' line='2799' column='1'/>
+      <function-decl name='sock_no_shutdown' mangled-name='sock_no_shutdown' filepath='net/core/sock.c' line='2814' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_shutdown'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2814' column='1'/>
+        <parameter type-id='95e97e5e' name='how' filepath='net/core/sock.c' line='2814' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_no_socketpair' mangled-name='sock_no_socketpair' filepath='net/core/sock.c' line='2767' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_socketpair'>
-        <parameter type-id='13103032' name='sock1' filepath='net/core/sock.c' line='2767' column='1'/>
-        <parameter type-id='13103032' name='sock2' filepath='net/core/sock.c' line='2767' column='1'/>
+      <function-decl name='sock_no_socketpair' mangled-name='sock_no_socketpair' filepath='net/core/sock.c' line='2782' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_socketpair'>
+        <parameter type-id='13103032' name='sock1' filepath='net/core/sock.c' line='2782' column='1'/>
+        <parameter type-id='13103032' name='sock2' filepath='net/core/sock.c' line='2782' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='sock_queue_rcv_skb' mangled-name='sock_queue_rcv_skb' filepath='net/core/sock.c' line='474' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_queue_rcv_skb'>
@@ -145431,34 +145450,34 @@
         <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='474' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_recvmsg' mangled-name='sock_recvmsg' filepath='net/socket.c' line='900' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_recvmsg'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='900' column='1'/>
-        <parameter type-id='6b9b777a' name='msg' filepath='net/socket.c' line='900' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='net/socket.c' line='900' column='1'/>
+      <function-decl name='sock_recvmsg' mangled-name='sock_recvmsg' filepath='net/socket.c' line='917' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_recvmsg'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='917' column='1'/>
+        <parameter type-id='6b9b777a' name='msg' filepath='net/socket.c' line='917' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/socket.c' line='917' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_register' mangled-name='sock_register' filepath='net/socket.c' line='2979' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_register'>
-        <parameter type-id='81a51edb' name='ops' filepath='net/socket.c' line='2979' column='1'/>
+      <function-decl name='sock_register' mangled-name='sock_register' filepath='net/socket.c' line='2996' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_register'>
+        <parameter type-id='81a51edb' name='ops' filepath='net/socket.c' line='2996' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='sock_release' mangled-name='sock_release' filepath='net/socket.c' line='623' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_release'>
         <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='623' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sock_setsockopt' mangled-name='sock_setsockopt' filepath='net/core/sock.c' line='832' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_setsockopt'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='832' column='1'/>
-        <parameter type-id='95e97e5e' name='level' filepath='net/core/sock.c' line='832' column='1'/>
-        <parameter type-id='95e97e5e' name='optname' filepath='net/core/sock.c' line='832' column='1'/>
-        <parameter type-id='298d29fd' name='optval' filepath='net/core/sock.c' line='833' column='1'/>
-        <parameter type-id='f0981eeb' name='optlen' filepath='net/core/sock.c' line='833' column='1'/>
+      <function-decl name='sock_setsockopt' mangled-name='sock_setsockopt' filepath='net/core/sock.c' line='833' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_setsockopt'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='833' column='1'/>
+        <parameter type-id='95e97e5e' name='level' filepath='net/core/sock.c' line='833' column='1'/>
+        <parameter type-id='95e97e5e' name='optname' filepath='net/core/sock.c' line='833' column='1'/>
+        <parameter type-id='298d29fd' name='optval' filepath='net/core/sock.c' line='834' column='1'/>
+        <parameter type-id='f0981eeb' name='optlen' filepath='net/core/sock.c' line='834' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_unregister' mangled-name='sock_unregister' filepath='net/socket.c' line='3016' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_unregister'>
-        <parameter type-id='95e97e5e' name='family' filepath='net/socket.c' line='3016' column='1'/>
+      <function-decl name='sock_unregister' mangled-name='sock_unregister' filepath='net/socket.c' line='3033' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_unregister'>
+        <parameter type-id='95e97e5e' name='family' filepath='net/socket.c' line='3033' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sock_wfree' mangled-name='sock_wfree' filepath='net/core/sock.c' line='2053' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_wfree'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2053' column='1'/>
+      <function-decl name='sock_wfree' mangled-name='sock_wfree' filepath='net/core/sock.c' line='2057' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_wfree'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2057' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sockfd_lookup' mangled-name='sockfd_lookup' filepath='net/socket.c' line='477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sockfd_lookup'>
@@ -145940,12 +145959,12 @@
         <parameter type-id='c485c22c' name='bh' filepath='fs/buffer.c' line='3086' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='submit_bio' mangled-name='submit_bio' filepath='block/blk-core.c' line='1079' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1079' column='1'/>
+      <function-decl name='submit_bio' mangled-name='submit_bio' filepath='block/blk-core.c' line='1077' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1077' column='1'/>
         <return type-id='041bc907'/>
       </function-decl>
-      <function-decl name='submit_bio_noacct' mangled-name='submit_bio_noacct' filepath='block/blk-core.c' line='1044' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_noacct'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1044' column='1'/>
+      <function-decl name='submit_bio_noacct' mangled-name='submit_bio_noacct' filepath='block/blk-core.c' line='1042' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_noacct'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1042' column='1'/>
         <return type-id='041bc907'/>
       </function-decl>
       <function-decl name='submit_bio_wait' mangled-name='submit_bio_wait' filepath='block/bio.c' line='1155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_wait'>
@@ -146024,13 +146043,13 @@
       <function-decl name='synchronize_rcu' mangled-name='synchronize_rcu' filepath='kernel/rcu/tree.c' line='3701' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='synchronize_rcu_expedited' mangled-name='synchronize_rcu_expedited' filepath='kernel/rcu/tree_exp.h' line='818' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu_expedited'>
+      <function-decl name='synchronize_rcu_expedited' mangled-name='synchronize_rcu_expedited' filepath='kernel/rcu/tree_exp.h' line='821' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu_expedited'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='synchronize_rcu_tasks' mangled-name='synchronize_rcu_tasks' filepath='kernel/rcu/tasks.h' line='554' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu_tasks'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='synchronize_rcu_tasks_trace' mangled-name='synchronize_rcu_tasks_trace' filepath='kernel/rcu/tasks.h' line='1191' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu_tasks_trace'>
+      <function-decl name='synchronize_rcu_tasks_trace' mangled-name='synchronize_rcu_tasks_trace' filepath='kernel/rcu/tasks.h' line='1194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu_tasks_trace'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='synchronize_srcu' mangled-name='synchronize_srcu' filepath='kernel/rcu/srcutree.c' line='1009' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_srcu'>
@@ -146213,7 +146232,7 @@
       <var-decl name='system_highpri_wq' type-id='242e3d19' mangled-name='system_highpri_wq' visibility='default' filepath='kernel/workqueue.c' line='349' column='1' elf-symbol-id='system_highpri_wq'/>
       <var-decl name='system_long_wq' type-id='242e3d19' mangled-name='system_long_wq' visibility='default' filepath='kernel/workqueue.c' line='351' column='1' elf-symbol-id='system_long_wq'/>
       <var-decl name='system_power_efficient_wq' type-id='242e3d19' mangled-name='system_power_efficient_wq' visibility='default' filepath='kernel/workqueue.c' line='357' column='1' elf-symbol-id='system_power_efficient_wq'/>
-      <var-decl name='system_state' type-id='2ead22b4' mangled-name='system_state' visibility='default' filepath='init/main.c' line='129' column='1' elf-symbol-id='system_state'/>
+      <var-decl name='system_state' type-id='2ead22b4' mangled-name='system_state' visibility='default' filepath='init/main.c' line='127' column='1' elf-symbol-id='system_state'/>
       <var-decl name='system_unbound_wq' type-id='242e3d19' mangled-name='system_unbound_wq' visibility='default' filepath='kernel/workqueue.c' line='353' column='1' elf-symbol-id='system_unbound_wq'/>
       <var-decl name='system_wq' type-id='242e3d19' mangled-name='system_wq' visibility='default' filepath='kernel/workqueue.c' line='347' column='1' elf-symbol-id='system_wq'/>
       <function-decl name='tag_pages_for_writeback' mangled-name='tag_pages_for_writeback' filepath='mm/page-writeback.c' line='2121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tag_pages_for_writeback'>
@@ -146226,7 +146245,7 @@
         <parameter type-id='f23e2572' name='tsk' filepath='kernel/pid.c' line='508' column='1'/>
         <return type-id='b816e1d0'/>
       </function-decl>
-      <var-decl name='task_groups' type-id='72f469ec' mangled-name='task_groups' visibility='default' filepath='kernel/sched/core.c' line='7446' column='1' elf-symbol-id='task_groups'/>
+      <var-decl name='task_groups' type-id='72f469ec' mangled-name='task_groups' visibility='default' filepath='kernel/sched/core.c' line='7450' column='1' elf-symbol-id='task_groups'/>
       <function-decl name='task_may_not_preempt' mangled-name='task_may_not_preempt' filepath='kernel/sched/rt.c' line='1484' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='task_may_not_preempt'>
         <parameter type-id='f23e2572' name='task' filepath='kernel/sched/rt.c' line='1484' column='1'/>
         <parameter type-id='95e97e5e' name='cpu' filepath='kernel/sched/rt.c' line='1484' column='1'/>
@@ -146295,12 +146314,12 @@
         <return type-id='b50a4934'/>
       </function-decl>
       <var-decl name='tcp_hashinfo' type-id='3482ac54' mangled-name='tcp_hashinfo' visibility='default' filepath='net/ipv4/tcp_ipv4.c' line='91' column='1' elf-symbol-id='tcp_hashinfo'/>
-      <function-decl name='tcp_parse_options' mangled-name='tcp_parse_options' filepath='net/ipv4/tcp_input.c' line='4003' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_parse_options'>
-        <parameter type-id='f91cf277' name='net' filepath='net/ipv4/tcp_input.c' line='4003' column='1'/>
-        <parameter type-id='11f4a000' name='skb' filepath='net/ipv4/tcp_input.c' line='4004' column='1'/>
-        <parameter type-id='61b9151d' name='opt_rx' filepath='net/ipv4/tcp_input.c' line='4005' column='1'/>
-        <parameter type-id='95e97e5e' name='estab' filepath='net/ipv4/tcp_input.c' line='4005' column='1'/>
-        <parameter type-id='f3a16a60' name='foc' filepath='net/ipv4/tcp_input.c' line='4006' column='1'/>
+      <function-decl name='tcp_parse_options' mangled-name='tcp_parse_options' filepath='net/ipv4/tcp_input.c' line='4022' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_parse_options'>
+        <parameter type-id='f91cf277' name='net' filepath='net/ipv4/tcp_input.c' line='4022' column='1'/>
+        <parameter type-id='11f4a000' name='skb' filepath='net/ipv4/tcp_input.c' line='4023' column='1'/>
+        <parameter type-id='61b9151d' name='opt_rx' filepath='net/ipv4/tcp_input.c' line='4024' column='1'/>
+        <parameter type-id='95e97e5e' name='estab' filepath='net/ipv4/tcp_input.c' line='4024' column='1'/>
+        <parameter type-id='f3a16a60' name='foc' filepath='net/ipv4/tcp_input.c' line='4025' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='tcp_register_congestion_control' mangled-name='tcp_register_congestion_control' filepath='net/ipv4/tcp_cong.c' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_register_congestion_control'>
@@ -146334,34 +146353,34 @@
         <parameter type-id='eefe253e' name='tcpci' filepath='drivers/usb/typec/tcpm/tcpci.c' line='64' column='1'/>
         <return type-id='426e425b'/>
       </function-decl>
-      <function-decl name='tcpci_irq' mangled-name='tcpci_irq' filepath='drivers/usb/typec/tcpm/tcpci.c' line='687' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpci_irq'>
-        <parameter type-id='eefe253e' name='tcpci' filepath='drivers/usb/typec/tcpm/tcpci.c' line='687' column='1'/>
+      <function-decl name='tcpci_irq' mangled-name='tcpci_irq' filepath='drivers/usb/typec/tcpm/tcpci.c' line='691' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpci_irq'>
+        <parameter type-id='eefe253e' name='tcpci' filepath='drivers/usb/typec/tcpm/tcpci.c' line='691' column='1'/>
         <return type-id='4bdecfd7'/>
       </function-decl>
-      <function-decl name='tcpci_register_port' mangled-name='tcpci_register_port' filepath='drivers/usb/typec/tcpm/tcpci.c' line='799' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpci_register_port'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/typec/tcpm/tcpci.c' line='799' column='1'/>
-        <parameter type-id='b6733265' name='data' filepath='drivers/usb/typec/tcpm/tcpci.c' line='799' column='1'/>
+      <function-decl name='tcpci_register_port' mangled-name='tcpci_register_port' filepath='drivers/usb/typec/tcpm/tcpci.c' line='803' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpci_register_port'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/typec/tcpm/tcpci.c' line='803' column='1'/>
+        <parameter type-id='b6733265' name='data' filepath='drivers/usb/typec/tcpm/tcpci.c' line='803' column='1'/>
         <return type-id='eefe253e'/>
       </function-decl>
-      <function-decl name='tcpci_unregister_port' mangled-name='tcpci_unregister_port' filepath='drivers/usb/typec/tcpm/tcpci.c' line='856' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpci_unregister_port'>
-        <parameter type-id='eefe253e' name='tcpci' filepath='drivers/usb/typec/tcpm/tcpci.c' line='856' column='1'/>
+      <function-decl name='tcpci_unregister_port' mangled-name='tcpci_unregister_port' filepath='drivers/usb/typec/tcpm/tcpci.c' line='860' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpci_unregister_port'>
+        <parameter type-id='eefe253e' name='tcpci' filepath='drivers/usb/typec/tcpm/tcpci.c' line='860' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tcpm_cc_change' mangled-name='tcpm_cc_change' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5483' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_cc_change'>
-        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5483' column='1'/>
+      <function-decl name='tcpm_cc_change' mangled-name='tcpm_cc_change' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5484' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_cc_change'>
+        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5484' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tcpm_is_toggling' mangled-name='tcpm_is_toggling' filepath='drivers/usb/typec/tcpm/tcpm.c' line='3840' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_is_toggling'>
-        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='3840' column='1'/>
+      <function-decl name='tcpm_is_toggling' mangled-name='tcpm_is_toggling' filepath='drivers/usb/typec/tcpm/tcpm.c' line='3841' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_is_toggling'>
+        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='3841' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='tcpm_pd_hard_reset' mangled-name='tcpm_pd_hard_reset' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5501' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_pd_hard_reset'>
-        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5501' column='1'/>
+      <function-decl name='tcpm_pd_hard_reset' mangled-name='tcpm_pd_hard_reset' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5502' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_pd_hard_reset'>
+        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5502' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tcpm_pd_receive' mangled-name='tcpm_pd_receive' filepath='drivers/usb/typec/tcpm/tcpm.c' line='2962' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_pd_receive'>
-        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='2962' column='1'/>
-        <parameter type-id='d7f1fb72' name='msg' filepath='drivers/usb/typec/tcpm/tcpm.c' line='2962' column='1'/>
+      <function-decl name='tcpm_pd_receive' mangled-name='tcpm_pd_receive' filepath='drivers/usb/typec/tcpm/tcpm.c' line='2963' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_pd_receive'>
+        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='2963' column='1'/>
+        <parameter type-id='d7f1fb72' name='msg' filepath='drivers/usb/typec/tcpm/tcpm.c' line='2963' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='tcpm_pd_transmit_complete' mangled-name='tcpm_pd_transmit_complete' filepath='drivers/usb/typec/tcpm/tcpm.c' line='919' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_pd_transmit_complete'>
@@ -146369,44 +146388,44 @@
         <parameter type-id='a2f9e316' name='status' filepath='drivers/usb/typec/tcpm/tcpm.c' line='920' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tcpm_register_port' mangled-name='tcpm_register_port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_register_port'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6468' column='1'/>
-        <parameter type-id='15b1f129' name='tcpc' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6468' column='1'/>
+      <function-decl name='tcpm_register_port' mangled-name='tcpm_register_port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6469' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_register_port'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6469' column='1'/>
+        <parameter type-id='15b1f129' name='tcpc' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6469' column='1'/>
         <return type-id='426e425b'/>
       </function-decl>
-      <function-decl name='tcpm_sink_frs' mangled-name='tcpm_sink_frs' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5510' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_sink_frs'>
-        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5510' column='1'/>
+      <function-decl name='tcpm_sink_frs' mangled-name='tcpm_sink_frs' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5511' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_sink_frs'>
+        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5511' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tcpm_sourcing_vbus' mangled-name='tcpm_sourcing_vbus' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_sourcing_vbus'>
-        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5519' column='1'/>
+      <function-decl name='tcpm_sourcing_vbus' mangled-name='tcpm_sourcing_vbus' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5520' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_sourcing_vbus'>
+        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5520' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tcpm_tcpc_reset' mangled-name='tcpm_tcpc_reset' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6033' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_tcpc_reset'>
-        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6033' column='1'/>
+      <function-decl name='tcpm_tcpc_reset' mangled-name='tcpm_tcpc_reset' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6034' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_tcpc_reset'>
+        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6034' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tcpm_unregister_port' mangled-name='tcpm_unregister_port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6569' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_unregister_port'>
-        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6569' column='1'/>
+      <function-decl name='tcpm_unregister_port' mangled-name='tcpm_unregister_port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6570' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_unregister_port'>
+        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6570' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tcpm_update_sink_capabilities' mangled-name='tcpm_update_sink_capabilities' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6171' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_update_sink_capabilities'>
-        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6171' column='1'/>
-        <parameter type-id='aded214c' name='pdo' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6171' column='1'/>
-        <parameter type-id='f0981eeb' name='nr_pdo' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6171' column='1'/>
-        <parameter type-id='f0981eeb' name='operating_snk_mw' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6172' column='1'/>
+      <function-decl name='tcpm_update_sink_capabilities' mangled-name='tcpm_update_sink_capabilities' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6172' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_update_sink_capabilities'>
+        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6172' column='1'/>
+        <parameter type-id='aded214c' name='pdo' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6172' column='1'/>
+        <parameter type-id='f0981eeb' name='nr_pdo' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6172' column='1'/>
+        <parameter type-id='f0981eeb' name='operating_snk_mw' filepath='drivers/usb/typec/tcpm/tcpm.c' line='6173' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='tcpm_vbus_change' mangled-name='tcpm_vbus_change' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5492' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_vbus_change'>
-        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5492' column='1'/>
+      <function-decl name='tcpm_vbus_change' mangled-name='tcpm_vbus_change' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5493' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpm_vbus_change'>
+        <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5493' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='thaw_bdev' mangled-name='thaw_bdev' filepath='fs/block_dev.c' line='610' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thaw_bdev'>
         <parameter type-id='b88dd945' name='bdev' filepath='fs/block_dev.c' line='610' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='thaw_super' mangled-name='thaw_super' filepath='fs/super.c' line='1821' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thaw_super'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='1821' column='1'/>
+      <function-decl name='thaw_super' mangled-name='thaw_super' filepath='fs/super.c' line='1830' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thaw_super'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='1830' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='thermal_cdev_update' mangled-name='thermal_cdev_update' filepath='drivers/thermal/thermal_helpers.c' line='188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cdev_update'>
@@ -146509,12 +146528,12 @@
         <parameter type-id='3df9fd28' name='st' filepath='kernel/sched/cputime.c' line='639' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tick_nohz_get_idle_calls_cpu' mangled-name='tick_nohz_get_idle_calls_cpu' filepath='kernel/time/tick-sched.c' line='1151' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tick_nohz_get_idle_calls_cpu'>
-        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/time/tick-sched.c' line='1151' column='1'/>
+      <function-decl name='tick_nohz_get_idle_calls_cpu' mangled-name='tick_nohz_get_idle_calls_cpu' filepath='kernel/time/tick-sched.c' line='1181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tick_nohz_get_idle_calls_cpu'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/time/tick-sched.c' line='1181' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='tick_nohz_get_sleep_length' mangled-name='tick_nohz_get_sleep_length' filepath='kernel/time/tick-sched.c' line='1111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tick_nohz_get_sleep_length'>
-        <parameter type-id='44372936' name='delta_next' filepath='kernel/time/tick-sched.c' line='1111' column='1'/>
+      <function-decl name='tick_nohz_get_sleep_length' mangled-name='tick_nohz_get_sleep_length' filepath='kernel/time/tick-sched.c' line='1141' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tick_nohz_get_sleep_length'>
+        <parameter type-id='44372936' name='delta_next' filepath='kernel/time/tick-sched.c' line='1141' column='1'/>
         <return type-id='fbc017ef'/>
       </function-decl>
       <function-decl name='time64_to_tm' mangled-name='time64_to_tm' filepath='kernel/time/timeconv.c' line='78' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='time64_to_tm'>
@@ -146553,9 +146572,9 @@
         <parameter type-id='0817f042' name='value' filepath='kernel/time/time.c' line='588' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='timestamp_truncate' mangled-name='timestamp_truncate' filepath='fs/inode.c' line='2220' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='timestamp_truncate'>
-        <parameter type-id='40a816ad' name='t' filepath='fs/inode.c' line='2220' column='1'/>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2220' column='1'/>
+      <function-decl name='timestamp_truncate' mangled-name='timestamp_truncate' filepath='fs/inode.c' line='2262' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='timestamp_truncate'>
+        <parameter type-id='40a816ad' name='t' filepath='fs/inode.c' line='2262' column='1'/>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2262' column='1'/>
         <return type-id='40a816ad'/>
       </function-decl>
       <function-decl name='topology_set_thermal_pressure' mangled-name='topology_set_thermal_pressure' filepath='drivers/base/arch_topology.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='topology_set_thermal_pressure'>
@@ -146566,8 +146585,8 @@
       <function-decl name='total_swapcache_pages' mangled-name='total_swapcache_pages' filepath='mm/swap_state.c' line='71' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='total_swapcache_pages'>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='touch_atime' mangled-name='touch_atime' filepath='fs/inode.c' line='1826' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='touch_atime'>
-        <parameter type-id='a77efac3' name='path' filepath='fs/inode.c' line='1826' column='1'/>
+      <function-decl name='touch_atime' mangled-name='touch_atime' filepath='fs/inode.c' line='1868' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='touch_atime'>
+        <parameter type-id='a77efac3' name='path' filepath='fs/inode.c' line='1868' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='touchscreen_parse_properties' mangled-name='touchscreen_parse_properties' filepath='drivers/input/touchscreen/of_touchscreen.c' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='touchscreen_parse_properties'>
@@ -146584,26 +146603,26 @@
         <parameter type-id='b50a4934' name='multitouch' filepath='drivers/input/touchscreen/of_touchscreen.c' line='197' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='trace_array_get_by_name' mangled-name='trace_array_get_by_name' filepath='kernel/trace/trace.c' line='8850' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_array_get_by_name'>
-        <parameter type-id='80f4b756' name='name' filepath='kernel/trace/trace.c' line='8850' column='1'/>
+      <function-decl name='trace_array_get_by_name' mangled-name='trace_array_get_by_name' filepath='kernel/trace/trace.c' line='8930' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_array_get_by_name'>
+        <parameter type-id='80f4b756' name='name' filepath='kernel/trace/trace.c' line='8930' column='1'/>
         <return type-id='898c1076'/>
       </function-decl>
       <function-decl name='trace_array_put' mangled-name='trace_array_put' filepath='kernel/trace/trace.c' line='468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_array_put'>
         <parameter type-id='898c1076' name='this_tr' filepath='kernel/trace/trace.c' line='468' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='trace_array_set_clr_event' mangled-name='trace_array_set_clr_event' filepath='kernel/trace/trace_events.c' line='916' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_array_set_clr_event'>
-        <parameter type-id='898c1076' name='tr' filepath='kernel/trace/trace_events.c' line='916' column='1'/>
-        <parameter type-id='80f4b756' name='system' filepath='kernel/trace/trace_events.c' line='916' column='1'/>
-        <parameter type-id='80f4b756' name='event' filepath='kernel/trace/trace_events.c' line='917' column='1'/>
-        <parameter type-id='b50a4934' name='enable' filepath='kernel/trace/trace_events.c' line='917' column='1'/>
+      <function-decl name='trace_array_set_clr_event' mangled-name='trace_array_set_clr_event' filepath='kernel/trace/trace_events.c' line='910' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_array_set_clr_event'>
+        <parameter type-id='898c1076' name='tr' filepath='kernel/trace/trace_events.c' line='910' column='1'/>
+        <parameter type-id='80f4b756' name='system' filepath='kernel/trace/trace_events.c' line='910' column='1'/>
+        <parameter type-id='80f4b756' name='event' filepath='kernel/trace/trace_events.c' line='911' column='1'/>
+        <parameter type-id='b50a4934' name='enable' filepath='kernel/trace/trace_events.c' line='911' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='trace_clock_local' mangled-name='trace_clock_local' filepath='kernel/trace/trace_clock.c' line='32' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_clock_local'>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='trace_event_buffer_commit' mangled-name='trace_event_buffer_commit' filepath='kernel/trace/trace.c' line='2874' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_buffer_commit'>
-        <parameter type-id='9f548f9a' name='fbuffer' filepath='kernel/trace/trace.c' line='2874' column='1'/>
+      <function-decl name='trace_event_buffer_commit' mangled-name='trace_event_buffer_commit' filepath='kernel/trace/trace.c' line='2884' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_buffer_commit'>
+        <parameter type-id='9f548f9a' name='fbuffer' filepath='kernel/trace/trace.c' line='2884' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='trace_event_buffer_reserve' mangled-name='trace_event_buffer_reserve' filepath='kernel/trace/trace_events.c' line='252' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_buffer_reserve'>
@@ -146626,14 +146645,14 @@
         <parameter type-id='eaa32e2f' name='data' filepath='kernel/trace/trace_events.c' line='288' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='trace_get_event_file' mangled-name='trace_get_event_file' filepath='kernel/trace/trace_events.c' line='2766' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_get_event_file'>
-        <parameter type-id='80f4b756' name='instance' filepath='kernel/trace/trace_events.c' line='2766' column='1'/>
-        <parameter type-id='80f4b756' name='system' filepath='kernel/trace/trace_events.c' line='2767' column='1'/>
-        <parameter type-id='80f4b756' name='event' filepath='kernel/trace/trace_events.c' line='2768' column='1'/>
+      <function-decl name='trace_get_event_file' mangled-name='trace_get_event_file' filepath='kernel/trace/trace_events.c' line='2763' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_get_event_file'>
+        <parameter type-id='80f4b756' name='instance' filepath='kernel/trace/trace_events.c' line='2763' column='1'/>
+        <parameter type-id='80f4b756' name='system' filepath='kernel/trace/trace_events.c' line='2764' column='1'/>
+        <parameter type-id='80f4b756' name='event' filepath='kernel/trace/trace_events.c' line='2765' column='1'/>
         <return type-id='3d4ca6d2'/>
       </function-decl>
-      <function-decl name='trace_handle_return' mangled-name='trace_handle_return' filepath='kernel/trace/trace.c' line='2610' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_handle_return'>
-        <parameter type-id='fc932690' name='s' filepath='kernel/trace/trace.c' line='2610' column='1'/>
+      <function-decl name='trace_handle_return' mangled-name='trace_handle_return' filepath='kernel/trace/trace.c' line='2620' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_handle_return'>
+        <parameter type-id='fc932690' name='s' filepath='kernel/trace/trace.c' line='2620' column='1'/>
         <return type-id='b1a0a119'/>
       </function-decl>
       <function-decl name='trace_output_call' mangled-name='trace_output_call' filepath='kernel/trace/trace_output.c' line='326' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_output_call'>
@@ -146692,10 +146711,10 @@
         <parameter type-id='002ac4a6' name='c' filepath='kernel/trace/trace_seq.c' line='233' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='trace_set_clr_event' mangled-name='trace_set_clr_event' filepath='kernel/trace/trace_events.c' line='892' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_set_clr_event'>
-        <parameter type-id='80f4b756' name='system' filepath='kernel/trace/trace_events.c' line='892' column='1'/>
-        <parameter type-id='80f4b756' name='event' filepath='kernel/trace/trace_events.c' line='892' column='1'/>
-        <parameter type-id='95e97e5e' name='set' filepath='kernel/trace/trace_events.c' line='892' column='1'/>
+      <function-decl name='trace_set_clr_event' mangled-name='trace_set_clr_event' filepath='kernel/trace/trace_events.c' line='886' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_set_clr_event'>
+        <parameter type-id='80f4b756' name='system' filepath='kernel/trace/trace_events.c' line='886' column='1'/>
+        <parameter type-id='80f4b756' name='event' filepath='kernel/trace/trace_events.c' line='886' column='1'/>
+        <parameter type-id='95e97e5e' name='set' filepath='kernel/trace/trace_events.c' line='886' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='tracepoint_probe_register' mangled-name='tracepoint_probe_register' filepath='kernel/tracepoint.c' line='550' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tracepoint_probe_register'>
@@ -146770,9 +146789,9 @@
         <parameter type-id='b50a4934' name='may_swap' filepath='mm/vmscan.c' line='3430' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='try_to_release_page' mangled-name='try_to_release_page' filepath='mm/filemap.c' line='3695' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='try_to_release_page'>
-        <parameter type-id='02f11ed4' name='page' filepath='mm/filemap.c' line='3695' column='1'/>
-        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/filemap.c' line='3695' column='1'/>
+      <function-decl name='try_to_release_page' mangled-name='try_to_release_page' filepath='mm/filemap.c' line='3698' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='try_to_release_page'>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/filemap.c' line='3698' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/filemap.c' line='3698' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='try_to_writeback_inodes_sb' mangled-name='try_to_writeback_inodes_sb' filepath='fs/fs-writeback.c' line='2505' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='try_to_writeback_inodes_sb'>
@@ -147198,8 +147217,8 @@
         <parameter type-id='02913b69' name='adev' filepath='drivers/usb/typec/bus.c' line='126' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='typec_altmode_get_partner' mangled-name='typec_altmode_get_partner' filepath='drivers/usb/typec/bus.c' line='199' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_altmode_get_partner'>
-        <parameter type-id='02913b69' name='adev' filepath='drivers/usb/typec/bus.c' line='199' column='1'/>
+      <function-decl name='typec_altmode_get_partner' mangled-name='typec_altmode_get_partner' filepath='drivers/usb/typec/bus.c' line='207' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_altmode_get_partner'>
+        <parameter type-id='02913b69' name='adev' filepath='drivers/usb/typec/bus.c' line='207' column='1'/>
         <return type-id='9aa82888'/>
       </function-decl>
       <function-decl name='typec_altmode_notify' mangled-name='typec_altmode_notify' filepath='drivers/usb/typec/bus.c' line='55' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_altmode_notify'>
@@ -147208,8 +147227,8 @@
         <parameter type-id='eaa32e2f' name='data' filepath='drivers/usb/typec/bus.c' line='56' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='typec_altmode_unregister_driver' mangled-name='typec_altmode_unregister_driver' filepath='drivers/usb/typec/bus.c' line='257' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_altmode_unregister_driver'>
-        <parameter type-id='e1932af2' name='drv' filepath='drivers/usb/typec/bus.c' line='257' column='1'/>
+      <function-decl name='typec_altmode_unregister_driver' mangled-name='typec_altmode_unregister_driver' filepath='drivers/usb/typec/bus.c' line='265' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_altmode_unregister_driver'>
+        <parameter type-id='e1932af2' name='drv' filepath='drivers/usb/typec/bus.c' line='265' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='typec_altmode_update_active' mangled-name='typec_altmode_update_active' filepath='drivers/usb/typec/class.c' line='348' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_altmode_update_active'>
@@ -147217,11 +147236,11 @@
         <parameter type-id='b50a4934' name='active' filepath='drivers/usb/typec/class.c' line='348' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='typec_altmode_vdm' mangled-name='typec_altmode_vdm' filepath='drivers/usb/typec/bus.c' line='175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_altmode_vdm'>
-        <parameter type-id='02913b69' name='adev' filepath='drivers/usb/typec/bus.c' line='175' column='1'/>
-        <parameter type-id='51bb592e' name='header' filepath='drivers/usb/typec/bus.c' line='176' column='1'/>
-        <parameter type-id='aded214c' name='vdo' filepath='drivers/usb/typec/bus.c' line='176' column='1'/>
-        <parameter type-id='95e97e5e' name='count' filepath='drivers/usb/typec/bus.c' line='176' column='1'/>
+      <function-decl name='typec_altmode_vdm' mangled-name='typec_altmode_vdm' filepath='drivers/usb/typec/bus.c' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_altmode_vdm'>
+        <parameter type-id='02913b69' name='adev' filepath='drivers/usb/typec/bus.c' line='183' column='1'/>
+        <parameter type-id='51bb592e' name='header' filepath='drivers/usb/typec/bus.c' line='184' column='1'/>
+        <parameter type-id='aded214c' name='vdo' filepath='drivers/usb/typec/bus.c' line='184' column='1'/>
+        <parameter type-id='95e97e5e' name='count' filepath='drivers/usb/typec/bus.c' line='184' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='typec_get_drvdata' mangled-name='typec_get_drvdata' filepath='drivers/usb/typec/class.c' line='1950' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_get_drvdata'>
@@ -147474,10 +147493,10 @@
         <parameter type-id='2c25e09d' name='ucsi' filepath='drivers/usb/typec/ucsi/ucsi.c' line='1385' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='udp4_hwcsum' mangled-name='udp4_hwcsum' filepath='net/ipv4/udp.c' line='814' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='udp4_hwcsum'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/ipv4/udp.c' line='814' column='1'/>
-        <parameter type-id='78a133c2' name='src' filepath='net/ipv4/udp.c' line='814' column='1'/>
-        <parameter type-id='78a133c2' name='dst' filepath='net/ipv4/udp.c' line='814' column='1'/>
+      <function-decl name='udp4_hwcsum' mangled-name='udp4_hwcsum' filepath='net/ipv4/udp.c' line='824' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='udp4_hwcsum'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/ipv4/udp.c' line='824' column='1'/>
+        <parameter type-id='78a133c2' name='src' filepath='net/ipv4/udp.c' line='824' column='1'/>
+        <parameter type-id='78a133c2' name='dst' filepath='net/ipv4/udp.c' line='824' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='udp_table' type-id='9a516b13' mangled-name='udp_table' visibility='default' filepath='net/ipv4/udp.c' line='121' column='1' elf-symbol-id='udp_table'/>
@@ -147764,12 +147783,12 @@
         <parameter type-id='d504f73d' name='nb' filepath='net/ipv4/devinet.c' line='1457' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='unregister_kprobe' mangled-name='unregister_kprobe' filepath='kernel/kprobes.c' line='1906' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_kprobe'>
-        <parameter type-id='0d97a11a' name='p' filepath='kernel/kprobes.c' line='1906' column='1'/>
+      <function-decl name='unregister_kprobe' mangled-name='unregister_kprobe' filepath='kernel/kprobes.c' line='1918' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_kprobe'>
+        <parameter type-id='0d97a11a' name='p' filepath='kernel/kprobes.c' line='1918' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='unregister_kretprobe' mangled-name='unregister_kretprobe' filepath='kernel/kprobes.c' line='2204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_kretprobe'>
-        <parameter type-id='d15edd25' name='rp' filepath='kernel/kprobes.c' line='2204' column='1'/>
+      <function-decl name='unregister_kretprobe' mangled-name='unregister_kretprobe' filepath='kernel/kprobes.c' line='2216' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_kretprobe'>
+        <parameter type-id='d15edd25' name='rp' filepath='kernel/kprobes.c' line='2216' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='unregister_memory_notifier' mangled-name='unregister_memory_notifier' filepath='drivers/base/memory.c' line='93' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_memory_notifier'>
@@ -147833,8 +147852,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='198' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='unregister_rpmsg_driver' mangled-name='unregister_rpmsg_driver' filepath='drivers/rpmsg/rpmsg_core.c' line='630' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_rpmsg_driver'>
-        <parameter type-id='7331a99f' name='rpdrv' filepath='drivers/rpmsg/rpmsg_core.c' line='630' column='1'/>
+      <function-decl name='unregister_rpmsg_driver' mangled-name='unregister_rpmsg_driver' filepath='drivers/rpmsg/rpmsg_core.c' line='659' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_rpmsg_driver'>
+        <parameter type-id='7331a99f' name='rpdrv' filepath='drivers/rpmsg/rpmsg_core.c' line='659' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='unregister_shrinker' mangled-name='unregister_shrinker' filepath='mm/vmscan.c' line='424' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_shrinker'>
@@ -147845,8 +147864,8 @@
         <parameter type-id='cbd24a98' name='ops' filepath='drivers/base/syscore.c' line='34' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='unregister_sysctl_table' mangled-name='unregister_sysctl_table' filepath='fs/proc/proc_sysctl.c' line='1695' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_sysctl_table'>
-        <parameter type-id='11b101bb' name='header' filepath='fs/proc/proc_sysctl.c' line='1695' column='1'/>
+      <function-decl name='unregister_sysctl_table' mangled-name='unregister_sysctl_table' filepath='fs/proc/proc_sysctl.c' line='1697' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_sysctl_table'>
+        <parameter type-id='11b101bb' name='header' filepath='fs/proc/proc_sysctl.c' line='1697' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='unregister_tcf_proto_ops' mangled-name='unregister_tcf_proto_ops' filepath='net/sched/cls_api.c' line='178' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_tcf_proto_ops'>
@@ -147905,10 +147924,10 @@
         <parameter type-id='49a58c0c' name='gadget' filepath='drivers/usb/gadget/udc/core.c' line='1424' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_add_hcd' mangled-name='usb_add_hcd' filepath='drivers/usb/core/hcd.c' line='2659' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_add_hcd'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2659' column='1'/>
-        <parameter type-id='f0981eeb' name='irqnum' filepath='drivers/usb/core/hcd.c' line='2660' column='1'/>
-        <parameter type-id='7359adad' name='irqflags' filepath='drivers/usb/core/hcd.c' line='2660' column='1'/>
+      <function-decl name='usb_add_hcd' mangled-name='usb_add_hcd' filepath='drivers/usb/core/hcd.c' line='2663' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_add_hcd'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2663' column='1'/>
+        <parameter type-id='f0981eeb' name='irqnum' filepath='drivers/usb/core/hcd.c' line='2664' column='1'/>
+        <parameter type-id='7359adad' name='irqflags' filepath='drivers/usb/core/hcd.c' line='2664' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_add_phy' mangled-name='usb_add_phy' filepath='drivers/usb/phy/phy.c' line='626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_add_phy'>
@@ -148004,20 +148023,20 @@
         <parameter type-id='95e97e5e' name='timeout' filepath='drivers/usb/core/message.c' line='368' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_calc_bus_time' mangled-name='usb_calc_bus_time' filepath='drivers/usb/core/hcd.c' line='1093' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_calc_bus_time'>
-        <parameter type-id='95e97e5e' name='speed' filepath='drivers/usb/core/hcd.c' line='1093' column='1'/>
-        <parameter type-id='95e97e5e' name='is_input' filepath='drivers/usb/core/hcd.c' line='1093' column='1'/>
-        <parameter type-id='95e97e5e' name='isoc' filepath='drivers/usb/core/hcd.c' line='1093' column='1'/>
-        <parameter type-id='95e97e5e' name='bytecount' filepath='drivers/usb/core/hcd.c' line='1093' column='1'/>
+      <function-decl name='usb_calc_bus_time' mangled-name='usb_calc_bus_time' filepath='drivers/usb/core/hcd.c' line='1097' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_calc_bus_time'>
+        <parameter type-id='95e97e5e' name='speed' filepath='drivers/usb/core/hcd.c' line='1097' column='1'/>
+        <parameter type-id='95e97e5e' name='is_input' filepath='drivers/usb/core/hcd.c' line='1097' column='1'/>
+        <parameter type-id='95e97e5e' name='isoc' filepath='drivers/usb/core/hcd.c' line='1097' column='1'/>
+        <parameter type-id='95e97e5e' name='bytecount' filepath='drivers/usb/core/hcd.c' line='1097' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
       <function-decl name='usb_choose_configuration' mangled-name='usb_choose_configuration' filepath='drivers/usb/core/generic.c' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_choose_configuration'>
         <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/generic.c' line='56' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_clear_halt' mangled-name='usb_clear_halt' filepath='drivers/usb/core/message.c' line='1205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_clear_halt'>
-        <parameter type-id='25e60cb2' name='dev' filepath='drivers/usb/core/message.c' line='1205' column='1'/>
-        <parameter type-id='95e97e5e' name='pipe' filepath='drivers/usb/core/message.c' line='1205' column='1'/>
+      <function-decl name='usb_clear_halt' mangled-name='usb_clear_halt' filepath='drivers/usb/core/message.c' line='1200' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_clear_halt'>
+        <parameter type-id='25e60cb2' name='dev' filepath='drivers/usb/core/message.c' line='1200' column='1'/>
+        <parameter type-id='95e97e5e' name='pipe' filepath='drivers/usb/core/message.c' line='1200' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_composite_probe' mangled-name='usb_composite_probe' filepath='drivers/usb/gadget/composite.c' line='2493' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_composite_probe'>
@@ -148048,17 +148067,17 @@
         <parameter type-id='f363a725' name='src' filepath='drivers/usb/gadget/config.c' line='122' column='1'/>
         <return type-id='f363a725'/>
       </function-decl>
-      <function-decl name='usb_create_hcd' mangled-name='usb_create_hcd' filepath='drivers/usb/core/hcd.c' line='2536' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_create_hcd'>
-        <parameter type-id='5aa12c86' name='driver' filepath='drivers/usb/core/hcd.c' line='2536' column='1'/>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/core/hcd.c' line='2537' column='1'/>
-        <parameter type-id='80f4b756' name='bus_name' filepath='drivers/usb/core/hcd.c' line='2537' column='1'/>
+      <function-decl name='usb_create_hcd' mangled-name='usb_create_hcd' filepath='drivers/usb/core/hcd.c' line='2540' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_create_hcd'>
+        <parameter type-id='5aa12c86' name='driver' filepath='drivers/usb/core/hcd.c' line='2540' column='1'/>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/core/hcd.c' line='2541' column='1'/>
+        <parameter type-id='80f4b756' name='bus_name' filepath='drivers/usb/core/hcd.c' line='2541' column='1'/>
         <return type-id='fc4f83c1'/>
       </function-decl>
-      <function-decl name='usb_create_shared_hcd' mangled-name='usb_create_shared_hcd' filepath='drivers/usb/core/hcd.c' line='2514' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_create_shared_hcd'>
-        <parameter type-id='5aa12c86' name='driver' filepath='drivers/usb/core/hcd.c' line='2514' column='1'/>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/core/hcd.c' line='2515' column='1'/>
-        <parameter type-id='80f4b756' name='bus_name' filepath='drivers/usb/core/hcd.c' line='2515' column='1'/>
-        <parameter type-id='fc4f83c1' name='primary_hcd' filepath='drivers/usb/core/hcd.c' line='2516' column='1'/>
+      <function-decl name='usb_create_shared_hcd' mangled-name='usb_create_shared_hcd' filepath='drivers/usb/core/hcd.c' line='2518' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_create_shared_hcd'>
+        <parameter type-id='5aa12c86' name='driver' filepath='drivers/usb/core/hcd.c' line='2518' column='1'/>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/core/hcd.c' line='2519' column='1'/>
+        <parameter type-id='80f4b756' name='bus_name' filepath='drivers/usb/core/hcd.c' line='2519' column='1'/>
+        <parameter type-id='fc4f83c1' name='primary_hcd' filepath='drivers/usb/core/hcd.c' line='2520' column='1'/>
         <return type-id='fc4f83c1'/>
       </function-decl>
       <function-decl name='usb_decode_ctrl' mangled-name='usb_decode_ctrl' filepath='drivers/usb/common/debug.c' line='299' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_decode_ctrl'>
@@ -148102,9 +148121,9 @@
         <parameter type-id='8bf48c31' name='iface' filepath='drivers/usb/core/driver.c' line='615' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_driver_set_configuration' mangled-name='usb_driver_set_configuration' filepath='drivers/usb/core/message.c' line='2243' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_driver_set_configuration'>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/message.c' line='2243' column='1'/>
-        <parameter type-id='95e97e5e' name='config' filepath='drivers/usb/core/message.c' line='2243' column='1'/>
+      <function-decl name='usb_driver_set_configuration' mangled-name='usb_driver_set_configuration' filepath='drivers/usb/core/message.c' line='2238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_driver_set_configuration'>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/message.c' line='2238' column='1'/>
+        <parameter type-id='95e97e5e' name='config' filepath='drivers/usb/core/message.c' line='2238' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_enable_autosuspend' mangled-name='usb_enable_autosuspend' filepath='drivers/usb/core/driver.c' line='1649' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_enable_autosuspend'>
@@ -148115,8 +148134,8 @@
         <parameter type-id='85196e3f' name='xhci_pdev' filepath='drivers/usb/host/pci-quirks.c' line='1039' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_enable_lpm' mangled-name='usb_enable_lpm' filepath='drivers/usb/core/hub.c' line='4298' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_enable_lpm'>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='4298' column='1'/>
+      <function-decl name='usb_enable_lpm' mangled-name='usb_enable_lpm' filepath='drivers/usb/core/hub.c' line='4323' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_enable_lpm'>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='4323' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_ep_alloc_request' mangled-name='usb_ep_alloc_request' filepath='drivers/usb/gadget/udc/core.c' line='175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_alloc_request'>
@@ -148327,45 +148346,45 @@
         <parameter type-id='f0981eeb' name='n_strings' filepath='drivers/usb/gadget/composite.c' line='1402' column='1'/>
         <return type-id='3b7e997b'/>
       </function-decl>
-      <function-decl name='usb_hc_died' mangled-name='usb_hc_died' filepath='drivers/usb/core/hcd.c' line='2385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hc_died'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2385' column='1'/>
+      <function-decl name='usb_hc_died' mangled-name='usb_hc_died' filepath='drivers/usb/core/hcd.c' line='2389' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hc_died'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2389' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_hcd_check_unlink_urb' mangled-name='usb_hcd_check_unlink_urb' filepath='drivers/usb/core/hcd.c' line='1210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_check_unlink_urb'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1210' column='1'/>
-        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1210' column='1'/>
-        <parameter type-id='95e97e5e' name='status' filepath='drivers/usb/core/hcd.c' line='1211' column='1'/>
+      <function-decl name='usb_hcd_check_unlink_urb' mangled-name='usb_hcd_check_unlink_urb' filepath='drivers/usb/core/hcd.c' line='1214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_check_unlink_urb'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1214' column='1'/>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1214' column='1'/>
+        <parameter type-id='95e97e5e' name='status' filepath='drivers/usb/core/hcd.c' line='1215' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_hcd_end_port_resume' mangled-name='usb_hcd_end_port_resume' filepath='drivers/usb/core/hcd.c' line='1067' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_end_port_resume'>
-        <parameter type-id='3ab7d422' name='bus' filepath='drivers/usb/core/hcd.c' line='1067' column='1'/>
-        <parameter type-id='95e97e5e' name='portnum' filepath='drivers/usb/core/hcd.c' line='1067' column='1'/>
+      <function-decl name='usb_hcd_end_port_resume' mangled-name='usb_hcd_end_port_resume' filepath='drivers/usb/core/hcd.c' line='1071' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_end_port_resume'>
+        <parameter type-id='3ab7d422' name='bus' filepath='drivers/usb/core/hcd.c' line='1071' column='1'/>
+        <parameter type-id='95e97e5e' name='portnum' filepath='drivers/usb/core/hcd.c' line='1071' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_hcd_giveback_urb' mangled-name='usb_hcd_giveback_urb' filepath='drivers/usb/core/hcd.c' line='1734' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_giveback_urb'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1734' column='1'/>
-        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1734' column='1'/>
-        <parameter type-id='95e97e5e' name='status' filepath='drivers/usb/core/hcd.c' line='1734' column='1'/>
+      <function-decl name='usb_hcd_giveback_urb' mangled-name='usb_hcd_giveback_urb' filepath='drivers/usb/core/hcd.c' line='1738' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_giveback_urb'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1738' column='1'/>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1738' column='1'/>
+        <parameter type-id='95e97e5e' name='status' filepath='drivers/usb/core/hcd.c' line='1738' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_hcd_irq' mangled-name='usb_hcd_irq' filepath='drivers/usb/core/hcd.c' line='2344' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_irq'>
-        <parameter type-id='95e97e5e' name='irq' filepath='drivers/usb/core/hcd.c' line='2344' column='1'/>
-        <parameter type-id='eaa32e2f' name='__hcd' filepath='drivers/usb/core/hcd.c' line='2344' column='1'/>
+      <function-decl name='usb_hcd_irq' mangled-name='usb_hcd_irq' filepath='drivers/usb/core/hcd.c' line='2348' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_irq'>
+        <parameter type-id='95e97e5e' name='irq' filepath='drivers/usb/core/hcd.c' line='2348' column='1'/>
+        <parameter type-id='eaa32e2f' name='__hcd' filepath='drivers/usb/core/hcd.c' line='2348' column='1'/>
         <return type-id='4bdecfd7'/>
       </function-decl>
-      <function-decl name='usb_hcd_is_primary_hcd' mangled-name='usb_hcd_is_primary_hcd' filepath='drivers/usb/core/hcd.c' line='2585' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_is_primary_hcd'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2585' column='1'/>
+      <function-decl name='usb_hcd_is_primary_hcd' mangled-name='usb_hcd_is_primary_hcd' filepath='drivers/usb/core/hcd.c' line='2589' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_is_primary_hcd'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2589' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_hcd_link_urb_to_ep' mangled-name='usb_hcd_link_urb_to_ep' filepath='drivers/usb/core/hcd.c' line='1152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_link_urb_to_ep'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1152' column='1'/>
-        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1152' column='1'/>
+      <function-decl name='usb_hcd_link_urb_to_ep' mangled-name='usb_hcd_link_urb_to_ep' filepath='drivers/usb/core/hcd.c' line='1156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_link_urb_to_ep'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1156' column='1'/>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1156' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_hcd_map_urb_for_dma' mangled-name='usb_hcd_map_urb_for_dma' filepath='drivers/usb/core/hcd.c' line='1405' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_map_urb_for_dma'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1405' column='1'/>
-        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1405' column='1'/>
-        <parameter type-id='3eb7c31c' name='mem_flags' filepath='drivers/usb/core/hcd.c' line='1406' column='1'/>
+      <function-decl name='usb_hcd_map_urb_for_dma' mangled-name='usb_hcd_map_urb_for_dma' filepath='drivers/usb/core/hcd.c' line='1409' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_map_urb_for_dma'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1409' column='1'/>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1409' column='1'/>
+        <parameter type-id='3eb7c31c' name='mem_flags' filepath='drivers/usb/core/hcd.c' line='1410' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='usb_hcd_pci_pm_ops' type-id='86af1d10' mangled-name='usb_hcd_pci_pm_ops' visibility='default' filepath='drivers/usb/core/hcd-pci.c' line='612' column='1' elf-symbol-id='usb_hcd_pci_pm_ops'/>
@@ -148383,42 +148402,42 @@
         <parameter type-id='85196e3f' name='dev' filepath='drivers/usb/core/hcd-pci.c' line='363' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_hcd_platform_shutdown' mangled-name='usb_hcd_platform_shutdown' filepath='drivers/usb/core/hcd.c' line='2951' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_platform_shutdown'>
-        <parameter type-id='db362995' name='dev' filepath='drivers/usb/core/hcd.c' line='2951' column='1'/>
+      <function-decl name='usb_hcd_platform_shutdown' mangled-name='usb_hcd_platform_shutdown' filepath='drivers/usb/core/hcd.c' line='2955' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_platform_shutdown'>
+        <parameter type-id='db362995' name='dev' filepath='drivers/usb/core/hcd.c' line='2955' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_hcd_poll_rh_status' mangled-name='usb_hcd_poll_rh_status' filepath='drivers/usb/core/hcd.c' line='753' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_poll_rh_status'>
         <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='753' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_hcd_resume_root_hub' mangled-name='usb_hcd_resume_root_hub' filepath='drivers/usb/core/hcd.c' line='2275' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_resume_root_hub'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2275' column='1'/>
+      <function-decl name='usb_hcd_resume_root_hub' mangled-name='usb_hcd_resume_root_hub' filepath='drivers/usb/core/hcd.c' line='2279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_resume_root_hub'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2279' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_hcd_start_port_resume' mangled-name='usb_hcd_start_port_resume' filepath='drivers/usb/core/hcd.c' line='1045' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_start_port_resume'>
-        <parameter type-id='3ab7d422' name='bus' filepath='drivers/usb/core/hcd.c' line='1045' column='1'/>
-        <parameter type-id='95e97e5e' name='portnum' filepath='drivers/usb/core/hcd.c' line='1045' column='1'/>
+      <function-decl name='usb_hcd_start_port_resume' mangled-name='usb_hcd_start_port_resume' filepath='drivers/usb/core/hcd.c' line='1049' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_start_port_resume'>
+        <parameter type-id='3ab7d422' name='bus' filepath='drivers/usb/core/hcd.c' line='1049' column='1'/>
+        <parameter type-id='95e97e5e' name='portnum' filepath='drivers/usb/core/hcd.c' line='1049' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_hcd_unlink_urb_from_ep' mangled-name='usb_hcd_unlink_urb_from_ep' filepath='drivers/usb/core/hcd.c' line='1243' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_unlink_urb_from_ep'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1243' column='1'/>
-        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1243' column='1'/>
+      <function-decl name='usb_hcd_unlink_urb_from_ep' mangled-name='usb_hcd_unlink_urb_from_ep' filepath='drivers/usb/core/hcd.c' line='1247' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_unlink_urb_from_ep'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1247' column='1'/>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1247' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_hcd_unmap_urb_for_dma' mangled-name='usb_hcd_unmap_urb_for_dma' filepath='drivers/usb/core/hcd.c' line='1358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_unmap_urb_for_dma'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1358' column='1'/>
-        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1358' column='1'/>
+      <function-decl name='usb_hcd_unmap_urb_for_dma' mangled-name='usb_hcd_unmap_urb_for_dma' filepath='drivers/usb/core/hcd.c' line='1362' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_unmap_urb_for_dma'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1362' column='1'/>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1362' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='usb_hcds_loaded' type-id='7359adad' mangled-name='usb_hcds_loaded' visibility='default' filepath='drivers/usb/core/hcd.c' line='81' column='1' elf-symbol-id='usb_hcds_loaded'/>
       <var-decl name='usb_hid_driver' type-id='0e5e2ca6' mangled-name='usb_hid_driver' visibility='default' filepath='drivers/hid/usbhid/hid-core.c' line='1316' column='1' elf-symbol-id='usb_hid_driver'/>
-      <function-decl name='usb_hub_clear_tt_buffer' mangled-name='usb_hub_clear_tt_buffer' filepath='drivers/usb/core/hub.c' line='867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hub_clear_tt_buffer'>
-        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hub.c' line='867' column='1'/>
+      <function-decl name='usb_hub_clear_tt_buffer' mangled-name='usb_hub_clear_tt_buffer' filepath='drivers/usb/core/hub.c' line='875' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hub_clear_tt_buffer'>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hub.c' line='875' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_hub_find_child' mangled-name='usb_hub_find_child' filepath='drivers/usb/core/hub.c' line='6132' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hub_find_child'>
-        <parameter type-id='25e60cb2' name='hdev' filepath='drivers/usb/core/hub.c' line='6132' column='1'/>
-        <parameter type-id='95e97e5e' name='port1' filepath='drivers/usb/core/hub.c' line='6133' column='1'/>
+      <function-decl name='usb_hub_find_child' mangled-name='usb_hub_find_child' filepath='drivers/usb/core/hub.c' line='6207' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hub_find_child'>
+        <parameter type-id='25e60cb2' name='hdev' filepath='drivers/usb/core/hub.c' line='6207' column='1'/>
+        <parameter type-id='95e97e5e' name='port1' filepath='drivers/usb/core/hub.c' line='6208' column='1'/>
         <return type-id='25e60cb2'/>
       </function-decl>
       <function-decl name='usb_ifnum_to_if' mangled-name='usb_ifnum_to_if' filepath='drivers/usb/core/usb.c' line='348' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ifnum_to_if'>
@@ -148517,16 +148536,16 @@
         <parameter type-id='6614aa5e' name='fi' filepath='drivers/usb/gadget/functions.c' line='69' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_put_hcd' mangled-name='usb_put_hcd' filepath='drivers/usb/core/hcd.c' line='2578' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_put_hcd'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2578' column='1'/>
+      <function-decl name='usb_put_hcd' mangled-name='usb_put_hcd' filepath='drivers/usb/core/hcd.c' line='2582' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_put_hcd'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2582' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_put_intf' mangled-name='usb_put_intf' filepath='drivers/usb/core/usb.c' line='820' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_put_intf'>
         <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/usb.c' line='820' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_queue_reset_device' mangled-name='usb_queue_reset_device' filepath='drivers/usb/core/hub.c' line='6112' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_queue_reset_device'>
-        <parameter type-id='8bf48c31' name='iface' filepath='drivers/usb/core/hub.c' line='6112' column='1'/>
+      <function-decl name='usb_queue_reset_device' mangled-name='usb_queue_reset_device' filepath='drivers/usb/core/hub.c' line='6187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_queue_reset_device'>
+        <parameter type-id='8bf48c31' name='iface' filepath='drivers/usb/core/hub.c' line='6187' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_register_dev' mangled-name='usb_register_dev' filepath='drivers/usb/core/file.c' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_register_dev'>
@@ -148549,16 +148568,16 @@
         <parameter type-id='e5411c2c' name='f' filepath='drivers/usb/gadget/composite.c' line='367' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_remove_hcd' mangled-name='usb_remove_hcd' filepath='drivers/usb/core/hcd.c' line='2880' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_remove_hcd'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2880' column='1'/>
+      <function-decl name='usb_remove_hcd' mangled-name='usb_remove_hcd' filepath='drivers/usb/core/hcd.c' line='2884' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_remove_hcd'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2884' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_remove_phy' mangled-name='usb_remove_phy' filepath='drivers/usb/phy/phy.c' line='703' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_remove_phy'>
         <parameter type-id='ca9354d1' name='x' filepath='drivers/usb/phy/phy.c' line='703' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_reset_device' mangled-name='usb_reset_device' filepath='drivers/usb/core/hub.c' line='5994' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_reset_device'>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='5994' column='1'/>
+      <function-decl name='usb_reset_device' mangled-name='usb_reset_device' filepath='drivers/usb/core/hub.c' line='6069' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_reset_device'>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='6069' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_role_switch_find_by_fwnode' mangled-name='usb_role_switch_find_by_fwnode' filepath='drivers/usb/roles/class.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_find_by_fwnode'>
@@ -148595,23 +148614,23 @@
         <parameter type-id='3e3cd44f' name='sw' filepath='drivers/usb/roles/class.c' line='357' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_root_hub_lost_power' mangled-name='usb_root_hub_lost_power' filepath='drivers/usb/core/hub.c' line='3850' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_root_hub_lost_power'>
-        <parameter type-id='25e60cb2' name='rhdev' filepath='drivers/usb/core/hub.c' line='3850' column='1'/>
+      <function-decl name='usb_root_hub_lost_power' mangled-name='usb_root_hub_lost_power' filepath='drivers/usb/core/hub.c' line='3868' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_root_hub_lost_power'>
+        <parameter type-id='25e60cb2' name='rhdev' filepath='drivers/usb/core/hub.c' line='3868' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_scuttle_anchored_urbs' mangled-name='usb_scuttle_anchored_urbs' filepath='drivers/usb/core/urb.c' line='1009' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_scuttle_anchored_urbs'>
         <parameter type-id='bd300bf3' name='anchor' filepath='drivers/usb/core/urb.c' line='1009' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_set_device_state' mangled-name='usb_set_device_state' filepath='drivers/usb/core/hub.c' line='2048' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_set_device_state'>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='2048' column='1'/>
-        <parameter type-id='901a91cb' name='new_state' filepath='drivers/usb/core/hub.c' line='2049' column='1'/>
+      <function-decl name='usb_set_device_state' mangled-name='usb_set_device_state' filepath='drivers/usb/core/hub.c' line='2056' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_set_device_state'>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='2056' column='1'/>
+        <parameter type-id='901a91cb' name='new_state' filepath='drivers/usb/core/hub.c' line='2057' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_set_interface' mangled-name='usb_set_interface' filepath='drivers/usb/core/message.c' line='1523' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_set_interface'>
-        <parameter type-id='25e60cb2' name='dev' filepath='drivers/usb/core/message.c' line='1523' column='1'/>
-        <parameter type-id='95e97e5e' name='interface' filepath='drivers/usb/core/message.c' line='1523' column='1'/>
-        <parameter type-id='95e97e5e' name='alternate' filepath='drivers/usb/core/message.c' line='1523' column='1'/>
+      <function-decl name='usb_set_interface' mangled-name='usb_set_interface' filepath='drivers/usb/core/message.c' line='1518' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_set_interface'>
+        <parameter type-id='25e60cb2' name='dev' filepath='drivers/usb/core/message.c' line='1518' column='1'/>
+        <parameter type-id='95e97e5e' name='interface' filepath='drivers/usb/core/message.c' line='1518' column='1'/>
+        <parameter type-id='95e97e5e' name='alternate' filepath='drivers/usb/core/message.c' line='1518' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_show_dynids' mangled-name='usb_show_dynids' filepath='drivers/usb/core/driver.c' line='115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_show_dynids'>
@@ -148666,13 +148685,13 @@
         <parameter type-id='f0981eeb' name='timeout' filepath='drivers/usb/core/urb.c' line='964' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_wakeup_enabled_descendants' mangled-name='usb_wakeup_enabled_descendants' filepath='drivers/usb/core/hub.c' line='3232' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_wakeup_enabled_descendants'>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='3232' column='1'/>
+      <function-decl name='usb_wakeup_enabled_descendants' mangled-name='usb_wakeup_enabled_descendants' filepath='drivers/usb/core/hub.c' line='3250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_wakeup_enabled_descendants'>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='3250' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='usb_wakeup_notification' mangled-name='usb_wakeup_notification' filepath='drivers/usb/core/hub.c' line='698' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_wakeup_notification'>
-        <parameter type-id='25e60cb2' name='hdev' filepath='drivers/usb/core/hub.c' line='698' column='1'/>
-        <parameter type-id='f0981eeb' name='portnum' filepath='drivers/usb/core/hub.c' line='699' column='1'/>
+      <function-decl name='usb_wakeup_notification' mangled-name='usb_wakeup_notification' filepath='drivers/usb/core/hub.c' line='706' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_wakeup_notification'>
+        <parameter type-id='25e60cb2' name='hdev' filepath='drivers/usb/core/hub.c' line='706' column='1'/>
+        <parameter type-id='f0981eeb' name='portnum' filepath='drivers/usb/core/hub.c' line='707' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usbnet_cdc_unbind' mangled-name='usbnet_cdc_unbind' filepath='drivers/net/usb/cdc_ether.c' line='345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_cdc_unbind'>
@@ -148727,10 +148746,10 @@
         <parameter type-id='bd3860fe' name='stats' filepath='drivers/net/usb/usbnet.c' line='981' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usbnet_link_change' mangled-name='usbnet_link_change' filepath='drivers/net/usb/usbnet.c' line='1946' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_link_change'>
-        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='1946' column='1'/>
-        <parameter type-id='b50a4934' name='link' filepath='drivers/net/usb/usbnet.c' line='1946' column='1'/>
-        <parameter type-id='b50a4934' name='need_reset' filepath='drivers/net/usb/usbnet.c' line='1946' column='1'/>
+      <function-decl name='usbnet_link_change' mangled-name='usbnet_link_change' filepath='drivers/net/usb/usbnet.c' line='1952' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_link_change'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='1952' column='1'/>
+        <parameter type-id='b50a4934' name='link' filepath='drivers/net/usb/usbnet.c' line='1952' column='1'/>
+        <parameter type-id='b50a4934' name='need_reset' filepath='drivers/net/usb/usbnet.c' line='1952' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usbnet_nway_reset' mangled-name='usbnet_nway_reset' filepath='drivers/net/usb/usbnet.c' line='1007' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_nway_reset'>
@@ -148746,28 +148765,28 @@
         <parameter type-id='bc57058f' name='prod' filepath='drivers/net/usb/usbnet.c' line='1630' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usbnet_read_cmd' mangled-name='usbnet_read_cmd' filepath='drivers/net/usb/usbnet.c' line='2029' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_read_cmd'>
-        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='2029' column='1'/>
-        <parameter type-id='f9b06939' name='cmd' filepath='drivers/net/usb/usbnet.c' line='2029' column='1'/>
-        <parameter type-id='f9b06939' name='reqtype' filepath='drivers/net/usb/usbnet.c' line='2029' column='1'/>
-        <parameter type-id='1dc6a898' name='value' filepath='drivers/net/usb/usbnet.c' line='2030' column='1'/>
-        <parameter type-id='1dc6a898' name='index' filepath='drivers/net/usb/usbnet.c' line='2030' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/net/usb/usbnet.c' line='2030' column='1'/>
-        <parameter type-id='1dc6a898' name='size' filepath='drivers/net/usb/usbnet.c' line='2030' column='1'/>
+      <function-decl name='usbnet_read_cmd' mangled-name='usbnet_read_cmd' filepath='drivers/net/usb/usbnet.c' line='2035' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_read_cmd'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='2035' column='1'/>
+        <parameter type-id='f9b06939' name='cmd' filepath='drivers/net/usb/usbnet.c' line='2035' column='1'/>
+        <parameter type-id='f9b06939' name='reqtype' filepath='drivers/net/usb/usbnet.c' line='2035' column='1'/>
+        <parameter type-id='1dc6a898' name='value' filepath='drivers/net/usb/usbnet.c' line='2036' column='1'/>
+        <parameter type-id='1dc6a898' name='index' filepath='drivers/net/usb/usbnet.c' line='2036' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/net/usb/usbnet.c' line='2036' column='1'/>
+        <parameter type-id='1dc6a898' name='size' filepath='drivers/net/usb/usbnet.c' line='2036' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usbnet_read_cmd_nopm' mangled-name='usbnet_read_cmd_nopm' filepath='drivers/net/usb/usbnet.c' line='2065' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_read_cmd_nopm'>
-        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='2065' column='1'/>
-        <parameter type-id='f9b06939' name='cmd' filepath='drivers/net/usb/usbnet.c' line='2065' column='1'/>
-        <parameter type-id='f9b06939' name='reqtype' filepath='drivers/net/usb/usbnet.c' line='2065' column='1'/>
-        <parameter type-id='1dc6a898' name='value' filepath='drivers/net/usb/usbnet.c' line='2066' column='1'/>
-        <parameter type-id='1dc6a898' name='index' filepath='drivers/net/usb/usbnet.c' line='2066' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/net/usb/usbnet.c' line='2066' column='1'/>
-        <parameter type-id='1dc6a898' name='size' filepath='drivers/net/usb/usbnet.c' line='2066' column='1'/>
+      <function-decl name='usbnet_read_cmd_nopm' mangled-name='usbnet_read_cmd_nopm' filepath='drivers/net/usb/usbnet.c' line='2071' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_read_cmd_nopm'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='2071' column='1'/>
+        <parameter type-id='f9b06939' name='cmd' filepath='drivers/net/usb/usbnet.c' line='2071' column='1'/>
+        <parameter type-id='f9b06939' name='reqtype' filepath='drivers/net/usb/usbnet.c' line='2071' column='1'/>
+        <parameter type-id='1dc6a898' name='value' filepath='drivers/net/usb/usbnet.c' line='2072' column='1'/>
+        <parameter type-id='1dc6a898' name='index' filepath='drivers/net/usb/usbnet.c' line='2072' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/net/usb/usbnet.c' line='2072' column='1'/>
+        <parameter type-id='1dc6a898' name='size' filepath='drivers/net/usb/usbnet.c' line='2072' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usbnet_resume' mangled-name='usbnet_resume' filepath='drivers/net/usb/usbnet.c' line='1869' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_resume'>
-        <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/usbnet.c' line='1869' column='1'/>
+      <function-decl name='usbnet_resume' mangled-name='usbnet_resume' filepath='drivers/net/usb/usbnet.c' line='1875' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_resume'>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/usbnet.c' line='1875' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usbnet_set_link_ksettings' mangled-name='usbnet_set_link_ksettings' filepath='drivers/net/usb/usbnet.c' line='959' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_set_link_ksettings'>
@@ -148794,9 +148813,9 @@
         <parameter type-id='68a2d05b' name='net' filepath='drivers/net/usb/usbnet.c' line='796' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usbnet_suspend' mangled-name='usbnet_suspend' filepath='drivers/net/usb/usbnet.c' line='1836' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_suspend'>
-        <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/usbnet.c' line='1836' column='1'/>
-        <parameter type-id='08496218' name='message' filepath='drivers/net/usb/usbnet.c' line='1836' column='1'/>
+      <function-decl name='usbnet_suspend' mangled-name='usbnet_suspend' filepath='drivers/net/usb/usbnet.c' line='1842' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_suspend'>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/usbnet.c' line='1842' column='1'/>
+        <parameter type-id='08496218' name='message' filepath='drivers/net/usb/usbnet.c' line='1842' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usbnet_tx_timeout' mangled-name='usbnet_tx_timeout' filepath='drivers/net/usb/usbnet.c' line='1269' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_tx_timeout'>
@@ -148812,34 +148831,34 @@
         <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='340' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usbnet_write_cmd' mangled-name='usbnet_write_cmd' filepath='drivers/net/usb/usbnet.c' line='2047' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_write_cmd'>
-        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='2047' column='1'/>
-        <parameter type-id='f9b06939' name='cmd' filepath='drivers/net/usb/usbnet.c' line='2047' column='1'/>
-        <parameter type-id='f9b06939' name='reqtype' filepath='drivers/net/usb/usbnet.c' line='2047' column='1'/>
-        <parameter type-id='1dc6a898' name='value' filepath='drivers/net/usb/usbnet.c' line='2048' column='1'/>
-        <parameter type-id='1dc6a898' name='index' filepath='drivers/net/usb/usbnet.c' line='2048' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/net/usb/usbnet.c' line='2048' column='1'/>
-        <parameter type-id='1dc6a898' name='size' filepath='drivers/net/usb/usbnet.c' line='2048' column='1'/>
+      <function-decl name='usbnet_write_cmd' mangled-name='usbnet_write_cmd' filepath='drivers/net/usb/usbnet.c' line='2053' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_write_cmd'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='2053' column='1'/>
+        <parameter type-id='f9b06939' name='cmd' filepath='drivers/net/usb/usbnet.c' line='2053' column='1'/>
+        <parameter type-id='f9b06939' name='reqtype' filepath='drivers/net/usb/usbnet.c' line='2053' column='1'/>
+        <parameter type-id='1dc6a898' name='value' filepath='drivers/net/usb/usbnet.c' line='2054' column='1'/>
+        <parameter type-id='1dc6a898' name='index' filepath='drivers/net/usb/usbnet.c' line='2054' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/net/usb/usbnet.c' line='2054' column='1'/>
+        <parameter type-id='1dc6a898' name='size' filepath='drivers/net/usb/usbnet.c' line='2054' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usbnet_write_cmd_async' mangled-name='usbnet_write_cmd_async' filepath='drivers/net/usb/usbnet.c' line='2103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_write_cmd_async'>
-        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='2103' column='1'/>
-        <parameter type-id='f9b06939' name='cmd' filepath='drivers/net/usb/usbnet.c' line='2103' column='1'/>
-        <parameter type-id='f9b06939' name='reqtype' filepath='drivers/net/usb/usbnet.c' line='2103' column='1'/>
-        <parameter type-id='1dc6a898' name='value' filepath='drivers/net/usb/usbnet.c' line='2104' column='1'/>
-        <parameter type-id='1dc6a898' name='index' filepath='drivers/net/usb/usbnet.c' line='2104' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/net/usb/usbnet.c' line='2104' column='1'/>
-        <parameter type-id='1dc6a898' name='size' filepath='drivers/net/usb/usbnet.c' line='2104' column='1'/>
+      <function-decl name='usbnet_write_cmd_async' mangled-name='usbnet_write_cmd_async' filepath='drivers/net/usb/usbnet.c' line='2109' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_write_cmd_async'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='2109' column='1'/>
+        <parameter type-id='f9b06939' name='cmd' filepath='drivers/net/usb/usbnet.c' line='2109' column='1'/>
+        <parameter type-id='f9b06939' name='reqtype' filepath='drivers/net/usb/usbnet.c' line='2109' column='1'/>
+        <parameter type-id='1dc6a898' name='value' filepath='drivers/net/usb/usbnet.c' line='2110' column='1'/>
+        <parameter type-id='1dc6a898' name='index' filepath='drivers/net/usb/usbnet.c' line='2110' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/net/usb/usbnet.c' line='2110' column='1'/>
+        <parameter type-id='1dc6a898' name='size' filepath='drivers/net/usb/usbnet.c' line='2110' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usbnet_write_cmd_nopm' mangled-name='usbnet_write_cmd_nopm' filepath='drivers/net/usb/usbnet.c' line='2077' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_write_cmd_nopm'>
-        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='2077' column='1'/>
-        <parameter type-id='f9b06939' name='cmd' filepath='drivers/net/usb/usbnet.c' line='2077' column='1'/>
-        <parameter type-id='f9b06939' name='reqtype' filepath='drivers/net/usb/usbnet.c' line='2077' column='1'/>
-        <parameter type-id='1dc6a898' name='value' filepath='drivers/net/usb/usbnet.c' line='2078' column='1'/>
-        <parameter type-id='1dc6a898' name='index' filepath='drivers/net/usb/usbnet.c' line='2078' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/net/usb/usbnet.c' line='2078' column='1'/>
-        <parameter type-id='1dc6a898' name='size' filepath='drivers/net/usb/usbnet.c' line='2079' column='1'/>
+      <function-decl name='usbnet_write_cmd_nopm' mangled-name='usbnet_write_cmd_nopm' filepath='drivers/net/usb/usbnet.c' line='2083' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_write_cmd_nopm'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='2083' column='1'/>
+        <parameter type-id='f9b06939' name='cmd' filepath='drivers/net/usb/usbnet.c' line='2083' column='1'/>
+        <parameter type-id='f9b06939' name='reqtype' filepath='drivers/net/usb/usbnet.c' line='2083' column='1'/>
+        <parameter type-id='1dc6a898' name='value' filepath='drivers/net/usb/usbnet.c' line='2084' column='1'/>
+        <parameter type-id='1dc6a898' name='index' filepath='drivers/net/usb/usbnet.c' line='2084' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/net/usb/usbnet.c' line='2084' column='1'/>
+        <parameter type-id='1dc6a898' name='size' filepath='drivers/net/usb/usbnet.c' line='2085' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usleep_range' mangled-name='usleep_range' filepath='kernel/time/timer.c' line='2095' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usleep_range'>
@@ -149747,16 +149766,16 @@
         <parameter type-id='f0981eeb' name='query_flags' filepath='fs/stat.c' line='125' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vfs_ioc_fssetxattr_check' mangled-name='vfs_ioc_fssetxattr_check' filepath='fs/inode.c' line='2298' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfs_ioc_fssetxattr_check'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2298' column='1'/>
-        <parameter type-id='62561e90' name='old_fa' filepath='fs/inode.c' line='2298' column='1'/>
-        <parameter type-id='a1405a51' name='fa' filepath='fs/inode.c' line='2299' column='1'/>
+      <function-decl name='vfs_ioc_fssetxattr_check' mangled-name='vfs_ioc_fssetxattr_check' filepath='fs/inode.c' line='2340' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfs_ioc_fssetxattr_check'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2340' column='1'/>
+        <parameter type-id='62561e90' name='old_fa' filepath='fs/inode.c' line='2340' column='1'/>
+        <parameter type-id='a1405a51' name='fa' filepath='fs/inode.c' line='2341' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vfs_ioc_setflags_prepare' mangled-name='vfs_ioc_setflags_prepare' filepath='fs/inode.c' line='2274' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfs_ioc_setflags_prepare'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2274' column='1'/>
-        <parameter type-id='f0981eeb' name='oldflags' filepath='fs/inode.c' line='2274' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='fs/inode.c' line='2275' column='1'/>
+      <function-decl name='vfs_ioc_setflags_prepare' mangled-name='vfs_ioc_setflags_prepare' filepath='fs/inode.c' line='2316' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfs_ioc_setflags_prepare'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2316' column='1'/>
+        <parameter type-id='f0981eeb' name='oldflags' filepath='fs/inode.c' line='2316' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='fs/inode.c' line='2317' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='vfs_llseek' mangled-name='vfs_llseek' filepath='fs/read_write.c' line='291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfs_llseek'>
@@ -150151,8 +150170,8 @@
         <return type-id='7359adad'/>
       </function-decl>
       <var-decl name='vm_zone_stat' type-id='84ab35b9' mangled-name='vm_zone_stat' visibility='default' filepath='mm/vmstat.c' line='163' column='1' elf-symbol-id='vm_zone_stat'/>
-      <function-decl name='vmalloc' mangled-name='vmalloc' filepath='mm/vmalloc.c' line='2644' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmalloc'>
-        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2644' column='1'/>
+      <function-decl name='vmalloc' mangled-name='vmalloc' filepath='mm/vmalloc.c' line='2648' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmalloc'>
+        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2648' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='vmalloc_nr_pages' mangled-name='vmalloc_nr_pages' filepath='mm/vmalloc.c' line='490' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmalloc_nr_pages'>
@@ -150166,8 +150185,8 @@
         <parameter type-id='eaa32e2f' name='vmalloc_addr' filepath='mm/vmalloc.c' line='401' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='vmalloc_user' mangled-name='vmalloc_user' filepath='mm/vmalloc.c' line='2680' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmalloc_user'>
-        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2680' column='1'/>
+      <function-decl name='vmalloc_user' mangled-name='vmalloc_user' filepath='mm/vmalloc.c' line='2684' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmalloc_user'>
+        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2684' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='vmap' mangled-name='vmap' filepath='mm/vmalloc.c' line='2396' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmap'>
@@ -150306,13 +150325,13 @@
         <parameter type-id='eaa32e2f' name='addr' filepath='mm/vmalloc.c' line='2372' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='vzalloc' mangled-name='vzalloc' filepath='mm/vmalloc.c' line='2664' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vzalloc'>
-        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2664' column='1'/>
+      <function-decl name='vzalloc' mangled-name='vzalloc' filepath='mm/vmalloc.c' line='2668' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vzalloc'>
+        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2668' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='vzalloc_node' mangled-name='vzalloc_node' filepath='mm/vmalloc.c' line='2720' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vzalloc_node'>
-        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2720' column='1'/>
-        <parameter type-id='95e97e5e' name='node' filepath='mm/vmalloc.c' line='2720' column='1'/>
+      <function-decl name='vzalloc_node' mangled-name='vzalloc_node' filepath='mm/vmalloc.c' line='2724' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vzalloc_node'>
+        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2724' column='1'/>
+        <parameter type-id='95e97e5e' name='node' filepath='mm/vmalloc.c' line='2724' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='wait_for_completion' mangled-name='wait_for_completion' filepath='kernel/sched/completion.c' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_for_completion'>
@@ -150482,20 +150501,20 @@
         <parameter type-id='eaa32e2f' name='key' filepath='kernel/sched/wait.c' line='466' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='work_busy' mangled-name='work_busy' filepath='kernel/workqueue.c' line='4598' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='work_busy'>
-        <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='4598' column='1'/>
+      <function-decl name='work_busy' mangled-name='work_busy' filepath='kernel/workqueue.c' line='4601' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='work_busy'>
+        <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='4601' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='work_on_cpu' mangled-name='work_on_cpu' filepath='kernel/workqueue.c' line='5155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='work_on_cpu'>
-        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/workqueue.c' line='5155' column='1'/>
-        <parameter type-id='68883d61' name='fn' filepath='kernel/workqueue.c' line='5155' column='1'/>
-        <parameter type-id='eaa32e2f' name='arg' filepath='kernel/workqueue.c' line='5155' column='1'/>
+      <function-decl name='work_on_cpu' mangled-name='work_on_cpu' filepath='kernel/workqueue.c' line='5158' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='work_on_cpu'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/workqueue.c' line='5158' column='1'/>
+        <parameter type-id='68883d61' name='fn' filepath='kernel/workqueue.c' line='5158' column='1'/>
+        <parameter type-id='eaa32e2f' name='arg' filepath='kernel/workqueue.c' line='5158' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='wq_worker_comm' mangled-name='wq_worker_comm' filepath='kernel/workqueue.c' line='4869' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wq_worker_comm'>
-        <parameter type-id='26a90f95' name='buf' filepath='kernel/workqueue.c' line='4869' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='kernel/workqueue.c' line='4869' column='1'/>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/workqueue.c' line='4869' column='1'/>
+      <function-decl name='wq_worker_comm' mangled-name='wq_worker_comm' filepath='kernel/workqueue.c' line='4872' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wq_worker_comm'>
+        <parameter type-id='26a90f95' name='buf' filepath='kernel/workqueue.c' line='4872' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='kernel/workqueue.c' line='4872' column='1'/>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/workqueue.c' line='4872' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='write_inode_now' mangled-name='write_inode_now' filepath='fs/fs-writeback.c' line='2565' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='write_inode_now'>
diff --git a/android/abi_gki_aarch64_db845c b/android/abi_gki_aarch64_db845c
index acbd8c5a6d04..ea98679922c1 100644
--- a/android/abi_gki_aarch64_db845c
+++ b/android/abi_gki_aarch64_db845c
@@ -213,7 +213,6 @@
   gpiochip_generic_request
   gpiochip_get_data
   gpiochip_remove
-  gpiod_direction_output
   gpiod_direction_output_raw
   gpiod_set_consumer_name
   gpiod_set_raw_value
@@ -469,10 +468,6 @@
   qcom_smem_state_unregister
   queue_delayed_work_on
   queue_work_on
-  radix_tree_delete
-  radix_tree_insert
-  radix_tree_lookup
-  radix_tree_next_chunk
   ___ratelimit
   rational_best_approximation
   _raw_spin_lock
@@ -526,6 +521,7 @@
   reset_control_reset
   round_jiffies_up
   rpmsg_register_device
+  rpmsg_register_device_override
   rpmsg_send
   rpmsg_unregister_device
   rproc_add
@@ -609,6 +605,7 @@
   strncpy
   strnlen
   strpbrk
+  strscpy
   strscpy_pad
   strsep
   __sw_hweight16
@@ -761,7 +758,6 @@
   skb_dequeue_tail
   skb_realloc_headroom
   strlcat
-  strscpy
   thermal_cooling_device_register
   vzalloc
 
@@ -769,8 +765,8 @@
   pci_clear_master
   pci_disable_device
   pci_disable_msi
+  pcie_capability_clear_and_set_word
   pcie_capability_read_word
-  pcie_capability_write_word
   pci_enable_device
   pci_enable_msi
   pci_iomap
@@ -1136,9 +1132,12 @@
   drm_atomic_private_obj_fini
   drm_atomic_private_obj_init
   drm_bridge_attach
+  drm_bridge_connector_enable_hpd
+  drm_bridge_connector_init
+  drm_bridge_detect
+  drm_bridge_hpd_notify
   drm_compat_ioctl
   drm_connector_has_possible_encoder
-  drm_connector_init_with_ddc
   drm_connector_list_iter_begin
   drm_connector_list_iter_end
   drm_connector_list_iter_next
@@ -1285,7 +1284,6 @@
   generic_file_llseek
   get_pid_task
   get_unused_fd_flags
-  gpiod_direction_input
   gpiod_get_value
   gpiod_set_value
   hdmi_audio_infoframe_pack
@@ -1367,10 +1365,6 @@
   tty_termios_baud_rate
   tty_termios_encode_baud_rate
 
-# required by ns.ko
-  kernel_bind
-  radix_tree_iter_resume
-
 # required by nvmem_qfprom.ko
   devm_nvmem_register
 
@@ -1531,6 +1525,7 @@
   srcu_notifier_chain_unregister
 
 # required by qcom_geni_serial.ko
+  devm_krealloc
   dev_pm_clear_wake_irq
   dev_pm_set_dedicated_wake_irq
   oops_in_progress
@@ -1590,10 +1585,16 @@
   autoremove_wake_function
   datagram_poll
   do_wait_intr_irq
+  kernel_bind
   lock_sock_nested
   proto_register
   proto_unregister
+  radix_tree_delete
+  radix_tree_insert
   radix_tree_iter_delete
+  radix_tree_iter_resume
+  radix_tree_lookup
+  radix_tree_next_chunk
   _raw_write_lock_bh
   _raw_write_unlock_bh
   refcount_dec_and_mutex_lock
@@ -1731,6 +1732,9 @@
   of_clk_add_provider
   of_clk_src_simple_get
 
+# required by snd-soc-wsa881x.ko
+  gpiod_direction_output
+
 # required by socinfo.ko
   add_device_randomness
   soc_device_register
@@ -1807,8 +1811,11 @@
   mfd_remove_devices
 
 # preserved by --additions-only
+  drm_connector_init_with_ddc
+  gpiod_direction_input
   idr_alloc_u32
   of_clk_get_by_name
+  pcie_capability_write_word
   snd_pcm_create_iec958_consumer_hw_params
   snd_soc_get_volsw_sx
   snd_soc_info_volsw_sx

From ac65f8979b0eaac80c4710729c509d8837d8fdb7 Mon Sep 17 00:00:00 2001
From: Christopher Bednarz <christopher.n.bednarz@intel.com>
Date: Fri, 18 Aug 2023 09:48:38 -0500
Subject: [PATCH 0684/1043] RDMA/irdma: Prevent zero-length STAG registration

commit bb6d73d9add68ad270888db327514384dfa44958 upstream.

Currently irdma allows zero-length STAGs to be programmed in HW during
the kernel mode fast register flow. Zero-length MR or STAG registration
disable HW memory length checks.

Improve gaps in bounds checking in irdma by preventing zero-length STAG or
MR registrations except if the IB_PD_UNSAFE_GLOBAL_RKEY is set.

This addresses the disclosure CVE-2023-25775.

Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Signed-off-by: Christopher Bednarz <christopher.n.bednarz@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Link: https://lore.kernel.org/r/20230818144838.1758-1-shiraz.saleem@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/i40iw/i40iw_ctrl.c  |  6 ++++++
 drivers/infiniband/hw/i40iw/i40iw_type.h  |  2 ++
 drivers/infiniband/hw/i40iw/i40iw_verbs.c | 10 ++++++++--
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index 86d3f8aff329..2b18bb36e4e3 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -3033,6 +3033,9 @@ static enum i40iw_status_code i40iw_sc_alloc_stag(
 	u64 header;
 	enum i40iw_page_size page_size;
 
+	if (!info->total_len && !info->all_memory)
+		return -EINVAL;
+
 	page_size = (info->page_size == 0x200000) ? I40IW_PAGE_SIZE_2M : I40IW_PAGE_SIZE_4K;
 	cqp = dev->cqp;
 	wqe = i40iw_sc_cqp_get_next_send_wqe(cqp, scratch);
@@ -3091,6 +3094,9 @@ static enum i40iw_status_code i40iw_sc_mr_reg_non_shared(
 	u8 addr_type;
 	enum i40iw_page_size page_size;
 
+	if (!info->total_len && !info->all_memory)
+		return -EINVAL;
+
 	page_size = (info->page_size == 0x200000) ? I40IW_PAGE_SIZE_2M : I40IW_PAGE_SIZE_4K;
 	if (info->access_rights & (I40IW_ACCESS_FLAGS_REMOTEREAD_ONLY |
 				   I40IW_ACCESS_FLAGS_REMOTEWRITE_ONLY))
diff --git a/drivers/infiniband/hw/i40iw/i40iw_type.h b/drivers/infiniband/hw/i40iw/i40iw_type.h
index c3babf3cbb8e..341aa6b1b6c1 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_type.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_type.h
@@ -786,6 +786,7 @@ struct i40iw_allocate_stag_info {
 	bool use_hmc_fcn_index;
 	u8 hmc_fcn_index;
 	bool use_pf_rid;
+	bool all_memory;
 };
 
 struct i40iw_reg_ns_stag_info {
@@ -804,6 +805,7 @@ struct i40iw_reg_ns_stag_info {
 	bool use_hmc_fcn_index;
 	u8 hmc_fcn_index;
 	bool use_pf_rid;
+	bool all_memory;
 };
 
 struct i40iw_fast_reg_stag_info {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 533f3caecb7a..89654dc91d81 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -1494,7 +1494,8 @@ static int i40iw_handle_q_mem(struct i40iw_device *iwdev,
 static int i40iw_hw_alloc_stag(struct i40iw_device *iwdev, struct i40iw_mr *iwmr)
 {
 	struct i40iw_allocate_stag_info *info;
-	struct i40iw_pd *iwpd = to_iwpd(iwmr->ibmr.pd);
+	struct ib_pd *pd = iwmr->ibmr.pd;
+	struct i40iw_pd *iwpd = to_iwpd(pd);
 	enum i40iw_status_code status;
 	int err = 0;
 	struct i40iw_cqp_request *cqp_request;
@@ -1511,6 +1512,7 @@ static int i40iw_hw_alloc_stag(struct i40iw_device *iwdev, struct i40iw_mr *iwmr
 	info->stag_idx = iwmr->stag >> I40IW_CQPSQ_STAG_IDX_SHIFT;
 	info->pd_id = iwpd->sc_pd.pd_id;
 	info->total_len = iwmr->length;
+	info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY;
 	info->remote_access = true;
 	cqp_info->cqp_cmd = OP_ALLOC_STAG;
 	cqp_info->post_sq = 1;
@@ -1563,6 +1565,8 @@ static struct ib_mr *i40iw_alloc_mr(struct ib_pd *pd, enum ib_mr_type mr_type,
 	iwmr->type = IW_MEMREG_TYPE_MEM;
 	palloc = &iwpbl->pble_alloc;
 	iwmr->page_cnt = max_num_sg;
+	/* Use system PAGE_SIZE as the sg page sizes are unknown at this point */
+	iwmr->length = max_num_sg * PAGE_SIZE;
 	mutex_lock(&iwdev->pbl_mutex);
 	status = i40iw_get_pble(&iwdev->sc_dev, iwdev->pble_rsrc, palloc, iwmr->page_cnt);
 	mutex_unlock(&iwdev->pbl_mutex);
@@ -1659,7 +1663,8 @@ static int i40iw_hwreg_mr(struct i40iw_device *iwdev,
 {
 	struct i40iw_pbl *iwpbl = &iwmr->iwpbl;
 	struct i40iw_reg_ns_stag_info *stag_info;
-	struct i40iw_pd *iwpd = to_iwpd(iwmr->ibmr.pd);
+	struct ib_pd *pd = iwmr->ibmr.pd;
+	struct i40iw_pd *iwpd = to_iwpd(pd);
 	struct i40iw_pble_alloc *palloc = &iwpbl->pble_alloc;
 	enum i40iw_status_code status;
 	int err = 0;
@@ -1679,6 +1684,7 @@ static int i40iw_hwreg_mr(struct i40iw_device *iwdev,
 	stag_info->total_len = iwmr->length;
 	stag_info->access_rights = access;
 	stag_info->pd_id = iwpd->sc_pd.pd_id;
+	stag_info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY;
 	stag_info->addr_type = I40IW_ADDR_TYPE_VA_BASED;
 	stag_info->page_size = iwmr->page_size;
 

From c3bead2f8fca13f637cd39f2faae63619cbc539d Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Tue, 28 Nov 2023 17:35:17 -0700
Subject: [PATCH 0685/1043] PCI: keystone: Drop __init from
 ks_pcie_add_pcie_{ep,port}()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit has no upstream equivalent.

After commit db5ebaeb8fda ("PCI: keystone: Don't discard .probe()
callback") in 5.10.202, there are two modpost warnings when building with
clang:

  WARNING: modpost: vmlinux.o(.text+0x5aa6dc): Section mismatch in reference from the function ks_pcie_probe() to the function .init.text:ks_pcie_add_pcie_port()
  The function ks_pcie_probe() references
  the function __init ks_pcie_add_pcie_port().
  This is often because ks_pcie_probe lacks a __init
  annotation or the annotation of ks_pcie_add_pcie_port is wrong.

  WARNING: modpost: vmlinux.o(.text+0x5aa6f4): Section mismatch in reference from the function ks_pcie_probe() to the function .init.text:ks_pcie_add_pcie_ep()
  The function ks_pcie_probe() references
  the function __init ks_pcie_add_pcie_ep().
  This is often because ks_pcie_probe lacks a __init
  annotation or the annotation of ks_pcie_add_pcie_ep is wrong.

ks_pcie_add_pcie_ep() was removed in upstream commit a0fd361db8e5 ("PCI:
dwc: Move "dbi", "dbi2", and "addr_space" resource setup into common
code") and ks_pcie_add_pcie_port() was removed in upstream
commit 60f5b73fa0f2 ("PCI: dwc: Remove unnecessary wrappers around
dw_pcie_host_init()"), both of which happened before upstream
commit 7994db905c0f ("PCI: keystone: Don't discard .probe() callback").

As neither of these removal changes are really suitable for stable, just
remove __init from these functions in stable, as it is no longer a
correct annotation after dropping __init from ks_pcie_probe().

Fixes: 012dba0ab814 ("PCI: keystone: Don't discard .probe() callback")
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/dwc/pci-keystone.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
index 5b722287aac9..afaea201a5af 100644
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -865,8 +865,8 @@ static irqreturn_t ks_pcie_err_irq_handler(int irq, void *priv)
 	return ks_pcie_handle_error_irq(ks_pcie);
 }
 
-static int __init ks_pcie_add_pcie_port(struct keystone_pcie *ks_pcie,
-					struct platform_device *pdev)
+static int ks_pcie_add_pcie_port(struct keystone_pcie *ks_pcie,
+				 struct platform_device *pdev)
 {
 	struct dw_pcie *pci = ks_pcie->pci;
 	struct pcie_port *pp = &pci->pp;
@@ -978,8 +978,8 @@ static const struct dw_pcie_ep_ops ks_pcie_am654_ep_ops = {
 	.get_features = &ks_pcie_am654_get_features,
 };
 
-static int __init ks_pcie_add_pcie_ep(struct keystone_pcie *ks_pcie,
-				      struct platform_device *pdev)
+static int ks_pcie_add_pcie_ep(struct keystone_pcie *ks_pcie,
+			       struct platform_device *pdev)
 {
 	int ret;
 	struct dw_pcie_ep *ep;

From dbc1929a5214754cf4f307ee8e85ab1838d8abfa Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Thu, 2 Nov 2023 16:26:59 +0000
Subject: [PATCH 0686/1043] afs: Fix afs_server_list to be cleaned up with RCU

[ Upstream commit e6bace7313d61e31f2b16fa3d774fd8cb3cb869e ]

afs_server_list is accessed with the rcu_read_lock() held from
volume->servers, so it needs to be cleaned up correctly.

Fix this by using kfree_rcu() instead of kfree().

Fixes: 8a070a964877 ("afs: Detect cell aliases 1 - Cells with root volumes")
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/internal.h    | 1 +
 fs/afs/server_list.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 637cbe549397..31c7a562147c 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -546,6 +546,7 @@ struct afs_server_entry {
 };
 
 struct afs_server_list {
+	struct rcu_head		rcu;
 	afs_volid_t		vids[AFS_MAXTYPES]; /* Volume IDs */
 	refcount_t		usage;
 	unsigned char		nr_servers;
diff --git a/fs/afs/server_list.c b/fs/afs/server_list.c
index ed9056703505..b59896b1de0a 100644
--- a/fs/afs/server_list.c
+++ b/fs/afs/server_list.c
@@ -17,7 +17,7 @@ void afs_put_serverlist(struct afs_net *net, struct afs_server_list *slist)
 		for (i = 0; i < slist->nr_servers; i++)
 			afs_unuse_server(net, slist->servers[i].server,
 					 afs_server_trace_put_slist);
-		kfree(slist);
+		kfree_rcu(slist, rcu);
 	}
 }
 

From 3b797242d1789039126c0c27bbeeee8d44e5cfce Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Thu, 8 Jun 2023 09:43:54 +0100
Subject: [PATCH 0687/1043] afs: Make error on cell lookup failure consistent
 with OpenAFS

[ Upstream commit 2a4ca1b4b77850544408595e2433f5d7811a9daa ]

When kafs tries to look up a cell in the DNS or the local config, it will
translate a lookup failure into EDESTADDRREQ whereas OpenAFS translates it
into ENOENT.  Applications such as West expect the latter behaviour and
fail if they see the former.

This can be seen by trying to mount an unknown cell:

   # mount -t afs %example.com:cell.root /mnt
   mount: /mnt: mount(2) system call failed: Destination address required.

Fixes: 4d673da14533 ("afs: Support the AFS dynamic root")
Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216637
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/dynroot.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index db832cc931c8..b35c6081dbfe 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -131,8 +131,8 @@ static int afs_probe_cell_name(struct dentry *dentry)
 
 	ret = dns_query(net->net, "afsdb", name, len, "srv=1",
 			NULL, NULL, false);
-	if (ret == -ENODATA)
-		ret = -EDESTADDRREQ;
+	if (ret == -ENODATA || ret == -ENOKEY)
+		ret = -ENOENT;
 	return ret;
 }
 

From 2c688ae2dd78eedd4e409b793bd58f9642b47ba2 Mon Sep 17 00:00:00 2001
From: Shuijing Li <shuijing.li@mediatek.com>
Date: Mon, 15 May 2023 17:49:55 +0800
Subject: [PATCH 0688/1043] drm/panel: boe-tv101wum-nl6: Fine tune the panel
 power sequence

[ Upstream commit 812562b8d881ce6d33fed8052b3a10b718430fb5 ]

For "boe,tv105wum-nw0" this special panel, it is stipulated in
the panel spec that MIPI needs to keep the LP11 state before
the lcm_reset pin is pulled high.

Signed-off-by: Shuijing Li <shuijing.li@mediatek.com>
Signed-off-by: Xinlei Lee <xinlei.lee@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230515094955.15982-3-shuijing.li@mediatek.com
Stable-dep-of: 6965809e5269 ("drm/panel: auo,b101uan08.3: Fine tune the panel power sequence")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
index db9d0b86d542..3229e5eabbd2 100644
--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
@@ -36,6 +36,7 @@ struct panel_desc {
 	const struct panel_init_cmd *init_cmds;
 	unsigned int lanes;
 	bool discharge_on_disable;
+	bool lp11_before_reset;
 };
 
 struct boe_panel {
@@ -551,6 +552,10 @@ static int boe_panel_prepare(struct drm_panel *panel)
 
 	usleep_range(5000, 10000);
 
+	if (boe->desc->lp11_before_reset) {
+		mipi_dsi_dcs_nop(boe->dsi);
+		usleep_range(1000, 2000);
+	}
 	gpiod_set_value(boe->enable_gpio, 1);
 	usleep_range(1000, 2000);
 	gpiod_set_value(boe->enable_gpio, 0);
@@ -719,6 +724,7 @@ static const struct panel_desc boe_tv105wum_nw0_desc = {
 	.mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE |
 		      MIPI_DSI_MODE_LPM,
 	.init_cmds = boe_init_cmd,
+	.lp11_before_reset = true,
 };
 
 static int boe_panel_get_modes(struct drm_panel *panel,

From 60660af9577ad3a17ed735b7625ab4ce191cfa44 Mon Sep 17 00:00:00 2001
From: Xuxin Xiong <xuxinxiong@huaqin.corp-partner.google.com>
Date: Tue, 14 Nov 2023 12:42:05 +0800
Subject: [PATCH 0689/1043] drm/panel: auo,b101uan08.3: Fine tune the panel
 power sequence

[ Upstream commit 6965809e526917b73c8f9178173184dcf13cec4b ]

For "auo,b101uan08.3" this panel, it is stipulated in the panel spec that
MIPI needs to keep the LP11 state before the lcm_reset pin is pulled high.

Fixes: 56ad624b4cb5 ("drm/panel: support for auo, b101uan08.3 wuxga dsi video mode panel")
Signed-off-by: Xuxin Xiong <xuxinxiong@huaqin.corp-partner.google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231114044205.613421-1-xuxinxiong@huaqin.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
index 3229e5eabbd2..9e518213a54f 100644
--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
@@ -697,6 +697,7 @@ static const struct panel_desc auo_b101uan08_3_desc = {
 	.mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE |
 		      MIPI_DSI_MODE_LPM,
 	.init_cmds = auo_b101uan08_3_init_cmd,
+	.lp11_before_reset = true,
 };
 
 static const struct drm_display_mode boe_tv105wum_nw0_default_mode = {

From a5e82e345f4a59a1b704b7383df088d0e922f76d Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Mon, 9 Oct 2023 00:33:15 +0200
Subject: [PATCH 0690/1043] drm/panel: simple: Fix Innolux G101ICE-L01 bus
 flags

[ Upstream commit 06fc41b09cfbc02977acd9189473593a37d82d9b ]

Add missing .bus_flags = DRM_BUS_FLAG_DE_HIGH to this panel description,
ones which match both the datasheet and the panel display_timing flags .

Fixes: 1e29b840af9f ("drm/panel: simple: Add Innolux G101ICE-L01 panel")
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231008223315.279215-1-marex@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-simple.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index e90b51811888..7c470b4763cb 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -2177,6 +2177,7 @@ static const struct panel_desc innolux_g101ice_l01 = {
 		.disable = 200,
 	},
 	.bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
+	.bus_flags = DRM_BUS_FLAG_DE_HIGH,
 	.connector_type = DRM_MODE_CONNECTOR_LVDS,
 };
 

From 939352ad650289d9ec86c86e58c57c26bbb84319 Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Mon, 9 Oct 2023 00:32:56 +0200
Subject: [PATCH 0691/1043] drm/panel: simple: Fix Innolux G101ICE-L01 timings

[ Upstream commit 3f9a91b6c00e655d27bd785dcda1742dbdc31bda ]

The Innolux G101ICE-L01 datasheet [1] page 17 table
6.1 INPUT SIGNAL TIMING SPECIFICATIONS
indicates that maximum vertical blanking time is 40 lines.
Currently the driver uses 29 lines.

Fix it, and since this panel is a DE panel, adjust the timings
to make them less hostile to controllers which cannot do 1 px
HSA/VSA, distribute the delays evenly between all three parts.

[1] https://www.data-modul.com/sites/default/files/products/G101ICE-L01-C2-specification-12042389.pdf

Fixes: 1e29b840af9f ("drm/panel: simple: Add Innolux G101ICE-L01 panel")
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231008223256.279196-1-marex@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-simple.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index 7c470b4763cb..ee01b61a6baf 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -2154,13 +2154,13 @@ static const struct panel_desc innolux_g070y2_l01 = {
 static const struct display_timing innolux_g101ice_l01_timing = {
 	.pixelclock = { 60400000, 71100000, 74700000 },
 	.hactive = { 1280, 1280, 1280 },
-	.hfront_porch = { 41, 80, 100 },
-	.hback_porch = { 40, 79, 99 },
-	.hsync_len = { 1, 1, 1 },
+	.hfront_porch = { 30, 60, 70 },
+	.hback_porch = { 30, 60, 70 },
+	.hsync_len = { 22, 40, 60 },
 	.vactive = { 800, 800, 800 },
-	.vfront_porch = { 5, 11, 14 },
-	.vback_porch = { 4, 11, 14 },
-	.vsync_len = { 1, 1, 1 },
+	.vfront_porch = { 3, 8, 14 },
+	.vback_porch = { 3, 8, 14 },
+	.vsync_len = { 4, 7, 12 },
 	.flags = DISPLAY_FLAGS_DE_HIGH,
 };
 

From 9942c194834642792331cf002c94c8e6d158609d Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 17 Nov 2023 14:17:33 +0000
Subject: [PATCH 0692/1043] wireguard: use DEV_STATS_INC()

[ Upstream commit 93da8d75a66568ba4bb5b14ad2833acd7304cd02 ]

wg_xmit() can be called concurrently, KCSAN reported [1]
some device stats updates can be lost.

Use DEV_STATS_INC() for this unlikely case.

[1]
BUG: KCSAN: data-race in wg_xmit / wg_xmit

read-write to 0xffff888104239160 of 8 bytes by task 1375 on cpu 0:
wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231
__netdev_start_xmit include/linux/netdevice.h:4918 [inline]
netdev_start_xmit include/linux/netdevice.h:4932 [inline]
xmit_one net/core/dev.c:3543 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559
...

read-write to 0xffff888104239160 of 8 bytes by task 1378 on cpu 1:
wg_xmit+0x60f/0x680 drivers/net/wireguard/device.c:231
__netdev_start_xmit include/linux/netdevice.h:4918 [inline]
netdev_start_xmit include/linux/netdevice.h:4932 [inline]
xmit_one net/core/dev.c:3543 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3559
...

v2: also change wg_packet_consume_data_done() (Hangbin Liu)
    and wg_packet_purge_staged_packets()

Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireguard/device.c  |  4 ++--
 drivers/net/wireguard/receive.c | 12 ++++++------
 drivers/net/wireguard/send.c    |  3 ++-
 3 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c
index e0693cd965ec..713ca20feaef 100644
--- a/drivers/net/wireguard/device.c
+++ b/drivers/net/wireguard/device.c
@@ -193,7 +193,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
 	 */
 	while (skb_queue_len(&peer->staged_packet_queue) > MAX_STAGED_PACKETS) {
 		dev_kfree_skb(__skb_dequeue(&peer->staged_packet_queue));
-		++dev->stats.tx_dropped;
+		DEV_STATS_INC(dev, tx_dropped);
 	}
 	skb_queue_splice_tail(&packets, &peer->staged_packet_queue);
 	spin_unlock_bh(&peer->staged_packet_queue.lock);
@@ -211,7 +211,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
 	else if (skb->protocol == htons(ETH_P_IPV6))
 		icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
 err:
-	++dev->stats.tx_errors;
+	DEV_STATS_INC(dev, tx_errors);
 	kfree_skb(skb);
 	return ret;
 }
diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c
index f500aaf67837..d38b24339a1f 100644
--- a/drivers/net/wireguard/receive.c
+++ b/drivers/net/wireguard/receive.c
@@ -423,20 +423,20 @@ static void wg_packet_consume_data_done(struct wg_peer *peer,
 	net_dbg_skb_ratelimited("%s: Packet has unallowed src IP (%pISc) from peer %llu (%pISpfsc)\n",
 				dev->name, skb, peer->internal_id,
 				&peer->endpoint.addr);
-	++dev->stats.rx_errors;
-	++dev->stats.rx_frame_errors;
+	DEV_STATS_INC(dev, rx_errors);
+	DEV_STATS_INC(dev, rx_frame_errors);
 	goto packet_processed;
 dishonest_packet_type:
 	net_dbg_ratelimited("%s: Packet is neither ipv4 nor ipv6 from peer %llu (%pISpfsc)\n",
 			    dev->name, peer->internal_id, &peer->endpoint.addr);
-	++dev->stats.rx_errors;
-	++dev->stats.rx_frame_errors;
+	DEV_STATS_INC(dev, rx_errors);
+	DEV_STATS_INC(dev, rx_frame_errors);
 	goto packet_processed;
 dishonest_packet_size:
 	net_dbg_ratelimited("%s: Packet has incorrect size from peer %llu (%pISpfsc)\n",
 			    dev->name, peer->internal_id, &peer->endpoint.addr);
-	++dev->stats.rx_errors;
-	++dev->stats.rx_length_errors;
+	DEV_STATS_INC(dev, rx_errors);
+	DEV_STATS_INC(dev, rx_length_errors);
 	goto packet_processed;
 packet_processed:
 	dev_kfree_skb(skb);
diff --git a/drivers/net/wireguard/send.c b/drivers/net/wireguard/send.c
index 95c853b59e1d..0d48e0f4a1ba 100644
--- a/drivers/net/wireguard/send.c
+++ b/drivers/net/wireguard/send.c
@@ -333,7 +333,8 @@ static void wg_packet_create_data(struct wg_peer *peer, struct sk_buff *first)
 void wg_packet_purge_staged_packets(struct wg_peer *peer)
 {
 	spin_lock_bh(&peer->staged_packet_queue.lock);
-	peer->device->dev->stats.tx_dropped += peer->staged_packet_queue.qlen;
+	DEV_STATS_ADD(peer->device->dev, tx_dropped,
+		      peer->staged_packet_queue.qlen);
 	__skb_queue_purge(&peer->staged_packet_queue);
 	spin_unlock_bh(&peer->staged_packet_queue.lock);
 }

From cc3b63c089e76dab352927fef6c627daac606f2a Mon Sep 17 00:00:00 2001
From: Chen Ni <nichen@iscas.ac.cn>
Date: Tue, 31 Oct 2023 04:00:07 +0000
Subject: [PATCH 0693/1043] ata: pata_isapnp: Add missing error check for
 devm_ioport_map()

[ Upstream commit a6925165ea82b7765269ddd8dcad57c731aa00de ]

Add missing error return check for devm_ioport_map() and return the
error if this function call fails.

Fixes: 0d5ff566779f ("libata: convert to iomap")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/pata_isapnp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/ata/pata_isapnp.c b/drivers/ata/pata_isapnp.c
index 43bb224430d3..8892931ea867 100644
--- a/drivers/ata/pata_isapnp.c
+++ b/drivers/ata/pata_isapnp.c
@@ -82,6 +82,9 @@ static int isapnp_init_one(struct pnp_dev *idev, const struct pnp_device_id *dev
 	if (pnp_port_valid(idev, 1)) {
 		ctl_addr = devm_ioport_map(&idev->dev,
 					   pnp_port_start(idev, 1), 1);
+		if (!ctl_addr)
+			return -ENOMEM;
+
 		ap->ioaddr.altstatus_addr = ctl_addr;
 		ap->ioaddr.ctl_addr = ctl_addr;
 		ap->ops = &isapnp_port_ops;

From 650e43dfe7d21f20431edaebec579439275e20c9 Mon Sep 17 00:00:00 2001
From: Jonas Karlman <jonas@kwiboo.se>
Date: Thu, 26 Oct 2023 19:14:58 +0000
Subject: [PATCH 0694/1043] drm/rockchip: vop: Fix color for RGB888/BGR888
 format on VOP full

[ Upstream commit bb0a05acd6121ff0e810b44fdc24dbdfaa46b642 ]

Use of DRM_FORMAT_RGB888 and DRM_FORMAT_BGR888 on e.g. RK3288, RK3328
and RK3399 result in wrong colors being displayed.

The issue can be observed using modetest:

  modetest -s <connector_id>@<crtc_id>:1920x1080-60@RG24
  modetest -s <connector_id>@<crtc_id>:1920x1080-60@BG24

Vendor 4.4 kernel apply an inverted rb swap for these formats on VOP
full framework (IP version 3.x) compared to VOP little framework (2.x).

Fix colors by applying different rb swap for VOP full framework (3.x)
and VOP little framework (2.x) similar to vendor 4.4 kernel.

Fixes: 85a359f25388 ("drm/rockchip: Add BGR formats to VOP")
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Tested-by: Diederik de Haas <didi.debian@cknow.org>
Reviewed-by: Christopher Obbard <chris.obbard@collabora.com>
Tested-by: Christopher Obbard <chris.obbard@collabora.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20231026191500.2994225-1-jonas@kwiboo.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 05fcc9e078d6..682d78fab9a5 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -248,14 +248,22 @@ static inline void vop_cfg_done(struct vop *vop)
 	VOP_REG_SET(vop, common, cfg_done, 1);
 }
 
-static bool has_rb_swapped(uint32_t format)
+static bool has_rb_swapped(uint32_t version, uint32_t format)
 {
 	switch (format) {
 	case DRM_FORMAT_XBGR8888:
 	case DRM_FORMAT_ABGR8888:
-	case DRM_FORMAT_BGR888:
 	case DRM_FORMAT_BGR565:
 		return true;
+	/*
+	 * full framework (IP version 3.x) only need rb swapped for RGB888 and
+	 * little framework (IP version 2.x) only need rb swapped for BGR888,
+	 * check for 3.x to also only rb swap BGR888 for unknown vop version
+	 */
+	case DRM_FORMAT_RGB888:
+		return VOP_MAJOR(version) == 3;
+	case DRM_FORMAT_BGR888:
+		return VOP_MAJOR(version) != 3;
 	default:
 		return false;
 	}
@@ -988,7 +996,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane,
 	VOP_WIN_SET(vop, win, dsp_info, dsp_info);
 	VOP_WIN_SET(vop, win, dsp_st, dsp_st);
 
-	rb_swap = has_rb_swapped(fb->format->format);
+	rb_swap = has_rb_swapped(vop->data->version, fb->format->format);
 	VOP_WIN_SET(vop, win, rb_swap, rb_swap);
 
 	/*

From 2f0ea5e0944a912075c0f943483a36e6dd5aac6f Mon Sep 17 00:00:00 2001
From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Date: Fri, 2 Sep 2022 15:29:23 +0200
Subject: [PATCH 0695/1043] HID: core: store the unique system identifier in
 hid_device

[ Upstream commit 1e839143d674603b0bbbc4c513bca35404967dbc ]

This unique identifier is currently used only for ensuring uniqueness in
sysfs. However, this could be handful for userspace to refer to a specific
hid_device by this id.

2 use cases are in my mind: LEDs (and their naming convention), and
HID-BPF.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20220902132938.2409206-9-benjamin.tissoires@redhat.com
Stable-dep-of: fc43e9c857b7 ("HID: fix HID device resource race between HID core and debugging support")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-core.c | 4 +++-
 include/linux/hid.h    | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 524d6d712e72..ab3bca4d5ad2 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2444,10 +2444,12 @@ int hid_add_device(struct hid_device *hdev)
 			hid_warn(hdev, "bad device descriptor (%d)\n", ret);
 	}
 
+	hdev->id = atomic_inc_return(&id);
+
 	/* XXX hack, any other cleaner solution after the driver core
 	 * is converted to allow more than 20 bytes as the device name? */
 	dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
-		     hdev->vendor, hdev->product, atomic_inc_return(&id));
+		     hdev->vendor, hdev->product, hdev->id);
 
 	hid_debug_register(hdev, dev_name(&hdev->dev));
 	ret = device_add(&hdev->dev);
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 256f34f49167..7818dbafab0f 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -624,6 +624,8 @@ struct hid_device {							/* device report descriptor */
 	struct list_head debug_list;
 	spinlock_t  debug_list_lock;
 	wait_queue_head_t debug_wait;
+
+	unsigned int id;						/* system unique id */
 };
 
 #define to_hid_device(pdev) \

From f8467afa754d734ca061fcaa174b2ceaebcba842 Mon Sep 17 00:00:00 2001
From: Charles Yi <be286@163.com>
Date: Tue, 31 Oct 2023 12:32:39 +0800
Subject: [PATCH 0696/1043] HID: fix HID device resource race between HID core
 and debugging support

[ Upstream commit fc43e9c857b7aa55efba9398419b14d9e35dcc7d ]

hid_debug_events_release releases resources bound to the HID device instance.
hid_device_release releases the underlying HID device instance potentially
before hid_debug_events_release has completed releasing debug resources bound
to the same HID device instance.

Reference count to prevent the HID device instance from being torn down
preemptively when HID debugging support is used. When count reaches zero,
release core resources of HID device instance using hiddev_free.

The crash:

[  120.728477][ T4396] kernel BUG at lib/list_debug.c:53!
[  120.728505][ T4396] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[  120.739806][ T4396] Modules linked in: bcmdhd dhd_static_buf 8822cu pcie_mhi r8168
[  120.747386][ T4396] CPU: 1 PID: 4396 Comm: hidt_bridge Not tainted 5.10.110 #257
[  120.754771][ T4396] Hardware name: Rockchip RK3588 EVB4 LP4 V10 Board (DT)
[  120.761643][ T4396] pstate: 60400089 (nZCv daIf +PAN -UAO -TCO BTYPE=--)
[  120.768338][ T4396] pc : __list_del_entry_valid+0x98/0xac
[  120.773730][ T4396] lr : __list_del_entry_valid+0x98/0xac
[  120.779120][ T4396] sp : ffffffc01e62bb60
[  120.783126][ T4396] x29: ffffffc01e62bb60 x28: ffffff818ce3a200
[  120.789126][ T4396] x27: 0000000000000009 x26: 0000000000980000
[  120.795126][ T4396] x25: ffffffc012431000 x24: ffffff802c6d4e00
[  120.801125][ T4396] x23: ffffff8005c66f00 x22: ffffffc01183b5b8
[  120.807125][ T4396] x21: ffffff819df2f100 x20: 0000000000000000
[  120.813124][ T4396] x19: ffffff802c3f0700 x18: ffffffc01d2cd058
[  120.819124][ T4396] x17: 0000000000000000 x16: 0000000000000000
[  120.825124][ T4396] x15: 0000000000000004 x14: 0000000000003fff
[  120.831123][ T4396] x13: ffffffc012085588 x12: 0000000000000003
[  120.837123][ T4396] x11: 00000000ffffbfff x10: 0000000000000003
[  120.843123][ T4396] x9 : 455103d46b329300 x8 : 455103d46b329300
[  120.849124][ T4396] x7 : 74707572726f6320 x6 : ffffffc0124b8cb5
[  120.855124][ T4396] x5 : ffffffffffffffff x4 : 0000000000000000
[  120.861123][ T4396] x3 : ffffffc011cf4f90 x2 : ffffff81fee7b948
[  120.867122][ T4396] x1 : ffffffc011cf4f90 x0 : 0000000000000054
[  120.873122][ T4396] Call trace:
[  120.876259][ T4396]  __list_del_entry_valid+0x98/0xac
[  120.881304][ T4396]  hid_debug_events_release+0x48/0x12c
[  120.886617][ T4396]  full_proxy_release+0x50/0xbc
[  120.891323][ T4396]  __fput+0xdc/0x238
[  120.895075][ T4396]  ____fput+0x14/0x24
[  120.898911][ T4396]  task_work_run+0x90/0x148
[  120.903268][ T4396]  do_exit+0x1bc/0x8a4
[  120.907193][ T4396]  do_group_exit+0x8c/0xa4
[  120.911458][ T4396]  get_signal+0x468/0x744
[  120.915643][ T4396]  do_signal+0x84/0x280
[  120.919650][ T4396]  do_notify_resume+0xd0/0x218
[  120.924262][ T4396]  work_pending+0xc/0x3f0

[ Rahul Rameshbabu <sergeantsagara@protonmail.com>: rework changelog ]
Fixes: cd667ce24796 ("HID: use debugfs for events/reports dumping")
Signed-off-by: Charles Yi <be286@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-core.c  | 12 ++++++++++--
 drivers/hid/hid-debug.c |  3 +++
 include/linux/hid.h     |  3 +++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index ab3bca4d5ad2..476967ab6294 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -702,15 +702,22 @@ static void hid_close_report(struct hid_device *device)
  * Free a device structure, all reports, and all fields.
  */
 
-static void hid_device_release(struct device *dev)
+void hiddev_free(struct kref *ref)
 {
-	struct hid_device *hid = to_hid_device(dev);
+	struct hid_device *hid = container_of(ref, struct hid_device, ref);
 
 	hid_close_report(hid);
 	kfree(hid->dev_rdesc);
 	kfree(hid);
 }
 
+static void hid_device_release(struct device *dev)
+{
+	struct hid_device *hid = to_hid_device(dev);
+
+	kref_put(&hid->ref, hiddev_free);
+}
+
 /*
  * Fetch a report description item from the data stream. We support long
  * items, though they are not used yet.
@@ -2492,6 +2499,7 @@ struct hid_device *hid_allocate_device(void)
 	spin_lock_init(&hdev->debug_list_lock);
 	sema_init(&hdev->driver_input_lock, 1);
 	mutex_init(&hdev->ll_open_lock);
+	kref_init(&hdev->ref);
 
 	return hdev;
 }
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index 1f60a381ae63..81da80f0c75b 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -1082,6 +1082,7 @@ static int hid_debug_events_open(struct inode *inode, struct file *file)
 		goto out;
 	}
 	list->hdev = (struct hid_device *) inode->i_private;
+	kref_get(&list->hdev->ref);
 	file->private_data = list;
 	mutex_init(&list->read_mutex);
 
@@ -1174,6 +1175,8 @@ static int hid_debug_events_release(struct inode *inode, struct file *file)
 	list_del(&list->node);
 	spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags);
 	kfifo_free(&list->hid_debug_fifo);
+
+	kref_put(&list->hdev->ref, hiddev_free);
 	kfree(list);
 
 	return 0;
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 7818dbafab0f..9e306bf9959d 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -624,10 +624,13 @@ struct hid_device {							/* device report descriptor */
 	struct list_head debug_list;
 	spinlock_t  debug_list_lock;
 	wait_queue_head_t debug_wait;
+	struct kref			ref;
 
 	unsigned int id;						/* system unique id */
 };
 
+void hiddev_free(struct kref *ref);
+
 #define to_hid_device(pdev) \
 	container_of(pdev, struct hid_device, dev)
 

From 27914bff9602c4523358b47a31c54f86bbc254da Mon Sep 17 00:00:00 2001
From: Kunwu Chan <chentao@kylinos.cn>
Date: Sun, 19 Nov 2023 22:17:59 +0800
Subject: [PATCH 0697/1043] ipv4: Correct/silence an endian warning in
 __ip_do_redirect

[ Upstream commit c0e2926266af3b5acf28df0a8fc6e4d90effe0bb ]

net/ipv4/route.c:783:46: warning: incorrect type in argument 2 (different base types)
net/ipv4/route.c:783:46:    expected unsigned int [usertype] key
net/ipv4/route.c:783:46:    got restricted __be32 [usertype] new_gw

Fixes: 969447f226b4 ("ipv4: use new_gw for redirect neigh lookup")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Link: https://lore.kernel.org/r/20231119141759.420477-1-chentao@kylinos.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 445b1a2966d7..d360c7d70e8a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -808,7 +808,7 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
 			goto reject_redirect;
 	}
 
-	n = __ipv4_neigh_lookup(rt->dst.dev, new_gw);
+	n = __ipv4_neigh_lookup(rt->dst.dev, (__force u32)new_gw);
 	if (!n)
 		n = neigh_create(&arp_tbl, &new_gw, rt->dst.dev);
 	if (!IS_ERR(n)) {

From 3ae55e3a3734864abed5bf7c39a756130aa0b00d Mon Sep 17 00:00:00 2001
From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Date: Mon, 20 Nov 2023 13:06:29 +0100
Subject: [PATCH 0698/1043] net: usb: ax88179_178a: fix failed operations
 during ax88179_reset

[ Upstream commit 0739af07d1d947af27c877f797cb82ceee702515 ]

Using generic ASIX Electronics Corp. AX88179 Gigabit Ethernet device,
the following test cycle has been implemented:
    - power on
    - check logs
    - shutdown
    - after detecting the system shutdown, disconnect power
    - after approximately 60 seconds of sleep, power is restored
Running some cycles, sometimes error logs like this appear:
    kernel: ax88179_178a 2-9:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -19
    kernel: ax88179_178a 2-9:1.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -19
    ...
These failed operation are happening during ax88179_reset execution, so
the initialization could not be correct.

In order to avoid this, we need to increase the delay after reset and
clock initial operations. By using these larger values, many cycles
have been run and no failed operations appear.

It would be better to check some status register to verify when the
operation has finished, but I do not have found any available information
(neither in the public datasheets nor in the manufacturer's driver). The
only available information for the necessary delays is the maufacturer's
driver (original values) but the proposed values are not enough for the
tested devices.

Fixes: e2ca90c276e1f ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver")
Reported-by: Herb Wei <weihao.bj@ieisystem.com>
Tested-by: Herb Wei <weihao.bj@ieisystem.com>
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Link: https://lore.kernel.org/r/20231120120642.54334-1-jtornosm@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/ax88179_178a.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 79a53fe245e5..38cb863ccb91 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1700,11 +1700,11 @@ static int ax88179_reset(struct usbnet *dev)
 
 	*tmp16 = AX_PHYPWR_RSTCTL_IPRL;
 	ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
-	msleep(200);
+	msleep(500);
 
 	*tmp = AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
 	ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, tmp);
-	msleep(100);
+	msleep(200);
 
 	/* Ethernet PHY Auto Detach*/
 	ax88179_auto_detach(dev, 0);

From 5ada292b5c504720a0acef8cae9acc62a694d19c Mon Sep 17 00:00:00 2001
From: "D. Wythe" <alibuda@linux.alibaba.com>
Date: Wed, 22 Nov 2023 10:37:05 +0800
Subject: [PATCH 0699/1043] net/smc: avoid data corruption caused by decline
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit e6d71b437abc2f249e3b6a1ae1a7228e09c6e563 ]

We found a data corruption issue during testing of SMC-R on Redis
applications.

The benchmark has a low probability of reporting a strange error as
shown below.

"Error: Protocol error, got "\xe2" as reply type byte"

Finally, we found that the retrieved error data was as follows:

0xE2 0xD4 0xC3 0xD9 0x04 0x00 0x2C 0x20 0xA6 0x56 0x00 0x16 0x3E 0x0C
0xCB 0x04 0x02 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xE2

It is quite obvious that this is a SMC DECLINE message, which means that
the applications received SMC protocol message.
We found that this was caused by the following situations:

client                  server
        ¦  clc proposal
        ------------->
        ¦  clc accept
        <-------------
        ¦  clc confirm
        ------------->
wait llc confirm
			send llc confirm
        ¦failed llc confirm
        ¦   x------
(after 2s)timeout
                        wait llc confirm rsp

wait decline

(after 1s) timeout
                        (after 2s) timeout
        ¦   decline
        -------------->
        ¦   decline
        <--------------

As a result, a decline message was sent in the implementation, and this
message was read from TCP by the already-fallback connection.

This patch double the client timeout as 2x of the server value,
With this simple change, the Decline messages should never cross or
collide (during Confirm link timeout).

This issue requires an immediate solution, since the protocol updates
involve a more long-term solution.

Fixes: 0fb0b02bd6fd ("net/smc: adapt SMC client code to use the LLC flow")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/af_smc.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 9fc47292b68d..664ddf5641de 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -396,8 +396,12 @@ static int smcr_clnt_conf_first_link(struct smc_sock *smc)
 	struct smc_llc_qentry *qentry;
 	int rc;
 
-	/* receive CONFIRM LINK request from server over RoCE fabric */
-	qentry = smc_llc_wait(link->lgr, NULL, SMC_LLC_WAIT_TIME,
+	/* Receive CONFIRM LINK request from server over RoCE fabric.
+	 * Increasing the client's timeout by twice as much as the server's
+	 * timeout by default can temporarily avoid decline messages of
+	 * both sides crossing or colliding
+	 */
+	qentry = smc_llc_wait(link->lgr, NULL, 2 * SMC_LLC_WAIT_TIME,
 			      SMC_LLC_CONFIRM_LINK);
 	if (!qentry) {
 		struct smc_clc_msg_decline dclc;

From ebc7fbd15a645fbe5b49b447d11adf79f67e8959 Mon Sep 17 00:00:00 2001
From: Stefano Stabellini <sstabellini@kernel.org>
Date: Wed, 22 Nov 2023 15:07:41 -0800
Subject: [PATCH 0700/1043] arm/xen: fix xen_vcpu_info allocation alignment

[ Upstream commit 7bf9a6b46549852a37e6d07e52c601c3c706b562 ]

xen_vcpu_info is a percpu area than needs to be mapped by Xen.
Currently, it could cross a page boundary resulting in Xen being unable
to map it:

[    0.567318] kernel BUG at arch/arm64/xen/../../arm/xen/enlighten.c:164!
[    0.574002] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP

Fix the issue by using __alloc_percpu and requesting alignment for the
memory allocation.

Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>

Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2311221501340.2053963@ubuntu-linux-20-04-desktop
Fixes: 24d5373dda7c ("arm/xen: Use alloc_percpu rather than __alloc_percpu")
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/xen/enlighten.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index 3d25fd615250..518c7557f78a 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -351,7 +351,8 @@ static int __init xen_guest_init(void)
 	 * for secondary CPUs as they are brought up.
 	 * For uniformity we use VCPUOP_register_vcpu_info even on cpu0.
 	 */
-	xen_vcpu_info = alloc_percpu(struct vcpu_info);
+	xen_vcpu_info = __alloc_percpu(sizeof(struct vcpu_info),
+				       1 << fls(sizeof(struct vcpu_info) - 1));
 	if (xen_vcpu_info == NULL)
 		return -ENOMEM;
 

From a2e868ad07eb7fb8754ac3fc9bf556c1e7363ff2 Mon Sep 17 00:00:00 2001
From: Raju Rangoju <Raju.Rangoju@amd.com>
Date: Wed, 22 Nov 2023 00:44:33 +0530
Subject: [PATCH 0701/1043] amd-xgbe: handle corner-case during sfp hotplug

[ Upstream commit 676ec53844cbdf2f47e68a076cdff7f0ec6cbe3f ]

Force the mode change for SFI in Fixed PHY configurations. Fixed PHY
configurations needs PLL to be enabled while doing mode set. When the
SFP module isn't connected during boot, driver assumes AN is ON and
attempts auto-negotiation. However, if the connected SFP comes up in
Fixed PHY configuration the link will not come up as PLL isn't enabled
while the initial mode set command is issued. So, force the mode change
for SFI in Fixed PHY configuration to fix link issues.

Fixes: e57f7a3feaef ("amd-xgbe: Prepare for working with more than one type of phy")
Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
index ca7372369b3e..60be836b294b 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
@@ -1178,7 +1178,19 @@ static int xgbe_phy_config_fixed(struct xgbe_prv_data *pdata)
 	if (pdata->phy.duplex != DUPLEX_FULL)
 		return -EINVAL;
 
-	xgbe_set_mode(pdata, mode);
+	/* Force the mode change for SFI in Fixed PHY config.
+	 * Fixed PHY configs needs PLL to be enabled while doing mode set.
+	 * When the SFP module isn't connected during boot, driver assumes
+	 * AN is ON and attempts autonegotiation. However, if the connected
+	 * SFP comes up in Fixed PHY config, the link will not come up as
+	 * PLL isn't enabled while the initial mode set command is issued.
+	 * So, force the mode change for SFI in Fixed PHY configuration to
+	 * fix link issues.
+	 */
+	if (mode == XGBE_MODE_SFI)
+		xgbe_change_mode(pdata, mode);
+	else
+		xgbe_set_mode(pdata, mode);
 
 	return 0;
 }

From b7c9e8c038f531c6629fd58e000a8e5676725d35 Mon Sep 17 00:00:00 2001
From: Raju Rangoju <Raju.Rangoju@amd.com>
Date: Wed, 22 Nov 2023 00:44:34 +0530
Subject: [PATCH 0702/1043] amd-xgbe: handle the corner-case during tx
 completion

[ Upstream commit 7121205d5330c6a3cb3379348886d47c77b78d06 ]

The existing implementation uses software logic to accumulate tx
completions until the specified time (1ms) is met and then poll them.
However, there exists a tiny gap which leads to a race between
resetting and checking the tx_activate flag. Due to this the tx
completions are not reported to upper layer and tx queue timeout
kicks-in restarting the device.

To address this, introduce a tx cleanup mechanism as part of the
periodic maintenance process.

Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver")
Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index a5d6faf7b89e..23401958bc13 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -682,10 +682,24 @@ static void xgbe_service(struct work_struct *work)
 static void xgbe_service_timer(struct timer_list *t)
 {
 	struct xgbe_prv_data *pdata = from_timer(pdata, t, service_timer);
+	struct xgbe_channel *channel;
+	unsigned int i;
 
 	queue_work(pdata->dev_workqueue, &pdata->service_work);
 
 	mod_timer(&pdata->service_timer, jiffies + HZ);
+
+	if (!pdata->tx_usecs)
+		return;
+
+	for (i = 0; i < pdata->channel_count; i++) {
+		channel = pdata->channel[i];
+		if (!channel->tx_ring || channel->tx_timer_active)
+			break;
+		channel->tx_timer_active = 1;
+		mod_timer(&channel->tx_timer,
+			  jiffies + usecs_to_jiffies(pdata->tx_usecs));
+	}
 }
 
 static void xgbe_init_timers(struct xgbe_prv_data *pdata)

From 8fb804dabdda2ee921741d7e5019b493c1dd3652 Mon Sep 17 00:00:00 2001
From: Raju Rangoju <Raju.Rangoju@amd.com>
Date: Wed, 22 Nov 2023 00:44:35 +0530
Subject: [PATCH 0703/1043] amd-xgbe: propagate the correct speed and duplex
 status

[ Upstream commit 7a2323ac24a50311f64a3a9b54ed5bef5821ecae ]

xgbe_get_link_ksettings() does not propagate correct speed and duplex
information to ethtool during cable unplug. Due to which ethtool reports
incorrect values for speed and duplex.

Address this by propagating correct information.

Fixes: 7c12aa08779c ("amd-xgbe: Move the PHY support into amd-xgbe")
Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c b/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
index 61f39a0e04f9..64aebf922dda 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c
@@ -314,10 +314,15 @@ static int xgbe_get_link_ksettings(struct net_device *netdev,
 
 	cmd->base.phy_address = pdata->phy.address;
 
-	cmd->base.autoneg = pdata->phy.autoneg;
-	cmd->base.speed = pdata->phy.speed;
-	cmd->base.duplex = pdata->phy.duplex;
+	if (netif_carrier_ok(netdev)) {
+		cmd->base.speed = pdata->phy.speed;
+		cmd->base.duplex = pdata->phy.duplex;
+	} else {
+		cmd->base.speed = SPEED_UNKNOWN;
+		cmd->base.duplex = DUPLEX_UNKNOWN;
+	}
 
+	cmd->base.autoneg = pdata->phy.autoneg;
 	cmd->base.port = PORT_NONE;
 
 	XGBE_LM_COPY(cmd, supported, lks, supported);

From 497e9b0b21a633605eb7d311a42c7e2b60a00de7 Mon Sep 17 00:00:00 2001
From: Samuel Holland <samuel.holland@sifive.com>
Date: Tue, 21 Nov 2023 16:42:17 -0800
Subject: [PATCH 0704/1043] net: axienet: Fix check for partial TX checksum

[ Upstream commit fd0413bbf8b11f56e8aa842783b0deda0dfe2926 ]

Due to a typo, the code checked the RX checksum feature in the TX path.

Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver")
Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://lore.kernel.org/r/20231122004219.3504219-1-samuel.holland@sifive.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 9d362283196a..2a5a3f8761c3 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -763,7 +763,7 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 		if (lp->features & XAE_FEATURE_FULL_TX_CSUM) {
 			/* Tx Full Checksum Offload Enabled */
 			cur_p->app0 |= 2;
-		} else if (lp->features & XAE_FEATURE_PARTIAL_RX_CSUM) {
+		} else if (lp->features & XAE_FEATURE_PARTIAL_TX_CSUM) {
 			csum_start_off = skb_transport_offset(skb);
 			csum_index_off = csum_start_off + skb->csum_offset;
 			/* Tx Partial Checksum Offload Enabled */

From 6e48c3175d0ba1c69facccee3dd6695b6451624d Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Thu, 26 Oct 2023 01:25:07 +0100
Subject: [PATCH 0705/1043] afs: Return ENOENT if no cell DNS record can be
 found

[ Upstream commit 0167236e7d66c5e1e85d902a6abc2529b7544539 ]

Make AFS return error ENOENT if no cell SRV or AFSDB DNS record (or
cellservdb config file record) can be found rather than returning
EDESTADDRREQ.

Also add cell name lookup info to the cursor dump.

Fixes: d5c32c89b208 ("afs: Fix cell DNS lookup")
Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216637
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/vl_rotate.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/afs/vl_rotate.c b/fs/afs/vl_rotate.c
index 488e58490b16..eb415ce56360 100644
--- a/fs/afs/vl_rotate.c
+++ b/fs/afs/vl_rotate.c
@@ -58,6 +58,12 @@ static bool afs_start_vl_iteration(struct afs_vl_cursor *vc)
 		}
 
 		/* Status load is ordered after lookup counter load */
+		if (cell->dns_status == DNS_LOOKUP_GOT_NOT_FOUND) {
+			pr_warn("No record of cell %s\n", cell->name);
+			vc->error = -ENOENT;
+			return false;
+		}
+
 		if (cell->dns_source == DNS_RECORD_UNAVAILABLE) {
 			vc->error = -EDESTADDRREQ;
 			return false;
@@ -285,6 +291,7 @@ bool afs_select_vlserver(struct afs_vl_cursor *vc)
  */
 static void afs_vl_dump_edestaddrreq(const struct afs_vl_cursor *vc)
 {
+	struct afs_cell *cell = vc->cell;
 	static int count;
 	int i;
 
@@ -294,6 +301,9 @@ static void afs_vl_dump_edestaddrreq(const struct afs_vl_cursor *vc)
 
 	rcu_read_lock();
 	pr_notice("EDESTADDR occurred\n");
+	pr_notice("CELL: %s err=%d\n", cell->name, cell->error);
+	pr_notice("DNS: src=%u st=%u lc=%x\n",
+		  cell->dns_source, cell->dns_status, cell->dns_lookup_count);
 	pr_notice("VC: ut=%lx ix=%u ni=%hu fl=%hx err=%hd\n",
 		  vc->untried, vc->index, vc->nr_iterations, vc->flags, vc->error);
 

From d24a18cb51bfea3c5179e3966738de884dc2bde3 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Wed, 1 Nov 2023 22:03:28 +0000
Subject: [PATCH 0706/1043] afs: Fix file locking on R/O volumes to operate in
 local mode

[ Upstream commit b590eb41be766c5a63acc7e8896a042f7a4e8293 ]

AFS doesn't really do locking on R/O volumes as fileservers don't maintain
state with each other and thus a lock on a R/O volume file on one
fileserver will not be be visible to someone looking at the same file on
another fileserver.

Further, the server may return an error if you try it.

Fix this by doing what other AFS clients do and handle filelocking on R/O
volume files entirely within the client and don't touch the server.

Fixes: 6c6c1d63c243 ("afs: Provide mount-time configurable byte-range file locking emulation")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/super.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/afs/super.c b/fs/afs/super.c
index e38bb1e7a4d2..1b62a99b3673 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -406,6 +406,8 @@ static int afs_validate_fc(struct fs_context *fc)
 			return PTR_ERR(volume);
 
 		ctx->volume = volume;
+		if (volume->type != AFSVL_RWVOL)
+			ctx->flock_mode = afs_flock_mode_local;
 	}
 
 	return 0;

From 86a7f67d7605943d65af7315711cea7e5c1b50d8 Mon Sep 17 00:00:00 2001
From: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Date: Tue, 9 Mar 2021 17:16:32 -0800
Subject: [PATCH 0707/1043] nvmet: remove unnecessary ctrl parameter

[ Upstream commit de5878048e11f1ec44164ebb8994de132074367a ]

The function nvmet_ctrl_find_get() accepts out pointer to nvmet_ctrl
structure. This function returns the same error value from two places
that is :- NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR.

Move this to the caller so we can change the return type to nvmet_ctrl.

Now that we can changed the return type, instead of taking out pointer
to the nvmet_ctrl structure remove that function parameter and return
the valid nvmet_ctrl pointer on success and NULL on failure.

Also, add and rename the goto labels for more readability with comments.

Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Stable-dep-of: 1c22e0295a5e ("nvmet: nul-terminate the NQNs passed in the connect command")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/core.c        | 21 +++++++++++----------
 drivers/nvme/target/fabrics-cmd.c | 11 ++++++-----
 drivers/nvme/target/nvmet.h       |  5 +++--
 3 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index a82a0796a614..59109eb8e8e4 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -1189,19 +1189,19 @@ static void nvmet_init_cap(struct nvmet_ctrl *ctrl)
 	ctrl->cap |= NVMET_QUEUE_SIZE - 1;
 }
 
-u16 nvmet_ctrl_find_get(const char *subsysnqn, const char *hostnqn, u16 cntlid,
-		struct nvmet_req *req, struct nvmet_ctrl **ret)
+struct nvmet_ctrl *nvmet_ctrl_find_get(const char *subsysnqn,
+				       const char *hostnqn, u16 cntlid,
+				       struct nvmet_req *req)
 {
+	struct nvmet_ctrl *ctrl = NULL;
 	struct nvmet_subsys *subsys;
-	struct nvmet_ctrl *ctrl;
-	u16 status = 0;
 
 	subsys = nvmet_find_get_subsys(req->port, subsysnqn);
 	if (!subsys) {
 		pr_warn("connect request for invalid subsystem %s!\n",
 			subsysnqn);
 		req->cqe->result.u32 = IPO_IATTR_CONNECT_DATA(subsysnqn);
-		return NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+		goto out;
 	}
 
 	mutex_lock(&subsys->lock);
@@ -1214,20 +1214,21 @@ u16 nvmet_ctrl_find_get(const char *subsysnqn, const char *hostnqn, u16 cntlid,
 			if (!kref_get_unless_zero(&ctrl->ref))
 				continue;
 
-			*ret = ctrl;
-			goto out;
+			/* ctrl found */
+			goto found;
 		}
 	}
 
+	ctrl = NULL; /* ctrl not found */
 	pr_warn("could not find controller %d for subsys %s / host %s\n",
 		cntlid, subsysnqn, hostnqn);
 	req->cqe->result.u32 = IPO_IATTR_CONNECT_DATA(cntlid);
-	status = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
 
-out:
+found:
 	mutex_unlock(&subsys->lock);
 	nvmet_subsys_put(subsys);
-	return status;
+out:
+	return ctrl;
 }
 
 u16 nvmet_check_ctrl_status(struct nvmet_req *req, struct nvme_command *cmd)
diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
index e62d3d0fa6c8..5baaace31c68 100644
--- a/drivers/nvme/target/fabrics-cmd.c
+++ b/drivers/nvme/target/fabrics-cmd.c
@@ -223,7 +223,7 @@ static void nvmet_execute_io_connect(struct nvmet_req *req)
 {
 	struct nvmf_connect_command *c = &req->cmd->connect;
 	struct nvmf_connect_data *d;
-	struct nvmet_ctrl *ctrl = NULL;
+	struct nvmet_ctrl *ctrl;
 	u16 qid = le16_to_cpu(c->qid);
 	u16 status = 0;
 
@@ -250,11 +250,12 @@ static void nvmet_execute_io_connect(struct nvmet_req *req)
 		goto out;
 	}
 
-	status = nvmet_ctrl_find_get(d->subsysnqn, d->hostnqn,
-				     le16_to_cpu(d->cntlid),
-				     req, &ctrl);
-	if (status)
+	ctrl = nvmet_ctrl_find_get(d->subsysnqn, d->hostnqn,
+				   le16_to_cpu(d->cntlid), req);
+	if (!ctrl) {
+		status = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
 		goto out;
+	}
 
 	if (unlikely(qid > ctrl->subsys->max_qid)) {
 		pr_warn("invalid queue id (%d)\n", qid);
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 4bf6d21290c2..ef162b64fabe 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -430,8 +430,9 @@ void nvmet_ctrl_fatal_error(struct nvmet_ctrl *ctrl);
 void nvmet_update_cc(struct nvmet_ctrl *ctrl, u32 new);
 u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn,
 		struct nvmet_req *req, u32 kato, struct nvmet_ctrl **ctrlp);
-u16 nvmet_ctrl_find_get(const char *subsysnqn, const char *hostnqn, u16 cntlid,
-		struct nvmet_req *req, struct nvmet_ctrl **ret);
+struct nvmet_ctrl *nvmet_ctrl_find_get(const char *subsysnqn,
+				       const char *hostnqn, u16 cntlid,
+				       struct nvmet_req *req);
 void nvmet_ctrl_put(struct nvmet_ctrl *ctrl);
 u16 nvmet_check_ctrl_status(struct nvmet_req *req, struct nvme_command *cmd);
 

From 2be451e7a2f124899546c1bb5c6d509a927968c8 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Fri, 17 Nov 2023 08:13:36 -0500
Subject: [PATCH 0708/1043] nvmet: nul-terminate the NQNs passed in the connect
 command

[ Upstream commit 1c22e0295a5eb571c27b53c7371f95699ef705ff ]

The host and subsystem NQNs are passed in the connect command payload and
interpreted as nul-terminated strings.  Ensure they actually are
nul-terminated before using them.

Fixes: a07b4970f464 "nvmet: add a generic NVMe target")
Reported-by: Alon Zahavi <zahavi.alon@gmail.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/fabrics-cmd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
index 5baaace31c68..fb4f62982cb7 100644
--- a/drivers/nvme/target/fabrics-cmd.c
+++ b/drivers/nvme/target/fabrics-cmd.c
@@ -189,6 +189,8 @@ static void nvmet_execute_admin_connect(struct nvmet_req *req)
 		goto out;
 	}
 
+	d->subsysnqn[NVMF_NQN_FIELD_LEN - 1] = '\0';
+	d->hostnqn[NVMF_NQN_FIELD_LEN - 1] = '\0';
 	status = nvmet_alloc_ctrl(d->subsysnqn, d->hostnqn, req,
 				  le32_to_cpu(c->kato), &ctrl);
 	if (status) {
@@ -250,6 +252,8 @@ static void nvmet_execute_io_connect(struct nvmet_req *req)
 		goto out;
 	}
 
+	d->subsysnqn[NVMF_NQN_FIELD_LEN - 1] = '\0';
+	d->hostnqn[NVMF_NQN_FIELD_LEN - 1] = '\0';
 	ctrl = nvmet_ctrl_find_get(d->subsysnqn, d->hostnqn,
 				   le16_to_cpu(d->cntlid), req);
 	if (!ctrl) {

From 68fe711312f1ae939ae3615df8aedc51dd72496a Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro@kernel.org>
Date: Fri, 17 Nov 2023 18:36:48 +0100
Subject: [PATCH 0709/1043] USB: dwc3: qcom: fix resource leaks on probe
 deferral

[ Upstream commit 51392a1879ff06dc21b68aef4825f6ef68a7be42 ]

The driver needs to deregister and free the newly allocated dwc3 core
platform device on ACPI probe errors (e.g. probe deferral) and on driver
unbind but instead it leaked those resources while erroneously dropping
a reference to the parent platform device which is still in use.

For OF probing the driver takes a reference to the dwc3 core platform
device which has also always been leaked.

Fix the broken ACPI tear down and make sure to drop the dwc3 core
reference for both OF and ACPI.

Fixes: 8fd95da2cfb5 ("usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()")
Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver")
Cc: stable@vger.kernel.org      # 4.18
Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Lee Jones <lee@kernel.org>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Acked-by: Andrew Halaney <ahalaney@redhat.com>
Link: https://lore.kernel.org/r/20231117173650.21161-2-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 9cf87666fc6e ("USB: dwc3: qcom: fix ACPI platform device leak")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc3/dwc3-qcom.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
index 3973f6c18857..0d11d282c0a2 100644
--- a/drivers/usb/dwc3/dwc3-qcom.c
+++ b/drivers/usb/dwc3/dwc3-qcom.c
@@ -690,6 +690,7 @@ static int dwc3_qcom_of_register_core(struct platform_device *pdev)
 	if (!qcom->dwc3) {
 		ret = -ENODEV;
 		dev_err(dev, "failed to get dwc3 platform device\n");
+		of_platform_depopulate(dev);
 	}
 
 node_put:
@@ -832,7 +833,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
 
 	if (ret) {
 		dev_err(dev, "failed to register DWC3 Core, err=%d\n", ret);
-		goto depopulate;
+		goto clk_disable;
 	}
 
 	ret = dwc3_qcom_interconnect_init(qcom);
@@ -864,7 +865,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
 	if (np)
 		of_platform_depopulate(&pdev->dev);
 	else
-		platform_device_put(pdev);
+		platform_device_del(qcom->dwc3);
+	platform_device_put(qcom->dwc3);
 clk_disable:
 	for (i = qcom->num_clocks - 1; i >= 0; i--) {
 		clk_disable_unprepare(qcom->clks[i]);
@@ -886,7 +888,8 @@ static int dwc3_qcom_remove(struct platform_device *pdev)
 	if (np)
 		of_platform_depopulate(&pdev->dev);
 	else
-		platform_device_put(pdev);
+		platform_device_del(qcom->dwc3);
+	platform_device_put(qcom->dwc3);
 
 	for (i = qcom->num_clocks - 1; i >= 0; i--) {
 		clk_disable_unprepare(qcom->clks[i]);

From cbfa5aadd65073cc4bbe243f71e0f35deaebbb21 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro@kernel.org>
Date: Fri, 17 Nov 2023 18:36:50 +0100
Subject: [PATCH 0710/1043] USB: dwc3: qcom: fix ACPI platform device leak

[ Upstream commit 9cf87666fc6e08572341fe08ecd909935998fbbd ]

Make sure to free the "urs" platform device, which is created for some
ACPI platforms, on probe errors and on driver unbind.

Compile-tested only.

Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot")
Cc: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Acked-by: Andrew Halaney <ahalaney@redhat.com>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Link: https://lore.kernel.org/r/20231117173650.21161-4-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc3/dwc3-qcom.c | 37 +++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
index 0d11d282c0a2..58d5169e8cab 100644
--- a/drivers/usb/dwc3/dwc3-qcom.c
+++ b/drivers/usb/dwc3/dwc3-qcom.c
@@ -699,9 +699,9 @@ static int dwc3_qcom_of_register_core(struct platform_device *pdev)
 	return ret;
 }
 
-static struct platform_device *
-dwc3_qcom_create_urs_usb_platdev(struct device *dev)
+static struct platform_device *dwc3_qcom_create_urs_usb_platdev(struct device *dev)
 {
+	struct platform_device *urs_usb = NULL;
 	struct fwnode_handle *fwh;
 	struct acpi_device *adev;
 	char name[8];
@@ -721,9 +721,26 @@ dwc3_qcom_create_urs_usb_platdev(struct device *dev)
 
 	adev = to_acpi_device_node(fwh);
 	if (!adev)
-		return NULL;
+		goto err_put_handle;
 
-	return acpi_create_platform_device(adev, NULL);
+	urs_usb = acpi_create_platform_device(adev, NULL);
+	if (IS_ERR_OR_NULL(urs_usb))
+		goto err_put_handle;
+
+	return urs_usb;
+
+err_put_handle:
+	fwnode_handle_put(fwh);
+
+	return urs_usb;
+}
+
+static void dwc3_qcom_destroy_urs_usb_platdev(struct platform_device *urs_usb)
+{
+	struct fwnode_handle *fwh = urs_usb->dev.fwnode;
+
+	platform_device_unregister(urs_usb);
+	fwnode_handle_put(fwh);
 }
 
 static int dwc3_qcom_probe(struct platform_device *pdev)
@@ -808,13 +825,13 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
 	if (IS_ERR(qcom->qscratch_base)) {
 		dev_err(dev, "failed to map qscratch, err=%d\n", ret);
 		ret = PTR_ERR(qcom->qscratch_base);
-		goto clk_disable;
+		goto free_urs;
 	}
 
 	ret = dwc3_qcom_setup_irq(pdev);
 	if (ret) {
 		dev_err(dev, "failed to setup IRQs, err=%d\n", ret);
-		goto clk_disable;
+		goto free_urs;
 	}
 
 	/*
@@ -833,7 +850,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
 
 	if (ret) {
 		dev_err(dev, "failed to register DWC3 Core, err=%d\n", ret);
-		goto clk_disable;
+		goto free_urs;
 	}
 
 	ret = dwc3_qcom_interconnect_init(qcom);
@@ -867,6 +884,9 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
 	else
 		platform_device_del(qcom->dwc3);
 	platform_device_put(qcom->dwc3);
+free_urs:
+	if (qcom->urs_usb)
+		dwc3_qcom_destroy_urs_usb_platdev(qcom->urs_usb);
 clk_disable:
 	for (i = qcom->num_clocks - 1; i >= 0; i--) {
 		clk_disable_unprepare(qcom->clks[i]);
@@ -891,6 +911,9 @@ static int dwc3_qcom_remove(struct platform_device *pdev)
 		platform_device_del(qcom->dwc3);
 	platform_device_put(qcom->dwc3);
 
+	if (qcom->urs_usb)
+		dwc3_qcom_destroy_urs_usb_platdev(qcom->urs_usb);
+
 	for (i = qcom->num_clocks - 1; i >= 0; i--) {
 		clk_disable_unprepare(qcom->clks[i]);
 		clk_put(qcom->clks[i]);

From 1301467cbe4c58ad94ed01318a7ce8beeddd32ec Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Tue, 21 Nov 2023 12:41:26 +0100
Subject: [PATCH 0711/1043] lockdep: Fix block chain corruption

[ Upstream commit bca4104b00fec60be330cd32818dd5c70db3d469 ]

Kent reported an occasional KASAN splat in lockdep. Mark then noted:

> I suspect the dodgy access is to chain_block_buckets[-1], which hits the last 4
> bytes of the redzone and gets (incorrectly/misleadingly) attributed to
> nr_large_chain_blocks.

That would mean @size == 0, at which point size_to_bucket() returns -1
and the above happens.

alloc_chain_hlocks() has 'size - req', for the first with the
precondition 'size >= rq', which allows the 0.

This code is trying to split a block, del_chain_block() takes what we
need, and add_chain_block() puts back the remainder, except in the
above case the remainder is 0 sized and things go sideways.

Fixes: 810507fe6fd5 ("locking/lockdep: Reuse freed chain_hlocks entries")
Reported-by: Kent Overstreet <kent.overstreet@linux.dev>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Kent Overstreet <kent.overstreet@linux.dev>
Link: https://lkml.kernel.org/r/20231121114126.GH8262@noisy.programming.kicks-ass.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/locking/lockdep.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 6cbd2b444476..7471d85f54ae 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -3357,7 +3357,8 @@ static int alloc_chain_hlocks(int req)
 		size = chain_block_size(curr);
 		if (likely(size >= req)) {
 			del_chain_block(0, size, chain_block_next(curr));
-			add_chain_block(curr + req, size - req);
+			if (size > req)
+				add_chain_block(curr + req, size - req);
 			return curr;
 		}
 	}

From 3b2e8b30b0d726e75dd0d17ffe58c8009f69fe1b Mon Sep 17 00:00:00 2001
From: Sakari Ailus <sakari.ailus@linux.intel.com>
Date: Mon, 4 Sep 2023 15:57:37 +0300
Subject: [PATCH 0712/1043] media: ccs: Correctly initialise try compose
 rectangle

[ Upstream commit 724ff68e968b19d786870d333f9952bdd6b119cb ]

Initialise the try sink compose rectangle size to the sink compose
rectangle for binner and scaler sub-devices. This was missed due to the
faulty condition that lead to the compose rectangles to be initialised for
the pixel array sub-device where it is not relevant.

Fixes: ccfc97bdb5ae ("[media] smiapp: Add driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/smiapp/smiapp-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
index 6fc0680a93d0..3bf96b047132 100644
--- a/drivers/media/i2c/smiapp/smiapp-core.c
+++ b/drivers/media/i2c/smiapp/smiapp-core.c
@@ -2647,7 +2647,7 @@ static int smiapp_open(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
 		try_fmt->code = sensor->internal_csi_format->code;
 		try_fmt->field = V4L2_FIELD_NONE;
 
-		if (ssd != sensor->pixel_array)
+		if (ssd == sensor->pixel_array)
 			continue;
 
 		try_comp = v4l2_subdev_get_try_compose(sd, fh->pad, i);

From 62526a55fee74731f93f36e5507e0900ef68921a Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhuacai@loongson.cn>
Date: Tue, 10 Oct 2023 16:54:34 +0800
Subject: [PATCH 0713/1043] MIPS: KVM: Fix a build warning about variable set
 but not used
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 83767a67e7b6a0291cde5681ec7e3708f3f8f877 ]

After commit 411740f5422a ("KVM: MIPS/MMU: Implement KVM_CAP_SYNC_MMU")
old_pte is no longer used in kvm_mips_map_page(). So remove it to fix a
build warning about variable set but not used:

   arch/mips/kvm/mmu.c: In function 'kvm_mips_map_page':
>> arch/mips/kvm/mmu.c:701:29: warning: variable 'old_pte' set but not used [-Wunused-but-set-variable]
     701 |         pte_t *ptep, entry, old_pte;
         |                             ^~~~~~~

Cc: stable@vger.kernel.org
Fixes: 411740f5422a960 ("KVM: MIPS/MMU: Implement KVM_CAP_SYNC_MMU")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310070530.aARZCSfh-lkp@intel.com/
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/kvm/mmu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c
index 28c366d307e7..38a5be10a3db 100644
--- a/arch/mips/kvm/mmu.c
+++ b/arch/mips/kvm/mmu.c
@@ -667,7 +667,7 @@ static int kvm_mips_map_page(struct kvm_vcpu *vcpu, unsigned long gpa,
 	gfn_t gfn = gpa >> PAGE_SHIFT;
 	int srcu_idx, err;
 	kvm_pfn_t pfn;
-	pte_t *ptep, entry, old_pte;
+	pte_t *ptep, entry;
 	bool writeable;
 	unsigned long prot_bits;
 	unsigned long mmu_seq;
@@ -739,7 +739,6 @@ static int kvm_mips_map_page(struct kvm_vcpu *vcpu, unsigned long gpa,
 	entry = pfn_pte(pfn, __pgprot(prot_bits));
 
 	/* Write the PTE */
-	old_pte = *ptep;
 	set_pte(ptep, entry);
 
 	err = 0;

From 8234c1c690a3808ce1fecf55e65727b0c486b54f Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Mon, 24 Apr 2023 11:38:36 +0800
Subject: [PATCH 0714/1043] ext4: add a new helper to check if es must be kept

[ Upstream commit 9649eb18c6288f514cacffdd699d5cd999c2f8f6 ]

In the extent status tree, we have extents which we can just drop without
issues and extents we must not drop - this depends on the extent's status
- currently ext4_es_is_delayed() extents must stay, others may be dropped.

A helper function is added to help determine if the current extent can
be dropped, although only ext4_es_is_delayed() extents cannot be dropped
currently.

Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230424033846.4732-3-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/extents_status.c | 34 +++++++++++++++++++++-------------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index 7806adcc41a7..cf6a21baddbc 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -448,6 +448,19 @@ static void ext4_es_list_del(struct inode *inode)
 	spin_unlock(&sbi->s_es_lock);
 }
 
+/*
+ * Returns true if we cannot fail to allocate memory for this extent_status
+ * entry and cannot reclaim it until its status changes.
+ */
+static inline bool ext4_es_must_keep(struct extent_status *es)
+{
+	/* fiemap, bigalloc, and seek_data/hole need to use it. */
+	if (ext4_es_is_delayed(es))
+		return true;
+
+	return false;
+}
+
 static struct extent_status *
 ext4_es_alloc_extent(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t len,
 		     ext4_fsblk_t pblk)
@@ -460,10 +473,8 @@ ext4_es_alloc_extent(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t len,
 	es->es_len = len;
 	es->es_pblk = pblk;
 
-	/*
-	 * We don't count delayed extent because we never try to reclaim them
-	 */
-	if (!ext4_es_is_delayed(es)) {
+	/* We never try to reclaim a must kept extent, so we don't count it. */
+	if (!ext4_es_must_keep(es)) {
 		if (!EXT4_I(inode)->i_es_shk_nr++)
 			ext4_es_list_add(inode);
 		percpu_counter_inc(&EXT4_SB(inode->i_sb)->
@@ -481,8 +492,8 @@ static void ext4_es_free_extent(struct inode *inode, struct extent_status *es)
 	EXT4_I(inode)->i_es_all_nr--;
 	percpu_counter_dec(&EXT4_SB(inode->i_sb)->s_es_stats.es_stats_all_cnt);
 
-	/* Decrease the shrink counter when this es is not delayed */
-	if (!ext4_es_is_delayed(es)) {
+	/* Decrease the shrink counter when we can reclaim the extent. */
+	if (!ext4_es_must_keep(es)) {
 		BUG_ON(EXT4_I(inode)->i_es_shk_nr == 0);
 		if (!--EXT4_I(inode)->i_es_shk_nr)
 			ext4_es_list_del(inode);
@@ -854,7 +865,7 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
 	if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
 					  128, EXT4_I(inode)))
 		goto retry;
-	if (err == -ENOMEM && !ext4_es_is_delayed(&newes))
+	if (err == -ENOMEM && !ext4_es_must_keep(&newes))
 		err = 0;
 
 	if (sbi->s_cluster_ratio > 1 && test_opt(inode->i_sb, DELALLOC) &&
@@ -1704,11 +1715,8 @@ static int es_do_reclaim_extents(struct ext4_inode_info *ei, ext4_lblk_t end,
 
 		(*nr_to_scan)--;
 		node = rb_next(&es->rb_node);
-		/*
-		 * We can't reclaim delayed extent from status tree because
-		 * fiemap, bigallic, and seek_data/hole need to use it.
-		 */
-		if (ext4_es_is_delayed(es))
+
+		if (ext4_es_must_keep(es))
 			goto next;
 		if (ext4_es_is_referenced(es)) {
 			ext4_es_clear_referenced(es);
@@ -1772,7 +1780,7 @@ void ext4_clear_inode_es(struct inode *inode)
 	while (node) {
 		es = rb_entry(node, struct extent_status, rb_node);
 		node = rb_next(node);
-		if (!ext4_es_is_delayed(es)) {
+		if (!ext4_es_must_keep(es)) {
 			rb_erase(&es->rb_node, &tree->root);
 			ext4_es_free_extent(inode, es);
 		}

From 0cc7653887b0f315aad65858752b033de85d1dea Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Mon, 24 Apr 2023 11:38:37 +0800
Subject: [PATCH 0715/1043] ext4: factor out __es_alloc_extent() and
 __es_free_extent()

[ Upstream commit 73a2f033656be11298912201ad50615307b4477a ]

Factor out __es_alloc_extent() and __es_free_extent(), which only allocate
and free extent_status in these two helpers.

The ext4_es_alloc_extent() function is split into __es_alloc_extent()
and ext4_es_init_extent(). In __es_alloc_extent() we allocate memory using
GFP_KERNEL | __GFP_NOFAIL | __GFP_ZERO if the memory allocation cannot
fail, otherwise we use GFP_ATOMIC. and the ext4_es_init_extent() is used to
initialize extent_status and update related variables after a successful
allocation.

This is to prepare for the use of pre-allocated extent_status later.

Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230424033846.4732-4-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/extents_status.c | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index cf6a21baddbc..012033db4106 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -461,14 +461,17 @@ static inline bool ext4_es_must_keep(struct extent_status *es)
 	return false;
 }
 
-static struct extent_status *
-ext4_es_alloc_extent(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t len,
-		     ext4_fsblk_t pblk)
+static inline struct extent_status *__es_alloc_extent(bool nofail)
+{
+	if (!nofail)
+		return kmem_cache_alloc(ext4_es_cachep, GFP_ATOMIC);
+
+	return kmem_cache_zalloc(ext4_es_cachep, GFP_KERNEL | __GFP_NOFAIL);
+}
+
+static void ext4_es_init_extent(struct inode *inode, struct extent_status *es,
+		ext4_lblk_t lblk, ext4_lblk_t len, ext4_fsblk_t pblk)
 {
-	struct extent_status *es;
-	es = kmem_cache_alloc(ext4_es_cachep, GFP_ATOMIC);
-	if (es == NULL)
-		return NULL;
 	es->es_lblk = lblk;
 	es->es_len = len;
 	es->es_pblk = pblk;
@@ -483,8 +486,11 @@ ext4_es_alloc_extent(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t len,
 
 	EXT4_I(inode)->i_es_all_nr++;
 	percpu_counter_inc(&EXT4_SB(inode->i_sb)->s_es_stats.es_stats_all_cnt);
+}
 
-	return es;
+static inline void __es_free_extent(struct extent_status *es)
+{
+	kmem_cache_free(ext4_es_cachep, es);
 }
 
 static void ext4_es_free_extent(struct inode *inode, struct extent_status *es)
@@ -501,7 +507,7 @@ static void ext4_es_free_extent(struct inode *inode, struct extent_status *es)
 					s_es_stats.es_stats_shk_cnt);
 	}
 
-	kmem_cache_free(ext4_es_cachep, es);
+	__es_free_extent(es);
 }
 
 /*
@@ -803,10 +809,12 @@ static int __es_insert_extent(struct inode *inode, struct extent_status *newes)
 		}
 	}
 
-	es = ext4_es_alloc_extent(inode, newes->es_lblk, newes->es_len,
-				  newes->es_pblk);
+	es = __es_alloc_extent(false);
 	if (!es)
 		return -ENOMEM;
+	ext4_es_init_extent(inode, es, newes->es_lblk, newes->es_len,
+			    newes->es_pblk);
+
 	rb_link_node(&es->rb_node, parent, p);
 	rb_insert_color(&es->rb_node, &tree->root);
 

From fcb07d8ea36356628347542528209d3980c4ec97 Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Mon, 24 Apr 2023 11:38:38 +0800
Subject: [PATCH 0716/1043] ext4: use pre-allocated es in __es_insert_extent()

[ Upstream commit 95f0b320339a977cf69872eac107122bf536775d ]

Pass a extent_status pointer prealloc to __es_insert_extent(). If the
pointer is non-null, it is used directly when a new extent_status is
needed to avoid memory allocation failures.

Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230424033846.4732-5-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/extents_status.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index 012033db4106..0d810ce7580d 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -144,7 +144,8 @@
 static struct kmem_cache *ext4_es_cachep;
 static struct kmem_cache *ext4_pending_cachep;
 
-static int __es_insert_extent(struct inode *inode, struct extent_status *newes);
+static int __es_insert_extent(struct inode *inode, struct extent_status *newes,
+			      struct extent_status *prealloc);
 static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
 			      ext4_lblk_t end, int *reserved);
 static int es_reclaim_extents(struct ext4_inode_info *ei, int *nr_to_scan);
@@ -769,7 +770,8 @@ static inline void ext4_es_insert_extent_check(struct inode *inode,
 }
 #endif
 
-static int __es_insert_extent(struct inode *inode, struct extent_status *newes)
+static int __es_insert_extent(struct inode *inode, struct extent_status *newes,
+			      struct extent_status *prealloc)
 {
 	struct ext4_es_tree *tree = &EXT4_I(inode)->i_es_tree;
 	struct rb_node **p = &tree->root.rb_node;
@@ -809,7 +811,10 @@ static int __es_insert_extent(struct inode *inode, struct extent_status *newes)
 		}
 	}
 
-	es = __es_alloc_extent(false);
+	if (prealloc)
+		es = prealloc;
+	else
+		es = __es_alloc_extent(false);
 	if (!es)
 		return -ENOMEM;
 	ext4_es_init_extent(inode, es, newes->es_lblk, newes->es_len,
@@ -869,7 +874,7 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
 	if (err != 0)
 		goto error;
 retry:
-	err = __es_insert_extent(inode, &newes);
+	err = __es_insert_extent(inode, &newes, NULL);
 	if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
 					  128, EXT4_I(inode)))
 		goto retry;
@@ -919,7 +924,7 @@ void ext4_es_cache_extent(struct inode *inode, ext4_lblk_t lblk,
 
 	es = __es_tree_search(&EXT4_I(inode)->i_es_tree.root, lblk);
 	if (!es || es->es_lblk > end)
-		__es_insert_extent(inode, &newes);
+		__es_insert_extent(inode, &newes, NULL);
 	write_unlock(&EXT4_I(inode)->i_es_lock);
 }
 
@@ -1365,7 +1370,7 @@ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
 					orig_es.es_len - len2;
 			ext4_es_store_pblock_status(&newes, block,
 						    ext4_es_status(&orig_es));
-			err = __es_insert_extent(inode, &newes);
+			err = __es_insert_extent(inode, &newes, NULL);
 			if (err) {
 				es->es_lblk = orig_es.es_lblk;
 				es->es_len = orig_es.es_len;
@@ -2020,7 +2025,7 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
 	if (err != 0)
 		goto error;
 retry:
-	err = __es_insert_extent(inode, &newes);
+	err = __es_insert_extent(inode, &newes, NULL);
 	if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
 					  128, EXT4_I(inode)))
 		goto retry;

From 608758ef8670f9f492fc40e197c55b4cfe06b470 Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Mon, 24 Apr 2023 11:38:39 +0800
Subject: [PATCH 0717/1043] ext4: use pre-allocated es in __es_remove_extent()

[ Upstream commit bda3efaf774fb687c2b7a555aaec3006b14a8857 ]

When splitting extent, if the second extent can not be dropped, we return
-ENOMEM and use GFP_NOFAIL to preallocate an extent_status outside of
i_es_lock and pass it to __es_remove_extent() to be used as the second
extent. This ensures that __es_remove_extent() is executed successfully,
thus ensuring consistency in the extent status tree. If the second extent
is not undroppable, we simply drop it and return 0. Then retry is no longer
necessary, remove it.

Now, __es_remove_extent() will always remove what it should, maybe more.

Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230424033846.4732-6-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/extents_status.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index 0d810ce7580d..10550d62a676 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -147,7 +147,8 @@ static struct kmem_cache *ext4_pending_cachep;
 static int __es_insert_extent(struct inode *inode, struct extent_status *newes,
 			      struct extent_status *prealloc);
 static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
-			      ext4_lblk_t end, int *reserved);
+			      ext4_lblk_t end, int *reserved,
+			      struct extent_status *prealloc);
 static int es_reclaim_extents(struct ext4_inode_info *ei, int *nr_to_scan);
 static int __es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,
 		       struct ext4_inode_info *locked_ei);
@@ -870,7 +871,7 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
 	ext4_es_insert_extent_check(inode, &newes);
 
 	write_lock(&EXT4_I(inode)->i_es_lock);
-	err = __es_remove_extent(inode, lblk, end, NULL);
+	err = __es_remove_extent(inode, lblk, end, NULL, NULL);
 	if (err != 0)
 		goto error;
 retry:
@@ -1314,6 +1315,7 @@ static unsigned int get_rsvd(struct inode *inode, ext4_lblk_t end,
  * @lblk - first block in range
  * @end - last block in range
  * @reserved - number of cluster reservations released
+ * @prealloc - pre-allocated es to avoid memory allocation failures
  *
  * If @reserved is not NULL and delayed allocation is enabled, counts
  * block/cluster reservations freed by removing range and if bigalloc
@@ -1321,7 +1323,8 @@ static unsigned int get_rsvd(struct inode *inode, ext4_lblk_t end,
  * error code on failure.
  */
 static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
-			      ext4_lblk_t end, int *reserved)
+			      ext4_lblk_t end, int *reserved,
+			      struct extent_status *prealloc)
 {
 	struct ext4_es_tree *tree = &EXT4_I(inode)->i_es_tree;
 	struct rb_node *node;
@@ -1329,14 +1332,12 @@ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
 	struct extent_status orig_es;
 	ext4_lblk_t len1, len2;
 	ext4_fsblk_t block;
-	int err;
+	int err = 0;
 	bool count_reserved = true;
 	struct rsvd_count rc;
 
 	if (reserved == NULL || !test_opt(inode->i_sb, DELALLOC))
 		count_reserved = false;
-retry:
-	err = 0;
 
 	es = __es_tree_search(&tree->root, lblk);
 	if (!es)
@@ -1370,14 +1371,13 @@ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
 					orig_es.es_len - len2;
 			ext4_es_store_pblock_status(&newes, block,
 						    ext4_es_status(&orig_es));
-			err = __es_insert_extent(inode, &newes, NULL);
+			err = __es_insert_extent(inode, &newes, prealloc);
 			if (err) {
+				if (!ext4_es_must_keep(&newes))
+					return 0;
+
 				es->es_lblk = orig_es.es_lblk;
 				es->es_len = orig_es.es_len;
-				if ((err == -ENOMEM) &&
-				    __es_shrink(EXT4_SB(inode->i_sb),
-							128, EXT4_I(inode)))
-					goto retry;
 				goto out;
 			}
 		} else {
@@ -1477,7 +1477,7 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
 	 * is reclaimed.
 	 */
 	write_lock(&EXT4_I(inode)->i_es_lock);
-	err = __es_remove_extent(inode, lblk, end, &reserved);
+	err = __es_remove_extent(inode, lblk, end, &reserved, NULL);
 	write_unlock(&EXT4_I(inode)->i_es_lock);
 	ext4_es_print_tree(inode);
 	ext4_da_release_space(inode, reserved);
@@ -2021,7 +2021,7 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
 
 	write_lock(&EXT4_I(inode)->i_es_lock);
 
-	err = __es_remove_extent(inode, lblk, lblk, NULL);
+	err = __es_remove_extent(inode, lblk, lblk, NULL, NULL);
 	if (err != 0)
 		goto error;
 retry:

From aa6568033cfbef6cbe83fe383795ce01c98e769c Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Mon, 24 Apr 2023 11:38:40 +0800
Subject: [PATCH 0718/1043] ext4: using nofail preallocation in
 ext4_es_remove_extent()

[ Upstream commit e9fe2b882bd5b26b987c9ba110c2222796f72af5 ]

If __es_remove_extent() returns an error it means that when splitting
extent, allocating an extent that must be kept failed, where returning
an error directly would cause the extent tree to be inconsistent. So we
use GFP_NOFAIL to pre-allocate an extent_status and pass it to
__es_remove_extent() to avoid this problem.

In addition, since the allocated memory is outside the i_es_lock, the
extent_status tree may change and the pre-allocated extent_status is
no longer needed, so we release the pre-allocated extent_status when
es->es_len is not initialized.

Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230424033846.4732-7-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/extents_status.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index 10550d62a676..4af825eb0cb4 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -1457,6 +1457,7 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
 	ext4_lblk_t end;
 	int err = 0;
 	int reserved = 0;
+	struct extent_status *es = NULL;
 
 	if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)
 		return 0;
@@ -1471,17 +1472,25 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
 	end = lblk + len - 1;
 	BUG_ON(end < lblk);
 
+retry:
+	if (err && !es)
+		es = __es_alloc_extent(true);
 	/*
 	 * ext4_clear_inode() depends on us taking i_es_lock unconditionally
 	 * so that we are sure __es_shrink() is done with the inode before it
 	 * is reclaimed.
 	 */
 	write_lock(&EXT4_I(inode)->i_es_lock);
-	err = __es_remove_extent(inode, lblk, end, &reserved, NULL);
+	err = __es_remove_extent(inode, lblk, end, &reserved, es);
+	if (es && !es->es_len)
+		__es_free_extent(es);
 	write_unlock(&EXT4_I(inode)->i_es_lock);
+	if (err)
+		goto retry;
+
 	ext4_es_print_tree(inode);
 	ext4_da_release_space(inode, reserved);
-	return err;
+	return 0;
 }
 
 static int __es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,

From 2ae2be6e7cd714a691ec29b4202df4e46369a981 Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Mon, 24 Apr 2023 11:38:41 +0800
Subject: [PATCH 0719/1043] ext4: using nofail preallocation in
 ext4_es_insert_delayed_block()

[ Upstream commit 4a2d98447b37bcb68a7f06a1078edcb4f7e6ce7e ]

Similar to in ext4_es_remove_extent(), we use a no-fail preallocation
to avoid inconsistencies, except that here we may have to preallocate
two extent_status.

Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230424033846.4732-8-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/extents_status.c | 33 ++++++++++++++++++++++-----------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index 4af825eb0cb4..4163a4801f96 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -2013,7 +2013,10 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
 				 bool allocated)
 {
 	struct extent_status newes;
-	int err = 0;
+	int err1 = 0;
+	int err2 = 0;
+	struct extent_status *es1 = NULL;
+	struct extent_status *es2 = NULL;
 
 	if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)
 		return 0;
@@ -2028,29 +2031,37 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
 
 	ext4_es_insert_extent_check(inode, &newes);
 
+retry:
+	if (err1 && !es1)
+		es1 = __es_alloc_extent(true);
+	if ((err1 || err2) && !es2)
+		es2 = __es_alloc_extent(true);
 	write_lock(&EXT4_I(inode)->i_es_lock);
 
-	err = __es_remove_extent(inode, lblk, lblk, NULL, NULL);
-	if (err != 0)
+	err1 = __es_remove_extent(inode, lblk, lblk, NULL, es1);
+	if (err1 != 0)
 		goto error;
-retry:
-	err = __es_insert_extent(inode, &newes, NULL);
-	if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
-					  128, EXT4_I(inode)))
-		goto retry;
-	if (err != 0)
+
+	err2 = __es_insert_extent(inode, &newes, es2);
+	if (err2 != 0)
 		goto error;
 
 	if (allocated)
 		__insert_pending(inode, lblk);
 
+	/* es is pre-allocated but not used, free it. */
+	if (es1 && !es1->es_len)
+		__es_free_extent(es1);
+	if (es2 && !es2->es_len)
+		__es_free_extent(es2);
 error:
 	write_unlock(&EXT4_I(inode)->i_es_lock);
+	if (err1 || err2)
+		goto retry;
 
 	ext4_es_print_tree(inode);
 	ext4_print_pending_tree(inode);
-
-	return err;
+	return 0;
 }
 
 /*

From 5527898c6a9f5c77ff9f5eebb2f50a57ccf1be1b Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Mon, 24 Apr 2023 11:38:42 +0800
Subject: [PATCH 0720/1043] ext4: using nofail preallocation in
 ext4_es_insert_extent()

[ Upstream commit 2a69c450083db164596c75c0f5b4d9c4c0e18eba ]

Similar to in ext4_es_insert_delayed_block(), we use preallocations that
do not fail to avoid inconsistencies, but we do not care about es that are
not must be kept, and we return 0 even if such es memory allocation fails.

Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230424033846.4732-9-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/extents_status.c | 40 +++++++++++++++++++++++++++-------------
 1 file changed, 27 insertions(+), 13 deletions(-)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index 4163a4801f96..1327cd9505db 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -841,8 +841,11 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
 {
 	struct extent_status newes;
 	ext4_lblk_t end = lblk + len - 1;
-	int err = 0;
+	int err1 = 0;
+	int err2 = 0;
 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+	struct extent_status *es1 = NULL;
+	struct extent_status *es2 = NULL;
 
 	if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)
 		return 0;
@@ -870,29 +873,40 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
 
 	ext4_es_insert_extent_check(inode, &newes);
 
-	write_lock(&EXT4_I(inode)->i_es_lock);
-	err = __es_remove_extent(inode, lblk, end, NULL, NULL);
-	if (err != 0)
-		goto error;
 retry:
-	err = __es_insert_extent(inode, &newes, NULL);
-	if (err == -ENOMEM && __es_shrink(EXT4_SB(inode->i_sb),
-					  128, EXT4_I(inode)))
-		goto retry;
-	if (err == -ENOMEM && !ext4_es_must_keep(&newes))
-		err = 0;
+	if (err1 && !es1)
+		es1 = __es_alloc_extent(true);
+	if ((err1 || err2) && !es2)
+		es2 = __es_alloc_extent(true);
+	write_lock(&EXT4_I(inode)->i_es_lock);
+
+	err1 = __es_remove_extent(inode, lblk, end, NULL, es1);
+	if (err1 != 0)
+		goto error;
+
+	err2 = __es_insert_extent(inode, &newes, es2);
+	if (err2 == -ENOMEM && !ext4_es_must_keep(&newes))
+		err2 = 0;
+	if (err2 != 0)
+		goto error;
 
 	if (sbi->s_cluster_ratio > 1 && test_opt(inode->i_sb, DELALLOC) &&
 	    (status & EXTENT_STATUS_WRITTEN ||
 	     status & EXTENT_STATUS_UNWRITTEN))
 		__revise_pending(inode, lblk, len);
 
+	/* es is pre-allocated but not used, free it. */
+	if (es1 && !es1->es_len)
+		__es_free_extent(es1);
+	if (es2 && !es2->es_len)
+		__es_free_extent(es2);
 error:
 	write_unlock(&EXT4_I(inode)->i_es_lock);
+	if (err1 || err2)
+		goto retry;
 
 	ext4_es_print_tree(inode);
-
-	return err;
+	return 0;
 }
 
 /*

From 10341e77e49fab3e095ae548ceb39335741b8fe9 Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Tue, 15 Aug 2023 15:08:08 +0800
Subject: [PATCH 0721/1043] ext4: fix slab-use-after-free in
 ext4_es_insert_extent()

[ Upstream commit 768d612f79822d30a1e7d132a4d4b05337ce42ec ]

Yikebaer reported an issue:
==================================================================
BUG: KASAN: slab-use-after-free in ext4_es_insert_extent+0xc68/0xcb0
fs/ext4/extents_status.c:894
Read of size 4 at addr ffff888112ecc1a4 by task syz-executor/8438

CPU: 1 PID: 8438 Comm: syz-executor Not tainted 6.5.0-rc5 #1
Call Trace:
 [...]
 kasan_report+0xba/0xf0 mm/kasan/report.c:588
 ext4_es_insert_extent+0xc68/0xcb0 fs/ext4/extents_status.c:894
 ext4_map_blocks+0x92a/0x16f0 fs/ext4/inode.c:680
 ext4_alloc_file_blocks.isra.0+0x2df/0xb70 fs/ext4/extents.c:4462
 ext4_zero_range fs/ext4/extents.c:4622 [inline]
 ext4_fallocate+0x251c/0x3ce0 fs/ext4/extents.c:4721
 [...]

Allocated by task 8438:
 [...]
 kmem_cache_zalloc include/linux/slab.h:693 [inline]
 __es_alloc_extent fs/ext4/extents_status.c:469 [inline]
 ext4_es_insert_extent+0x672/0xcb0 fs/ext4/extents_status.c:873
 ext4_map_blocks+0x92a/0x16f0 fs/ext4/inode.c:680
 ext4_alloc_file_blocks.isra.0+0x2df/0xb70 fs/ext4/extents.c:4462
 ext4_zero_range fs/ext4/extents.c:4622 [inline]
 ext4_fallocate+0x251c/0x3ce0 fs/ext4/extents.c:4721
 [...]

Freed by task 8438:
 [...]
 kmem_cache_free+0xec/0x490 mm/slub.c:3823
 ext4_es_try_to_merge_right fs/ext4/extents_status.c:593 [inline]
 __es_insert_extent+0x9f4/0x1440 fs/ext4/extents_status.c:802
 ext4_es_insert_extent+0x2ca/0xcb0 fs/ext4/extents_status.c:882
 ext4_map_blocks+0x92a/0x16f0 fs/ext4/inode.c:680
 ext4_alloc_file_blocks.isra.0+0x2df/0xb70 fs/ext4/extents.c:4462
 ext4_zero_range fs/ext4/extents.c:4622 [inline]
 ext4_fallocate+0x251c/0x3ce0 fs/ext4/extents.c:4721
 [...]
==================================================================

The flow of issue triggering is as follows:
1. remove es
      raw es               es  removed  es1
|-------------------| -> |----|.......|------|

2. insert es
  es   insert   es1      merge with es  es1     merge with es and free es1
|----|.......|------| -> |------------|------| -> |-------------------|

es merges with newes, then merges with es1, frees es1, then determines
if es1->es_len is 0 and triggers a UAF.

The code flow is as follows:
ext4_es_insert_extent
  es1 = __es_alloc_extent(true);
  es2 = __es_alloc_extent(true);
  __es_remove_extent(inode, lblk, end, NULL, es1)
    __es_insert_extent(inode, &newes, es1) ---> insert es1 to es tree
  __es_insert_extent(inode, &newes, es2)
    ext4_es_try_to_merge_right
      ext4_es_free_extent(inode, es1) --->  es1 is freed
  if (es1 && !es1->es_len)
    // Trigger UAF by determining if es1 is used.

We determine whether es1 or es2 is used immediately after calling
__es_remove_extent() or __es_insert_extent() to avoid triggering a
UAF if es1 or es2 is freed.

Reported-by: Yikebaer Aizezi <yikebaer61@gmail.com>
Closes: https://lore.kernel.org/lkml/CALcu4raD4h9coiyEBL4Bm0zjDwxC2CyPiTwsP3zFuhot6y9Beg@mail.gmail.com
Fixes: 2a69c450083d ("ext4: using nofail preallocation in ext4_es_insert_extent()")
Cc: stable@kernel.org
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230815070808.3377171-1-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Stable-dep-of: 8e387c89e96b ("ext4: make sure allocate pending entry not fail")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/extents_status.c | 44 +++++++++++++++++++++++++++-------------
 1 file changed, 30 insertions(+), 14 deletions(-)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index 1327cd9505db..6c55ab427e65 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -883,23 +883,29 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
 	err1 = __es_remove_extent(inode, lblk, end, NULL, es1);
 	if (err1 != 0)
 		goto error;
+	/* Free preallocated extent if it didn't get used. */
+	if (es1) {
+		if (!es1->es_len)
+			__es_free_extent(es1);
+		es1 = NULL;
+	}
 
 	err2 = __es_insert_extent(inode, &newes, es2);
 	if (err2 == -ENOMEM && !ext4_es_must_keep(&newes))
 		err2 = 0;
 	if (err2 != 0)
 		goto error;
+	/* Free preallocated extent if it didn't get used. */
+	if (es2) {
+		if (!es2->es_len)
+			__es_free_extent(es2);
+		es2 = NULL;
+	}
 
 	if (sbi->s_cluster_ratio > 1 && test_opt(inode->i_sb, DELALLOC) &&
 	    (status & EXTENT_STATUS_WRITTEN ||
 	     status & EXTENT_STATUS_UNWRITTEN))
 		__revise_pending(inode, lblk, len);
-
-	/* es is pre-allocated but not used, free it. */
-	if (es1 && !es1->es_len)
-		__es_free_extent(es1);
-	if (es2 && !es2->es_len)
-		__es_free_extent(es2);
 error:
 	write_unlock(&EXT4_I(inode)->i_es_lock);
 	if (err1 || err2)
@@ -1496,8 +1502,12 @@ int ext4_es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
 	 */
 	write_lock(&EXT4_I(inode)->i_es_lock);
 	err = __es_remove_extent(inode, lblk, end, &reserved, es);
-	if (es && !es->es_len)
-		__es_free_extent(es);
+	/* Free preallocated extent if it didn't get used. */
+	if (es) {
+		if (!es->es_len)
+			__es_free_extent(es);
+		es = NULL;
+	}
 	write_unlock(&EXT4_I(inode)->i_es_lock);
 	if (err)
 		goto retry;
@@ -2055,19 +2065,25 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
 	err1 = __es_remove_extent(inode, lblk, lblk, NULL, es1);
 	if (err1 != 0)
 		goto error;
+	/* Free preallocated extent if it didn't get used. */
+	if (es1) {
+		if (!es1->es_len)
+			__es_free_extent(es1);
+		es1 = NULL;
+	}
 
 	err2 = __es_insert_extent(inode, &newes, es2);
 	if (err2 != 0)
 		goto error;
+	/* Free preallocated extent if it didn't get used. */
+	if (es2) {
+		if (!es2->es_len)
+			__es_free_extent(es2);
+		es2 = NULL;
+	}
 
 	if (allocated)
 		__insert_pending(inode, lblk);
-
-	/* es is pre-allocated but not used, free it. */
-	if (es1 && !es1->es_len)
-		__es_free_extent(es1);
-	if (es2 && !es2->es_len)
-		__es_free_extent(es2);
 error:
 	write_unlock(&EXT4_I(inode)->i_es_lock);
 	if (err1 || err2)

From ec75d1d0cd2c4b46e3ddf92f3ad94f0e4ca08cda Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Thu, 24 Aug 2023 17:26:05 +0800
Subject: [PATCH 0722/1043] ext4: make sure allocate pending entry not fail

[ Upstream commit 8e387c89e96b9543a339f84043cf9df15fed2632 ]

__insert_pending() allocate memory in atomic context, so the allocation
could fail, but we are not handling that failure now. It could lead
ext4_es_remove_extent() to get wrong reserved clusters, and the global
data blocks reservation count will be incorrect. The same to
extents_status entry preallocation, preallocate pending entry out of the
i_es_lock with __GFP_NOFAIL, make sure __insert_pending() and
__revise_pending() always succeeds.

Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20230824092619.1327976-3-yi.zhang@huaweicloud.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/extents_status.c | 123 ++++++++++++++++++++++++++++-----------
 1 file changed, 89 insertions(+), 34 deletions(-)

diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c
index 6c55ab427e65..cccbdfd49a86 100644
--- a/fs/ext4/extents_status.c
+++ b/fs/ext4/extents_status.c
@@ -152,8 +152,9 @@ static int __es_remove_extent(struct inode *inode, ext4_lblk_t lblk,
 static int es_reclaim_extents(struct ext4_inode_info *ei, int *nr_to_scan);
 static int __es_shrink(struct ext4_sb_info *sbi, int nr_to_scan,
 		       struct ext4_inode_info *locked_ei);
-static void __revise_pending(struct inode *inode, ext4_lblk_t lblk,
-			     ext4_lblk_t len);
+static int __revise_pending(struct inode *inode, ext4_lblk_t lblk,
+			    ext4_lblk_t len,
+			    struct pending_reservation **prealloc);
 
 int __init ext4_init_es(void)
 {
@@ -450,6 +451,19 @@ static void ext4_es_list_del(struct inode *inode)
 	spin_unlock(&sbi->s_es_lock);
 }
 
+static inline struct pending_reservation *__alloc_pending(bool nofail)
+{
+	if (!nofail)
+		return kmem_cache_alloc(ext4_pending_cachep, GFP_ATOMIC);
+
+	return kmem_cache_zalloc(ext4_pending_cachep, GFP_KERNEL | __GFP_NOFAIL);
+}
+
+static inline void __free_pending(struct pending_reservation *pr)
+{
+	kmem_cache_free(ext4_pending_cachep, pr);
+}
+
 /*
  * Returns true if we cannot fail to allocate memory for this extent_status
  * entry and cannot reclaim it until its status changes.
@@ -841,11 +855,12 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
 {
 	struct extent_status newes;
 	ext4_lblk_t end = lblk + len - 1;
-	int err1 = 0;
-	int err2 = 0;
+	int err1 = 0, err2 = 0, err3 = 0;
 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
 	struct extent_status *es1 = NULL;
 	struct extent_status *es2 = NULL;
+	struct pending_reservation *pr = NULL;
+	bool revise_pending = false;
 
 	if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)
 		return 0;
@@ -873,11 +888,17 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
 
 	ext4_es_insert_extent_check(inode, &newes);
 
+	revise_pending = sbi->s_cluster_ratio > 1 &&
+			 test_opt(inode->i_sb, DELALLOC) &&
+			 (status & (EXTENT_STATUS_WRITTEN |
+				    EXTENT_STATUS_UNWRITTEN));
 retry:
 	if (err1 && !es1)
 		es1 = __es_alloc_extent(true);
 	if ((err1 || err2) && !es2)
 		es2 = __es_alloc_extent(true);
+	if ((err1 || err2 || err3) && revise_pending && !pr)
+		pr = __alloc_pending(true);
 	write_lock(&EXT4_I(inode)->i_es_lock);
 
 	err1 = __es_remove_extent(inode, lblk, end, NULL, es1);
@@ -902,13 +923,18 @@ int ext4_es_insert_extent(struct inode *inode, ext4_lblk_t lblk,
 		es2 = NULL;
 	}
 
-	if (sbi->s_cluster_ratio > 1 && test_opt(inode->i_sb, DELALLOC) &&
-	    (status & EXTENT_STATUS_WRITTEN ||
-	     status & EXTENT_STATUS_UNWRITTEN))
-		__revise_pending(inode, lblk, len);
+	if (revise_pending) {
+		err3 = __revise_pending(inode, lblk, len, &pr);
+		if (err3 != 0)
+			goto error;
+		if (pr) {
+			__free_pending(pr);
+			pr = NULL;
+		}
+	}
 error:
 	write_unlock(&EXT4_I(inode)->i_es_lock);
-	if (err1 || err2)
+	if (err1 || err2 || err3)
 		goto retry;
 
 	ext4_es_print_tree(inode);
@@ -1316,7 +1342,7 @@ static unsigned int get_rsvd(struct inode *inode, ext4_lblk_t end,
 				rc->ndelonly--;
 				node = rb_next(&pr->rb_node);
 				rb_erase(&pr->rb_node, &tree->root);
-				kmem_cache_free(ext4_pending_cachep, pr);
+				__free_pending(pr);
 				if (!node)
 					break;
 				pr = rb_entry(node, struct pending_reservation,
@@ -1913,11 +1939,13 @@ static struct pending_reservation *__get_pending(struct inode *inode,
  *
  * @inode - file containing the cluster
  * @lblk - logical block in the cluster to be added
+ * @prealloc - preallocated pending entry
  *
  * Returns 0 on successful insertion and -ENOMEM on failure.  If the
  * pending reservation is already in the set, returns successfully.
  */
-static int __insert_pending(struct inode *inode, ext4_lblk_t lblk)
+static int __insert_pending(struct inode *inode, ext4_lblk_t lblk,
+			    struct pending_reservation **prealloc)
 {
 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
 	struct ext4_pending_tree *tree = &EXT4_I(inode)->i_pending_tree;
@@ -1943,10 +1971,15 @@ static int __insert_pending(struct inode *inode, ext4_lblk_t lblk)
 		}
 	}
 
-	pr = kmem_cache_alloc(ext4_pending_cachep, GFP_ATOMIC);
-	if (pr == NULL) {
-		ret = -ENOMEM;
-		goto out;
+	if (likely(*prealloc == NULL)) {
+		pr = __alloc_pending(false);
+		if (!pr) {
+			ret = -ENOMEM;
+			goto out;
+		}
+	} else {
+		pr = *prealloc;
+		*prealloc = NULL;
 	}
 	pr->lclu = lclu;
 
@@ -1976,7 +2009,7 @@ static void __remove_pending(struct inode *inode, ext4_lblk_t lblk)
 	if (pr != NULL) {
 		tree = &EXT4_I(inode)->i_pending_tree;
 		rb_erase(&pr->rb_node, &tree->root);
-		kmem_cache_free(ext4_pending_cachep, pr);
+		__free_pending(pr);
 	}
 }
 
@@ -2037,10 +2070,10 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
 				 bool allocated)
 {
 	struct extent_status newes;
-	int err1 = 0;
-	int err2 = 0;
+	int err1 = 0, err2 = 0, err3 = 0;
 	struct extent_status *es1 = NULL;
 	struct extent_status *es2 = NULL;
+	struct pending_reservation *pr = NULL;
 
 	if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY)
 		return 0;
@@ -2060,6 +2093,8 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
 		es1 = __es_alloc_extent(true);
 	if ((err1 || err2) && !es2)
 		es2 = __es_alloc_extent(true);
+	if ((err1 || err2 || err3) && allocated && !pr)
+		pr = __alloc_pending(true);
 	write_lock(&EXT4_I(inode)->i_es_lock);
 
 	err1 = __es_remove_extent(inode, lblk, lblk, NULL, es1);
@@ -2082,11 +2117,18 @@ int ext4_es_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk,
 		es2 = NULL;
 	}
 
-	if (allocated)
-		__insert_pending(inode, lblk);
+	if (allocated) {
+		err3 = __insert_pending(inode, lblk, &pr);
+		if (err3 != 0)
+			goto error;
+		if (pr) {
+			__free_pending(pr);
+			pr = NULL;
+		}
+	}
 error:
 	write_unlock(&EXT4_I(inode)->i_es_lock);
-	if (err1 || err2)
+	if (err1 || err2 || err3)
 		goto retry;
 
 	ext4_es_print_tree(inode);
@@ -2192,21 +2234,24 @@ unsigned int ext4_es_delayed_clu(struct inode *inode, ext4_lblk_t lblk,
  * @inode - file containing the range
  * @lblk - logical block defining the start of range
  * @len  - length of range in blocks
+ * @prealloc - preallocated pending entry
  *
  * Used after a newly allocated extent is added to the extents status tree.
  * Requires that the extents in the range have either written or unwritten
  * status.  Must be called while holding i_es_lock.
  */
-static void __revise_pending(struct inode *inode, ext4_lblk_t lblk,
-			     ext4_lblk_t len)
+static int __revise_pending(struct inode *inode, ext4_lblk_t lblk,
+			    ext4_lblk_t len,
+			    struct pending_reservation **prealloc)
 {
 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
 	ext4_lblk_t end = lblk + len - 1;
 	ext4_lblk_t first, last;
 	bool f_del = false, l_del = false;
+	int ret = 0;
 
 	if (len == 0)
-		return;
+		return 0;
 
 	/*
 	 * Two cases - block range within single cluster and block range
@@ -2227,7 +2272,9 @@ static void __revise_pending(struct inode *inode, ext4_lblk_t lblk,
 			f_del = __es_scan_range(inode, &ext4_es_is_delonly,
 						first, lblk - 1);
 		if (f_del) {
-			__insert_pending(inode, first);
+			ret = __insert_pending(inode, first, prealloc);
+			if (ret < 0)
+				goto out;
 		} else {
 			last = EXT4_LBLK_CMASK(sbi, end) +
 			       sbi->s_cluster_ratio - 1;
@@ -2235,9 +2282,11 @@ static void __revise_pending(struct inode *inode, ext4_lblk_t lblk,
 				l_del = __es_scan_range(inode,
 							&ext4_es_is_delonly,
 							end + 1, last);
-			if (l_del)
-				__insert_pending(inode, last);
-			else
+			if (l_del) {
+				ret = __insert_pending(inode, last, prealloc);
+				if (ret < 0)
+					goto out;
+			} else
 				__remove_pending(inode, last);
 		}
 	} else {
@@ -2245,18 +2294,24 @@ static void __revise_pending(struct inode *inode, ext4_lblk_t lblk,
 		if (first != lblk)
 			f_del = __es_scan_range(inode, &ext4_es_is_delonly,
 						first, lblk - 1);
-		if (f_del)
-			__insert_pending(inode, first);
-		else
+		if (f_del) {
+			ret = __insert_pending(inode, first, prealloc);
+			if (ret < 0)
+				goto out;
+		} else
 			__remove_pending(inode, first);
 
 		last = EXT4_LBLK_CMASK(sbi, end) + sbi->s_cluster_ratio - 1;
 		if (last != end)
 			l_del = __es_scan_range(inode, &ext4_es_is_delonly,
 						end + 1, last);
-		if (l_del)
-			__insert_pending(inode, last);
-		else
+		if (l_del) {
+			ret = __insert_pending(inode, last, prealloc);
+			if (ret < 0)
+				goto out;
+		} else
 			__remove_pending(inode, last);
 	}
+out:
+	return ret;
 }

From fcc60c0a18704324ef88e249c3fce4d9021ef91e Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat, 14 Oct 2023 21:34:40 -0400
Subject: [PATCH 0723/1043] nfsd: lock_rename() needs both directories to live
 on the same fs

commit 1aee9158bc978f91701c5992e395efbc6da2de3c upstream.

... checking that after lock_rename() is too late.  Incidentally,
NFSv2 had no nfserr_xdev...

Fixes: aa387d6ce153 "nfsd: fix EXDEV checking in rename"
Cc: stable@vger.kernel.org # v3.9+
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Acked-by: Chuck Lever <chuck.lever@oracle.com>
Tested-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/vfs.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index b09ead06a249..31edb883afd0 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1758,6 +1758,12 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
 	if (!flen || isdotent(fname, flen) || !tlen || isdotent(tname, tlen))
 		goto out;
 
+	err = (rqstp->rq_vers == 2) ? nfserr_acces : nfserr_xdev;
+	if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)
+		goto out;
+	if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry)
+		goto out;
+
 retry:
 	host_err = fh_want_write(ffhp);
 	if (host_err) {
@@ -1792,12 +1798,6 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
 	if (ndentry == trap)
 		goto out_dput_new;
 
-	host_err = -EXDEV;
-	if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)
-		goto out_dput_new;
-	if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry)
-		goto out_dput_new;
-
 	if (nfsd_has_cached_files(ndentry)) {
 		has_cached = true;
 		goto out_dput_old;

From 0f312dc1eb2f35dc281b1ea1dcda6ec0b3868eb6 Mon Sep 17 00:00:00 2001
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Date: Tue, 19 Sep 2023 05:34:18 +0000
Subject: [PATCH 0724/1043] ASoC: simple-card: fixup asoc_simple_probe() error
 handling

commit 41bae58df411f9accf01ea660730649b2fab1dab upstream.

asoc_simple_probe() is used for both "DT probe" (A) and "platform probe"
(B). It uses "goto err" when error case, but it is not needed for
"platform probe" case (B). Thus it is using "return" directly there.

	static int asoc_simple_probe(...)
	{
 ^		if (...) {
 |			...
(A)			if (ret < 0)
 |				goto err;
 v		} else {
 ^			...
 |			if (ret < 0)
(B)				return -Exxx;
 v		}

		...
 ^		if (ret < 0)
(C)			goto err;
 v		...

	err:
(D)		simple_util_clean_reference(card);

		return ret;
	}

Both case are using (C) part, and it calls (D) when err case.
But (D) will do nothing for (B) case.
Because of these behavior, current code itself is not wrong,
but is confusable, and more, static analyzing tool will warning on
(B) part (should use goto err).

To avoid static analyzing tool warning, this patch uses "goto err"
on (B) part.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87o7hy7mlh.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/generic/simple-card.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index ac97e8b7978c..8723d540ac2f 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -634,10 +634,12 @@ static int asoc_simple_probe(struct platform_device *pdev)
 
 		int dai_idx = 0;
 
+		ret = -EINVAL;
+
 		cinfo = dev->platform_data;
 		if (!cinfo) {
 			dev_err(dev, "no info for asoc-simple-card\n");
-			return -EINVAL;
+			goto err;
 		}
 
 		if (!cinfo->name ||
@@ -646,7 +648,7 @@ static int asoc_simple_probe(struct platform_device *pdev)
 		    !cinfo->platform ||
 		    !cinfo->cpu_dai.name) {
 			dev_err(dev, "insufficient asoc_simple_card_info settings\n");
-			return -EINVAL;
+			goto err;
 		}
 
 		dai_props->cpu_dai	= &priv->dais[dai_idx++];

From 8c4b5cc9084313e77b437f287ea79eac63fa135d Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Wed, 15 Nov 2023 19:02:22 +0100
Subject: [PATCH 0725/1043] ACPI: resource: Skip IRQ override on ASUS
 ExpertBook B1402CVA

commit bd911485294a6f0596e4592ed442438015cffc8a upstream.

Like various other ASUS ExpertBook-s, the ASUS ExpertBook B1402CVA
has an ACPI DSDT table that describes IRQ 1 as ActiveLow while
the kernel overrides it to EdgeHigh.

This prevents the keyboard from working. To fix this issue, add this laptop
to the skip_override_table so that the kernel does not override IRQ 1.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218114
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/resource.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index ba70bcded128..508d22728ce8 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -448,6 +448,13 @@ static const struct dmi_system_id asus_laptop[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "GMxXGxx"),
 		},
 	},
+	{
+		/* Asus ExpertBook B1402CVA */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "B1402CVA"),
+		},
+	},
 	{
 		/* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */
 		.matches = {

From be8af3b6c80dc32cc690dbe1fcfe5efbb7a98ed7 Mon Sep 17 00:00:00 2001
From: Keith Busch <kbusch@kernel.org>
Date: Mon, 6 Nov 2023 18:12:30 +0100
Subject: [PATCH 0726/1043] swiotlb-xen: provide the "max_mapping_size" method
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit bff2a2d453a1b683378b4508b86b84389f551a00 upstream.

There's a bug that when using the XEN hypervisor with bios with large
multi-page bio vectors on NVMe, the kernel deadlocks [1].

The deadlocks are caused by inability to map a large bio vector -
dma_map_sgtable always returns an error, this gets propagated to the block
layer as BLK_STS_RESOURCE and the block layer retries the request
indefinitely.

XEN uses the swiotlb framework to map discontiguous pages into contiguous
runs that are submitted to the PCIe device. The swiotlb framework has a
limitation on the length of a mapping - this needs to be announced with
the max_mapping_size method to make sure that the hardware drivers do not
create larger mappings.

Without max_mapping_size, the NVMe block driver would create large
mappings that overrun the maximum mapping size.

Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Link: https://lore.kernel.org/stable/ZTNH0qtmint%2FzLJZ@mail-itl/ [1]
Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Suggested-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/151bef41-e817-aea9-675-a35fdac4ed@redhat.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/swiotlb-xen.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index 2b385c1b4a99..ad3ee4857e15 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -579,4 +579,5 @@ const struct dma_map_ops xen_swiotlb_dma_ops = {
 	.get_sgtable = dma_common_get_sgtable,
 	.alloc_pages = dma_common_alloc_pages,
 	.free_pages = dma_common_free_pages,
+	.max_mapping_size = swiotlb_max_mapping_size,
 };

From cd7a0695906da952fca45d79222524ed6cd0eda9 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Mon, 20 Nov 2023 13:25:01 +0800
Subject: [PATCH 0727/1043] bcache: replace a mistaken IS_ERR() by
 IS_ERR_OR_NULL() in btree_gc_coalesce()

commit f72f4312d4388376fc8a1f6cf37cb21a0d41758b upstream.

Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in
node allocations") do the following change inside btree_gc_coalesce(),

31 @@ -1340,7 +1340,7 @@ static int btree_gc_coalesce(
32         memset(new_nodes, 0, sizeof(new_nodes));
33         closure_init_stack(&cl);
34
35 -       while (nodes < GC_MERGE_NODES && !IS_ERR_OR_NULL(r[nodes].b))
36 +       while (nodes < GC_MERGE_NODES && !IS_ERR(r[nodes].b))
37                 keys += r[nodes++].keys;
38
39         blocks = btree_default_blocks(b->c) * 2 / 3;

At line 35 the original r[nodes].b is not always allocatored from
__bch_btree_node_alloc(), and possibly initialized as NULL pointer by
caller of btree_gc_coalesce(). Therefore the change at line 36 is not
correct.

This patch replaces the mistaken IS_ERR() by IS_ERR_OR_NULL() to avoid
potential issue.

Fixes: 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations")
Cc:  <stable@vger.kernel.org> # 6.5+
Cc: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20231120052503.6122-9-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/btree.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 24c57bb85b35..fd1da84e83b6 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1342,7 +1342,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
 	memset(new_nodes, 0, sizeof(new_nodes));
 	closure_init_stack(&cl);
 
-	while (nodes < GC_MERGE_NODES && !IS_ERR(r[nodes].b))
+	while (nodes < GC_MERGE_NODES && !IS_ERR_OR_NULL(r[nodes].b))
 		keys += r[nodes++].keys;
 
 	blocks = btree_default_blocks(b->c) * 2 / 3;

From 89f9ba7ee7029e2ee6743b56141f6a75404ceaeb Mon Sep 17 00:00:00 2001
From: Mingzhe Zou <mingzhe.zou@easystack.cn>
Date: Mon, 20 Nov 2023 13:25:00 +0800
Subject: [PATCH 0728/1043] bcache: fixup multi-threaded
 bch_sectors_dirty_init() wake-up race

commit 2faac25d7958c4761bb8cec54adb79f806783ad6 upstream.

We get a kernel crash about "unable to handle kernel paging request":

```dmesg
[368033.032005] BUG: unable to handle kernel paging request at ffffffffad9ae4b5
[368033.032007] PGD fc3a0d067 P4D fc3a0d067 PUD fc3a0e063 PMD 8000000fc38000e1
[368033.032012] Oops: 0003 [#1] SMP PTI
[368033.032015] CPU: 23 PID: 55090 Comm: bch_dirtcnt[0] Kdump: loaded Tainted: G           OE    --------- -  - 4.18.0-147.5.1.es8_24.x86_64 #1
[368033.032017] Hardware name: Tsinghua Tongfang THTF Chaoqiang Server/072T6D, BIOS 2.4.3 01/17/2017
[368033.032027] RIP: 0010:native_queued_spin_lock_slowpath+0x183/0x1d0
[368033.032029] Code: 8b 02 48 85 c0 74 f6 48 89 c1 eb d0 c1 e9 12 83 e0
03 83 e9 01 48 c1 e0 05 48 63 c9 48 05 c0 3d 02 00 48 03 04 cd 60 68 93
ad <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 02
[368033.032031] RSP: 0018:ffffbb48852abe00 EFLAGS: 00010082
[368033.032032] RAX: ffffffffad9ae4b5 RBX: 0000000000000246 RCX: 0000000000003bf3
[368033.032033] RDX: ffff97b0ff8e3dc0 RSI: 0000000000600000 RDI: ffffbb4884743c68
[368033.032034] RBP: 0000000000000001 R08: 0000000000000000 R09: 000007ffffffffff
[368033.032035] R10: ffffbb486bb01000 R11: 0000000000000001 R12: ffffffffc068da70
[368033.032036] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
[368033.032038] FS:  0000000000000000(0000) GS:ffff97b0ff8c0000(0000) knlGS:0000000000000000
[368033.032039] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[368033.032040] CR2: ffffffffad9ae4b5 CR3: 0000000fc3a0a002 CR4: 00000000003626e0
[368033.032042] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[368033.032043] bcache: bch_cached_dev_attach() Caching rbd479 as bcache462 on set 8cff3c36-4a76-4242-afaa-7630206bc70b
[368033.032045] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[368033.032046] Call Trace:
[368033.032054]  _raw_spin_lock_irqsave+0x32/0x40
[368033.032061]  __wake_up_common_lock+0x63/0xc0
[368033.032073]  ? bch_ptr_invalid+0x10/0x10 [bcache]
[368033.033502]  bch_dirty_init_thread+0x14c/0x160 [bcache]
[368033.033511]  ? read_dirty_submit+0x60/0x60 [bcache]
[368033.033516]  kthread+0x112/0x130
[368033.033520]  ? kthread_flush_work_fn+0x10/0x10
[368033.034505]  ret_from_fork+0x35/0x40
```

The crash occurred when call wake_up(&state->wait), and then we want
to look at the value in the state. However, bch_sectors_dirty_init()
is not found in the stack of any task. Since state is allocated on
the stack, we guess that bch_sectors_dirty_init() has exited, causing
bch_dirty_init_thread() to be unable to handle kernel paging request.

In order to verify this idea, we added some printing information during
wake_up(&state->wait). We find that "wake up" is printed twice, however
we only expect the last thread to wake up once.

```dmesg
[  994.641004] alcache: bch_dirty_init_thread() wake up
[  994.641018] alcache: bch_dirty_init_thread() wake up
[  994.641523] alcache: bch_sectors_dirty_init() init exit
```

There is a race. If bch_sectors_dirty_init() exits after the first wake
up, the second wake up will trigger this bug("unable to handle kernel
paging request").

Proceed as follows:

bch_sectors_dirty_init
    kthread_run ==============> bch_dirty_init_thread(bch_dirtcnt[0])
            ...                         ...
    atomic_inc(&state.started)          ...
            ...                         ...
    atomic_read(&state.enough)          ...
            ...                 atomic_set(&state->enough, 1)
    kthread_run ======================================================> bch_dirty_init_thread(bch_dirtcnt[1])
            ...                 atomic_dec_and_test(&state->started)            ...
    atomic_inc(&state.started)          ...                                     ...
            ...                 wake_up(&state->wait)                           ...
    atomic_read(&state.enough)                                          atomic_dec_and_test(&state->started)
            ...                                                                 ...
    wait_event(state.wait, atomic_read(&state.started) == 0)                    ...
    return                                                                      ...
                                                                        wake_up(&state->wait)

We believe it is very common to wake up twice if there is no dirty, but
crash is an extremely low probability event. It's hard for us to reproduce
this issue. We attached and detached continuously for a week, with a total
of more than one million attaches and only one crash.

Putting atomic_inc(&state.started) before kthread_run() can avoid waking
up twice.

Fixes: b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded")
Signed-off-by: Mingzhe Zou <mingzhe.zou@easystack.cn>
Cc:  <stable@vger.kernel.org>
Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20231120052503.6122-8-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/writeback.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 6324c922f6ba..a1989c0c47f1 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -958,17 +958,18 @@ void bch_sectors_dirty_init(struct bcache_device *d)
 		if (atomic_read(&state.enough))
 			break;
 
+		atomic_inc(&state.started);
 		state.infos[i].state = &state;
 		state.infos[i].thread =
 			kthread_run(bch_dirty_init_thread, &state.infos[i],
 				    "bch_dirtcnt[%d]", i);
 		if (IS_ERR(state.infos[i].thread)) {
 			pr_err("fails to run thread bch_dirty_init[%d]\n", i);
+			atomic_dec(&state.started);
 			for (--i; i >= 0; i--)
 				kthread_stop(state.infos[i].thread);
 			goto out;
 		}
-		atomic_inc(&state.started);
 	}
 
 out:

From c841de6247e94e07566d57163d3c0d8b29278f7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20H=C3=B6ppner?= <hoeppner@linux.ibm.com>
Date: Wed, 25 Oct 2023 15:24:37 +0200
Subject: [PATCH 0729/1043] s390/dasd: protect device queue against concurrent
 access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit db46cd1e0426f52999d50fa72cfa97fa39952885 upstream.

In dasd_profile_start() the amount of requests on the device queue are
counted. The access to the device queue is unprotected against
concurrent access. With a lot of parallel I/O, especially with alias
devices enabled, the device queue can change while dasd_profile_start()
is accessing the queue. In the worst case this leads to a kernel panic
due to incorrect pointer accesses.

Fix this by taking the device lock before accessing the queue and
counting the requests. Additionally the check for a valid profile data
pointer can be done earlier to avoid unnecessary locking in a hot path.

Cc:  <stable@vger.kernel.org>
Fixes: 4fa52aa7a82f ("[S390] dasd: add enhanced DASD statistics interface")
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Link: https://lore.kernel.org/r/20231025132437.1223363-3-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/block/dasd.c | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 09e932a7b17f..81de5c98221a 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -737,18 +737,20 @@ static void dasd_profile_start(struct dasd_block *block,
 	 * we count each request only once.
 	 */
 	device = cqr->startdev;
-	if (device->profile.data) {
-		counter = 1; /* request is not yet queued on the start device */
-		list_for_each(l, &device->ccw_queue)
-			if (++counter >= 31)
-				break;
-	}
+	if (!device->profile.data)
+		return;
+
+	spin_lock(get_ccwdev_lock(device->cdev));
+	counter = 1; /* request is not yet queued on the start device */
+	list_for_each(l, &device->ccw_queue)
+		if (++counter >= 31)
+			break;
+	spin_unlock(get_ccwdev_lock(device->cdev));
+
 	spin_lock(&device->profile.lock);
-	if (device->profile.data) {
-		device->profile.data->dasd_io_nr_req[counter]++;
-		if (rq_data_dir(req) == READ)
-			device->profile.data->dasd_read_nr_req[counter]++;
-	}
+	device->profile.data->dasd_io_nr_req[counter]++;
+	if (rq_data_dir(req) == READ)
+		device->profile.data->dasd_read_nr_req[counter]++;
 	spin_unlock(&device->profile.lock);
 }
 

From 518ef825016d416d29426dd98605ea08fee9dfb2 Mon Sep 17 00:00:00 2001
From: Asuna Yang <spriteovo@gmail.com>
Date: Wed, 22 Nov 2023 22:18:03 +0800
Subject: [PATCH 0730/1043] USB: serial: option: add Luat Air72*U series
 products

commit da90e45d5afc4da2de7cd3ea7943d0f1baa47cc2 upstream.

Update the USB serial option driver support for Luat Air72*U series
products.

ID 1782:4e00 Spreadtrum Communications Inc. UNISOC-8910

T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1782 ProdID=4e00 Rev=00.00
S: Manufacturer=UNISOC
S: Product=UNISOC-8910
C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=400mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=4096ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

If#= 2: AT
If#= 3: PPP + AT
If#= 4: Debug

Co-developed-by: Yangyu Chen <cyy@cyyself.name>
Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Signed-off-by: Asuna Yang <SpriteOvO@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 3e0579d6ec82..51e9a9658551 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -609,6 +609,8 @@ static void option_instat_callback(struct urb *urb);
 #define UNISOC_VENDOR_ID			0x1782
 /* TOZED LT70-C based on UNISOC SL8563 uses UNISOC's vendor ID */
 #define TOZED_PRODUCT_LT70C			0x4055
+/* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */
+#define LUAT_PRODUCT_AIR720U			0x4e00
 
 /* Device flags */
 
@@ -2271,6 +2273,7 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) },
 	{ } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);

From ff6c130e48a79c826cbc2427bd8b34a7592460cc Mon Sep 17 00:00:00 2001
From: Haiyang Zhang <haiyangz@microsoft.com>
Date: Sun, 19 Nov 2023 08:23:42 -0800
Subject: [PATCH 0731/1043] hv_netvsc: Fix race of register_netdevice_notifier
 and VF register

commit 85520856466ed6bc3b1ccb013cddac70ceb437db upstream.

If VF NIC is registered earlier, NETDEV_REGISTER event is replayed,
but NETDEV_POST_INIT is not.

Move register_netdevice_notifier() earlier, so the call back
function is set before probing.

Cc: stable@vger.kernel.org
Fixes: e04e7a7bbd4b ("hv_netvsc: Fix a deadlock by getting rtnl lock earlier in netvsc_probe()")
Reported-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Reviewed-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/hyperv/netvsc_drv.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index f2020be43cfe..20b1b2a9c606 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -2771,12 +2771,17 @@ static int __init netvsc_drv_init(void)
 	}
 	netvsc_ring_bytes = ring_size * PAGE_SIZE;
 
+	register_netdevice_notifier(&netvsc_netdev_notifier);
+
 	ret = vmbus_driver_register(&netvsc_drv);
 	if (ret)
-		return ret;
+		goto err_vmbus_reg;
 
-	register_netdevice_notifier(&netvsc_netdev_notifier);
 	return 0;
+
+err_vmbus_reg:
+	unregister_netdevice_notifier(&netvsc_netdev_notifier);
+	return ret;
 }
 
 MODULE_LICENSE("GPL");

From a70b6da7c640e053caa20003ee9fe60390f15728 Mon Sep 17 00:00:00 2001
From: Long Li <longli@microsoft.com>
Date: Sun, 19 Nov 2023 08:23:43 -0800
Subject: [PATCH 0732/1043] hv_netvsc: Mark VF as slave before exposing it to
 user-mode

commit c807d6cd089d2f4951baa838081ec5ae3e2360f8 upstream.

When a VF is being exposed form the kernel, it should be marked as "slave"
before exposing to the user-mode. The VF is not usable without netvsc
running as master. The user-mode should never see a VF without the "slave"
flag.

This commit moves the code of setting the slave flag to the time before
VF is exposed to user-mode.

Cc: stable@vger.kernel.org
Fixes: 0c195567a8f6 ("netvsc: transparent VF management")
Signed-off-by: Long Li <longli@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Acked-by: Stephen Hemminger <stephen@networkplumber.org>
Acked-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/hyperv/netvsc_drv.c | 32 +++++++++++++++++++++++---------
 1 file changed, 23 insertions(+), 9 deletions(-)

diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 20b1b2a9c606..2104d57fb657 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -2217,9 +2217,6 @@ static int netvsc_vf_join(struct net_device *vf_netdev,
 		goto upper_link_failed;
 	}
 
-	/* set slave flag before open to prevent IPv6 addrconf */
-	vf_netdev->flags |= IFF_SLAVE;
-
 	schedule_delayed_work(&ndev_ctx->vf_takeover, VF_TAKEOVER_INT);
 
 	call_netdevice_notifiers(NETDEV_JOIN, vf_netdev);
@@ -2317,16 +2314,18 @@ static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
 			return hv_get_drvdata(ndev_ctx->device_ctx);
 	}
 
-	/* Fallback path to check synthetic vf with
-	 * help of mac addr
+	/* Fallback path to check synthetic vf with help of mac addr.
+	 * Because this function can be called before vf_netdev is
+	 * initialized (NETDEV_POST_INIT) when its perm_addr has not been copied
+	 * from dev_addr, also try to match to its dev_addr.
+	 * Note: On Hyper-V and Azure, it's not possible to set a MAC address
+	 * on a VF that matches to the MAC of a unrelated NETVSC device.
 	 */
 	list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) {
 		ndev = hv_get_drvdata(ndev_ctx->device_ctx);
-		if (ether_addr_equal(vf_netdev->perm_addr, ndev->perm_addr)) {
-			netdev_notice(vf_netdev,
-				      "falling back to mac addr based matching\n");
+		if (ether_addr_equal(vf_netdev->perm_addr, ndev->perm_addr) ||
+		    ether_addr_equal(vf_netdev->dev_addr, ndev->perm_addr))
 			return ndev;
-		}
 	}
 
 	netdev_notice(vf_netdev,
@@ -2334,6 +2333,19 @@ static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev)
 	return NULL;
 }
 
+static int netvsc_prepare_bonding(struct net_device *vf_netdev)
+{
+	struct net_device *ndev;
+
+	ndev = get_netvsc_byslot(vf_netdev);
+	if (!ndev)
+		return NOTIFY_DONE;
+
+	/* set slave flag before open to prevent IPv6 addrconf */
+	vf_netdev->flags |= IFF_SLAVE;
+	return NOTIFY_DONE;
+}
+
 static int netvsc_register_vf(struct net_device *vf_netdev)
 {
 	struct net_device_context *net_device_ctx;
@@ -2737,6 +2749,8 @@ static int netvsc_netdev_event(struct notifier_block *this,
 		return NOTIFY_DONE;
 
 	switch (event) {
+	case NETDEV_POST_INIT:
+		return netvsc_prepare_bonding(event_dev);
 	case NETDEV_REGISTER:
 		return netvsc_register_vf(event_dev);
 	case NETDEV_UNREGISTER:

From c73dd8f4b4768a4604807d76e3759d2268f3314d Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Wed, 29 Nov 2023 13:38:43 -0500
Subject: [PATCH 0733/1043] dm-delay: fix a race between delay_presuspend and
 delay_bio

[ Upstream commit 6fc45b6ed921dc00dfb264dc08c7d67ee63d2656 ]

In delay_presuspend, we set the atomic variable may_delay and then stop
the timer and flush pending bios. The intention here is to prevent the
delay target from re-arming the timer again.

However, this test is racy. Suppose that one thread goes to delay_bio,
sees that dc->may_delay is one and proceeds; now, another thread executes
delay_presuspend, it sets dc->may_delay to zero, deletes the timer and
flushes pending bios. Then, the first thread continues and adds the bio to
delayed->list despite the fact that dc->may_delay is false.

Fix this bug by changing may_delay's type from atomic_t to bool and
only access it while holding the delayed_bios_lock mutex. Note that we
don't have to grab the mutex in delay_resume because there are no bios
in flight at this point.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/dm-delay.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
index 2628a832787b..d58b9ae6f287 100644
--- a/drivers/md/dm-delay.c
+++ b/drivers/md/dm-delay.c
@@ -30,7 +30,7 @@ struct delay_c {
 	struct workqueue_struct *kdelayd_wq;
 	struct work_struct flush_expired_bios;
 	struct list_head delayed_bios;
-	atomic_t may_delay;
+	bool may_delay;
 
 	struct delay_class read;
 	struct delay_class write;
@@ -191,7 +191,7 @@ static int delay_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	INIT_WORK(&dc->flush_expired_bios, flush_expired_bios);
 	INIT_LIST_HEAD(&dc->delayed_bios);
 	mutex_init(&dc->timer_lock);
-	atomic_set(&dc->may_delay, 1);
+	dc->may_delay = true;
 	dc->argc = argc;
 
 	ret = delay_class_ctr(ti, &dc->read, argv);
@@ -245,7 +245,7 @@ static int delay_bio(struct delay_c *dc, struct delay_class *c, struct bio *bio)
 	struct dm_delay_info *delayed;
 	unsigned long expires = 0;
 
-	if (!c->delay || !atomic_read(&dc->may_delay))
+	if (!c->delay)
 		return DM_MAPIO_REMAPPED;
 
 	delayed = dm_per_bio_data(bio, sizeof(struct dm_delay_info));
@@ -254,6 +254,10 @@ static int delay_bio(struct delay_c *dc, struct delay_class *c, struct bio *bio)
 	delayed->expires = expires = jiffies + msecs_to_jiffies(c->delay);
 
 	mutex_lock(&delayed_bios_lock);
+	if (unlikely(!dc->may_delay)) {
+		mutex_unlock(&delayed_bios_lock);
+		return DM_MAPIO_REMAPPED;
+	}
 	c->ops++;
 	list_add_tail(&delayed->list, &dc->delayed_bios);
 	mutex_unlock(&delayed_bios_lock);
@@ -267,7 +271,10 @@ static void delay_presuspend(struct dm_target *ti)
 {
 	struct delay_c *dc = ti->private;
 
-	atomic_set(&dc->may_delay, 0);
+	mutex_lock(&delayed_bios_lock);
+	dc->may_delay = false;
+	mutex_unlock(&delayed_bios_lock);
+
 	del_timer_sync(&dc->delay_timer);
 	flush_bios(flush_delayed_bios(dc, 1));
 }
@@ -276,7 +283,7 @@ static void delay_resume(struct dm_target *ti)
 {
 	struct delay_c *dc = ti->private;
 
-	atomic_set(&dc->may_delay, 1);
+	dc->may_delay = true;
 }
 
 static int delay_map(struct dm_target *ti, struct bio *bio)

From e74c2e6fecb704d3b174672f255bccfc6aca7d1a Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Mon, 20 Nov 2023 13:24:55 +0800
Subject: [PATCH 0734/1043] bcache: check return value from
 btree_node_alloc_replacement()

commit 777967e7e9f6f5f3e153abffb562bffaf4430d26 upstream.

In btree_gc_rewrite_node(), pointer 'n' is not checked after it returns
from btree_gc_rewrite_node(). There is potential possibility that 'n' is
a non NULL ERR_PTR(), referencing such error code is not permitted in
following code. Therefore a return value checking is necessary after 'n'
is back from btree_node_alloc_replacement().

Signed-off-by: Coly Li <colyli@suse.de>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Cc:  <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20231120052503.6122-3-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/btree.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index fd1da84e83b6..956c740ddfeb 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1506,6 +1506,8 @@ static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op,
 		return 0;
 
 	n = btree_node_alloc_replacement(replace, NULL);
+	if (IS_ERR(n))
+		return 0;
 
 	/* recheck reserve after allocating replacement node */
 	if (btree_check_reserve(b, NULL)) {

From 3ebf83df623a4be915dda22a14282c7cc3537efe Mon Sep 17 00:00:00 2001
From: Rand Deeb <rand.sec96@gmail.com>
Date: Mon, 20 Nov 2023 13:24:57 +0800
Subject: [PATCH 0735/1043] bcache: prevent potential division by zero error

commit 2c7f497ac274a14330208b18f6f734000868ebf9 upstream.

In SHOW(), the variable 'n' is of type 'size_t.' While there is a
conditional check to verify that 'n' is not equal to zero before
executing the 'do_div' macro, concerns arise regarding potential
division by zero error in 64-bit environments.

The concern arises when 'n' is 64 bits in size, greater than zero, and
the lower 32 bits of it are zeros. In such cases, the conditional check
passes because 'n' is non-zero, but the 'do_div' macro casts 'n' to
'uint32_t,' effectively truncating it to its lower 32 bits.
Consequently, the 'n' value becomes zero.

To fix this potential division by zero error and ensure precise
division handling, this commit replaces the 'do_div' macro with
div64_u64(). div64_u64() is designed to work with 64-bit operands,
guaranteeing that division is performed correctly.

This change enhances the robustness of the code, ensuring that division
operations yield accurate results in all scenarios, eliminating the
possibility of division by zero, and improving compatibility across
different 64-bit environments.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Rand Deeb <rand.sec96@gmail.com>
Cc:  <stable@vger.kernel.org>
Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20231120052503.6122-5-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 554e3afc9b68..ca3e2f000cd4 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -1078,7 +1078,7 @@ SHOW(__bch_cache)
 			sum += INITIAL_PRIO - cached[i];
 
 		if (n)
-			do_div(sum, n);
+			sum = div64_u64(sum, n);
 
 		for (i = 0; i < ARRAY_SIZE(q); i++)
 			q[i] = INITIAL_PRIO - cached[n * (i + 1) /

From be327b8f76c2af64885df07e084f9dcc0d024c7f Mon Sep 17 00:00:00 2001
From: Mingzhe Zou <mingzhe.zou@easystack.cn>
Date: Mon, 20 Nov 2023 13:24:58 +0800
Subject: [PATCH 0736/1043] bcache: fixup init dirty data errors

commit 7cc47e64d3d69786a2711a4767e26b26ba63d7ed upstream.

We found that after long run, the dirty_data of the bcache device
will have errors. This error cannot be eliminated unless re-register.

We also found that reattach after detach, this error can accumulate.

In bch_sectors_dirty_init(), all inode <= d->id keys will be recounted
again. This is wrong, we only need to count the keys of the current
device.

Fixes: b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded")
Signed-off-by: Mingzhe Zou <mingzhe.zou@easystack.cn>
Cc:  <stable@vger.kernel.org>
Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20231120052503.6122-6-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/writeback.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index a1989c0c47f1..ac34b47e44d1 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -935,8 +935,11 @@ void bch_sectors_dirty_init(struct bcache_device *d)
 		op.count = 0;
 
 		for_each_key_filter(&c->root->keys,
-				    k, &iter, bch_ptr_invalid)
+				    k, &iter, bch_ptr_invalid) {
+			if (KEY_INODE(k) != op.inode)
+				continue;
 			sectors_dirty_init_fn(&op.op, c->root, k);
+		}
 
 		rw_unlock(0, c->root);
 		return;

From f49ad460a2c8dd9d6e1a36680004448251ff26a9 Mon Sep 17 00:00:00 2001
From: Mingzhe Zou <mingzhe.zou@easystack.cn>
Date: Mon, 20 Nov 2023 13:24:59 +0800
Subject: [PATCH 0737/1043] bcache: fixup lock c->root error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e34820f984512b433ee1fc291417e60c47d56727 upstream.

We had a problem with io hung because it was waiting for c->root to
release the lock.

crash> cache_set.root -l cache_set.list ffffa03fde4c0050
  root = 0xffff802ef454c800
crash> btree -o 0xffff802ef454c800 | grep rw_semaphore
  [ffff802ef454c858] struct rw_semaphore lock;
crash> struct rw_semaphore ffff802ef454c858
struct rw_semaphore {
  count = {
    counter = -4294967297
  },
  wait_list = {
    next = 0xffff00006786fc28,
    prev = 0xffff00005d0efac8
  },
  wait_lock = {
    raw_lock = {
      {
        val = {
          counter = 0
        },
        {
          locked = 0 '\000',
          pending = 0 '\000'
        },
        {
          locked_pending = 0,
          tail = 0
        }
      }
    }
  },
  osq = {
    tail = {
      counter = 0
    }
  },
  owner = 0xffffa03fdc586603
}

The "counter = -4294967297" means that lock count is -1 and a write lock
is being attempted. Then, we found that there is a btree with a counter
of 1 in btree_cache_freeable.

crash> cache_set -l cache_set.list ffffa03fde4c0050 -o|grep btree_cache
  [ffffa03fde4c1140] struct list_head btree_cache;
  [ffffa03fde4c1150] struct list_head btree_cache_freeable;
  [ffffa03fde4c1160] struct list_head btree_cache_freed;
  [ffffa03fde4c1170] unsigned int btree_cache_used;
  [ffffa03fde4c1178] wait_queue_head_t btree_cache_wait;
  [ffffa03fde4c1190] struct task_struct *btree_cache_alloc_lock;
crash> list -H ffffa03fde4c1140|wc -l
973
crash> list -H ffffa03fde4c1150|wc -l
1123
crash> cache_set.btree_cache_used -l cache_set.list ffffa03fde4c0050
  btree_cache_used = 2097
crash> list -s btree -l btree.list -H ffffa03fde4c1140|grep -E -A2 "^  lock = {" > btree_cache.txt
crash> list -s btree -l btree.list -H ffffa03fde4c1150|grep -E -A2 "^  lock = {" > btree_cache_freeable.txt
[root@node-3 127.0.0.1-2023-08-04-16:40:28]# pwd
/var/crash/127.0.0.1-2023-08-04-16:40:28
[root@node-3 127.0.0.1-2023-08-04-16:40:28]# cat btree_cache.txt|grep counter|grep -v "counter = 0"
[root@node-3 127.0.0.1-2023-08-04-16:40:28]# cat btree_cache_freeable.txt|grep counter|grep -v "counter = 0"
      counter = 1

We found that this is a bug in bch_sectors_dirty_init() when locking c->root:
    (1). Thread X has locked c->root(A) write.
    (2). Thread Y failed to lock c->root(A), waiting for the lock(c->root A).
    (3). Thread X bch_btree_set_root() changes c->root from A to B.
    (4). Thread X releases the lock(c->root A).
    (5). Thread Y successfully locks c->root(A).
    (6). Thread Y releases the lock(c->root B).

        down_write locked ---(1)----------------------┐
                |                                     |
                |   down_read waiting ---(2)----┐     |
                |           |               ┌-------------┐ ┌-------------┐
        bch_btree_set_root ===(3)========>> | c->root   A | | c->root   B |
                |           |               └-------------┘ └-------------┘
            up_write ---(4)---------------------┘     |            |
                            |                         |            |
                    down_read locked ---(5)-----------┘            |
                            |                                      |
                        up_read ---(6)-----------------------------┘

Since c->root may change, the correct steps to lock c->root should be
the same as bch_root_usage(), compare after locking.

static unsigned int bch_root_usage(struct cache_set *c)
{
        unsigned int bytes = 0;
        struct bkey *k;
        struct btree *b;
        struct btree_iter iter;

        goto lock_root;

        do {
                rw_unlock(false, b);
lock_root:
                b = c->root;
                rw_lock(false, b, b->level);
        } while (b != c->root);

        for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad)
                bytes += bkey_bytes(k);

        rw_unlock(false, b);

        return (bytes * 100) / btree_bytes(c);
}

Fixes: b144e45fc576 ("bcache: make bch_sectors_dirty_init() to be multithreaded")
Signed-off-by: Mingzhe Zou <mingzhe.zou@easystack.cn>
Cc:  <stable@vger.kernel.org>
Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20231120052503.6122-7-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/writeback.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index ac34b47e44d1..94e899ce3855 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -921,14 +921,22 @@ static int bch_btre_dirty_init_thread_nr(void)
 void bch_sectors_dirty_init(struct bcache_device *d)
 {
 	int i;
+	struct btree *b = NULL;
 	struct bkey *k = NULL;
 	struct btree_iter iter;
 	struct sectors_dirty_init op;
 	struct cache_set *c = d->c;
 	struct bch_dirty_init_state state;
 
+retry_lock:
+	b = c->root;
+	rw_lock(0, b, b->level);
+	if (b != c->root) {
+		rw_unlock(0, b);
+		goto retry_lock;
+	}
+
 	/* Just count root keys if no leaf node */
-	rw_lock(0, c->root, c->root->level);
 	if (c->root->level == 0) {
 		bch_btree_op_init(&op.op, -1);
 		op.inode = d->id;
@@ -941,7 +949,7 @@ void bch_sectors_dirty_init(struct bcache_device *d)
 			sectors_dirty_init_fn(&op.op, c->root, k);
 		}
 
-		rw_unlock(0, c->root);
+		rw_unlock(0, b);
 		return;
 	}
 
@@ -978,7 +986,7 @@ void bch_sectors_dirty_init(struct bcache_device *d)
 out:
 	/* Must wait for all threads to stop. */
 	wait_event(state.wait, atomic_read(&state.started) == 0);
-	rw_unlock(0, c->root);
+	rw_unlock(0, b);
 }
 
 void bch_cached_dev_writeback_init(struct cached_dev *dc)

From 14a6e089d6108e8781807707796c64d6f1fced89 Mon Sep 17 00:00:00 2001
From: Victor Fragoso <victorffs@hotmail.com>
Date: Tue, 21 Nov 2023 21:05:56 +0000
Subject: [PATCH 0738/1043] USB: serial: option: add Fibocom L7xx modules

commit e389fe8b68137344562fb6e4d53d8a89ef6212dd upstream.

Add support for Fibocom L716-EU module series.

L716-EU is a Fibocom module based on ZTE's V3E/V3T chipset.

Device creates multiple interfaces when connected to PC as follows:
 - Network Interface: ECM or RNDIS (set by FW or AT Command)
 - ttyUSB0: AT port
 - ttyUSB1: Modem port
 - ttyUSB2: AT2 port
 - ttyUSB3: Trace port for log information
 - ADB: ADB port for debugging. ("Driver=usbfs" when ADB server enabled)

Here are the outputs of lsusb and usb-devices:
$ ls /dev/ttyUSB*
/dev/ttyUSB0  /dev/ttyUSB1  /dev/ttyUSB2  /dev/ttyUSB3

usb-devices:
L716-EU (ECM mode):
T:  Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 51 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=2cb7 ProdID=0001 Rev= 1.00
S:  Manufacturer=Fibocom,Incorporated
S:  Product=Fibocom Mobile Boardband
S:  SerialNumber=1234567890ABCDEF
C:* #Ifs= 7 Cfg#= 1 Atr=e0 MxPwr=500mA
A:  FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether
E:  Ad=87(I) Atr=03(Int.) MxPS=  16 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

L716-EU (RNDIS mode):
T:  Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 49 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=2cb7 ProdID=0001 Rev= 1.00
S:  Manufacturer=Fibocom,Incorporated
S:  Product=Fibocom Mobile Boardband
S:  SerialNumber=1234567890ABCDEF
C:* #Ifs= 7 Cfg#= 1 Atr=e0 MxPwr=500mA
A:  FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=02 Prot=ff Driver=rndis_host
E:  Ad=87(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Signed-off-by: Victor Fragoso <victorffs@hotmail.com>
Reviewed-by: Lars Melin <larsm17@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 51e9a9658551..bee52ff296d1 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2251,6 +2251,7 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
 	{ USB_DEVICE(0x1782, 0x4d10) },						/* Fibocom L610 (AT mode) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x1782, 0x4d11, 0xff) },			/* Fibocom L610 (ECM/RNDIS mode) */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0001, 0xff, 0xff, 0xff) },	/* Fibocom L716-EU (ECM/RNDIS mode) */
 	{ USB_DEVICE(0x2cb7, 0x0104),						/* Fibocom NL678 series */
 	  .driver_info = RSVD(4) | RSVD(5) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff),			/* Fibocom NL678 series */

From f1432dff5dd6a463c990fbf071f1d2495f765135 Mon Sep 17 00:00:00 2001
From: Puliang Lu <puliang.lu@fibocom.com>
Date: Thu, 26 Oct 2023 20:35:06 +0800
Subject: [PATCH 0739/1043] USB: serial: option: fix FM101R-GL defines

commit a1092619dd28ac0fcf23016160a2fdccd98ef935 upstream.

Modify the definition of the two Fibocom FM101R-GL PID macros, which had
their PIDs switched.

The correct PIDs are:

- VID:PID 413C:8213, FM101R-GL ESIM are laptop M.2 cards (with
  MBIM interfaces for Linux)

- VID:PID 413C:8215, FM101R-GL are laptop M.2 cards (with
  MBIM interface for Linux)

0x8213: mbim, tty
0x8215: mbim, tty

Signed-off-by: Puliang Lu <puliang.lu@fibocom.com>
Fixes: 52480e1f1a25 ("USB: serial: option: add Fibocom to DELL custom modem FM101R-GL")
Link: https://lore.kernel.org/lkml/TYZPR02MB508845BAD7936A62A105CE5D89DFA@TYZPR02MB5088.apcprd02.prod.outlook.com/
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index bee52ff296d1..2acfde6c79f2 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -203,8 +203,8 @@ static void option_instat_callback(struct urb *urb);
 #define DELL_PRODUCT_5829E_ESIM			0x81e4
 #define DELL_PRODUCT_5829E			0x81e6
 
-#define DELL_PRODUCT_FM101R			0x8213
-#define DELL_PRODUCT_FM101R_ESIM		0x8215
+#define DELL_PRODUCT_FM101R_ESIM		0x8213
+#define DELL_PRODUCT_FM101R			0x8215
 
 #define KYOCERA_VENDOR_ID			0x0c88
 #define KYOCERA_PRODUCT_KPC650			0x17da

From 5d7a5e63dc3be3d9960e15460b0f45bf00ec78c3 Mon Sep 17 00:00:00 2001
From: Lech Perczak <lech.perczak@gmail.com>
Date: Sat, 18 Nov 2023 00:19:17 +0100
Subject: [PATCH 0740/1043] USB: serial: option: don't claim interface 4 for
 ZTE MF290
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 8771127e25d6c20d458ad27cf32f7fcfc1755e05 upstream.

Interface 4 is used by for QMI interface in stock firmware of MF28D, the
router which uses MF290 modem. Free the interface up, to rebind it to
qmi_wwan driver.
The proper configuration is:

Interface mapping is:
0: QCDM, 1: (unknown), 2: AT (PCUI), 2: AT (Modem), 4: QMI

T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  4 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=19d2 ProdID=0189 Rev= 0.00
S:  Manufacturer=ZTE, Incorporated
S:  Product=ZTE LTE Technologies MSM
C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=84(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E:  Ad=86(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms

Cc: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 2acfde6c79f2..851c24253940 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1548,7 +1548,8 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0167, 0xff, 0xff, 0xff),
 	  .driver_info = RSVD(4) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0189, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0189, 0xff, 0xff, 0xff),
+	  .driver_info = RSVD(4) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0191, 0xff, 0xff, 0xff), /* ZTE EuFi890 */
 	  .driver_info = RSVD(4) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0196, 0xff, 0xff, 0xff) },

From d5325ed6eb7c630a2c7782cd74c6c35413fd3043 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Wed, 15 Nov 2023 15:45:07 +0100
Subject: [PATCH 0741/1043] USB: dwc2: write HCINT with INTMASK applied

commit 0583bc776ca5b5a3f5752869fc31cf7322df2b35 upstream.

dwc2_hc_n_intr() writes back INTMASK as read but evaluates it
with intmask applied. In stress testing this causes spurious
interrupts like this:

[Mon Aug 14 10:51:07 2023] dwc2 3f980000.usb: dwc2_hc_chhltd_intr_dma: Channel 7 - ChHltd set, but reason is unknown
[Mon Aug 14 10:51:07 2023] dwc2 3f980000.usb: hcint 0x00000002, intsts 0x04600001
[Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: dwc2_hc_chhltd_intr_dma: Channel 0 - ChHltd set, but reason is unknown
[Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: hcint 0x00000002, intsts 0x04600001
[Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: dwc2_hc_chhltd_intr_dma: Channel 4 - ChHltd set, but reason is unknown
[Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: hcint 0x00000002, intsts 0x04600001
[Mon Aug 14 10:51:08 2023] dwc2 3f980000.usb: dwc2_update_urb_state_abn(): trimming xfer length

Applying INTMASK prevents this. The issue exists in all versions of the
driver.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Tested-by: Ivan Ivanov <ivan.ivanov@suse.com>
Tested-by: Andrea della Porta <andrea.porta@suse.com>
Link: https://lore.kernel.org/r/20231115144514.15248-1-oneukum@suse.com
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc2/hcd_intr.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index d5f4ec1b73b1..08e2792cb732 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -2045,15 +2045,17 @@ static void dwc2_hc_n_intr(struct dwc2_hsotg *hsotg, int chnum)
 {
 	struct dwc2_qtd *qtd;
 	struct dwc2_host_chan *chan;
-	u32 hcint, hcintmsk;
+	u32 hcint, hcintraw, hcintmsk;
 
 	chan = hsotg->hc_ptr_array[chnum];
 
-	hcint = dwc2_readl(hsotg, HCINT(chnum));
+	hcintraw = dwc2_readl(hsotg, HCINT(chnum));
 	hcintmsk = dwc2_readl(hsotg, HCINTMSK(chnum));
+	hcint = hcintraw & hcintmsk;
+	dwc2_writel(hsotg, hcint, HCINT(chnum));
+
 	if (!chan) {
 		dev_err(hsotg->dev, "## hc_ptr_array for channel is NULL ##\n");
-		dwc2_writel(hsotg, hcint, HCINT(chnum));
 		return;
 	}
 
@@ -2062,11 +2064,9 @@ static void dwc2_hc_n_intr(struct dwc2_hsotg *hsotg, int chnum)
 			 chnum);
 		dev_vdbg(hsotg->dev,
 			 "  hcint 0x%08x, hcintmsk 0x%08x, hcint&hcintmsk 0x%08x\n",
-			 hcint, hcintmsk, hcint & hcintmsk);
+			 hcintraw, hcintmsk, hcint);
 	}
 
-	dwc2_writel(hsotg, hcint, HCINT(chnum));
-
 	/*
 	 * If we got an interrupt after someone called
 	 * dwc2_hcd_endpoint_disable() we don't want to crash below
@@ -2076,8 +2076,7 @@ static void dwc2_hc_n_intr(struct dwc2_hsotg *hsotg, int chnum)
 		return;
 	}
 
-	chan->hcint = hcint;
-	hcint &= hcintmsk;
+	chan->hcint = hcintraw;
 
 	/*
 	 * If the channel was halted due to a dequeue, the qtd list might

From 2620c5977f49483b89b442a1e076d65588ab4a77 Mon Sep 17 00:00:00 2001
From: Alexander Stein <alexander.stein@ew.tq-group.com>
Date: Wed, 25 Oct 2023 11:51:10 +0200
Subject: [PATCH 0742/1043] usb: dwc3: Fix default mode initialization

commit 10d510abd096d620b9fda2dd3e0047c5efc4ad2b upstream.

The default mode, configurable by DT, shall be set before usb role switch
driver is registered. Otherwise there is a race between default mode
and mode set by usb role switch driver.

Fixes: 98ed256a4dbad ("usb: dwc3: Add support for role-switch-default-mode binding")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/20231025095110.2405281-1-alexander.stein@ew.tq-group.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/drd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/dwc3/drd.c b/drivers/usb/dwc3/drd.c
index 0a96f44ccca7..8bcfbb29ce70 100644
--- a/drivers/usb/dwc3/drd.c
+++ b/drivers/usb/dwc3/drd.c
@@ -547,6 +547,7 @@ static int dwc3_setup_role_switch(struct dwc3 *dwc)
 		dwc->role_switch_default_mode = USB_DR_MODE_PERIPHERAL;
 		mode = DWC3_GCTL_PRTCAP_DEVICE;
 	}
+	dwc3_set_mode(dwc, mode);
 
 	dwc3_role_switch.fwnode = dev_fwnode(dwc->dev);
 	dwc3_role_switch.set = dwc3_usb_role_switch_set;
@@ -556,7 +557,6 @@ static int dwc3_setup_role_switch(struct dwc3 *dwc)
 	if (IS_ERR(dwc->role_sw))
 		return PTR_ERR(dwc->role_sw);
 
-	dwc3_set_mode(dwc, mode);
 	return 0;
 }
 #else

From 5ac96667ea325f042916fced84731d3fe7bf1280 Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda <ribalda@chromium.org>
Date: Fri, 27 Oct 2023 11:28:20 +0000
Subject: [PATCH 0743/1043] usb: dwc3: set the dma max_seg_size

commit 8bbae288a85abed6a1cf7d185d8b9dc2f5dcb12c upstream.

Allow devices to have dma operations beyond 4K, and avoid warnings such
as:

DMA-API: dwc3 a600000.usb: mapping sg segment longer than device claims to support [len=86016] [max=65536]

Cc: stable@vger.kernel.org
Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
Reported-by: Zubin Mithra <zsm@chromium.org>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/20231026-dwc3-v2-1-1d4fd5c3e067@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 5bc245b4be44..214a8ff2d69c 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1627,6 +1627,8 @@ static int dwc3_probe(struct platform_device *pdev)
 
 	pm_runtime_put(dev);
 
+	dma_set_max_seg_size(dev, UINT_MAX);
+
 	return 0;
 
 err5:

From f5f85ea5bb6affeb97c36844fbaa5776cc9227ff Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro@kernel.org>
Date: Mon, 20 Nov 2023 17:16:06 +0100
Subject: [PATCH 0744/1043] USB: dwc3: qcom: fix wakeup after probe deferral

commit 41f5a0973259db9e4e3c9963d36505f80107d1a0 upstream.

The Qualcomm glue driver is overriding the interrupt trigger types
defined by firmware when requesting the wakeup interrupts during probe.

This can lead to a failure to map the DP/DM wakeup interrupts after a
probe deferral as the firmware defined trigger types do not match the
type used for the initial mapping:

	irq: type mismatch, failed to map hwirq-14 for interrupt-controller@b220000!
	irq: type mismatch, failed to map hwirq-15 for interrupt-controller@b220000!

Fix this by not overriding the firmware provided trigger types when
requesting the wakeup interrupts.

Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver")
Cc: stable@vger.kernel.org      # 4.18
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
Link: https://lore.kernel.org/r/20231120161607.7405-3-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/dwc3-qcom.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
index 58d5169e8cab..db3559a10207 100644
--- a/drivers/usb/dwc3/dwc3-qcom.c
+++ b/drivers/usb/dwc3/dwc3-qcom.c
@@ -492,7 +492,7 @@ static int dwc3_qcom_setup_irq(struct platform_device *pdev)
 		irq_set_status_flags(irq, IRQ_NOAUTOEN);
 		ret = devm_request_threaded_irq(qcom->dev, irq, NULL,
 					qcom_dwc3_resume_irq,
-					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+					IRQF_ONESHOT,
 					"qcom_dwc3 HS", qcom);
 		if (ret) {
 			dev_err(qcom->dev, "hs_phy_irq failed: %d\n", ret);
@@ -507,7 +507,7 @@ static int dwc3_qcom_setup_irq(struct platform_device *pdev)
 		irq_set_status_flags(irq, IRQ_NOAUTOEN);
 		ret = devm_request_threaded_irq(qcom->dev, irq, NULL,
 					qcom_dwc3_resume_irq,
-					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+					IRQF_ONESHOT,
 					"qcom_dwc3 DP_HS", qcom);
 		if (ret) {
 			dev_err(qcom->dev, "dp_hs_phy_irq failed: %d\n", ret);
@@ -522,7 +522,7 @@ static int dwc3_qcom_setup_irq(struct platform_device *pdev)
 		irq_set_status_flags(irq, IRQ_NOAUTOEN);
 		ret = devm_request_threaded_irq(qcom->dev, irq, NULL,
 					qcom_dwc3_resume_irq,
-					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+					IRQF_ONESHOT,
 					"qcom_dwc3 DM_HS", qcom);
 		if (ret) {
 			dev_err(qcom->dev, "dm_hs_phy_irq failed: %d\n", ret);
@@ -537,7 +537,7 @@ static int dwc3_qcom_setup_irq(struct platform_device *pdev)
 		irq_set_status_flags(irq, IRQ_NOAUTOEN);
 		ret = devm_request_threaded_irq(qcom->dev, irq, NULL,
 					qcom_dwc3_resume_irq,
-					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+					IRQF_ONESHOT,
 					"qcom_dwc3 SS", qcom);
 		if (ret) {
 			dev_err(qcom->dev, "ss_phy_irq failed: %d\n", ret);

From 8fb79be6e9800abd6e07d6f7254ebb0317300dd7 Mon Sep 17 00:00:00 2001
From: Keith Busch <kbusch@kernel.org>
Date: Mon, 20 Nov 2023 14:18:31 -0800
Subject: [PATCH 0745/1043] io_uring: fix off-by one bvec index

commit d6fef34ee4d102be448146f24caf96d7b4a05401 upstream.

If the offset equals the bv_len of the first registered bvec, then the
request does not include any of that first bvec. Skip it so that drivers
don't have to deal with a zero length bvec, which was observed to break
NVMe's PRP list creation.

Cc: stable@vger.kernel.org
Fixes: bd11b3a391e3 ("io_uring: don't use iov_iter_advance() for fixed buffers")
Signed-off-by: Keith Busch <kbusch@kernel.org>
Link: https://lore.kernel.org/r/20231120221831.2646460-1-kbusch@meta.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/io_uring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 1fe05e70cc79..0c4f159865b9 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -3149,7 +3149,7 @@ static int __io_import_fixed(struct io_kiocb *req, int rw, struct iov_iter *iter
 		 */
 		const struct bio_vec *bvec = imu->bvec;
 
-		if (offset <= bvec->bv_len) {
+		if (offset < bvec->bv_len) {
 			iov_iter_advance(iter, offset);
 		} else {
 			unsigned long seg_skip;

From d6bac7048f28503ee2f8ad4f8f574ce1f384b108 Mon Sep 17 00:00:00 2001
From: Maria Yu <quic_aiquny@quicinc.com>
Date: Wed, 15 Nov 2023 18:28:24 +0800
Subject: [PATCH 0746/1043] pinctrl: avoid reload of p state in list iteration

commit 4198a9b571065978632276264e01d71d68000ac5 upstream.

When in the list_for_each_entry iteration, reload of p->state->settings
with a local setting from old_state will turn the list iteration into an
infinite loop.

The typical symptom when the issue happens, will be a printk message like:

  "not freeing pin xx (xxx) as part of deactivating group xxx - it is
already used for some other setting".

This is a compiler-dependent problem, one instance occurred using Clang
version 10.0 on the arm64 architecture with linux version 4.19.

Fixes: 6e5e959dde0d ("pinctrl: API changes to support multiple states per device")
Signed-off-by: Maria Yu <quic_aiquny@quicinc.com>
Cc:  <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20231115102824.23727-1-quic_aiquny@quicinc.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/core.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 840000870d5a..4d5249436993 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1239,17 +1239,17 @@ static void pinctrl_link_add(struct pinctrl_dev *pctldev,
 static int pinctrl_commit_state(struct pinctrl *p, struct pinctrl_state *state)
 {
 	struct pinctrl_setting *setting, *setting2;
-	struct pinctrl_state *old_state = p->state;
+	struct pinctrl_state *old_state = READ_ONCE(p->state);
 	int ret;
 
-	if (p->state) {
+	if (old_state) {
 		/*
 		 * For each pinmux setting in the old state, forget SW's record
 		 * of mux owner for that pingroup. Any pingroups which are
 		 * still owned by the new state will be re-acquired by the call
 		 * to pinmux_enable_setting() in the loop below.
 		 */
-		list_for_each_entry(setting, &p->state->settings, node) {
+		list_for_each_entry(setting, &old_state->settings, node) {
 			if (setting->type != PIN_MAP_TYPE_MUX_GROUP)
 				continue;
 			pinmux_disable_setting(setting);

From 71c9fb31e18bd3f7f9da6169c8a78925b5a0c616 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Wed, 29 Nov 2023 17:34:08 +0800
Subject: [PATCH 0747/1043] firewire: core: fix possible memory leak in
 create_units()

commit 891e0eab32a57fca4d36c5162628eb0bcb1f0edf upstream.

If device_register() fails, the refcount of device is not 0, the name
allocated in dev_set_name() is leaked. To fix this by calling put_device(),
so that it will be freed in callback function kobject_cleanup().

unreferenced object 0xffff9d99035c7a90 (size 8):
  comm "systemd-udevd", pid 168, jiffies 4294672386 (age 152.089s)
  hex dump (first 8 bytes):
    66 77 30 2e 30 00 ff ff                          fw0.0...
  backtrace:
    [<00000000e1d62bac>] __kmem_cache_alloc_node+0x1e9/0x360
    [<00000000bbeaff31>] __kmalloc_node_track_caller+0x44/0x1a0
    [<00000000491f2fb4>] kvasprintf+0x67/0xd0
    [<000000005b960ddc>] kobject_set_name_vargs+0x1e/0x90
    [<00000000427ac591>] dev_set_name+0x4e/0x70
    [<000000003b4e447d>] create_units+0xc5/0x110

fw_unit_release() will be called in the error path, move fw_device_get()
before calling device_register() to keep balanced with fw_device_put() in
fw_unit_release().

Cc: stable@vger.kernel.org
Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array")
Fixes: a1f64819fe9f ("firewire: struct device - replace bus_id with dev_name(), dev_set_name()")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/firewire/core-device.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index 80db43a22069..94ae27865b9e 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -719,14 +719,11 @@ static void create_units(struct fw_device *device)
 					fw_unit_attributes,
 					&unit->attribute_group);
 
-		if (device_register(&unit->device) < 0)
-			goto skip_unit;
-
 		fw_device_get(device);
-		continue;
-
-	skip_unit:
-		kfree(unit);
+		if (device_register(&unit->device) < 0) {
+			put_device(&unit->device);
+			continue;
+		}
 	}
 }
 

From b02b66194d549e1e9c52d3172c0981e4dfe4f6e0 Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Fri, 3 Nov 2023 10:47:15 +0200
Subject: [PATCH 0748/1043] mmc: block: Do not lose cache flush during CQE
 error recovery

commit 174925d340aac55296318e43fd96c0e1d196e105 upstream.

During CQE error recovery, error-free data commands get requeued if there
is any data left to transfer, but non-data commands are completed even
though they have not been processed.  Requeue them instead.

Note the only non-data command is cache flush, which would have resulted in
a cache flush being lost if it was queued at the time of CQE recovery.

Fixes: 1e8e55b67030 ("mmc: block: Add CQE support")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Link: https://lore.kernel.org/r/20231103084720.6886-2-adrian.hunter@intel.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/block.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index d81baf750aeb..41d98d7198be 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1418,6 +1418,8 @@ static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req)
 			blk_mq_requeue_request(req, true);
 		else
 			__blk_mq_end_request(req, BLK_STS_OK);
+	} else if (mq->in_recovery) {
+		blk_mq_requeue_request(req, true);
 	} else {
 		blk_mq_end_request(req, BLK_STS_OK);
 	}

From f338f738d7bd5f51e90fb3ba7c5ef14425bb7661 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 30 Nov 2023 16:13:21 +0100
Subject: [PATCH 0749/1043] ALSA: hda: Disable power-save on KONTRON SinglePC

commit a337c355719c42a6c5b67e985ad753590ed844fb upstream.

It's been reported that the runtime PM on KONTRON SinglePC (PCI SSID
1734:1232) caused a stall of playback after a bunch of invocations.
(FWIW, this looks like an timing issue, and the stall happens rather
on the controller side.)

As a workaround, disable the default power-save on this platform.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20231130151321.9813-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/hda_intel.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index dfef761d5521..12c6eb76fca3 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2278,6 +2278,8 @@ static const struct snd_pci_quirk power_save_denylist[] = {
 	SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0),
 	/* https://bugs.launchpad.net/bugs/1821663 */
 	SND_PCI_QUIRK(0x1631, 0xe017, "Packard Bell NEC IMEDIA 5204", 0),
+	/* KONTRON SinglePC may cause a stall at runtime resume */
+	SND_PCI_QUIRK(0x1734, 0x1232, "KONTRON SinglePC", 0),
 	{}
 };
 #endif /* CONFIG_PM */

From cf80c538061e482b0690542d97a3f2e96ab47f1b Mon Sep 17 00:00:00 2001
From: Kailang Yang <kailang@realtek.com>
Date: Wed, 25 Oct 2023 15:24:06 +0800
Subject: [PATCH 0750/1043] ALSA: hda/realtek: Headset Mic VREF to 100%

commit baaacbff64d9f34b64f294431966d035aeadb81c upstream.

This platform need to set Mic VREF to 100%.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/0916af40f08a4348a3298a9a59e6967e@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 65f8dc65b967..48d9e3c448c9 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1994,6 +1994,7 @@ enum {
 	ALC887_FIXUP_ASUS_AUDIO,
 	ALC887_FIXUP_ASUS_HMIC,
 	ALCS1200A_FIXUP_MIC_VREF,
+	ALC888VD_FIXUP_MIC_100VREF,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -2547,6 +2548,13 @@ static const struct hda_fixup alc882_fixups[] = {
 			{}
 		}
 	},
+	[ALC888VD_FIXUP_MIC_100VREF] = {
+		.type = HDA_FIXUP_PINCTLS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x18, PIN_VREF100 }, /* headset mic */
+			{}
+		}
+	},
 };
 
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2616,6 +2624,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
 
 	SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+	SND_PCI_QUIRK(0x10ec, 0x12d8, "iBase Elo Touch", ALC888VD_FIXUP_MIC_100VREF),
 	SND_PCI_QUIRK(0x13fe, 0x1009, "Advantech MIT-W101", ALC886_FIXUP_EAPD),
 	SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),

From 5de40a7ffaa02e8727a4e46f9a15083628226f38 Mon Sep 17 00:00:00 2001
From: Kailang Yang <kailang@realtek.com>
Date: Wed, 29 Nov 2023 15:38:40 +0800
Subject: [PATCH 0751/1043] ALSA: hda/realtek: Add supported ALC257 for
 ChromeOS

commit cae2bdb579ecc9d4219c58a7d3fde1958118dc1d upstream.

ChromeOS want to support ALC257.
Add codec ID to some relation function.

Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/99a88a7dbdb045fd9d934abeb6cec15f@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 48d9e3c448c9..3d94a2f41d82 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3266,6 +3266,7 @@ static void alc_disable_headset_jack_key(struct hda_codec *codec)
 	case 0x10ec0230:
 	case 0x10ec0236:
 	case 0x10ec0256:
+	case 0x10ec0257:
 	case 0x19e58326:
 		alc_write_coef_idx(codec, 0x48, 0x0);
 		alc_update_coef_idx(codec, 0x49, 0x0045, 0x0);
@@ -3295,6 +3296,7 @@ static void alc_enable_headset_jack_key(struct hda_codec *codec)
 	case 0x10ec0230:
 	case 0x10ec0236:
 	case 0x10ec0256:
+	case 0x10ec0257:
 	case 0x19e58326:
 		alc_write_coef_idx(codec, 0x48, 0xd011);
 		alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045);
@@ -6424,6 +6426,7 @@ static void alc_combo_jack_hp_jd_restart(struct hda_codec *codec)
 	case 0x10ec0236:
 	case 0x10ec0255:
 	case 0x10ec0256:
+	case 0x10ec0257:
 	case 0x19e58326:
 		alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */
 		alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15);

From c3c9f92738227ea3c89d306a3c9b094fdefe8768 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Tue, 28 Nov 2023 14:50:23 +0100
Subject: [PATCH 0752/1043] dm-verity: align struct dm_verity_fec_io properly

commit 38bc1ab135db87577695816b190e7d6d8ec75879 upstream.

dm_verity_fec_io is placed after the end of two hash digests. If the hash
digest has unaligned length, struct dm_verity_fec_io could be unaligned.

This commit fixes the placement of struct dm_verity_fec_io, so that it's
aligned.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Fixes: a739ff3f543a ("dm verity: add support for forward error correction")
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-verity-fec.c | 3 ++-
 drivers/md/dm-verity.h     | 6 ------
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
index cea2b3789736..442437e4e03b 100644
--- a/drivers/md/dm-verity-fec.c
+++ b/drivers/md/dm-verity-fec.c
@@ -24,7 +24,8 @@ bool verity_fec_is_enabled(struct dm_verity *v)
  */
 static inline struct dm_verity_fec_io *fec_io(struct dm_verity_io *io)
 {
-	return (struct dm_verity_fec_io *) verity_io_digest_end(io->v, io);
+	return (struct dm_verity_fec_io *)
+		((char *)io + io->v->ti->per_io_data_size - sizeof(struct dm_verity_fec_io));
 }
 
 /*
diff --git a/drivers/md/dm-verity.h b/drivers/md/dm-verity.h
index 4e769d13473a..78d1e51195ad 100644
--- a/drivers/md/dm-verity.h
+++ b/drivers/md/dm-verity.h
@@ -111,12 +111,6 @@ static inline u8 *verity_io_want_digest(struct dm_verity *v,
 	return (u8 *)(io + 1) + v->ahash_reqsize + v->digest_size;
 }
 
-static inline u8 *verity_io_digest_end(struct dm_verity *v,
-				       struct dm_verity_io *io)
-{
-	return verity_io_want_digest(v, io) + v->digest_size;
-}
-
 extern int verity_for_bv_block(struct dm_verity *v, struct dm_verity_io *io,
 			       struct bvec_iter *iter,
 			       int (*process)(struct dm_verity *v,

From 18ac427906af4dbdca7c5e8a1abdf6edc2eaec2c Mon Sep 17 00:00:00 2001
From: Wu Bo <bo.wu@vivo.com>
Date: Tue, 21 Nov 2023 20:51:50 -0700
Subject: [PATCH 0753/1043] dm verity: don't perform FEC for failed readahead
 IO

commit 0193e3966ceeeef69e235975918b287ab093082b upstream.

We found an issue under Android OTA scenario that many BIOs have to do
FEC where the data under dm-verity is 100% complete and no corruption.

Android OTA has many dm-block layers, from upper to lower:
dm-verity
dm-snapshot
dm-origin & dm-cow
dm-linear
ufs

DM tables have to change 2 times during Android OTA merging process.
When doing table change, the dm-snapshot will be suspended for a while.
During this interval, many readahead IOs are submitted to dm_verity
from filesystem. Then the kverity works are busy doing FEC process
which cost too much time to finish dm-verity IO. This causes needless
delay which feels like system is hung.

After adding debugging it was found that each readahead IO needed
around 10s to finish when this situation occurred. This is due to IO
amplification:

dm-snapshot suspend
erofs_readahead     // 300+ io is submitted
	dm_submit_bio (dm_verity)
		dm_submit_bio (dm_snapshot)
		bio return EIO
		bio got nothing, it's empty
	verity_end_io
	verity_verify_io
	forloop range(0, io->n_blocks)    // each io->nblocks ~= 20
		verity_fec_decode
		fec_decode_rsb
		fec_read_bufs
		forloop range(0, v->fec->rsn) // v->fec->rsn = 253
			new_read
			submit_bio (dm_snapshot)
		end loop
	end loop
dm-snapshot resume

Readahead BIOs get nothing while dm-snapshot is suspended, so all of
them will cause verity's FEC.
Each readahead BIO needs to verify ~20 (io->nblocks) blocks.
Each block needs to do FEC, and every block needs to do 253
(v->fec->rsn) reads.
So during the suspend interval(~200ms), 300 readahead BIOs trigger
~1518000 (300*20*253) IOs to dm-snapshot.

As readahead IO is not required by userspace, and to fix this issue,
it is best to pass readahead errors to upper layer to handle it.

Cc: stable@vger.kernel.org
Fixes: a739ff3f543a ("dm verity: add support for forward error correction")
Signed-off-by: Wu Bo <bo.wu@vivo.com>
Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-verity-target.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index 0c2048d2b847..7671949c8a2d 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -583,7 +583,9 @@ static void verity_end_io(struct bio *bio)
 	struct dm_verity_io *io = bio->bi_private;
 
 	if (bio->bi_status &&
-	    (!verity_fec_is_enabled(io->v) || verity_is_system_shutting_down())) {
+	    (!verity_fec_is_enabled(io->v) ||
+	     verity_is_system_shutting_down() ||
+	     (bio->bi_opf & REQ_RAHEAD))) {
 		verity_finish_io(io, bio->bi_status);
 		return;
 	}

From f62ceb880a71612841dbcb2c729c92b9e9759be3 Mon Sep 17 00:00:00 2001
From: Markus Weippert <markus@gekmihesg.de>
Date: Fri, 24 Nov 2023 16:14:37 +0100
Subject: [PATCH 0754/1043] bcache: revert replacing IS_ERR_OR_NULL with IS_ERR

commit bb6cc253861bd5a7cf8439e2118659696df9619f upstream.

Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in
node allocations") replaced IS_ERR_OR_NULL by IS_ERR. This leads to a
NULL pointer dereference.

BUG: kernel NULL pointer dereference, address: 0000000000000080
Call Trace:
 ? __die_body.cold+0x1a/0x1f
 ? page_fault_oops+0xd2/0x2b0
 ? exc_page_fault+0x70/0x170
 ? asm_exc_page_fault+0x22/0x30
 ? btree_node_free+0xf/0x160 [bcache]
 ? up_write+0x32/0x60
 btree_gc_coalesce+0x2aa/0x890 [bcache]
 ? bch_extent_bad+0x70/0x170 [bcache]
 btree_gc_recurse+0x130/0x390 [bcache]
 ? btree_gc_mark_node+0x72/0x230 [bcache]
 bch_btree_gc+0x5da/0x600 [bcache]
 ? cpuusage_read+0x10/0x10
 ? bch_btree_gc+0x600/0x600 [bcache]
 bch_gc_thread+0x135/0x180 [bcache]

The relevant code starts with:

    new_nodes[0] = NULL;

    for (i = 0; i < nodes; i++) {
        if (__bch_keylist_realloc(&keylist, bkey_u64s(&r[i].b->key)))
            goto out_nocoalesce;
    // ...
out_nocoalesce:
    // ...
    for (i = 0; i < nodes; i++)
        if (!IS_ERR(new_nodes[i])) {  // IS_ERR_OR_NULL before
028ddcac477b
            btree_node_free(new_nodes[i]);  // new_nodes[0] is NULL
            rw_unlock(true, new_nodes[i]);
        }

This patch replaces IS_ERR() by IS_ERR_OR_NULL() to fix this.

Fixes: 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations")
Link: https://lore.kernel.org/all/3DF4A87A-2AC1-4893-AE5F-E921478419A9@suse.de/
Cc: stable@vger.kernel.org
Cc: Zheng Wang <zyytlz.wz@163.com>
Cc: Coly Li <colyli@suse.de>
Signed-off-by: Markus Weippert <markus@gekmihesg.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/bcache/btree.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 956c740ddfeb..3d6a7fbcbb15 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1489,7 +1489,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
 	bch_keylist_free(&keylist);
 
 	for (i = 0; i < nodes; i++)
-		if (!IS_ERR(new_nodes[i])) {
+		if (!IS_ERR_OR_NULL(new_nodes[i])) {
 			btree_node_free(new_nodes[i]);
 			rw_unlock(true, new_nodes[i]);
 		}

From b5cbbc2b2da99fb55a8bc5c2cc0d9ad5f3e8fa25 Mon Sep 17 00:00:00 2001
From: "Abdul Halim, Mohd Syazwan" <mohd.syazwan.abdul.halim@intel.com>
Date: Wed, 22 Nov 2023 11:26:06 +0800
Subject: [PATCH 0755/1043] iommu/vt-d: Add MTL to quirk list to skip TE
 disabling

commit 85b80fdffa867d75dfb9084a839e7949e29064e8 upstream.

The VT-d spec requires (10.4.4 Global Command Register, TE field) that:

Hardware implementations supporting DMA draining must drain any in-flight
DMA read/write requests queued within the Root-Complex before switching
address translation on or off and reflecting the status of the command
through the TES field in the Global Status register.

Unfortunately, some integrated graphic devices fail to do so after some
kind of power state transition. As the result, the system might stuck in
iommu_disable_translation(), waiting for the completion of TE transition.

Add MTL to the quirk list for those devices and skips TE disabling if the
qurik hits.

Fixes: b1012ca8dc4f ("iommu/vt-d: Skip TE disabling on quirky gfx dedicated iommu")
Cc: stable@vger.kernel.org
Signed-off-by: Abdul Halim, Mohd Syazwan <mohd.syazwan.abdul.halim@intel.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/20231116022324.30120-1-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iommu/intel/iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 47666c9b4ba1..6be92e0afdb0 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -6325,7 +6325,7 @@ static void quirk_igfx_skip_te_disable(struct pci_dev *dev)
 	ver = (dev->device >> 8) & 0xff;
 	if (ver != 0x45 && ver != 0x46 && ver != 0x4c &&
 	    ver != 0x4e && ver != 0x8a && ver != 0x98 &&
-	    ver != 0x9a && ver != 0xa7)
+	    ver != 0x9a && ver != 0xa7 && ver != 0x7d)
 		return;
 
 	if (risky_device(dev))

From b53dc7c766aec1b53c3d6ab0c29c3a3235bd6275 Mon Sep 17 00:00:00 2001
From: Timothy Pearson <tpearson@raptorengineering.com>
Date: Sun, 19 Nov 2023 09:18:02 -0600
Subject: [PATCH 0756/1043] powerpc: Don't clobber f0/vs0 during fp|altivec
 register save

commit 5e1d824f9a283cbf90f25241b66d1f69adb3835b upstream.

During floating point and vector save to thread data f0/vs0 are
clobbered by the FPSCR/VSCR store routine. This has been obvserved to
lead to userspace register corruption and application data corruption
with io-uring.

Fix it by restoring f0/vs0 after FPSCR/VSCR store has completed for
all the FP, altivec, VMX register save paths.

Tested under QEMU in kvm mode, running on a Talos II workstation with
dual POWER9 DD2.2 CPUs.

Additional detail (mpe):

Typically save_fpu() is called from __giveup_fpu() which saves the FP
regs and also *turns off FP* in the tasks MSR, meaning the kernel will
reload the FP regs from the thread struct before letting the task use FP
again. So in that case save_fpu() is free to clobber f0 because the FP
regs no longer hold live values for the task.

There is another case though, which is the path via:
  sys_clone()
    ...
    copy_process()
      dup_task_struct()
        arch_dup_task_struct()
          flush_all_to_thread()
            save_all()

That path saves the FP regs but leaves them live. That's meant as an
optimisation for a process that's using FP/VSX and then calls fork(),
leaving the regs live means the parent process doesn't have to take a
fault after the fork to get its FP regs back. The optimisation was added
in commit 8792468da5e1 ("powerpc: Add the ability to save FPU without
giving it up").

That path does clobber f0, but f0 is volatile across function calls,
and typically programs reach copy_process() from userspace via a syscall
wrapper function. So in normal usage f0 being clobbered across a
syscall doesn't cause visible data corruption.

But there is now a new path, because io-uring can call copy_process()
via create_io_thread() from the signal handling path. That's OK if the
signal is handled as part of syscall return, but it's not OK if the
signal is handled due to some other interrupt.

That path is:

interrupt_return_srr_user()
  interrupt_exit_user_prepare()
    interrupt_exit_user_prepare_main()
      do_notify_resume()
        get_signal()
          task_work_run()
            create_worker_cb()
              create_io_worker()
                copy_process()
                  dup_task_struct()
                    arch_dup_task_struct()
                      flush_all_to_thread()
                        save_all()
                          if (tsk->thread.regs->msr & MSR_FP)
                            save_fpu()
                            # f0 is clobbered and potentially live in userspace

Note the above discussion applies equally to save_altivec().

Fixes: 8792468da5e1 ("powerpc: Add the ability to save FPU without giving it up")
Cc: stable@vger.kernel.org # v4.6+
Closes: https://lore.kernel.org/all/480932026.45576726.1699374859845.JavaMail.zimbra@raptorengineeringinc.com/
Closes: https://lore.kernel.org/linuxppc-dev/480221078.47953493.1700206777956.JavaMail.zimbra@raptorengineeringinc.com/
Tested-by: Timothy Pearson <tpearson@raptorengineering.com>
Tested-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com>
[mpe: Reword change log to describe exact path of corruption & other minor tweaks]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/1921539696.48534988.1700407082933.JavaMail.zimbra@raptorengineeringinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/fpu.S    | 13 +++++++++++++
 arch/powerpc/kernel/vector.S |  2 ++
 2 files changed, 15 insertions(+)

diff --git a/arch/powerpc/kernel/fpu.S b/arch/powerpc/kernel/fpu.S
index 3ff9a8fafa46..a56597c88e94 100644
--- a/arch/powerpc/kernel/fpu.S
+++ b/arch/powerpc/kernel/fpu.S
@@ -23,6 +23,15 @@
 #include <asm/feature-fixups.h>
 
 #ifdef CONFIG_VSX
+#define __REST_1FPVSR(n,c,base)						\
+BEGIN_FTR_SECTION							\
+	b	2f;							\
+END_FTR_SECTION_IFSET(CPU_FTR_VSX);					\
+	REST_FPR(n,base);						\
+	b	3f;							\
+2:	REST_VSR(n,c,base);						\
+3:
+
 #define __REST_32FPVSRS(n,c,base)					\
 BEGIN_FTR_SECTION							\
 	b	2f;							\
@@ -41,9 +50,11 @@ END_FTR_SECTION_IFSET(CPU_FTR_VSX);					\
 2:	SAVE_32VSRS(n,c,base);						\
 3:
 #else
+#define __REST_1FPVSR(n,b,base)		REST_FPR(n, base)
 #define __REST_32FPVSRS(n,b,base)	REST_32FPRS(n, base)
 #define __SAVE_32FPVSRS(n,b,base)	SAVE_32FPRS(n, base)
 #endif
+#define REST_1FPVSR(n,c,base)   __REST_1FPVSR(n,__REG_##c,__REG_##base)
 #define REST_32FPVSRS(n,c,base) __REST_32FPVSRS(n,__REG_##c,__REG_##base)
 #define SAVE_32FPVSRS(n,c,base) __SAVE_32FPVSRS(n,__REG_##c,__REG_##base)
 
@@ -67,6 +78,7 @@ _GLOBAL(store_fp_state)
 	SAVE_32FPVSRS(0, R4, R3)
 	mffs	fr0
 	stfd	fr0,FPSTATE_FPSCR(r3)
+	REST_1FPVSR(0, R4, R3)
 	blr
 EXPORT_SYMBOL(store_fp_state)
 
@@ -132,4 +144,5 @@ _GLOBAL(save_fpu)
 2:	SAVE_32FPVSRS(0, R4, R6)
 	mffs	fr0
 	stfd	fr0,FPSTATE_FPSCR(r6)
+	REST_1FPVSR(0, R4, R6)
 	blr
diff --git a/arch/powerpc/kernel/vector.S b/arch/powerpc/kernel/vector.S
index 801dc28fdcca..6bd47d4242d0 100644
--- a/arch/powerpc/kernel/vector.S
+++ b/arch/powerpc/kernel/vector.S
@@ -32,6 +32,7 @@ _GLOBAL(store_vr_state)
 	mfvscr	v0
 	li	r4, VRSTATE_VSCR
 	stvx	v0, r4, r3
+	lvx	v0, 0, r3
 	blr
 EXPORT_SYMBOL(store_vr_state)
 
@@ -104,6 +105,7 @@ _GLOBAL(save_altivec)
 	mfvscr	v0
 	li	r4,VRSTATE_VSCR
 	stvx	v0,r4,r7
+	lvx	v0,0,r7
 	blr
 
 #ifdef CONFIG_VSX

From bab9cec493b6c1cbb14f763206d3da978676d732 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Thu, 23 Nov 2023 20:28:27 +0100
Subject: [PATCH 0757/1043] parisc: Drop the HP-UX ENOSYM and EREMOTERELEASE
 error codes

commit e5f3e299a2b1e9c3ece24a38adfc089aef307e8a upstream.

Those return codes are only defined for the parisc architecture and
are leftovers from when we wanted to be HP-UX compatible.

They are not returned by any Linux kernel syscall but do trigger
problems with the glibc strerrorname_np() and strerror() functions as
reported in glibc issue #31080.

There is no need to keep them, so simply remove them.

Signed-off-by: Helge Deller <deller@gmx.de>
Reported-by: Bruno Haible <bruno@clisp.org>
Closes: https://sourceware.org/bugzilla/show_bug.cgi?id=31080
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/include/uapi/asm/errno.h       | 2 --
 lib/errname.c                              | 6 ------
 tools/arch/parisc/include/uapi/asm/errno.h | 2 --
 3 files changed, 10 deletions(-)

diff --git a/arch/parisc/include/uapi/asm/errno.h b/arch/parisc/include/uapi/asm/errno.h
index 87245c584784..8d94739d75c6 100644
--- a/arch/parisc/include/uapi/asm/errno.h
+++ b/arch/parisc/include/uapi/asm/errno.h
@@ -75,7 +75,6 @@
 
 /* We now return you to your regularly scheduled HPUX. */
 
-#define ENOSYM		215	/* symbol does not exist in executable */
 #define	ENOTSOCK	216	/* Socket operation on non-socket */
 #define	EDESTADDRREQ	217	/* Destination address required */
 #define	EMSGSIZE	218	/* Message too long */
@@ -101,7 +100,6 @@
 #define	ETIMEDOUT	238	/* Connection timed out */
 #define	ECONNREFUSED	239	/* Connection refused */
 #define	EREFUSED	ECONNREFUSED	/* for HP's NFS apparently */
-#define	EREMOTERELEASE	240	/* Remote peer released connection */
 #define	EHOSTDOWN	241	/* Host is down */
 #define	EHOSTUNREACH	242	/* No route to host */
 
diff --git a/lib/errname.c b/lib/errname.c
index a5799a8c9cab..fec08e7c8a1d 100644
--- a/lib/errname.c
+++ b/lib/errname.c
@@ -110,9 +110,6 @@ static const char *names_0[] = {
 	E(ENOSPC),
 	E(ENOSR),
 	E(ENOSTR),
-#ifdef ENOSYM
-	E(ENOSYM),
-#endif
 	E(ENOSYS),
 	E(ENOTBLK),
 	E(ENOTCONN),
@@ -143,9 +140,6 @@ static const char *names_0[] = {
 #endif
 	E(EREMOTE),
 	E(EREMOTEIO),
-#ifdef EREMOTERELEASE
-	E(EREMOTERELEASE),
-#endif
 	E(ERESTART),
 	E(ERFKILL),
 	E(EROFS),
diff --git a/tools/arch/parisc/include/uapi/asm/errno.h b/tools/arch/parisc/include/uapi/asm/errno.h
index 87245c584784..8d94739d75c6 100644
--- a/tools/arch/parisc/include/uapi/asm/errno.h
+++ b/tools/arch/parisc/include/uapi/asm/errno.h
@@ -75,7 +75,6 @@
 
 /* We now return you to your regularly scheduled HPUX. */
 
-#define ENOSYM		215	/* symbol does not exist in executable */
 #define	ENOTSOCK	216	/* Socket operation on non-socket */
 #define	EDESTADDRREQ	217	/* Destination address required */
 #define	EMSGSIZE	218	/* Message too long */
@@ -101,7 +100,6 @@
 #define	ETIMEDOUT	238	/* Connection timed out */
 #define	ECONNREFUSED	239	/* Connection refused */
 #define	EREFUSED	ECONNREFUSED	/* for HP's NFS apparently */
-#define	EREMOTERELEASE	240	/* Remote peer released connection */
 #define	EHOSTDOWN	241	/* Host is down */
 #define	EHOSTUNREACH	242	/* No route to host */
 

From 2d6c2238acf8043ec71cdede3542efd54e02798a Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Thu, 2 Nov 2023 07:54:50 +1030
Subject: [PATCH 0758/1043] btrfs: add dmesg output for first mount and last
 unmount of a filesystem

commit 2db313205f8b96eea467691917138d646bb50aef upstream.

There is a feature request to add dmesg output when unmounting a btrfs.
There are several alternative methods to do the same thing, but with
their own problems:

- Use eBPF to watch btrfs_put_super()/open_ctree()
  Not end user friendly, they have to dip their head into the source
  code.

- Watch for directory /sys/fs/<uuid>/
  This is way more simple, but still requires some simple device -> uuid
  lookups.  And a script needs to use inotify to watch /sys/fs/.

Compared to all these, directly outputting the information into dmesg
would be the most simple one, with both device and UUID included.

And since we're here, also add the output when mounting a filesystem for
the first time for parity. A more fine grained monitoring of subvolume
mounts should be done by another layer, like audit.

Now mounting a btrfs with all default mkfs options would look like this:

  [81.906566] BTRFS info (device dm-8): first mount of filesystem 633b5c16-afe3-4b79-b195-138fe145e4f2
  [81.907494] BTRFS info (device dm-8): using crc32c (crc32c-intel) checksum algorithm
  [81.908258] BTRFS info (device dm-8): using free space tree
  [81.912644] BTRFS info (device dm-8): auto enabling async discard
  [81.913277] BTRFS info (device dm-8): checking UUID tree
  [91.668256] BTRFS info (device dm-8): last unmount of filesystem 633b5c16-afe3-4b79-b195-138fe145e4f2

CC: stable@vger.kernel.org # 5.4+
Link: https://github.com/kdave/btrfs-progs/issues/689
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ update changelog ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/disk-io.c | 1 +
 fs/btrfs/super.c   | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 0e25a3f64b2e..cd689d5c4c82 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2972,6 +2972,7 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_device
 		goto fail_alloc;
 	}
 
+	btrfs_info(fs_info, "first mount of filesystem %pU", disk_super->fsid);
 	/*
 	 * Verify the type first, if that or the checksum value are
 	 * corrupted, we'll find out
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index ea731fa8bd35..fd4edd966450 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -318,7 +318,10 @@ void __btrfs_panic(struct btrfs_fs_info *fs_info, const char *function,
 
 static void btrfs_put_super(struct super_block *sb)
 {
-	close_ctree(btrfs_sb(sb));
+	struct btrfs_fs_info *fs_info = btrfs_sb(sb);
+
+	btrfs_info(fs_info, "last unmount of filesystem %pU", fs_info->fs_devices->fsid);
+	close_ctree(fs_info);
 }
 
 enum {

From baaab02a8c0b28828e71f99bf00d40c0aae6a067 Mon Sep 17 00:00:00 2001
From: Bragatheswaran Manickavel <bragathemanick0908@gmail.com>
Date: Sat, 18 Nov 2023 14:40:12 +0530
Subject: [PATCH 0759/1043] btrfs: ref-verify: fix memory leaks in
 btrfs_ref_tree_mod()

commit f91192cd68591c6b037da345bc9fcd5e50540358 upstream.

In btrfs_ref_tree_mod(), when !parent 're' was allocated through
kmalloc(). In the following code, if an error occurs, the execution will
be redirected to 'out' or 'out_unlock' and the function will be exited.
However, on some of the paths, 're' are not deallocated and may lead to
memory leaks.

For example: lookup_block_entry() for 'be' returns NULL, the out label
will be invoked. During that flow ref and 'ra' are freed but not 're',
which can potentially lead to a memory leak.

CC: stable@vger.kernel.org # 5.10+
Reported-and-tested-by: syzbot+d66de4cbf532749df35f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d66de4cbf532749df35f
Signed-off-by: Bragatheswaran Manickavel <bragathemanick0908@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/ref-verify.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
index 78693d3dd15b..bd3bb94cc56b 100644
--- a/fs/btrfs/ref-verify.c
+++ b/fs/btrfs/ref-verify.c
@@ -804,6 +804,7 @@ int btrfs_ref_tree_mod(struct btrfs_fs_info *fs_info,
 			dump_ref_action(fs_info, ra);
 			kfree(ref);
 			kfree(ra);
+			kfree(re);
 			goto out_unlock;
 		} else if (be->num_refs == 0) {
 			btrfs_err(fs_info,
@@ -813,6 +814,7 @@ int btrfs_ref_tree_mod(struct btrfs_fs_info *fs_info,
 			dump_ref_action(fs_info, ra);
 			kfree(ref);
 			kfree(ra);
+			kfree(re);
 			goto out_unlock;
 		}
 

From 12a0ec5ed7cf61df1f1af85241b46647f4d76533 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Tue, 21 Nov 2023 13:38:32 +0000
Subject: [PATCH 0760/1043] btrfs: fix off-by-one when checking chunk map
 includes logical address

commit 5fba5a571858ce2d787fdaf55814e42725bfa895 upstream.

At btrfs_get_chunk_map() we get the extent map for the chunk that contains
the given logical address stored in the 'logical' argument. Then we do
sanity checks to verify the extent map contains the logical address. One
of these checks verifies if the extent map covers a range with an end
offset behind the target logical address - however this check has an
off-by-one error since it will consider an extent map whose start offset
plus its length matches the target logical address as inclusive, while
the fact is that the last byte it covers is behind the target logical
address (by 1).

So fix this condition by using '<=' rather than '<' when comparing the
extent map's "start + length" against the target logical address.

CC: stable@vger.kernel.org # 4.14+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/volumes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 86c50e0570a5..a7fd68e60498 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2998,7 +2998,7 @@ struct extent_map *btrfs_get_chunk_map(struct btrfs_fs_info *fs_info,
 		return ERR_PTR(-EINVAL);
 	}
 
-	if (em->start > logical || em->start + em->len < logical) {
+	if (em->start > logical || em->start + em->len <= logical) {
 		btrfs_crit(fs_info,
 			   "found a bad mapping, wanted %llu-%llu, found %llu-%llu",
 			   logical, length, em->start, em->start + em->len);

From 74ff16c84433a135fd86281b8eb75c8f4b042a91 Mon Sep 17 00:00:00 2001
From: Jann Horn <jannh@google.com>
Date: Fri, 24 Nov 2023 17:48:31 +0100
Subject: [PATCH 0761/1043] btrfs: send: ensure send_fd is writable

commit 0ac1d13a55eb37d398b63e6ff6db4a09a2c9128c upstream.

kernel_write() requires the caller to ensure that the file is writable.
Let's do that directly after looking up the ->send_fd.

We don't need a separate bailout path because the "out" path already
does fput() if ->send_filp is non-NULL.

This has no security impact for two reasons:

 - the ioctl requires CAP_SYS_ADMIN
 - __kernel_write() bails out on read-only files - but only since 5.8,
   see commit a01ac27be472 ("fs: check FMODE_WRITE in __kernel_write")

Reported-and-tested-by: syzbot+12e098239d20385264d3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=12e098239d20385264d3
Fixes: 31db9f7c23fb ("Btrfs: introduce BTRFS_IOC_SEND for btrfs send/receive")
CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/send.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index b081b61e97c8..af9701afcab7 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -7303,7 +7303,7 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg)
 	sctx->flags = arg->flags;
 
 	sctx->send_filp = fget(arg->send_fd);
-	if (!sctx->send_filp) {
+	if (!sctx->send_filp || !(sctx->send_filp->f_mode & FMODE_WRITE)) {
 		ret = -EBADF;
 		goto out;
 	}

From 5c4d5c8556eef372bd58391be4dd5d8bbde0b85a Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Tue, 21 Nov 2023 13:38:33 +0000
Subject: [PATCH 0762/1043] btrfs: make error messages more clear when getting
 a chunk map

commit 7d410d5efe04e42a6cd959bfe6d59d559fdf8b25 upstream.

When getting a chunk map, at btrfs_get_chunk_map(), we do some sanity
checks to verify we found a chunk map and that map found covers the
logical address the caller passed in. However the messages aren't very
clear in the sense that don't mention the issue is with a chunk map and
one of them prints the 'length' argument as if it were the end offset of
the requested range (while the in the string format we use %llu-%llu
which suggests a range, and the second %llu-%llu is actually a range for
the chunk map). So improve these two details in the error messages.

CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/volumes.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index a7fd68e60498..eaf5cd043dac 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2993,15 +2993,16 @@ struct extent_map *btrfs_get_chunk_map(struct btrfs_fs_info *fs_info,
 	read_unlock(&em_tree->lock);
 
 	if (!em) {
-		btrfs_crit(fs_info, "unable to find logical %llu length %llu",
+		btrfs_crit(fs_info,
+			   "unable to find chunk map for logical %llu length %llu",
 			   logical, length);
 		return ERR_PTR(-EINVAL);
 	}
 
 	if (em->start > logical || em->start + em->len <= logical) {
 		btrfs_crit(fs_info,
-			   "found a bad mapping, wanted %llu-%llu, found %llu-%llu",
-			   logical, length, em->start, em->start + em->len);
+			   "found a bad chunk map, wanted %llu-%llu, found %llu-%llu",
+			   logical, logical + length, em->start, em->start + em->len);
 		free_extent_map(em);
 		return ERR_PTR(-EINVAL);
 	}

From 4937fb36bbb8cf91d43a4db38be6dea5b7f275ff Mon Sep 17 00:00:00 2001
From: Max Nguyen <maxwell.nguyen@hp.com>
Date: Sun, 17 Sep 2023 22:21:53 -0700
Subject: [PATCH 0763/1043] Input: xpad - add HyperX Clutch Gladiate Support

commit e28a0974d749e5105d77233c0a84d35c37da047e upstream.

Add HyperX controller support to xpad_device and xpad_table.

Suggested-by: Chris Toledanes <chris.toledanes@hp.com>
Reviewed-by: Carl Ng <carl.ng@hp.com>
Signed-off-by: Max Nguyen <maxwell.nguyen@hp.com>
Reviewed-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
Link: https://lore.kernel.org/r/20230906231514.4291-1-hphyperxdev@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/joystick/xpad.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 762c50239146..beedad0fe09a 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -119,6 +119,7 @@ static const struct xpad_device {
 	{ 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
 	{ 0x044f, 0x0f10, "Thrustmaster Modena GT Wheel", 0, XTYPE_XBOX },
 	{ 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 },
+	{ 0x03f0, 0x0495, "HyperX Clutch Gladiate", 0, XTYPE_XBOXONE },
 	{ 0x045e, 0x0202, "Microsoft X-Box pad v1 (US)", 0, XTYPE_XBOX },
 	{ 0x045e, 0x0285, "Microsoft X-Box pad (Japan)", 0, XTYPE_XBOX },
 	{ 0x045e, 0x0287, "Microsoft Xbox Controller S", 0, XTYPE_XBOX },
@@ -431,6 +432,7 @@ static const struct usb_device_id xpad_table[] = {
 	XPAD_XBOX360_VENDOR(0x0079),		/* GPD Win 2 Controller */
 	XPAD_XBOX360_VENDOR(0x03eb),		/* Wooting Keyboards (Legacy) */
 	XPAD_XBOX360_VENDOR(0x044f),		/* Thrustmaster X-Box 360 controllers */
+	XPAD_XBOXONE_VENDOR(0x03f0),		/* HP HyperX Xbox One Controllers */
 	XPAD_XBOX360_VENDOR(0x045e),		/* Microsoft X-Box 360 controllers */
 	XPAD_XBOXONE_VENDOR(0x045e),		/* Microsoft X-Box One controllers */
 	XPAD_XBOX360_VENDOR(0x046d),		/* Logitech X-Box 360 style controllers */

From ae6e41066e6e2e14907ba34ee610b04160ab59c5 Mon Sep 17 00:00:00 2001
From: Haiyang Zhang <haiyangz@microsoft.com>
Date: Sun, 19 Nov 2023 08:23:41 -0800
Subject: [PATCH 0764/1043] hv_netvsc: fix race of netvsc and VF
 register_netdevice

[ Upstream commit d30fb712e52964f2cf9a9c14cf67078394044837 ]

The rtnl lock also needs to be held before rndis_filter_device_add()
which advertises nvsp_2_vsc_capability / sriov bit, and triggers
VF NIC offering and registering. If VF NIC finished register_netdev()
earlier it may cause name based config failure.

To fix this issue, move the call to rtnl_lock() before
rndis_filter_device_add(), so VF will be registered later than netvsc
/ synthetic NIC, and gets a name numbered (ethX) after netvsc.

Cc: stable@vger.kernel.org
Fixes: e04e7a7bbd4b ("hv_netvsc: Fix a deadlock by getting rtnl lock earlier in netvsc_probe()")
Reported-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/hyperv/netvsc_drv.c | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 2104d57fb657..790bf750281a 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -2528,6 +2528,21 @@ static int netvsc_probe(struct hv_device *dev,
 		goto devinfo_failed;
 	}
 
+	/* We must get rtnl lock before scheduling nvdev->subchan_work,
+	 * otherwise netvsc_subchan_work() can get rtnl lock first and wait
+	 * all subchannels to show up, but that may not happen because
+	 * netvsc_probe() can't get rtnl lock and as a result vmbus_onoffer()
+	 * -> ... -> device_add() -> ... -> __device_attach() can't get
+	 * the device lock, so all the subchannels can't be processed --
+	 * finally netvsc_subchan_work() hangs forever.
+	 *
+	 * The rtnl lock also needs to be held before rndis_filter_device_add()
+	 * which advertises nvsp_2_vsc_capability / sriov bit, and triggers
+	 * VF NIC offering and registering. If VF NIC finished register_netdev()
+	 * earlier it may cause name based config failure.
+	 */
+	rtnl_lock();
+
 	nvdev = rndis_filter_device_add(dev, device_info);
 	if (IS_ERR(nvdev)) {
 		ret = PTR_ERR(nvdev);
@@ -2537,16 +2552,6 @@ static int netvsc_probe(struct hv_device *dev,
 
 	memcpy(net->dev_addr, device_info->mac_adr, ETH_ALEN);
 
-	/* We must get rtnl lock before scheduling nvdev->subchan_work,
-	 * otherwise netvsc_subchan_work() can get rtnl lock first and wait
-	 * all subchannels to show up, but that may not happen because
-	 * netvsc_probe() can't get rtnl lock and as a result vmbus_onoffer()
-	 * -> ... -> device_add() -> ... -> __device_attach() can't get
-	 * the device lock, so all the subchannels can't be processed --
-	 * finally netvsc_subchan_work() hangs forever.
-	 */
-	rtnl_lock();
-
 	if (nvdev->num_chn > 1)
 		schedule_work(&nvdev->subchan_work);
 
@@ -2580,9 +2585,9 @@ static int netvsc_probe(struct hv_device *dev,
 	return 0;
 
 register_failed:
-	rtnl_unlock();
 	rndis_filter_device_remove(dev, nvdev);
 rndis_failed:
+	rtnl_unlock();
 	netvsc_devinfo_put(device_info);
 devinfo_failed:
 	free_percpu(net_device_ctx->vf_stats);

From 713530d3c8f13bbb3fda56159e7ed1236a8b4563 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Wed, 2 Nov 2022 14:13:19 -0400
Subject: [PATCH 0765/1043] USB: core: Change configuration warnings to notices

[ Upstream commit 7a09c1269702db8eccb6f718da2b00173e1e0034 ]

It has been pointed out that the kernel log messages warning about
problems in USB configuration and related descriptors are vexing for
users.  The warning log level has a fairly high priority, but the user
can do nothing to fix the underlying errors in the device's firmware.

To reduce the amount of useless information produced by tools that
filter high-priority log messages, we can change these warnings to
notices, i.e., change dev_warn() to dev_notice().  The same holds for
a few messages that currently use dev_err(): Unless they indicate a
failure that might make a device unusable (such as inability to
transfer a config descriptor), change them to dev_notice() also.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216630
Suggested-by: Artem S. Tashkinov <aros@gmx.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/Y2KzPx0h6z1jXCuN@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 974bba5c118f ("usb: config: fix iteration issue in 'usb_get_bos_descriptor()'")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/core/config.c | 82 +++++++++++++++++++--------------------
 1 file changed, 41 insertions(+), 41 deletions(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 39f1eca60a71..1e40e63d301b 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -61,7 +61,7 @@ static void usb_parse_ssp_isoc_endpoint_companion(struct device *ddev,
 	desc = (struct usb_ssp_isoc_ep_comp_descriptor *) buffer;
 	if (desc->bDescriptorType != USB_DT_SSP_ISOC_ENDPOINT_COMP ||
 	    size < USB_DT_SSP_ISOC_EP_COMP_SIZE) {
-		dev_warn(ddev, "Invalid SuperSpeedPlus isoc endpoint companion"
+		dev_notice(ddev, "Invalid SuperSpeedPlus isoc endpoint companion"
 			 "for config %d interface %d altsetting %d ep %d.\n",
 			 cfgno, inum, asnum, ep->desc.bEndpointAddress);
 		return;
@@ -83,7 +83,7 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
 
 	if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP ||
 			size < USB_DT_SS_EP_COMP_SIZE) {
-		dev_warn(ddev, "No SuperSpeed endpoint companion for config %d "
+		dev_notice(ddev, "No SuperSpeed endpoint companion for config %d "
 				" interface %d altsetting %d ep %d: "
 				"using minimum values\n",
 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
@@ -109,13 +109,13 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
 
 	/* Check the various values */
 	if (usb_endpoint_xfer_control(&ep->desc) && desc->bMaxBurst != 0) {
-		dev_warn(ddev, "Control endpoint with bMaxBurst = %d in "
+		dev_notice(ddev, "Control endpoint with bMaxBurst = %d in "
 				"config %d interface %d altsetting %d ep %d: "
 				"setting to zero\n", desc->bMaxBurst,
 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
 		ep->ss_ep_comp.bMaxBurst = 0;
 	} else if (desc->bMaxBurst > 15) {
-		dev_warn(ddev, "Endpoint with bMaxBurst = %d in "
+		dev_notice(ddev, "Endpoint with bMaxBurst = %d in "
 				"config %d interface %d altsetting %d ep %d: "
 				"setting to 15\n", desc->bMaxBurst,
 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
@@ -125,7 +125,7 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
 	if ((usb_endpoint_xfer_control(&ep->desc) ||
 			usb_endpoint_xfer_int(&ep->desc)) &&
 				desc->bmAttributes != 0) {
-		dev_warn(ddev, "%s endpoint with bmAttributes = %d in "
+		dev_notice(ddev, "%s endpoint with bmAttributes = %d in "
 				"config %d interface %d altsetting %d ep %d: "
 				"setting to zero\n",
 				usb_endpoint_xfer_control(&ep->desc) ? "Control" : "Bulk",
@@ -134,7 +134,7 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
 		ep->ss_ep_comp.bmAttributes = 0;
 	} else if (usb_endpoint_xfer_bulk(&ep->desc) &&
 			desc->bmAttributes > 16) {
-		dev_warn(ddev, "Bulk endpoint with more than 65536 streams in "
+		dev_notice(ddev, "Bulk endpoint with more than 65536 streams in "
 				"config %d interface %d altsetting %d ep %d: "
 				"setting to max\n",
 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
@@ -142,7 +142,7 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
 	} else if (usb_endpoint_xfer_isoc(&ep->desc) &&
 		   !USB_SS_SSP_ISOC_COMP(desc->bmAttributes) &&
 		   USB_SS_MULT(desc->bmAttributes) > 3) {
-		dev_warn(ddev, "Isoc endpoint has Mult of %d in "
+		dev_notice(ddev, "Isoc endpoint has Mult of %d in "
 				"config %d interface %d altsetting %d ep %d: "
 				"setting to 3\n",
 				USB_SS_MULT(desc->bmAttributes),
@@ -160,7 +160,7 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
 	else
 		max_tx = 999999;
 	if (le16_to_cpu(desc->wBytesPerInterval) > max_tx) {
-		dev_warn(ddev, "%s endpoint with wBytesPerInterval of %d in "
+		dev_notice(ddev, "%s endpoint with wBytesPerInterval of %d in "
 				"config %d interface %d altsetting %d ep %d: "
 				"setting to %d\n",
 				usb_endpoint_xfer_isoc(&ep->desc) ? "Isoc" : "Int",
@@ -273,7 +273,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 	else if (d->bLength >= USB_DT_ENDPOINT_SIZE)
 		n = USB_DT_ENDPOINT_SIZE;
 	else {
-		dev_warn(ddev, "config %d interface %d altsetting %d has an "
+		dev_notice(ddev, "config %d interface %d altsetting %d has an "
 		    "invalid endpoint descriptor of length %d, skipping\n",
 		    cfgno, inum, asnum, d->bLength);
 		goto skip_to_next_endpoint_or_interface_descriptor;
@@ -281,7 +281,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 
 	i = d->bEndpointAddress & ~USB_ENDPOINT_DIR_MASK;
 	if (i >= 16 || i == 0) {
-		dev_warn(ddev, "config %d interface %d altsetting %d has an "
+		dev_notice(ddev, "config %d interface %d altsetting %d has an "
 		    "invalid endpoint with address 0x%X, skipping\n",
 		    cfgno, inum, asnum, d->bEndpointAddress);
 		goto skip_to_next_endpoint_or_interface_descriptor;
@@ -293,7 +293,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 
 	/* Check for duplicate endpoint addresses */
 	if (config_endpoint_is_duplicate(config, inum, asnum, d)) {
-		dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
+		dev_notice(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
 				cfgno, inum, asnum, d->bEndpointAddress);
 		goto skip_to_next_endpoint_or_interface_descriptor;
 	}
@@ -301,7 +301,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 	/* Ignore some endpoints */
 	if (udev->quirks & USB_QUIRK_ENDPOINT_IGNORE) {
 		if (usb_endpoint_is_ignored(udev, ifp, d)) {
-			dev_warn(ddev, "config %d interface %d altsetting %d has an ignored endpoint with address 0x%X, skipping\n",
+			dev_notice(ddev, "config %d interface %d altsetting %d has an ignored endpoint with address 0x%X, skipping\n",
 					cfgno, inum, asnum,
 					d->bEndpointAddress);
 			goto skip_to_next_endpoint_or_interface_descriptor;
@@ -378,7 +378,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 		}
 	}
 	if (d->bInterval < i || d->bInterval > j) {
-		dev_warn(ddev, "config %d interface %d altsetting %d "
+		dev_notice(ddev, "config %d interface %d altsetting %d "
 		    "endpoint 0x%X has an invalid bInterval %d, "
 		    "changing to %d\n",
 		    cfgno, inum, asnum,
@@ -391,7 +391,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 	 * them usable, we will try treating them as Interrupt endpoints.
 	 */
 	if (udev->speed == USB_SPEED_LOW && usb_endpoint_xfer_bulk(d)) {
-		dev_warn(ddev, "config %d interface %d altsetting %d "
+		dev_notice(ddev, "config %d interface %d altsetting %d "
 		    "endpoint 0x%X is Bulk; changing to Interrupt\n",
 		    cfgno, inum, asnum, d->bEndpointAddress);
 		endpoint->desc.bmAttributes = USB_ENDPOINT_XFER_INT;
@@ -408,7 +408,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 	 */
 	maxp = le16_to_cpu(endpoint->desc.wMaxPacketSize);
 	if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) {
-		dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n",
+		dev_notice(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n",
 		    cfgno, inum, asnum, d->bEndpointAddress);
 	}
 
@@ -439,7 +439,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 	j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
 
 	if (maxp > j) {
-		dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
+		dev_notice(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
 		    cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
 		maxp = j;
 		endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
@@ -452,7 +452,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
 	 */
 	if (udev->speed == USB_SPEED_HIGH && usb_endpoint_xfer_bulk(d)) {
 		if (maxp != 512)
-			dev_warn(ddev, "config %d interface %d altsetting %d "
+			dev_notice(ddev, "config %d interface %d altsetting %d "
 				"bulk endpoint 0x%X has invalid maxpacket %d\n",
 				cfgno, inum, asnum, d->bEndpointAddress,
 				maxp);
@@ -533,7 +533,7 @@ static int usb_parse_interface(struct device *ddev, int cfgno,
 	      i < intfc->num_altsetting;
 	     (++i, ++alt)) {
 		if (alt->desc.bAlternateSetting == asnum) {
-			dev_warn(ddev, "Duplicate descriptor for config %d "
+			dev_notice(ddev, "Duplicate descriptor for config %d "
 			    "interface %d altsetting %d, skipping\n",
 			    cfgno, inum, asnum);
 			goto skip_to_next_interface_descriptor;
@@ -559,7 +559,7 @@ static int usb_parse_interface(struct device *ddev, int cfgno,
 	num_ep = num_ep_orig = alt->desc.bNumEndpoints;
 	alt->desc.bNumEndpoints = 0;		/* Use as a counter */
 	if (num_ep > USB_MAXENDPOINTS) {
-		dev_warn(ddev, "too many endpoints for config %d interface %d "
+		dev_notice(ddev, "too many endpoints for config %d interface %d "
 		    "altsetting %d: %d, using maximum allowed: %d\n",
 		    cfgno, inum, asnum, num_ep, USB_MAXENDPOINTS);
 		num_ep = USB_MAXENDPOINTS;
@@ -590,7 +590,7 @@ static int usb_parse_interface(struct device *ddev, int cfgno,
 	}
 
 	if (n != num_ep_orig)
-		dev_warn(ddev, "config %d interface %d altsetting %d has %d "
+		dev_notice(ddev, "config %d interface %d altsetting %d has %d "
 		    "endpoint descriptor%s, different from the interface "
 		    "descriptor's value: %d\n",
 		    cfgno, inum, asnum, n, plural(n), num_ep_orig);
@@ -625,7 +625,7 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 	if (config->desc.bDescriptorType != USB_DT_CONFIG ||
 	    config->desc.bLength < USB_DT_CONFIG_SIZE ||
 	    config->desc.bLength > size) {
-		dev_err(ddev, "invalid descriptor for config index %d: "
+		dev_notice(ddev, "invalid descriptor for config index %d: "
 		    "type = 0x%X, length = %d\n", cfgidx,
 		    config->desc.bDescriptorType, config->desc.bLength);
 		return -EINVAL;
@@ -636,7 +636,7 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 	size -= config->desc.bLength;
 
 	if (nintf > USB_MAXINTERFACES) {
-		dev_warn(ddev, "config %d has too many interfaces: %d, "
+		dev_notice(ddev, "config %d has too many interfaces: %d, "
 		    "using maximum allowed: %d\n",
 		    cfgno, nintf, USB_MAXINTERFACES);
 		nintf = USB_MAXINTERFACES;
@@ -650,7 +650,7 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 	     (buffer2 += header->bLength, size2 -= header->bLength)) {
 
 		if (size2 < sizeof(struct usb_descriptor_header)) {
-			dev_warn(ddev, "config %d descriptor has %d excess "
+			dev_notice(ddev, "config %d descriptor has %d excess "
 			    "byte%s, ignoring\n",
 			    cfgno, size2, plural(size2));
 			break;
@@ -658,7 +658,7 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 
 		header = (struct usb_descriptor_header *) buffer2;
 		if ((header->bLength > size2) || (header->bLength < 2)) {
-			dev_warn(ddev, "config %d has an invalid descriptor "
+			dev_notice(ddev, "config %d has an invalid descriptor "
 			    "of length %d, skipping remainder of the config\n",
 			    cfgno, header->bLength);
 			break;
@@ -670,7 +670,7 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 
 			d = (struct usb_interface_descriptor *) header;
 			if (d->bLength < USB_DT_INTERFACE_SIZE) {
-				dev_warn(ddev, "config %d has an invalid "
+				dev_notice(ddev, "config %d has an invalid "
 				    "interface descriptor of length %d, "
 				    "skipping\n", cfgno, d->bLength);
 				continue;
@@ -680,7 +680,7 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 
 			if ((dev->quirks & USB_QUIRK_HONOR_BNUMINTERFACES) &&
 			    n >= nintf_orig) {
-				dev_warn(ddev, "config %d has more interface "
+				dev_notice(ddev, "config %d has more interface "
 				    "descriptors, than it declares in "
 				    "bNumInterfaces, ignoring interface "
 				    "number: %d\n", cfgno, inum);
@@ -688,7 +688,7 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 			}
 
 			if (inum >= nintf_orig)
-				dev_warn(ddev, "config %d has an invalid "
+				dev_notice(ddev, "config %d has an invalid "
 				    "interface number: %d but max is %d\n",
 				    cfgno, inum, nintf_orig - 1);
 
@@ -713,14 +713,14 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 
 			d = (struct usb_interface_assoc_descriptor *)header;
 			if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
-				dev_warn(ddev,
+				dev_notice(ddev,
 					 "config %d has an invalid interface association descriptor of length %d, skipping\n",
 					 cfgno, d->bLength);
 				continue;
 			}
 
 			if (iad_num == USB_MAXIADS) {
-				dev_warn(ddev, "found more Interface "
+				dev_notice(ddev, "found more Interface "
 					       "Association Descriptors "
 					       "than allocated for in "
 					       "configuration %d\n", cfgno);
@@ -731,7 +731,7 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 
 		} else if (header->bDescriptorType == USB_DT_DEVICE ||
 			    header->bDescriptorType == USB_DT_CONFIG)
-			dev_warn(ddev, "config %d contains an unexpected "
+			dev_notice(ddev, "config %d contains an unexpected "
 			    "descriptor of type 0x%X, skipping\n",
 			    cfgno, header->bDescriptorType);
 
@@ -740,11 +740,11 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 	config->desc.wTotalLength = cpu_to_le16(buffer2 - buffer0);
 
 	if (n != nintf)
-		dev_warn(ddev, "config %d has %d interface%s, different from "
+		dev_notice(ddev, "config %d has %d interface%s, different from "
 		    "the descriptor's value: %d\n",
 		    cfgno, n, plural(n), nintf_orig);
 	else if (n == 0)
-		dev_warn(ddev, "config %d has no interfaces?\n", cfgno);
+		dev_notice(ddev, "config %d has no interfaces?\n", cfgno);
 	config->desc.bNumInterfaces = nintf = n;
 
 	/* Check for missing interface numbers */
@@ -754,7 +754,7 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 				break;
 		}
 		if (j >= nintf)
-			dev_warn(ddev, "config %d has no interface number "
+			dev_notice(ddev, "config %d has no interface number "
 			    "%d\n", cfgno, i);
 	}
 
@@ -762,7 +762,7 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 	for (i = 0; i < nintf; ++i) {
 		j = nalts[i];
 		if (j > USB_MAXALTSETTING) {
-			dev_warn(ddev, "too many alternate settings for "
+			dev_notice(ddev, "too many alternate settings for "
 			    "config %d interface %d: %d, "
 			    "using maximum allowed: %d\n",
 			    cfgno, inums[i], j, USB_MAXALTSETTING);
@@ -811,7 +811,7 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 					break;
 			}
 			if (n >= intfc->num_altsetting)
-				dev_warn(ddev, "config %d interface %d has no "
+				dev_notice(ddev, "config %d interface %d has no "
 				    "altsetting %d\n", cfgno, inums[i], j);
 		}
 	}
@@ -868,7 +868,7 @@ int usb_get_configuration(struct usb_device *dev)
 	int result;
 
 	if (ncfg > USB_MAXCONFIG) {
-		dev_warn(ddev, "too many configurations: %d, "
+		dev_notice(ddev, "too many configurations: %d, "
 		    "using maximum allowed: %d\n", ncfg, USB_MAXCONFIG);
 		dev->descriptor.bNumConfigurations = ncfg = USB_MAXCONFIG;
 	}
@@ -902,7 +902,7 @@ int usb_get_configuration(struct usb_device *dev)
 			    "descriptor/%s: %d\n", cfgno, "start", result);
 			if (result != -EPIPE)
 				goto err;
-			dev_err(ddev, "chopping to %d config(s)\n", cfgno);
+			dev_notice(ddev, "chopping to %d config(s)\n", cfgno);
 			dev->descriptor.bNumConfigurations = cfgno;
 			break;
 		} else if (result < 4) {
@@ -934,7 +934,7 @@ int usb_get_configuration(struct usb_device *dev)
 			goto err;
 		}
 		if (result < length) {
-			dev_warn(ddev, "config index %d descriptor too short "
+			dev_notice(ddev, "config index %d descriptor too short "
 			    "(expected %i, got %i)\n", cfgno, length, result);
 			length = result;
 		}
@@ -993,7 +993,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
 	/* Get BOS descriptor */
 	ret = usb_get_descriptor(dev, USB_DT_BOS, 0, bos, USB_DT_BOS_SIZE);
 	if (ret < USB_DT_BOS_SIZE || bos->bLength < USB_DT_BOS_SIZE) {
-		dev_err(ddev, "unable to get BOS descriptor or descriptor too short\n");
+		dev_notice(ddev, "unable to get BOS descriptor or descriptor too short\n");
 		if (ret >= 0)
 			ret = -ENOMSG;
 		kfree(bos);
@@ -1021,7 +1021,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
 
 	ret = usb_get_descriptor(dev, USB_DT_BOS, 0, buffer, total_len);
 	if (ret < total_len) {
-		dev_err(ddev, "unable to get BOS descriptor set\n");
+		dev_notice(ddev, "unable to get BOS descriptor set\n");
 		if (ret >= 0)
 			ret = -ENOMSG;
 		goto err;
@@ -1046,7 +1046,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
 		}
 
 		if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
-			dev_warn(ddev, "descriptor type invalid, skip\n");
+			dev_notice(ddev, "descriptor type invalid, skip\n");
 			continue;
 		}
 

From 9ef94ec8e52eaf7b9abc5b5f8f5b911751112223 Mon Sep 17 00:00:00 2001
From: Niklas Neronin <niklas.neronin@linux.intel.com>
Date: Wed, 15 Nov 2023 14:13:25 +0200
Subject: [PATCH 0766/1043] usb: config: fix iteration issue in
 'usb_get_bos_descriptor()'

[ Upstream commit 974bba5c118f4c2baf00de0356e3e4f7928b4cbc ]

The BOS descriptor defines a root descriptor and is the base descriptor for
accessing a family of related descriptors.

Function 'usb_get_bos_descriptor()' encounters an iteration issue when
skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in
the same descriptor being read repeatedly.

To address this issue, a 'goto' statement is introduced to ensure that the
pointer and the amount read is updated correctly. This ensures that the
function iterates to the next descriptor instead of reading the same
descriptor repeatedly.

Cc: stable@vger.kernel.org
Fixes: 3dd550a2d365 ("USB: usbcore: Fix slab-out-of-bounds bug during device reset")
Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com>
Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20231115121325.471454-1-niklas.neronin@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/core/config.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 1e40e63d301b..2f8a1225b697 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -1047,7 +1047,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
 
 		if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
 			dev_notice(ddev, "descriptor type invalid, skip\n");
-			continue;
+			goto skip_to_next_descriptor;
 		}
 
 		switch (cap_type) {
@@ -1080,6 +1080,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
 			break;
 		}
 
+skip_to_next_descriptor:
 		total_len -= length;
 		buffer += length;
 	}

From 772fe1da9a8d4dcd8993abaecbde04789c52a4c2 Mon Sep 17 00:00:00 2001
From: Zhengchao Shao <shaozhengchao@huawei.com>
Date: Thu, 23 Nov 2023 15:13:14 +0800
Subject: [PATCH 0767/1043] ipv4: igmp: fix refcnt uaf issue when receiving
 igmp query packet

[ Upstream commit e2b706c691905fe78468c361aaabc719d0a496f1 ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/igmp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 4cffdb9795de..cb55fede03c0 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -216,8 +216,10 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
 	int tv = prandom_u32() % max_delay;
 
 	im->tm_running = 1;
-	if (!mod_timer(&im->timer, jiffies+tv+2))
-		refcount_inc(&im->refcnt);
+	if (refcount_inc_not_zero(&im->refcnt)) {
+		if (mod_timer(&im->timer, jiffies + tv + 2))
+			ip_ma_put(im);
+	}
 }
 
 static void igmp_gq_start_timer(struct in_device *in_dev)

From fe7fd9c209e8c27c97d3173f81ed10042176fb01 Mon Sep 17 00:00:00 2001
From: Ioana Ciornei <ioana.ciornei@nxp.com>
Date: Fri, 24 Nov 2023 12:28:04 +0200
Subject: [PATCH 0768/1043] dpaa2-eth: increase the needed headroom to account
 for alignment

[ Upstream commit f422abe3f23d483cf01f386819f26fb3fe0dbb2b ]

Increase the needed headroom to account for a 64 byte alignment
restriction which, with this patch, we make mandatory on the Tx path.
The case in which the amount of headroom needed is not available is
already handled by the driver which instead sends a S/G frame with the
first buffer only holding the SW and HW annotation areas.

Without this patch, we can empirically see data corruption happening
between Tx and Tx confirmation which sometimes leads to the SW
annotation area being overwritten.

Since this is an old IP where the hardware team cannot help to
understand the underlying behavior, we make the Tx alignment mandatory
for all frames to avoid the crash on Tx conf. Also, remove the comment
that suggested that this is just an optimization.

This patch also sets the needed_headroom net device field to the usual
value that the driver would need on the Tx path:
	- 64 bytes for the software annotation area
	- 64 bytes to account for a 64 byte aligned buffer address

Fixes: 6e2387e8f19e ("staging: fsl-dpaa2/eth: Add Freescale DPAA2 Ethernet driver")
Closes: https://lore.kernel.org/netdev/aa784d0c-85eb-4e5d-968b-c8f74fa86be6@gin.de/
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 8 ++++----
 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
index 35401202523e..07ba0438f965 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
@@ -928,14 +928,12 @@ static int dpaa2_eth_build_single_fd(struct dpaa2_eth_priv *priv,
 	dma_addr_t addr;
 
 	buffer_start = skb->data - dpaa2_eth_needed_headroom(skb);
-
-	/* If there's enough room to align the FD address, do it.
-	 * It will help hardware optimize accesses.
-	 */
 	aligned_start = PTR_ALIGN(buffer_start - DPAA2_ETH_TX_BUF_ALIGN,
 				  DPAA2_ETH_TX_BUF_ALIGN);
 	if (aligned_start >= skb->head)
 		buffer_start = aligned_start;
+	else
+		return -ENOMEM;
 
 	/* Store a backpointer to the skb at the beginning of the buffer
 	 * (in the private data area) such that we can release it
@@ -4337,6 +4335,8 @@ static int dpaa2_eth_probe(struct fsl_mc_device *dpni_dev)
 	if (err)
 		goto err_dl_port_add;
 
+	net_dev->needed_headroom = DPAA2_ETH_SWA_SIZE + DPAA2_ETH_TX_BUF_ALIGN;
+
 	err = register_netdev(net_dev);
 	if (err < 0) {
 		dev_err(dev, "register_netdev() failed\n");
diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h
index d236b8695c39..2825f53e7e9b 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h
@@ -664,7 +664,7 @@ static inline bool dpaa2_eth_rx_pause_enabled(u64 link_options)
 
 static inline unsigned int dpaa2_eth_needed_headroom(struct sk_buff *skb)
 {
-	unsigned int headroom = DPAA2_ETH_SWA_SIZE;
+	unsigned int headroom = DPAA2_ETH_SWA_SIZE + DPAA2_ETH_TX_BUF_ALIGN;
 
 	/* If we don't have an skb (e.g. XDP buffer), we only need space for
 	 * the software annotation area

From cb1644f9f005492a67be395a810aacda151ac6e4 Mon Sep 17 00:00:00 2001
From: Willem de Bruijn <willemb@google.com>
Date: Fri, 24 Nov 2023 12:15:19 -0500
Subject: [PATCH 0769/1043] selftests/net: ipsec: fix constant out of range

[ Upstream commit 088559815477c6f623a5db5993491ddd7facbec7 ]

Fix a small compiler warning.

nr_process must be a signed long: it is assigned a signed long by
strtol() and is compared against LONG_MIN and LONG_MAX.

ipsec.c:2280:65:
    error: result of comparison of constant -9223372036854775808
    with expression of type 'unsigned int' is always false
    [-Werror,-Wtautological-constant-out-of-range-compare]

  if ((errno == ERANGE && (nr_process == LONG_MAX || nr_process == LONG_MIN))

Fixes: bc2652b7ae1e ("selftest/net/xfrm: Add test for ipsec tunnel")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>
Link: https://lore.kernel.org/r/20231124171645.1011043-2-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/net/ipsec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/net/ipsec.c b/tools/testing/selftests/net/ipsec.c
index 17ced7d6ce25..03b048b66831 100644
--- a/tools/testing/selftests/net/ipsec.c
+++ b/tools/testing/selftests/net/ipsec.c
@@ -2117,7 +2117,7 @@ static int check_results(void)
 
 int main(int argc, char **argv)
 {
-	unsigned int nr_process = 1;
+	long nr_process = 1;
 	int route_sock = -1, ret = KSFT_SKIP;
 	int test_desc_fd[2];
 	uint32_t route_seq;
@@ -2138,7 +2138,7 @@ int main(int argc, char **argv)
 			exit_usage(argv);
 		}
 
-		if (nr_process > MAX_PROCESSES || !nr_process) {
+		if (nr_process > MAX_PROCESSES || nr_process < 1) {
 			printk("nr_process should be between [1; %u]",
 					MAX_PROCESSES);
 			exit_usage(argv);

From f18bcace1294ac8ce7092d4b42ae9d0abaa1d9bc Mon Sep 17 00:00:00 2001
From: Willem de Bruijn <willemb@google.com>
Date: Fri, 24 Nov 2023 12:15:22 -0500
Subject: [PATCH 0770/1043] selftests/net: mptcp: fix uninitialized variable
 warnings

[ Upstream commit 00a4f8fd9c750f20d8fd4535c71c9caa7ef5ff2f ]

Same init_rng() in both tests. The function reads /dev/urandom to
initialize srand(). In case of failure, it falls back onto the
entropy in the uninitialized variable. Not sure if this is on purpose.
But failure reading urandom should be rare, so just fail hard. While
at it, convert to getrandom(). Which man 4 random suggests is simpler
and more robust.

    mptcp_inq.c:525:6:
    mptcp_connect.c:1131:6:

    error: variable 'foo' is used uninitialized
    whenever 'if' condition is false
    [-Werror,-Wsometimes-uninitialized]

Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp")
Fixes: b51880568f20 ("selftests: mptcp: add inq test case")
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Willem de Bruijn <willemb@google.com>

----

When input is randomized because this is expected to meaningfully
explore edge cases, should we also add
1. logging the random seed to stdout and
2. adding a command line argument to replay from a specific seed
I can do this in net-next, if authors find it useful in this case.
Reviewed-by: Matthieu Baerts <matttbe@kernel.org>

Link: https://lore.kernel.org/r/20231124171645.1011043-5-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/net/mptcp/mptcp_connect.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c
index 77bb62feb872..37c1ec888ba2 100644
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
@@ -15,6 +15,7 @@
 #include <unistd.h>
 
 #include <sys/poll.h>
+#include <sys/random.h>
 #include <sys/sendfile.h>
 #include <sys/stat.h>
 #include <sys/socket.h>
@@ -734,15 +735,11 @@ int main_loop_s(int listensock)
 
 static void init_rng(void)
 {
-	int fd = open("/dev/urandom", O_RDONLY);
 	unsigned int foo;
 
-	if (fd > 0) {
-		int ret = read(fd, &foo, sizeof(foo));
-
-		if (ret < 0)
-			srand(fd + foo);
-		close(fd);
+	if (getrandom(&foo, sizeof(foo), 0) == -1) {
+		perror("getrandom");
+		exit(1);
 	}
 
 	srand(foo);

From ef7af2105a259ec2f31471287ada376e3ee2f4f6 Mon Sep 17 00:00:00 2001
From: Furong Xu <0x1207@gmail.com>
Date: Sat, 25 Nov 2023 14:01:26 +0800
Subject: [PATCH 0771/1043] net: stmmac: xgmac: Disable FPE MMC interrupts

[ Upstream commit e54d628a2721bfbb002c19f6e8ca6746cec7640f ]

Commit aeb18dd07692 ("net: stmmac: xgmac: Disable MMC interrupts
by default") tries to disable MMC interrupts to avoid a storm of
unhandled interrupts, but leaves the FPE(Frame Preemption) MMC
interrupts enabled, FPE MMC interrupts can cause the same problem.
Now we mask FPE TX and RX interrupts to disable all MMC interrupts.

Fixes: aeb18dd07692 ("net: stmmac: xgmac: Disable MMC interrupts by default")
Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
Signed-off-by: Furong Xu <0x1207@gmail.com>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Link: https://lore.kernel.org/r/20231125060126.2328690-1-0x1207@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
index a57b0fa815ab..a510bac0b825 100644
--- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
@@ -177,8 +177,10 @@
 #define MMC_XGMAC_RX_DISCARD_OCT_GB	0x1b4
 #define MMC_XGMAC_RX_ALIGN_ERR_PKT	0x1bc
 
+#define MMC_XGMAC_TX_FPE_INTR_MASK	0x204
 #define MMC_XGMAC_TX_FPE_FRAG		0x208
 #define MMC_XGMAC_TX_HOLD_REQ		0x20c
+#define MMC_XGMAC_RX_FPE_INTR_MASK	0x224
 #define MMC_XGMAC_RX_PKT_ASSEMBLY_ERR	0x228
 #define MMC_XGMAC_RX_PKT_SMD_ERR	0x22c
 #define MMC_XGMAC_RX_PKT_ASSEMBLY_OK	0x230
@@ -352,6 +354,8 @@ static void dwxgmac_mmc_intr_all_mask(void __iomem *mmcaddr)
 {
 	writel(0x0, mmcaddr + MMC_RX_INTR_MASK);
 	writel(0x0, mmcaddr + MMC_TX_INTR_MASK);
+	writel(MMC_DEFAULT_MASK, mmcaddr + MMC_XGMAC_TX_FPE_INTR_MASK);
+	writel(MMC_DEFAULT_MASK, mmcaddr + MMC_XGMAC_RX_FPE_INTR_MASK);
 	writel(MMC_DEFAULT_MASK, mmcaddr + MMC_XGMAC_RX_IPC_INTR_MASK);
 }
 

From 72ce3379cd5e6105657dcb23576e80ba5d276f35 Mon Sep 17 00:00:00 2001
From: Geetha sowjanya <gakula@marvell.com>
Date: Sat, 25 Nov 2023 22:04:02 +0530
Subject: [PATCH 0772/1043] octeontx2-pf: Fix adding mbox work queue entry when
 num_vfs > 64

[ Upstream commit 51597219e0cd5157401d4d0ccb5daa4d9961676f ]

When more than 64 VFs are enabled for a PF then mbox communication
between VF and PF is not working as mbox work queueing for few VFs
are skipped due to wrong calculation of VF numbers.

Fixes: d424b6c02415 ("octeontx2-pf: Enable SRIOV and added VF mbox handling")
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Link: https://lore.kernel.org/r/1700930042-5400-1-git-send-email-sbhatta@marvell.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
index 000dd89c4baf..d6f7a2a58aee 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
@@ -556,7 +556,9 @@ static irqreturn_t otx2_pfvf_mbox_intr_handler(int irq, void *pf_irq)
 		otx2_write64(pf, RVU_PF_VFPF_MBOX_INTX(1), intr);
 		otx2_queue_work(mbox, pf->mbox_pfvf_wq, 64, vfs, intr,
 				TYPE_PFVF);
-		vfs -= 64;
+		if (intr)
+			trace_otx2_msg_interrupt(mbox->mbox.pdev, "VF(s) to PF", intr);
+		vfs = 64;
 	}
 
 	intr = otx2_read64(pf, RVU_PF_VFPF_MBOX_INTX(0));
@@ -564,7 +566,8 @@ static irqreturn_t otx2_pfvf_mbox_intr_handler(int irq, void *pf_irq)
 
 	otx2_queue_work(mbox, pf->mbox_pfvf_wq, 0, vfs, intr, TYPE_PFVF);
 
-	trace_otx2_msg_interrupt(mbox->mbox.pdev, "VF(s) to PF", intr);
+	if (intr)
+		trace_otx2_msg_interrupt(mbox->mbox.pdev, "VF(s) to PF", intr);
 
 	return IRQ_HANDLED;
 }

From 8a909c119827b452fc62d366d3ffd19d5d0acb71 Mon Sep 17 00:00:00 2001
From: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Date: Thu, 19 May 2022 09:47:28 -0400
Subject: [PATCH 0773/1043] Revert "workqueue: remove unused cancel_work()"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 73b4b53276a1d6290cd4f47dbbc885b6e6e59ac6 ]

This reverts commit 6417250d3f894e66a68ba1cd93676143f2376a6f.

amdpgu need this function in order to prematurly stop pending
reset works when another reset work already in progress.

Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Reviewed-by: Lai Jiangshan<jiangshanlai@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: 91d3d149978b ("r8169: prevent potential deadlock in rtl8169_close")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/workqueue.h | 1 +
 kernel/workqueue.c        | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
index 460c58fa011a..0383fac637e1 100644
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -460,6 +460,7 @@ extern int schedule_on_each_cpu(work_func_t func);
 int execute_in_process_context(work_func_t fn, struct execute_work *);
 
 extern bool flush_work(struct work_struct *work);
+extern bool cancel_work(struct work_struct *work);
 extern bool cancel_work_sync(struct work_struct *work);
 
 extern bool flush_delayed_work(struct delayed_work *dwork);
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 37d01e44d483..63140e4dd5df 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3240,6 +3240,15 @@ static bool __cancel_work(struct work_struct *work, bool is_dwork)
 	return ret;
 }
 
+/*
+ * See cancel_delayed_work()
+ */
+bool cancel_work(struct work_struct *work)
+{
+	return __cancel_work(work, false);
+}
+EXPORT_SYMBOL(cancel_work);
+
 /**
  * cancel_delayed_work - cancel a delayed work
  * @dwork: delayed_work to cancel

From a36e00e957a2f565e8e762a347cca9bbfaff5522 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Sun, 26 Nov 2023 23:01:02 +0100
Subject: [PATCH 0774/1043] r8169: prevent potential deadlock in rtl8169_close

[ Upstream commit 91d3d149978ba7b238198dd80e4b823756aa7cfa ]

ndo_stop() is RTNL-protected by net core, and the worker function takes
RTNL as well. Therefore we will deadlock when trying to execute a
pending work synchronously. To fix this execute any pending work
asynchronously. This will do no harm because netif_running() is false
in ndo_stop(), and therefore the work function is effectively a no-op.
However we have to ensure that no task is running or pending after
rtl_remove_one(), therefore add a call to cancel_work_sync().

Fixes: abe5fc42f9ce ("r8169: use RTNL to protect critical sections")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/12395867-1d17-4cac-aa7d-c691938fcddf@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index ab6af1f1ad5b..d33720f68c67 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -4769,7 +4769,7 @@ static int rtl8169_close(struct net_device *dev)
 	rtl8169_down(tp);
 	rtl8169_rx_clear(tp);
 
-	cancel_work_sync(&tp->wk.work);
+	cancel_work(&tp->wk.work);
 
 	free_irq(pci_irq_vector(pdev, 0), tp);
 
@@ -5035,6 +5035,8 @@ static void rtl_remove_one(struct pci_dev *pdev)
 	if (pci_dev_run_wake(pdev))
 		pm_runtime_get_noresume(&pdev->dev);
 
+	cancel_work_sync(&tp->wk.work);
+
 	unregister_netdev(tp->dev);
 
 	if (r8168_check_dash(tp))

From f78d0f301395018162f3916a9ce57c41c8898891 Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Mon, 27 Nov 2023 21:24:20 +0900
Subject: [PATCH 0775/1043] ravb: Fix races between ravb_tx_timeout_work() and
 net related ops

[ Upstream commit 9870257a0a338cd8d6c1cddab74e703f490f6779 ]

Fix races between ravb_tx_timeout_work() and functions of net_device_ops
and ethtool_ops by using rtnl_trylock() and rtnl_unlock(). Note that
since ravb_close() is under the rtnl lock and calls cancel_work_sync(),
ravb_tx_timeout_work() should calls rtnl_trylock(). Otherwise, a deadlock
may happen in ravb_tx_timeout_work() like below:

CPU0			CPU1
			ravb_tx_timeout()
			schedule_work()
...
__dev_close_many()
// Under rtnl lock
ravb_close()
cancel_work_sync()
// Waiting
			ravb_tx_timeout_work()
			rtnl_lock()
			// This is possible to cause a deadlock

If rtnl_trylock() fails, rescheduling the work with sleep for 1 msec.

Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/20231127122420.3706751-1-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/renesas/ravb_main.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index f218bacec001..9d4a35f006c6 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1438,6 +1438,12 @@ static void ravb_tx_timeout_work(struct work_struct *work)
 	struct net_device *ndev = priv->ndev;
 	int error;
 
+	if (!rtnl_trylock()) {
+		usleep_range(1000, 2000);
+		schedule_work(&priv->work);
+		return;
+	}
+
 	netif_tx_stop_all_queues(ndev);
 
 	/* Stop PTP Clock driver */
@@ -1470,7 +1476,7 @@ static void ravb_tx_timeout_work(struct work_struct *work)
 		 */
 		netdev_err(ndev, "%s: ravb_dmac_init() failed, error %d\n",
 			   __func__, error);
-		return;
+		goto out_unlock;
 	}
 	ravb_emac_init(ndev);
 
@@ -1480,6 +1486,9 @@ static void ravb_tx_timeout_work(struct work_struct *work)
 		ravb_ptp_init(ndev, priv->pdev);
 
 	netif_tx_start_all_queues(ndev);
+
+out_unlock:
+	rtnl_unlock();
 }
 
 /* Packet transmit function for Ethernet AVB */

From 5d428cda38e86f9e3e4e420e044754b770edae45 Mon Sep 17 00:00:00 2001
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Date: Tue, 28 Nov 2023 10:04:35 +0200
Subject: [PATCH 0776/1043] net: ravb: Use pm_runtime_resume_and_get()

[ Upstream commit 88b74831faaee455c2af380382d979fc38e79270 ]

pm_runtime_get_sync() may return an error. In case it returns with an error
dev->power.usage_count needs to be decremented. pm_runtime_resume_and_get()
takes care of this. Thus use it.

Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/renesas/ravb_main.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 9d4a35f006c6..a9cd390dedbd 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -2072,7 +2072,9 @@ static int ravb_probe(struct platform_device *pdev)
 	ndev->hw_features = NETIF_F_RXCSUM;
 
 	pm_runtime_enable(&pdev->dev);
-	pm_runtime_get_sync(&pdev->dev);
+	error = pm_runtime_resume_and_get(&pdev->dev);
+	if (error < 0)
+		goto out_rpm_disable;
 
 	/* The Ether-specific entries in the device structure. */
 	ndev->base_addr = res->start;
@@ -2247,6 +2249,7 @@ static int ravb_probe(struct platform_device *pdev)
 	free_netdev(ndev);
 
 	pm_runtime_put(&pdev->dev);
+out_rpm_disable:
 	pm_runtime_disable(&pdev->dev);
 	return error;
 }

From 889c84e2b200cacefa965515b3d60aff1ffb0869 Mon Sep 17 00:00:00 2001
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Date: Tue, 28 Nov 2023 10:04:37 +0200
Subject: [PATCH 0777/1043] net: ravb: Start TX queues after HW initialization
 succeeded

[ Upstream commit 6f32c086602050fc11157adeafaa1c1eb393f0af ]

ravb_phy_start() may fail. If that happens, the TX queues will remain
started. Thus, move the netif_tx_start_all_queues() after PHY is
successfully initialized.

Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/renesas/ravb_main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index a9cd390dedbd..f092f468016b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1383,13 +1383,13 @@ static int ravb_open(struct net_device *ndev)
 	if (priv->chip_id == RCAR_GEN2)
 		ravb_ptp_init(ndev, priv->pdev);
 
-	netif_tx_start_all_queues(ndev);
-
 	/* PHY control start */
 	error = ravb_phy_start(ndev);
 	if (error)
 		goto out_ptp_stop;
 
+	netif_tx_start_all_queues(ndev);
+
 	return 0;
 
 out_ptp_stop:

From 8e52b19d92e1cc318bba7e1522bf9b86d99411c1 Mon Sep 17 00:00:00 2001
From: Steve French <stfrench@microsoft.com>
Date: Mon, 16 Oct 2023 12:18:23 -0500
Subject: [PATCH 0778/1043] smb3: fix touch -h of symlink

[ Upstream commit 475efd9808a3094944a56240b2711349e433fb66 ]

For example:
      touch -h -t 02011200 testfile
where testfile is a symlink would not change the timestamp, but
      touch -t 02011200 testfile
does work to change the timestamp of the target

Suggested-by: David Howells <dhowells@redhat.com>
Reported-by: Micah Veilleux <micah.veilleux@iba-group.com>
Closes: https://bugzilla.samba.org/show_bug.cgi?id=14476
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/cifsfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 0d8d7b57636f..b87d6792b14a 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1076,6 +1076,7 @@ const struct inode_operations cifs_file_inode_ops = {
 
 const struct inode_operations cifs_symlink_inode_ops = {
 	.get_link = cifs_get_link,
+	.setattr = cifs_setattr,
 	.permission = cifs_permission,
 	.listxattr = cifs_listxattr,
 };

From 6368a32d26a382570bedad9609a654cc3dcd815b Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Mon, 18 Oct 2021 16:33:22 +0200
Subject: [PATCH 0779/1043] ASoC: Intel: Move soc_intel_is_foo() helpers to a
 generic header

[ Upstream commit cd45c9bf8b43cd387e167cf166ae5c517f56d658 ]

The soc_intel_is_foo() helpers from
sound/soc/intel/common/soc-intel-quirks.h are useful outside of the
sound subsystem too.

Move these to include/linux/platform_data/x86/soc.h, so that
other code can use them too.

Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Acked-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20211018143324.296961-2-hdegoede@redhat.com
Stable-dep-of: 7dd692217b86 ("ASoC: SOF: sof-pci-dev: Fix community key quirk detection")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/platform_data/x86/soc.h     | 65 +++++++++++++++++++++++
 sound/soc/intel/common/soc-intel-quirks.h | 51 ++----------------
 2 files changed, 68 insertions(+), 48 deletions(-)
 create mode 100644 include/linux/platform_data/x86/soc.h

diff --git a/include/linux/platform_data/x86/soc.h b/include/linux/platform_data/x86/soc.h
new file mode 100644
index 000000000000..da05f425587a
--- /dev/null
+++ b/include/linux/platform_data/x86/soc.h
@@ -0,0 +1,65 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Helpers for Intel SoC model detection
+ *
+ * Copyright (c) 2019, Intel Corporation.
+ */
+
+#ifndef __PLATFORM_DATA_X86_SOC_H
+#define __PLATFORM_DATA_X86_SOC_H
+
+#if IS_ENABLED(CONFIG_X86)
+
+#include <asm/cpu_device_id.h>
+#include <asm/intel-family.h>
+
+#define SOC_INTEL_IS_CPU(soc, type)				\
+static inline bool soc_intel_is_##soc(void)			\
+{								\
+	static const struct x86_cpu_id soc##_cpu_ids[] = {	\
+		X86_MATCH_INTEL_FAM6_MODEL(type, NULL),		\
+		{}						\
+	};							\
+	const struct x86_cpu_id *id;				\
+								\
+	id = x86_match_cpu(soc##_cpu_ids);			\
+	if (id)							\
+		return true;					\
+	return false;						\
+}
+
+SOC_INTEL_IS_CPU(byt, ATOM_SILVERMONT);
+SOC_INTEL_IS_CPU(cht, ATOM_AIRMONT);
+SOC_INTEL_IS_CPU(apl, ATOM_GOLDMONT);
+SOC_INTEL_IS_CPU(glk, ATOM_GOLDMONT_PLUS);
+SOC_INTEL_IS_CPU(cml, KABYLAKE_L);
+
+#else /* IS_ENABLED(CONFIG_X86) */
+
+static inline bool soc_intel_is_byt(void)
+{
+	return false;
+}
+
+static inline bool soc_intel_is_cht(void)
+{
+	return false;
+}
+
+static inline bool soc_intel_is_apl(void)
+{
+	return false;
+}
+
+static inline bool soc_intel_is_glk(void)
+{
+	return false;
+}
+
+static inline bool soc_intel_is_cml(void)
+{
+	return false;
+}
+#endif /* IS_ENABLED(CONFIG_X86) */
+
+#endif /* __PLATFORM_DATA_X86_SOC_H */
diff --git a/sound/soc/intel/common/soc-intel-quirks.h b/sound/soc/intel/common/soc-intel-quirks.h
index a93987ab7f4d..de4e550c5b34 100644
--- a/sound/soc/intel/common/soc-intel-quirks.h
+++ b/sound/soc/intel/common/soc-intel-quirks.h
@@ -9,34 +9,13 @@
 #ifndef _SND_SOC_INTEL_QUIRKS_H
 #define _SND_SOC_INTEL_QUIRKS_H
 
+#include <linux/platform_data/x86/soc.h>
+
 #if IS_ENABLED(CONFIG_X86)
 
 #include <linux/dmi.h>
-#include <asm/cpu_device_id.h>
-#include <asm/intel-family.h>
 #include <asm/iosf_mbi.h>
 
-#define SOC_INTEL_IS_CPU(soc, type)				\
-static inline bool soc_intel_is_##soc(void)			\
-{								\
-	static const struct x86_cpu_id soc##_cpu_ids[] = {	\
-		X86_MATCH_INTEL_FAM6_MODEL(type, NULL),		\
-		{}						\
-	};							\
-	const struct x86_cpu_id *id;				\
-								\
-	id = x86_match_cpu(soc##_cpu_ids);			\
-	if (id)							\
-		return true;					\
-	return false;						\
-}
-
-SOC_INTEL_IS_CPU(byt, ATOM_SILVERMONT);
-SOC_INTEL_IS_CPU(cht, ATOM_AIRMONT);
-SOC_INTEL_IS_CPU(apl, ATOM_GOLDMONT);
-SOC_INTEL_IS_CPU(glk, ATOM_GOLDMONT_PLUS);
-SOC_INTEL_IS_CPU(cml, KABYLAKE_L);
-
 static inline bool soc_intel_is_byt_cr(struct platform_device *pdev)
 {
 	/*
@@ -114,30 +93,6 @@ static inline bool soc_intel_is_byt_cr(struct platform_device *pdev)
 	return false;
 }
 
-static inline bool soc_intel_is_byt(void)
-{
-	return false;
-}
-
-static inline bool soc_intel_is_cht(void)
-{
-	return false;
-}
-
-static inline bool soc_intel_is_apl(void)
-{
-	return false;
-}
-
-static inline bool soc_intel_is_glk(void)
-{
-	return false;
-}
-
-static inline bool soc_intel_is_cml(void)
-{
-	return false;
-}
 #endif
 
- #endif /* _SND_SOC_INTEL_QUIRKS_H */
+#endif /* _SND_SOC_INTEL_QUIRKS_H */

From 4aeb3320d70ecea66df0e01203c7fd4375f23a80 Mon Sep 17 00:00:00 2001
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Date: Fri, 19 Nov 2021 17:13:27 -0600
Subject: [PATCH 0780/1043] ASoC: SOF: sof-pci-dev: use community key on all Up
 boards
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 405e52f412b85b581899f5e1b82d25a7c8959d89 ]

There are already 3 versions of the Up boards with support for the SOF
community key (ApolloLake, WhiskyLake, TigerLake). Rather than
continue to add quirks for each version, let's add a wildcard.

For WHL and TGL, the authentication supports both the SOF community
key and the firmware signed with the Intel production key. Given two
choices, the community key is the preferred option to allow developers
to sign their own firmware. The firmware signed with production key
can still be selected if needed with a kernel module
option (snd-sof-pci.fw_path="intel/sof")

Tested-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://lore.kernel.org/r/20211119231327.211946-1-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 7dd692217b86 ("ASoC: SOF: sof-pci-dev: Fix community key quirk detection")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sof/sof-pci-dev.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c
index fe9feaab6a0a..571dc679ff7c 100644
--- a/sound/soc/sof/sof-pci-dev.c
+++ b/sound/soc/sof/sof-pci-dev.c
@@ -59,17 +59,9 @@ static const struct dmi_system_id sof_tplg_table[] = {
 
 static const struct dmi_system_id community_key_platforms[] = {
 	{
-		.ident = "Up Squared",
+		.ident = "Up boards",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "AAEON"),
-			DMI_MATCH(DMI_BOARD_NAME, "UP-APL01"),
-		}
-	},
-	{
-		.ident = "Up Extreme",
-		.matches = {
-			DMI_MATCH(DMI_SYS_VENDOR, "AAEON"),
-			DMI_MATCH(DMI_BOARD_NAME, "UP-WHL01"),
 		}
 	},
 	{

From 3a79fcb743f77cf9cc22041e3788a09428dd2a8e Mon Sep 17 00:00:00 2001
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Date: Thu, 14 Apr 2022 13:48:08 -0500
Subject: [PATCH 0781/1043] ASoC: SOF: sof-pci-dev: add parameter to override
 topology filename
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 772627acfeb0e670ede534b7d5502dae9668d3ee ]

The existing 'tplg_path' module parameter can be used to load
alternate firmware files, be it for development or to handle
OEM-specific or board-specific releases. However the topology filename
is either hard-coded in machine descriptors or modified by specific
DMI-quirks.

For additional flexibility, this patch adds the 'tplg_filename' module
parameter to override topology names.

To avoid any confusion between DMI- and parameter-override, a variable
rename is added.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Reviewed-by: Paul Olaru <paul.olaru@oss.nxp.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://lore.kernel.org/r/20220414184817.362215-7-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 7dd692217b86 ("ASoC: SOF: sof-pci-dev: Fix community key quirk detection")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sof/sof-pci-dev.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c
index 571dc679ff7c..966bf2840347 100644
--- a/sound/soc/sof/sof-pci-dev.c
+++ b/sound/soc/sof/sof-pci-dev.c
@@ -31,17 +31,21 @@ static char *tplg_path;
 module_param(tplg_path, charp, 0444);
 MODULE_PARM_DESC(tplg_path, "alternate path for SOF topology.");
 
+static char *tplg_filename;
+module_param(tplg_filename, charp, 0444);
+MODULE_PARM_DESC(tplg_filename, "alternate filename for SOF topology.");
+
 static int sof_pci_debug;
 module_param_named(sof_pci_debug, sof_pci_debug, int, 0444);
 MODULE_PARM_DESC(sof_pci_debug, "SOF PCI debug options (0x0 all off)");
 
-static const char *sof_override_tplg_name;
+static const char *sof_dmi_override_tplg_name;
 
 #define SOF_PCI_DISABLE_PM_RUNTIME BIT(0)
 
 static int sof_tplg_cb(const struct dmi_system_id *id)
 {
-	sof_override_tplg_name = id->driver_data;
+	sof_dmi_override_tplg_name = id->driver_data;
 	return 1;
 }
 
@@ -391,9 +395,20 @@ static int sof_pci_probe(struct pci_dev *pci,
 		sof_pdata->tplg_filename_prefix =
 			sof_pdata->desc->default_tplg_path;
 
-	dmi_check_system(sof_tplg_table);
-	if (sof_override_tplg_name)
-		sof_pdata->tplg_filename = sof_override_tplg_name;
+	/*
+	 * the topology filename will be provided in the machine descriptor, unless
+	 * it is overridden by a module parameter or DMI quirk.
+	 */
+	if (tplg_filename) {
+		sof_pdata->tplg_filename = tplg_filename;
+
+		dev_dbg(dev, "Module parameter used, changed tplg filename to %s\n",
+			sof_pdata->tplg_filename);
+	} else {
+		dmi_check_system(sof_tplg_table);
+		if (sof_dmi_override_tplg_name)
+			sof_pdata->tplg_filename = sof_dmi_override_tplg_name;
+	}
 
 #if IS_ENABLED(CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE)
 	/* set callback to enable runtime_pm */

From b37e1fbe6d305a2fedeb9471305218b5bfec5cc4 Mon Sep 17 00:00:00 2001
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Date: Thu, 21 Apr 2022 11:33:55 -0500
Subject: [PATCH 0782/1043] ASoC: SOF: sof-pci-dev: don't use the community key
 on APL Chromebooks

[ Upstream commit d81e4ba5ef1c1033b6c720b22fc99feeb71e71a0 ]

As suggested by MrChromebox, the SOF driver can be used with the SOF
firmware binary signed with the production key. This patch adds an
additional check for the ApolloLake SoC before modifying the default
firmware path.

Note that ApolloLake Chromebooks officially ship with the Skylake
driver, so to use SOF the users have to explicitly opt-in with
'options intel-dspcfg dsp_driver=3'. There is no plan to change the
default selection.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20220421163358.319489-2-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 7dd692217b86 ("ASoC: SOF: sof-pci-dev: Fix community key quirk detection")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sof/sof-pci-dev.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c
index 966bf2840347..42e1a62789bc 100644
--- a/sound/soc/sof/sof-pci-dev.c
+++ b/sound/soc/sof/sof-pci-dev.c
@@ -12,6 +12,7 @@
 #include <linux/dmi.h>
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/platform_data/x86/soc.h>
 #include <linux/pm_runtime.h>
 #include <sound/intel-dsp-config.h>
 #include <sound/soc-acpi.h>
@@ -40,6 +41,7 @@ module_param_named(sof_pci_debug, sof_pci_debug, int, 0444);
 MODULE_PARM_DESC(sof_pci_debug, "SOF PCI debug options (0x0 all off)");
 
 static const char *sof_dmi_override_tplg_name;
+static bool sof_dmi_use_community_key;
 
 #define SOF_PCI_DISABLE_PM_RUNTIME BIT(0)
 
@@ -61,15 +63,35 @@ static const struct dmi_system_id sof_tplg_table[] = {
 	{}
 };
 
+/* all Up boards use the community key */
+static int up_use_community_key(const struct dmi_system_id *id)
+{
+	sof_dmi_use_community_key = true;
+	return 1;
+}
+
+/*
+ * For ApolloLake Chromebooks we want to force the use of the Intel production key.
+ * All newer platforms use the community key
+ */
+static int chromebook_use_community_key(const struct dmi_system_id *id)
+{
+	if (!soc_intel_is_apl())
+		sof_dmi_use_community_key = true;
+	return 1;
+}
+
 static const struct dmi_system_id community_key_platforms[] = {
 	{
 		.ident = "Up boards",
+		.callback = up_use_community_key,
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "AAEON"),
 		}
 	},
 	{
 		.ident = "Google Chromebooks",
+		.callback = chromebook_use_community_key,
 		.matches = {
 			DMI_MATCH(DMI_PRODUCT_FAMILY, "Google"),
 		}
@@ -375,7 +397,7 @@ static int sof_pci_probe(struct pci_dev *pci,
 			"Module parameter used, changed fw path to %s\n",
 			sof_pdata->fw_filename_prefix);
 
-	} else if (dmi_check_system(community_key_platforms)) {
+	} else if (dmi_check_system(community_key_platforms) && sof_dmi_use_community_key) {
 		sof_pdata->fw_filename_prefix =
 			devm_kasprintf(dev, GFP_KERNEL, "%s/%s",
 				       sof_pdata->desc->default_fw_path,

From cb420e35571cb056df9bd86b00f7961b878ba7f7 Mon Sep 17 00:00:00 2001
From: Mark Hasemeyer <markhas@chromium.org>
Date: Fri, 20 Oct 2023 14:59:53 -0600
Subject: [PATCH 0783/1043] ASoC: SOF: sof-pci-dev: Fix community key quirk
 detection

[ Upstream commit 7dd692217b861a8292ff8ac2c9d4458538fd6b96 ]

Some Chromebooks do not populate the product family DMI value resulting
in firmware load failures.

Add another quirk detection entry that looks for "Google" in the BIOS
version. Theoretically, PRODUCT_FAMILY could be replaced with
BIOS_VERSION, but it is left as a quirk to be conservative.

Cc: stable@vger.kernel.org
Signed-off-by: Mark Hasemeyer <markhas@chromium.org>
Acked-by: Curtis Malainey <cujomalainey@chromium.org>
Link: https://lore.kernel.org/r/20231020145953.v1.1.Iaf5702dc3f8af0fd2f81a22ba2da1a5e15b3604c@changeid
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sof/sof-pci-dev.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c
index 42e1a62789bc..ade292a61ed6 100644
--- a/sound/soc/sof/sof-pci-dev.c
+++ b/sound/soc/sof/sof-pci-dev.c
@@ -96,6 +96,13 @@ static const struct dmi_system_id community_key_platforms[] = {
 			DMI_MATCH(DMI_PRODUCT_FAMILY, "Google"),
 		}
 	},
+	{
+		.ident = "Google firmware",
+		.callback = chromebook_use_community_key,
+		.matches = {
+			DMI_MATCH(DMI_BIOS_VERSION, "Google"),
+		}
+	},
 	{},
 };
 

From 03e07092c6ce8e9ae77141e42d65bf4b641fec8d Mon Sep 17 00:00:00 2001
From: Alexander Gordeev <agordeev@linux.ibm.com>
Date: Mon, 29 Mar 2021 18:32:55 +0200
Subject: [PATCH 0784/1043] s390/mm: fix phys vs virt confusion in
 mark_kernel_pXd() functions family

[ Upstream commit 3784231b1e091857bd129fd9658a8b3cedbdcd58 ]

Due to historical reasons mark_kernel_pXd() functions
misuse the notion of physical vs virtual addresses
difference.

Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Stable-dep-of: 44d930452476 ("s390/cmma: fix detection of DAT pages")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/mm/page-states.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/s390/mm/page-states.c b/arch/s390/mm/page-states.c
index 567c69f3069e..7f0e154a470a 100644
--- a/arch/s390/mm/page-states.c
+++ b/arch/s390/mm/page-states.c
@@ -112,7 +112,7 @@ static void mark_kernel_pmd(pud_t *pud, unsigned long addr, unsigned long end)
 		next = pmd_addr_end(addr, end);
 		if (pmd_none(*pmd) || pmd_large(*pmd))
 			continue;
-		page = virt_to_page(pmd_val(*pmd));
+		page = phys_to_page(pmd_val(*pmd));
 		set_bit(PG_arch_1, &page->flags);
 	} while (pmd++, addr = next, addr != end);
 }
@@ -130,7 +130,7 @@ static void mark_kernel_pud(p4d_t *p4d, unsigned long addr, unsigned long end)
 		if (pud_none(*pud) || pud_large(*pud))
 			continue;
 		if (!pud_folded(*pud)) {
-			page = virt_to_page(pud_val(*pud));
+			page = phys_to_page(pud_val(*pud));
 			for (i = 0; i < 3; i++)
 				set_bit(PG_arch_1, &page[i].flags);
 		}
@@ -151,7 +151,7 @@ static void mark_kernel_p4d(pgd_t *pgd, unsigned long addr, unsigned long end)
 		if (p4d_none(*p4d))
 			continue;
 		if (!p4d_folded(*p4d)) {
-			page = virt_to_page(p4d_val(*p4d));
+			page = phys_to_page(p4d_val(*p4d));
 			for (i = 0; i < 3; i++)
 				set_bit(PG_arch_1, &page[i].flags);
 		}
@@ -173,7 +173,7 @@ static void mark_kernel_pgd(void)
 		if (pgd_none(*pgd))
 			continue;
 		if (!pgd_folded(*pgd)) {
-			page = virt_to_page(pgd_val(*pgd));
+			page = phys_to_page(pgd_val(*pgd));
 			for (i = 0; i < 3; i++)
 				set_bit(PG_arch_1, &page[i].flags);
 		}

From c922282d11b31f4d6baa65e20be75a0bbca14669 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@linux.ibm.com>
Date: Tue, 24 Oct 2023 10:15:19 +0200
Subject: [PATCH 0785/1043] s390/cmma: fix detection of DAT pages

[ Upstream commit 44d93045247661acbd50b1629e62f415f2747577 ]

If the cmma no-dat feature is available the kernel page tables are walked
to identify and mark all pages which are used for address translation (all
region, segment, and page tables). In a subsequent loop all other pages are
marked as "no-dat" pages with the ESSA instruction.

This information is visible to the hypervisor, so that the hypervisor can
optimize purging of guest TLB entries. The initial loop however is
incorrect: only the first three of the four pages which belong to segment
and region tables will be marked as being used for DAT. The last page is
incorrectly marked as no-dat.

This can result in incorrect guest TLB flushes.

Fix this by simply marking all four pages.

Cc: <stable@vger.kernel.org>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/mm/page-states.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/s390/mm/page-states.c b/arch/s390/mm/page-states.c
index 7f0e154a470a..4e5312fa2c53 100644
--- a/arch/s390/mm/page-states.c
+++ b/arch/s390/mm/page-states.c
@@ -131,7 +131,7 @@ static void mark_kernel_pud(p4d_t *p4d, unsigned long addr, unsigned long end)
 			continue;
 		if (!pud_folded(*pud)) {
 			page = phys_to_page(pud_val(*pud));
-			for (i = 0; i < 3; i++)
+			for (i = 0; i < 4; i++)
 				set_bit(PG_arch_1, &page[i].flags);
 		}
 		mark_kernel_pmd(pud, addr, next);
@@ -152,7 +152,7 @@ static void mark_kernel_p4d(pgd_t *pgd, unsigned long addr, unsigned long end)
 			continue;
 		if (!p4d_folded(*p4d)) {
 			page = phys_to_page(p4d_val(*p4d));
-			for (i = 0; i < 3; i++)
+			for (i = 0; i < 4; i++)
 				set_bit(PG_arch_1, &page[i].flags);
 		}
 		mark_kernel_pud(p4d, addr, next);
@@ -174,7 +174,7 @@ static void mark_kernel_pgd(void)
 			continue;
 		if (!pgd_folded(*pgd)) {
 			page = phys_to_page(pgd_val(*pgd));
-			for (i = 0; i < 3; i++)
+			for (i = 0; i < 4; i++)
 				set_bit(PG_arch_1, &page[i].flags);
 		}
 		mark_kernel_p4d(pgd, addr, next);

From a6128ad78771bb6c7c59a1ef66945726c1361ea6 Mon Sep 17 00:00:00 2001
From: Kishon Vijay Abraham I <kishon@ti.com>
Date: Wed, 11 Aug 2021 18:03:36 +0530
Subject: [PATCH 0786/1043] misc: pci_endpoint_test: Add deviceID for AM64 and
 J7200

[ Upstream commit 7c52009d94ab561e70cb72e007a6076f20451f85 ]

Add device ID specific to AM64 and J7200 in pci_endpoint_test so that
endpoints configured with those deviceIDs can use pci_endpoint_test
driver.

Link: https://lore.kernel.org/r/20210811123336.31357-6-kishon@ti.com
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Stable-dep-of: 8293703a492a ("misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/pci_endpoint_test.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index b4a07a166605..9832c2966c11 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -70,6 +70,8 @@
 
 #define PCI_DEVICE_ID_TI_J721E			0xb00d
 #define PCI_DEVICE_ID_TI_AM654			0xb00c
+#define PCI_DEVICE_ID_TI_J7200			0xb00f
+#define PCI_DEVICE_ID_TI_AM64			0xb010
 #define PCI_DEVICE_ID_LS1088A			0x80c0
 
 #define is_am654_pci_dev(pdev)		\
@@ -1000,6 +1002,12 @@ static const struct pci_device_id pci_endpoint_test_tbl[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E),
 	  .driver_data = (kernel_ulong_t)&j721e_data,
 	},
+	{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J7200),
+	  .driver_data = (kernel_ulong_t)&j721e_data,
+	},
+	{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_AM64),
+	  .driver_data = (kernel_ulong_t)&j721e_data,
+	},
 	{ }
 };
 MODULE_DEVICE_TABLE(pci, pci_endpoint_test_tbl);

From 15bc430fc176e918f859579aaeed0280d48e8ff5 Mon Sep 17 00:00:00 2001
From: Siddharth Vadapalli <s-vadapalli@ti.com>
Date: Fri, 20 Oct 2023 17:32:48 +0530
Subject: [PATCH 0787/1043] misc: pci_endpoint_test: Add deviceID for J721S2
 PCIe EP device support

[ Upstream commit 8293703a492ae97c86af27c75b76e6239ec86483 ]

Add DEVICE_ID for J721S2 and enable support for endpoints configured
with this DEVICE_ID in the pci_endpoint_test driver.

Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Cc: stable <stable@kernel.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20231020120248.3168406-1-s-vadapalli@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/pci_endpoint_test.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index 9832c2966c11..cdb9a55a2c70 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -72,6 +72,7 @@
 #define PCI_DEVICE_ID_TI_AM654			0xb00c
 #define PCI_DEVICE_ID_TI_J7200			0xb00f
 #define PCI_DEVICE_ID_TI_AM64			0xb010
+#define PCI_DEVICE_ID_TI_J721S2		0xb013
 #define PCI_DEVICE_ID_LS1088A			0x80c0
 
 #define is_am654_pci_dev(pdev)		\
@@ -1008,6 +1009,9 @@ static const struct pci_device_id pci_endpoint_test_tbl[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_AM64),
 	  .driver_data = (kernel_ulong_t)&j721e_data,
 	},
+	{ PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721S2),
+	  .driver_data = (kernel_ulong_t)&j721e_data,
+	},
 	{ }
 };
 MODULE_DEVICE_TABLE(pci, pci_endpoint_test_tbl);

From 8a3322a35f740e189e55a697b4d6548fcf61f09c Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Fri, 27 Oct 2023 13:36:48 +0200
Subject: [PATCH 0788/1043] fbdev: stifb: Make the STI next font pointer a
 32-bit signed offset

[ Upstream commit 8a32aa17c1cd48df1ddaa78e45abcb8c7a2220d6 ]

The pointer to the next STI font is actually a signed 32-bit
offset. With this change the 64-bit kernel will correctly subract
the (signed 32-bit) offset instead of adding a (unsigned 32-bit)
offset. It has no effect on 32-bit kernels.

This fixes the stifb driver with a 64-bit kernel on qemu.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/sticore.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/sticore.h b/drivers/video/fbdev/sticore.h
index 0ebdd28a0b81..d83ab3ded5f3 100644
--- a/drivers/video/fbdev/sticore.h
+++ b/drivers/video/fbdev/sticore.h
@@ -231,7 +231,7 @@ struct sti_rom_font {
 	 u8 height;
 	 u8 font_type;		/* language type */
 	 u8 bytes_per_char;
-	u32 next_font;
+	s32 next_font;		/* note: signed int */
 	 u8 underline_height;
 	 u8 underline_pos;
 	 u8 res008[2];

From 01fbfcd8105c3ccb5ba51699a3e79182d5705da0 Mon Sep 17 00:00:00 2001
From: Amir Goldstein <amir73il@gmail.com>
Date: Thu, 5 Oct 2023 14:15:58 +0300
Subject: [PATCH 0789/1043] ima: annotate iint mutex to avoid lockdep false
 positive warnings

[ Upstream commit e044374a8a0a99e46f4e6d6751d3042b6d9cc12e ]

It is not clear that IMA should be nested at all, but as long is it
measures files both on overlayfs and on underlying fs, we need to
annotate the iint mutex to avoid lockdep false positives related to
IMA + overlayfs, same as overlayfs annotates the inode mutex.

Reported-and-tested-by: syzbot+b42fe626038981fb7bfa@syzkaller.appspotmail.com
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/integrity/iint.c | 48 ++++++++++++++++++++++++++++++---------
 1 file changed, 37 insertions(+), 11 deletions(-)

diff --git a/security/integrity/iint.c b/security/integrity/iint.c
index 9ed2d5bfbed5..b6e33ac70aef 100644
--- a/security/integrity/iint.c
+++ b/security/integrity/iint.c
@@ -66,9 +66,32 @@ struct integrity_iint_cache *integrity_iint_find(struct inode *inode)
 	return iint;
 }
 
-static void iint_free(struct integrity_iint_cache *iint)
+#define IMA_MAX_NESTING (FILESYSTEM_MAX_STACK_DEPTH+1)
+
+/*
+ * It is not clear that IMA should be nested at all, but as long is it measures
+ * files both on overlayfs and on underlying fs, we need to annotate the iint
+ * mutex to avoid lockdep false positives related to IMA + overlayfs.
+ * See ovl_lockdep_annotate_inode_mutex_key() for more details.
+ */
+static inline void iint_lockdep_annotate(struct integrity_iint_cache *iint,
+					 struct inode *inode)
+{
+#ifdef CONFIG_LOCKDEP
+	static struct lock_class_key iint_mutex_key[IMA_MAX_NESTING];
+
+	int depth = inode->i_sb->s_stack_depth;
+
+	if (WARN_ON_ONCE(depth < 0 || depth >= IMA_MAX_NESTING))
+		depth = 0;
+
+	lockdep_set_class(&iint->mutex, &iint_mutex_key[depth]);
+#endif
+}
+
+static void iint_init_always(struct integrity_iint_cache *iint,
+			     struct inode *inode)
 {
-	kfree(iint->ima_hash);
 	iint->ima_hash = NULL;
 	iint->version = 0;
 	iint->flags = 0UL;
@@ -80,6 +103,14 @@ static void iint_free(struct integrity_iint_cache *iint)
 	iint->ima_creds_status = INTEGRITY_UNKNOWN;
 	iint->evm_status = INTEGRITY_UNKNOWN;
 	iint->measured_pcrs = 0;
+	mutex_init(&iint->mutex);
+	iint_lockdep_annotate(iint, inode);
+}
+
+static void iint_free(struct integrity_iint_cache *iint)
+{
+	kfree(iint->ima_hash);
+	mutex_destroy(&iint->mutex);
 	kmem_cache_free(iint_cache, iint);
 }
 
@@ -112,6 +143,8 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode)
 	if (!iint)
 		return NULL;
 
+	iint_init_always(iint, inode);
+
 	write_lock(&integrity_iint_lock);
 
 	p = &integrity_iint_tree.rb_node;
@@ -161,25 +194,18 @@ void integrity_inode_free(struct inode *inode)
 	iint_free(iint);
 }
 
-static void init_once(void *foo)
+static void iint_init_once(void *foo)
 {
 	struct integrity_iint_cache *iint = foo;
 
 	memset(iint, 0, sizeof(*iint));
-	iint->ima_file_status = INTEGRITY_UNKNOWN;
-	iint->ima_mmap_status = INTEGRITY_UNKNOWN;
-	iint->ima_bprm_status = INTEGRITY_UNKNOWN;
-	iint->ima_read_status = INTEGRITY_UNKNOWN;
-	iint->ima_creds_status = INTEGRITY_UNKNOWN;
-	iint->evm_status = INTEGRITY_UNKNOWN;
-	mutex_init(&iint->mutex);
 }
 
 static int __init integrity_iintcache_init(void)
 {
 	iint_cache =
 	    kmem_cache_create("iint_cache", sizeof(struct integrity_iint_cache),
-			      0, SLAB_PANIC, init_once);
+			      0, SLAB_PANIC, iint_init_once);
 	return 0;
 }
 DEFINE_LSM(integrity) = {

From 2df04d76c97dfc7ec0c00a949d13049e48790903 Mon Sep 17 00:00:00 2001
From: Rajat Jain <rajatja@google.com>
Date: Mon, 24 May 2021 10:18:11 -0700
Subject: [PATCH 0790/1043] driver core: Move the "removable" attribute from
 USB to core

[ Upstream commit 70f400d4d957c2453c8689552ff212bc59f88938 ]

Move the "removable" attribute from USB to core in order to allow it to be
supported by other subsystem / buses. Individual buses that want to support
this attribute can populate the removable property of the device while
enumerating it with the 3 possible values -
 - "unknown"
 - "fixed"
 - "removable"
Leaving the field unchanged (i.e. "not supported") would mean that the
attribute would not show up in sysfs for that device. The UAPI (location,
symantics etc) for the attribute remains unchanged.

Move the "removable" attribute from USB to the device core so it can be
used by other subsystems / buses.

By default, devices do not have a "removable" attribute in sysfs.

If a subsystem or bus driver wants to support a "removable" attribute, it
should call device_set_removable() before calling device_register() or
device_add(), e.g.:

    device_set_removable(dev, DEVICE_REMOVABLE);
    device_register(dev);

The possible values and the resulting sysfs attribute contents are:

    DEVICE_REMOVABLE_UNKNOWN  ->  "unknown"
    DEVICE_REMOVABLE          ->  "removable"
    DEVICE_FIXED              ->  "fixed"

Convert the USB "removable" attribute to use this new device core
functionality.  There should be no user-visible change in the location or
semantics of attribute for USB devices.

Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Rajat Jain <rajatja@google.com>
Link: https://lore.kernel.org/r/20210524171812.18095-1-rajatja@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 432e664e7c98 ("drm/amdgpu: don't use ATRM for external devices")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/ABI/testing/sysfs-bus-usb       | 11 ------
 .../ABI/testing/sysfs-devices-removable       | 17 +++++++++
 drivers/base/core.c                           | 28 ++++++++++++++
 drivers/usb/core/hub.c                        | 13 ++++---
 drivers/usb/core/sysfs.c                      | 24 ------------
 include/linux/device.h                        | 37 +++++++++++++++++++
 include/linux/usb.h                           |  7 ----
 7 files changed, 89 insertions(+), 48 deletions(-)
 create mode 100644 Documentation/ABI/testing/sysfs-devices-removable

diff --git a/Documentation/ABI/testing/sysfs-bus-usb b/Documentation/ABI/testing/sysfs-bus-usb
index bf2c1968525f..73eb23bc1f34 100644
--- a/Documentation/ABI/testing/sysfs-bus-usb
+++ b/Documentation/ABI/testing/sysfs-bus-usb
@@ -154,17 +154,6 @@ Description:
 		files hold a string value (enable or disable) indicating whether
 		or not USB3 hardware LPM U1 or U2 is enabled for the device.
 
-What:		/sys/bus/usb/devices/.../removable
-Date:		February 2012
-Contact:	Matthew Garrett <mjg@redhat.com>
-Description:
-		Some information about whether a given USB device is
-		physically fixed to the platform can be inferred from a
-		combination of hub descriptor bits and platform-specific data
-		such as ACPI. This file will read either "removable" or
-		"fixed" if the information is available, and "unknown"
-		otherwise.
-
 What:		/sys/bus/usb/devices/.../ltm_capable
 Date:		July 2012
 Contact:	Sarah Sharp <sarah.a.sharp@linux.intel.com>
diff --git a/Documentation/ABI/testing/sysfs-devices-removable b/Documentation/ABI/testing/sysfs-devices-removable
new file mode 100644
index 000000000000..acf7766e800b
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-devices-removable
@@ -0,0 +1,17 @@
+What:		/sys/devices/.../removable
+Date:		May 2021
+Contact:	Rajat Jain <rajatxjain@gmail.com>
+Description:
+		Information about whether a given device can be removed from the
+		platform by the	user. This is determined by its subsystem in a
+		bus / platform-specific way. This attribute is only present for
+		devices that can support determining such information:
+
+		"removable": device can be removed from the platform by the user
+		"fixed":     device is fixed to the platform / cannot be removed
+			     by the user.
+		"unknown":   The information is unavailable / cannot be deduced.
+
+		Currently this is only supported by USB (which infers the
+		information from a combination of hub descriptor bits and
+		platform-specific data such as ACPI).
diff --git a/drivers/base/core.c b/drivers/base/core.c
index cb859febd03c..d98cab88c38a 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2053,6 +2053,25 @@ static ssize_t online_store(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RW(online);
 
+static ssize_t removable_show(struct device *dev, struct device_attribute *attr,
+			      char *buf)
+{
+	const char *loc;
+
+	switch (dev->removable) {
+	case DEVICE_REMOVABLE:
+		loc = "removable";
+		break;
+	case DEVICE_FIXED:
+		loc = "fixed";
+		break;
+	default:
+		loc = "unknown";
+	}
+	return sysfs_emit(buf, "%s\n", loc);
+}
+static DEVICE_ATTR_RO(removable);
+
 int device_add_groups(struct device *dev, const struct attribute_group **groups)
 {
 	return sysfs_create_groups(&dev->kobj, groups);
@@ -2230,8 +2249,16 @@ static int device_add_attrs(struct device *dev)
 			goto err_remove_dev_online;
 	}
 
+	if (dev_removable_is_valid(dev)) {
+		error = device_create_file(dev, &dev_attr_removable);
+		if (error)
+			goto err_remove_dev_waiting_for_supplier;
+	}
+
 	return 0;
 
+ err_remove_dev_waiting_for_supplier:
+	device_remove_file(dev, &dev_attr_waiting_for_supplier);
  err_remove_dev_online:
 	device_remove_file(dev, &dev_attr_online);
  err_remove_dev_groups:
@@ -2251,6 +2278,7 @@ static void device_remove_attrs(struct device *dev)
 	struct class *class = dev->class;
 	const struct device_type *type = dev->type;
 
+	device_remove_file(dev, &dev_attr_removable);
 	device_remove_file(dev, &dev_attr_waiting_for_supplier);
 	device_remove_file(dev, &dev_attr_online);
 	device_remove_groups(dev, dev->groups);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index cfcd4f2ffffa..331f41c6cc75 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2450,6 +2450,8 @@ static void set_usb_port_removable(struct usb_device *udev)
 	u16 wHubCharacteristics;
 	bool removable = true;
 
+	dev_set_removable(&udev->dev, DEVICE_REMOVABLE_UNKNOWN);
+
 	if (!hdev)
 		return;
 
@@ -2461,11 +2463,11 @@ static void set_usb_port_removable(struct usb_device *udev)
 	 */
 	switch (hub->ports[udev->portnum - 1]->connect_type) {
 	case USB_PORT_CONNECT_TYPE_HOT_PLUG:
-		udev->removable = USB_DEVICE_REMOVABLE;
+		dev_set_removable(&udev->dev, DEVICE_REMOVABLE);
 		return;
 	case USB_PORT_CONNECT_TYPE_HARD_WIRED:
 	case USB_PORT_NOT_USED:
-		udev->removable = USB_DEVICE_FIXED;
+		dev_set_removable(&udev->dev, DEVICE_FIXED);
 		return;
 	default:
 		break;
@@ -2490,9 +2492,9 @@ static void set_usb_port_removable(struct usb_device *udev)
 	}
 
 	if (removable)
-		udev->removable = USB_DEVICE_REMOVABLE;
+		dev_set_removable(&udev->dev, DEVICE_REMOVABLE);
 	else
-		udev->removable = USB_DEVICE_FIXED;
+		dev_set_removable(&udev->dev, DEVICE_FIXED);
 
 }
 
@@ -2564,8 +2566,7 @@ int usb_new_device(struct usb_device *udev)
 	device_enable_async_suspend(&udev->dev);
 
 	/* check whether the hub or firmware marks this port as non-removable */
-	if (udev->parent)
-		set_usb_port_removable(udev);
+	set_usb_port_removable(udev);
 
 	/* Register the device.  The device driver is responsible
 	 * for configuring the device and invoking the add-device
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index a2ca38e25e0c..35ce8b87e939 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -298,29 +298,6 @@ static ssize_t urbnum_show(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RO(urbnum);
 
-static ssize_t removable_show(struct device *dev, struct device_attribute *attr,
-			      char *buf)
-{
-	struct usb_device *udev;
-	char *state;
-
-	udev = to_usb_device(dev);
-
-	switch (udev->removable) {
-	case USB_DEVICE_REMOVABLE:
-		state = "removable";
-		break;
-	case USB_DEVICE_FIXED:
-		state = "fixed";
-		break;
-	default:
-		state = "unknown";
-	}
-
-	return sprintf(buf, "%s\n", state);
-}
-static DEVICE_ATTR_RO(removable);
-
 static ssize_t ltm_capable_show(struct device *dev,
 				struct device_attribute *attr, char *buf)
 {
@@ -825,7 +802,6 @@ static struct attribute *dev_attrs[] = {
 	&dev_attr_avoid_reset_quirk.attr,
 	&dev_attr_authorized.attr,
 	&dev_attr_remove.attr,
-	&dev_attr_removable.attr,
 	&dev_attr_ltm_capable.attr,
 #ifdef CONFIG_OF
 	&dev_attr_devspec.attr,
diff --git a/include/linux/device.h b/include/linux/device.h
index 4f7e0c85e11f..6394c4b70a09 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -348,6 +348,22 @@ enum dl_dev_state {
 	DL_DEV_UNBINDING,
 };
 
+/**
+ * enum device_removable - Whether the device is removable. The criteria for a
+ * device to be classified as removable is determined by its subsystem or bus.
+ * @DEVICE_REMOVABLE_NOT_SUPPORTED: This attribute is not supported for this
+ *				    device (default).
+ * @DEVICE_REMOVABLE_UNKNOWN:  Device location is Unknown.
+ * @DEVICE_FIXED: Device is not removable by the user.
+ * @DEVICE_REMOVABLE: Device is removable by the user.
+ */
+enum device_removable {
+	DEVICE_REMOVABLE_NOT_SUPPORTED = 0, /* must be 0 */
+	DEVICE_REMOVABLE_UNKNOWN,
+	DEVICE_FIXED,
+	DEVICE_REMOVABLE,
+};
+
 /**
  * struct dev_links_info - Device data related to device links.
  * @suppliers: List of links to supplier devices.
@@ -435,6 +451,9 @@ struct dev_links_info {
  * 		device (i.e. the bus driver that discovered the device).
  * @iommu_group: IOMMU group the device belongs to.
  * @iommu:	Per device generic IOMMU runtime data
+ * @removable:  Whether the device can be removed from the system. This
+ *              should be set by the subsystem / bus driver that discovered
+ *              the device.
  *
  * @offline_disabled: If set, the device is permanently online.
  * @offline:	Set after successful invocation of bus type's .offline().
@@ -546,6 +565,8 @@ struct device {
 	struct iommu_group	*iommu_group;
 	struct dev_iommu	*iommu;
 
+	enum device_removable	removable;
+
 	bool			offline_disabled:1;
 	bool			offline:1;
 	bool			of_node_reused:1;
@@ -781,6 +802,22 @@ static inline bool dev_has_sync_state(struct device *dev)
 	return false;
 }
 
+static inline void dev_set_removable(struct device *dev,
+				     enum device_removable removable)
+{
+	dev->removable = removable;
+}
+
+static inline bool dev_is_removable(struct device *dev)
+{
+	return dev->removable == DEVICE_REMOVABLE;
+}
+
+static inline bool dev_removable_is_valid(struct device *dev)
+{
+	return dev->removable != DEVICE_REMOVABLE_NOT_SUPPORTED;
+}
+
 /*
  * High level routines for use by the bus drivers
  */
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 8bc1119afc31..e02cf70ca52f 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -478,12 +478,6 @@ struct usb_dev_state;
 
 struct usb_tt;
 
-enum usb_device_removable {
-	USB_DEVICE_REMOVABLE_UNKNOWN = 0,
-	USB_DEVICE_REMOVABLE,
-	USB_DEVICE_FIXED,
-};
-
 enum usb_port_connect_type {
 	USB_PORT_CONNECT_TYPE_UNKNOWN = 0,
 	USB_PORT_CONNECT_TYPE_HOT_PLUG,
@@ -710,7 +704,6 @@ struct usb_device {
 #endif
 	struct wusb_dev *wusb_dev;
 	int slot_id;
-	enum usb_device_removable removable;
 	struct usb2_lpm_parameters l1_params;
 	struct usb3_lpm_parameters u1_params;
 	struct usb3_lpm_parameters u2_params;

From 8d4237a149e32e0243f44c3e368e59cbac0f0822 Mon Sep 17 00:00:00 2001
From: Alex Deucher <alexander.deucher@amd.com>
Date: Tue, 17 Oct 2023 15:40:01 -0400
Subject: [PATCH 0791/1043] drm/amdgpu: don't use ATRM for external devices

[ Upstream commit 432e664e7c98c243fab4c3c95bd463bea3aeed28 ]

The ATRM ACPI method is for fetching the dGPU vbios rom
image on laptops and all-in-one systems.  It should not be
used for external add in cards.  If the dGPU is thunderbolt
connected, don't try ATRM.

v2: pci_is_thunderbolt_attached only works for Intel.  Use
    pdev->external_facing instead.
v3: dev_is_removable() seems to be what we want

Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2925
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
index 4b568ee93243..02a73b9e08d7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
@@ -29,6 +29,7 @@
 #include "amdgpu.h"
 #include "atom.h"
 
+#include <linux/device.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
 #include <linux/acpi.h>
@@ -285,6 +286,10 @@ static bool amdgpu_atrm_get_bios(struct amdgpu_device *adev)
 	if (adev->flags & AMD_IS_APU)
 		return false;
 
+	/* ATRM is for on-platform devices only */
+	if (dev_is_removable(&adev->pdev->dev))
+		return false;
+
 	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
 		dhandle = ACPI_HANDLE(&pdev->dev);
 		if (!dhandle)

From f9aa2857c6e6bac8ac96e3bf85113d89dfc06f02 Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Wed, 5 Jul 2023 14:58:10 -0400
Subject: [PATCH 0792/1043] fs: add ctime accessors infrastructure

[ Upstream commit 9b6304c1d53745c300b86f202d0dcff395e2d2db ]

struct timespec64 has unused bits in the tv_nsec field that can be used
for other purposes. In future patches, we're going to change how the
inode->i_ctime is accessed in certain inodes in order to make use of
them. In order to do that safely though, we'll need to eradicate raw
accesses of the inode->i_ctime field from the kernel.

Add new accessor functions for the ctime that we use to replace them.

Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Message-Id: <20230705185812.579118-2-jlayton@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: 5923d6686a10 ("smb3: fix caching of ctime on setxattr")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/inode.c         | 16 ++++++++++++++++
 include/linux/fs.h | 45 ++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/fs/inode.c b/fs/inode.c
index 311237e8d359..5c7139aa2bda 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -2392,6 +2392,22 @@ int vfs_ioc_fssetxattr_check(struct inode *inode, const struct fsxattr *old_fa,
 }
 EXPORT_SYMBOL(vfs_ioc_fssetxattr_check);
 
+/**
+ * inode_set_ctime_current - set the ctime to current_time
+ * @inode: inode
+ *
+ * Set the inode->i_ctime to the current value for the inode. Returns
+ * the current value that was assigned to i_ctime.
+ */
+struct timespec64 inode_set_ctime_current(struct inode *inode)
+{
+	struct timespec64 now = current_time(inode);
+
+	inode_set_ctime(inode, now.tv_sec, now.tv_nsec);
+	return now;
+}
+EXPORT_SYMBOL(inode_set_ctime_current);
+
 /**
  * in_group_or_capable - check whether caller is CAP_FSETID privileged
  * @inode:	inode to check
diff --git a/include/linux/fs.h b/include/linux/fs.h
index f9e25d0a7b9c..82316863c71f 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1580,7 +1580,50 @@ static inline void i_gid_write(struct inode *inode, gid_t gid)
 	inode->i_gid = make_kgid(inode->i_sb->s_user_ns, gid);
 }
 
-extern struct timespec64 current_time(struct inode *inode);
+struct timespec64 current_time(struct inode *inode);
+struct timespec64 inode_set_ctime_current(struct inode *inode);
+
+/**
+ * inode_get_ctime - fetch the current ctime from the inode
+ * @inode: inode from which to fetch ctime
+ *
+ * Grab the current ctime from the inode and return it.
+ */
+static inline struct timespec64 inode_get_ctime(const struct inode *inode)
+{
+	return inode->i_ctime;
+}
+
+/**
+ * inode_set_ctime_to_ts - set the ctime in the inode
+ * @inode: inode in which to set the ctime
+ * @ts: value to set in the ctime field
+ *
+ * Set the ctime in @inode to @ts
+ */
+static inline struct timespec64 inode_set_ctime_to_ts(struct inode *inode,
+						      struct timespec64 ts)
+{
+	inode->i_ctime = ts;
+	return ts;
+}
+
+/**
+ * inode_set_ctime - set the ctime in the inode
+ * @inode: inode in which to set the ctime
+ * @sec: tv_sec value to set
+ * @nsec: tv_nsec value to set
+ *
+ * Set the ctime in @inode to { @sec, @nsec }
+ */
+static inline struct timespec64 inode_set_ctime(struct inode *inode,
+						time64_t sec, long nsec)
+{
+	struct timespec64 ts = { .tv_sec  = sec,
+				 .tv_nsec = nsec };
+
+	return inode_set_ctime_to_ts(inode, ts);
+}
 
 /*
  * Snapshotting support.

From c2b6f7e48e381f191f6d057277226b53512d2cbe Mon Sep 17 00:00:00 2001
From: Steve French <stfrench@microsoft.com>
Date: Tue, 7 Nov 2023 21:38:13 -0600
Subject: [PATCH 0793/1043] smb3: fix caching of ctime on setxattr

[ Upstream commit 5923d6686a100c2b4cabd4c2ca9d5a12579c7614 ]

Fixes xfstest generic/728 which had been failing due to incorrect
ctime after setxattr and removexattr

Update ctime on successful set of xattr

Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/xattr.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index b8299173ea7e..c6931eab3f97 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -157,10 +157,13 @@ static int cifs_xattr_set(const struct xattr_handler *handler,
 		if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
 			goto out;
 
-		if (pTcon->ses->server->ops->set_EA)
+		if (pTcon->ses->server->ops->set_EA) {
 			rc = pTcon->ses->server->ops->set_EA(xid, pTcon,
 				full_path, name, value, (__u16)size,
 				cifs_sb->local_nls, cifs_sb);
+			if (rc == 0)
+				inode_set_ctime_current(inode);
+		}
 		break;
 
 	case XATTR_CIFS_ACL:

From b19fe82b4b92eee5205152b3624f3ef88710b672 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 9 Aug 2021 16:03:04 -0700
Subject: [PATCH 0794/1043] scsi: core: Introduce the scsi_cmd_to_rq() function

[ Upstream commit 51f3a478892873337c54068d1185bcd797000a52 ]

The 'request' member of struct scsi_cmnd is superfluous. The struct request
and struct scsi_cmnd data structures are adjacent and hence the request
pointer can be derived easily from a scsi_cmnd pointer. Introduce a helper
function that performs that conversion in a type-safe way. This patch is
the first step towards removing the request member from struct
scsi_cmnd. Making that change has the following advantages:

 - This is a performance optimization since adding an offset to a pointer
   takes less time than dereferencing a pointer.

 - struct scsi_cmnd becomes smaller.

Link: https://lore.kernel.org/r/20210809230355.8186-2-bvanassche@acm.org
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: 19597cad64d6 ("scsi: qla2xxx: Fix system crash due to bad pointer access")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/scsi/scsi_cmnd.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index 4d272e834ca2..b1c9b52876f3 100644
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -144,6 +144,12 @@ struct scsi_cmnd {
 	unsigned int extra_len;	/* length of alignment and padding */
 };
 
+/* Variant of blk_mq_rq_from_pdu() that verifies the type of its argument. */
+static inline struct request *scsi_cmd_to_rq(struct scsi_cmnd *scmd)
+{
+	return blk_mq_rq_from_pdu(scmd);
+}
+
 /*
  * Return the driver private allocation behind the command.
  * Only works if cmd_size is set in the host template.

From 46a4bf13502ff3ef91623dea2a2a248d9e4c7ee2 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Mon, 9 Aug 2021 16:03:41 -0700
Subject: [PATCH 0795/1043] scsi: qla2xxx: Use scsi_cmd_to_rq() instead of
 scsi_cmnd.request

[ Upstream commit c7d6b2c2cd5656b05849afb0de3f422da1742d0f ]

Prepare for removal of the request pointer by using scsi_cmd_to_rq()
instead. This patch does not change any functionality.

Link: https://lore.kernel.org/r/20210809230355.8186-39-bvanassche@acm.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: 19597cad64d6 ("scsi: qla2xxx: Fix system crash due to bad pointer access")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_os.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 8d199deaf3b1..136522a1c728 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -839,7 +839,7 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
 		uint16_t hwq;
 		struct qla_qpair *qpair = NULL;
 
-		tag = blk_mq_unique_tag(cmd->request);
+		tag = blk_mq_unique_tag(scsi_cmd_to_rq(cmd));
 		hwq = blk_mq_unique_tag_to_hwq(tag);
 		qpair = ha->queue_pair_map[hwq];
 
@@ -1714,7 +1714,7 @@ static void qla2x00_abort_srb(struct qla_qpair *qp, srb_t *sp, const int res,
 		}
 
 		spin_lock_irqsave(qp->qp_lock_ptr, *flags);
-		if (ret_cmd && blk_mq_request_started(cmd->request))
+		if (ret_cmd && blk_mq_request_started(scsi_cmd_to_rq(cmd)))
 			sp->done(sp, res);
 	} else {
 		sp->done(sp, res);

From 910566a789a2649c45fbb4364be0ebb6c6588beb Mon Sep 17 00:00:00 2001
From: Quinn Tran <qutran@marvell.com>
Date: Mon, 30 Oct 2023 12:19:12 +0530
Subject: [PATCH 0796/1043] scsi: qla2xxx: Fix system crash due to bad pointer
 access

[ Upstream commit 19597cad64d608aa8ac2f8aef50a50187a565223 ]

User experiences system crash when running AER error injection.  The
perturbation causes the abort-all-I/O path to trigger. The driver assumes
all I/O on this path is FCP only. If there is both NVMe & FCP traffic, a
system crash happens. Add additional check to see if I/O is FCP or not
before access.

PID: 999019  TASK: ff35d769f24722c0  CPU: 53  COMMAND: "kworker/53:1"
 0 [ff3f78b964847b58] machine_kexec at ffffffffae86973d
 1 [ff3f78b964847ba8] __crash_kexec at ffffffffae9be29d
 2 [ff3f78b964847c70] crash_kexec at ffffffffae9bf528
 3 [ff3f78b964847c78] oops_end at ffffffffae8282ab
 4 [ff3f78b964847c98] exc_page_fault at ffffffffaf2da502
 5 [ff3f78b964847cc0] asm_exc_page_fault at ffffffffaf400b62
   [exception RIP: qla2x00_abort_srb+444]
   RIP: ffffffffc07b5f8c  RSP: ff3f78b964847d78  RFLAGS: 00010046
   RAX: 0000000000000282  RBX: ff35d74a0195a200  RCX: ff35d76886fd03a0
   RDX: 0000000000000001  RSI: ffffffffc07c5ec8  RDI: ff35d74a0195a200
   RBP: ff35d76913d22080   R8: ff35d7694d103200   R9: ff35d7694d103200
   R10: 0000000100000000  R11: ffffffffb05d6630  R12: 0000000000010000
   R13: ff3f78b964847df8  R14: ff35d768d8754000  R15: ff35d768877248e0
   ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 6 [ff3f78b964847d70] qla2x00_abort_srb at ffffffffc07b5f84 [qla2xxx]
 7 [ff3f78b964847de0] __qla2x00_abort_all_cmds at ffffffffc07b6238 [qla2xxx]
 8 [ff3f78b964847e38] qla2x00_abort_all_cmds at ffffffffc07ba635 [qla2xxx]
 9 [ff3f78b964847e58] qla2x00_terminate_rport_io at ffffffffc08145eb [qla2xxx]
10 [ff3f78b964847e70] fc_terminate_rport_io at ffffffffc045987e [scsi_transport_fc]
11 [ff3f78b964847e88] process_one_work at ffffffffae914f15
12 [ff3f78b964847ed0] worker_thread at ffffffffae9154c0
13 [ff3f78b964847f10] kthread at ffffffffae91c456
14 [ff3f78b964847f50] ret_from_fork at ffffffffae8036ef

Cc: stable@vger.kernel.org
Fixes: f45bca8c5052 ("scsi: qla2xxx: Fix double scsi_done for abort path")
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20231030064912.37912-1-njavali@marvell.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_os.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 136522a1c728..0930bf996cd3 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1714,8 +1714,16 @@ static void qla2x00_abort_srb(struct qla_qpair *qp, srb_t *sp, const int res,
 		}
 
 		spin_lock_irqsave(qp->qp_lock_ptr, *flags);
-		if (ret_cmd && blk_mq_request_started(scsi_cmd_to_rq(cmd)))
-			sp->done(sp, res);
+		switch (sp->type) {
+		case SRB_SCSI_CMD:
+			if (ret_cmd && blk_mq_request_started(scsi_cmd_to_rq(cmd)))
+				sp->done(sp, res);
+			break;
+		default:
+			if (ret_cmd)
+				sp->done(sp, res);
+			break;
+		}
 	} else {
 		sp->done(sp, res);
 	}

From 6b35f36ff8f018aadc8d5b29e9d2d4561dfd81bb Mon Sep 17 00:00:00 2001
From: Christoph Niedermaier <cniedermaier@dh-electronics.com>
Date: Fri, 12 May 2023 17:07:11 +0200
Subject: [PATCH 0797/1043] cpufreq: imx6q: don't warn for disabling a
 non-existing frequency

[ Upstream commit 11a3b0ac33d95aa84be426e801f800997262a225 ]

It is confusing if a warning is given for disabling a non-existent
frequency of the operating performance points (OPP). In this case
the function dev_pm_opp_disable() returns -ENODEV. Check the return
value and avoid the output of a warning in this case. Avoid code
duplication by using a separate function.

Signed-off-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
[ Viresh : Updated commit subject ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Stable-dep-of: 2e4e0984c7d6 ("cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/imx6q-cpufreq.c | 30 ++++++++++++++++--------------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 5bf5fc759881..cc874d0c4395 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -209,6 +209,14 @@ static struct cpufreq_driver imx6q_cpufreq_driver = {
 	.suspend = cpufreq_generic_suspend,
 };
 
+static void imx6x_disable_freq_in_opp(struct device *dev, unsigned long freq)
+{
+	int ret = dev_pm_opp_disable(dev, freq);
+
+	if (ret < 0 && ret != -ENODEV)
+		dev_warn(dev, "failed to disable %ldMHz OPP\n", freq / 1000000);
+}
+
 #define OCOTP_CFG3			0x440
 #define OCOTP_CFG3_SPEED_SHIFT		16
 #define OCOTP_CFG3_SPEED_1P2GHZ		0x3
@@ -254,17 +262,15 @@ static int imx6q_opp_check_speed_grading(struct device *dev)
 	val &= 0x3;
 
 	if (val < OCOTP_CFG3_SPEED_996MHZ)
-		if (dev_pm_opp_disable(dev, 996000000))
-			dev_warn(dev, "failed to disable 996MHz OPP\n");
+		imx6x_disable_freq_in_opp(dev, 996000000);
 
 	if (of_machine_is_compatible("fsl,imx6q") ||
 	    of_machine_is_compatible("fsl,imx6qp")) {
 		if (val != OCOTP_CFG3_SPEED_852MHZ)
-			if (dev_pm_opp_disable(dev, 852000000))
-				dev_warn(dev, "failed to disable 852MHz OPP\n");
+			imx6x_disable_freq_in_opp(dev, 852000000);
+
 		if (val != OCOTP_CFG3_SPEED_1P2GHZ)
-			if (dev_pm_opp_disable(dev, 1200000000))
-				dev_warn(dev, "failed to disable 1.2GHz OPP\n");
+			imx6x_disable_freq_in_opp(dev, 1200000000);
 	}
 
 	return 0;
@@ -316,20 +322,16 @@ static int imx6ul_opp_check_speed_grading(struct device *dev)
 	val >>= OCOTP_CFG3_SPEED_SHIFT;
 	val &= 0x3;
 
-	if (of_machine_is_compatible("fsl,imx6ul")) {
+	if (of_machine_is_compatible("fsl,imx6ul"))
 		if (val != OCOTP_CFG3_6UL_SPEED_696MHZ)
-			if (dev_pm_opp_disable(dev, 696000000))
-				dev_warn(dev, "failed to disable 696MHz OPP\n");
-	}
+			imx6x_disable_freq_in_opp(dev, 696000000);
 
 	if (of_machine_is_compatible("fsl,imx6ull")) {
 		if (val != OCOTP_CFG3_6ULL_SPEED_792MHZ)
-			if (dev_pm_opp_disable(dev, 792000000))
-				dev_warn(dev, "failed to disable 792MHz OPP\n");
+			imx6x_disable_freq_in_opp(dev, 792000000);
 
 		if (val != OCOTP_CFG3_6ULL_SPEED_900MHZ)
-			if (dev_pm_opp_disable(dev, 900000000))
-				dev_warn(dev, "failed to disable 900MHz OPP\n");
+			imx6x_disable_freq_in_opp(dev, 900000000);
 	}
 
 	return ret;

From 2011f06e32ab9b230af332af927e400fc0958397 Mon Sep 17 00:00:00 2001
From: Christoph Niedermaier <cniedermaier@dh-electronics.com>
Date: Wed, 22 Nov 2023 14:41:13 +0100
Subject: [PATCH 0798/1043] cpufreq: imx6q: Don't disable 792 Mhz OPP
 unnecessarily

[ Upstream commit 2e4e0984c7d696cc74cf2fd7e7f62997f0e9ebe6 ]

For a 900MHz i.MX6ULL CPU the 792MHz OPP is disabled. There is no
convincing reason to disable this OPP. If a CPU can run at 900MHz,
it should also be able to cope with 792MHz. Looking at the voltage
level of 792MHz in [1] (page 24, table 10. "Operating Ranges") the
current defined OPP is above the minimum. So the voltage level
shouldn't be a problem. However in [2] (page 24, table 10.
"Operating Ranges"), it is not mentioned that 792MHz OPP isn't
allowed. Change it to only disable 792MHz OPP for i.MX6ULL types
below 792 MHz.

[1] https://www.nxp.com/docs/en/data-sheet/IMX6ULLIEC.pdf
[2] https://www.nxp.com/docs/en/data-sheet/IMX6ULLCEC.pdf

Fixes: 0aa9abd4c212 ("cpufreq: imx6q: check speed grades for i.MX6ULL")
Signed-off-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
Reviewed-by: Marek Vasut <marex@denx.de>
Reviewed-by: Fabio Estevam <festevam@denx.de>
[ Viresh: Edited subject ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/imx6q-cpufreq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index cc874d0c4395..00f7ad746668 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -327,7 +327,7 @@ static int imx6ul_opp_check_speed_grading(struct device *dev)
 			imx6x_disable_freq_in_opp(dev, 696000000);
 
 	if (of_machine_is_compatible("fsl,imx6ull")) {
-		if (val != OCOTP_CFG3_6ULL_SPEED_792MHZ)
+		if (val < OCOTP_CFG3_6ULL_SPEED_792MHZ)
 			imx6x_disable_freq_in_opp(dev, 792000000);
 
 		if (val != OCOTP_CFG3_6ULL_SPEED_900MHZ)

From e94ededefc423906faa99df72d90d9005f9d33c8 Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Fri, 3 Nov 2023 10:47:16 +0200
Subject: [PATCH 0799/1043] mmc: cqhci: Increase recovery halt timeout

[ Upstream commit b578d5d18e929aa7c007a98cce32657145dde219 ]

Failing to halt complicates the recovery. Additionally, unless the card or
controller are stuck, which is expected to be very rare, then the halt
should succeed, so it is better to wait. Set a large timeout.

Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Link: https://lore.kernel.org/r/20231103084720.6886-3-adrian.hunter@intel.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/cqhci.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
index 7ba4f714106f..a0a9cb6e2a15 100644
--- a/drivers/mmc/host/cqhci.c
+++ b/drivers/mmc/host/cqhci.c
@@ -932,10 +932,10 @@ static bool cqhci_halt(struct mmc_host *mmc, unsigned int timeout)
 /*
  * After halting we expect to be able to use the command line. We interpret the
  * failure to halt to mean the data lines might still be in use (and the upper
- * layers will need to send a STOP command), so we set the timeout based on a
- * generous command timeout.
+ * layers will need to send a STOP command), however failing to halt complicates
+ * the recovery, so set a timeout that would reasonably allow I/O to complete.
  */
-#define CQHCI_START_HALT_TIMEOUT	5
+#define CQHCI_START_HALT_TIMEOUT	500
 
 static void cqhci_recovery_start(struct mmc_host *mmc)
 {

From cb9ca7cc273b27c0daf387f735d90d4ea52283ee Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Fri, 3 Nov 2023 10:47:19 +0200
Subject: [PATCH 0800/1043] mmc: cqhci: Warn of halt or task clear failure

[ Upstream commit 35597bdb04ec27ef3b1cea007dc69f8ff5df75a5 ]

A correctly operating controller should successfully halt and clear tasks.
Failure may result in errors elsewhere, so promote messages from debug to
warnings.

Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Link: https://lore.kernel.org/r/20231103084720.6886-6-adrian.hunter@intel.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/cqhci.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
index a0a9cb6e2a15..7bccd6494cd9 100644
--- a/drivers/mmc/host/cqhci.c
+++ b/drivers/mmc/host/cqhci.c
@@ -890,8 +890,8 @@ static bool cqhci_clear_all_tasks(struct mmc_host *mmc, unsigned int timeout)
 	ret = cqhci_tasks_cleared(cq_host);
 
 	if (!ret)
-		pr_debug("%s: cqhci: Failed to clear tasks\n",
-			 mmc_hostname(mmc));
+		pr_warn("%s: cqhci: Failed to clear tasks\n",
+			mmc_hostname(mmc));
 
 	return ret;
 }
@@ -924,7 +924,7 @@ static bool cqhci_halt(struct mmc_host *mmc, unsigned int timeout)
 	ret = cqhci_halted(cq_host);
 
 	if (!ret)
-		pr_debug("%s: cqhci: Failed to halt\n", mmc_hostname(mmc));
+		pr_warn("%s: cqhci: Failed to halt\n", mmc_hostname(mmc));
 
 	return ret;
 }

From bb785011843ead83a9cb8dcd898371e7a177bed8 Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Fri, 3 Nov 2023 10:47:20 +0200
Subject: [PATCH 0801/1043] mmc: cqhci: Fix task clearing in CQE error recovery
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 1de1b77982e1a1df9707cb11f9b1789e6b8919d4 ]

If a task completion notification (TCN) is received when there is no
outstanding task, the cqhci driver issues a "spurious TCN" warning. This
was observed to happen right after CQE error recovery.

When an error interrupt is received the driver runs recovery logic.
It halts the controller, clears all pending tasks, and then re-enables
it. On some platforms, like Intel Jasper Lake, a stale task completion
event was observed, regardless of the CQHCI_CLEAR_ALL_TASKS bit being set.

This results in either:
a) Spurious TC completion event for an empty slot.
b) Corrupted data being passed up the stack, as a result of premature
   completion for a newly added task.

Rather than add a quirk for affected controllers, ensure tasks are cleared
by toggling CQHCI_ENABLE, which would happen anyway if
cqhci_clear_all_tasks() timed out. This is simpler and should be safe and
effective for all controllers.

Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host")
Cc: stable@vger.kernel.org
Reported-by: Kornel Dulęba <korneld@chromium.org>
Tested-by: Kornel Dulęba <korneld@chromium.org>
Co-developed-by: Kornel Dulęba <korneld@chromium.org>
Signed-off-by: Kornel Dulęba <korneld@chromium.org>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Link: https://lore.kernel.org/r/20231103084720.6886-7-adrian.hunter@intel.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/cqhci.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
index 7bccd6494cd9..23cf7912c1ba 100644
--- a/drivers/mmc/host/cqhci.c
+++ b/drivers/mmc/host/cqhci.c
@@ -1023,28 +1023,28 @@ static void cqhci_recovery_finish(struct mmc_host *mmc)
 
 	ok = cqhci_halt(mmc, CQHCI_FINISH_HALT_TIMEOUT);
 
-	if (!cqhci_clear_all_tasks(mmc, CQHCI_CLEAR_TIMEOUT))
-		ok = false;
-
 	/*
 	 * The specification contradicts itself, by saying that tasks cannot be
 	 * cleared if CQHCI does not halt, but if CQHCI does not halt, it should
 	 * be disabled/re-enabled, but not to disable before clearing tasks.
 	 * Have a go anyway.
 	 */
-	if (!ok) {
-		pr_debug("%s: cqhci: disable / re-enable\n", mmc_hostname(mmc));
-		cqcfg = cqhci_readl(cq_host, CQHCI_CFG);
-		cqcfg &= ~CQHCI_ENABLE;
-		cqhci_writel(cq_host, cqcfg, CQHCI_CFG);
-		cqcfg |= CQHCI_ENABLE;
-		cqhci_writel(cq_host, cqcfg, CQHCI_CFG);
-		/* Be sure that there are no tasks */
-		ok = cqhci_halt(mmc, CQHCI_FINISH_HALT_TIMEOUT);
-		if (!cqhci_clear_all_tasks(mmc, CQHCI_CLEAR_TIMEOUT))
-			ok = false;
-		WARN_ON(!ok);
-	}
+	if (!cqhci_clear_all_tasks(mmc, CQHCI_CLEAR_TIMEOUT))
+		ok = false;
+
+	/* Disable to make sure tasks really are cleared */
+	cqcfg = cqhci_readl(cq_host, CQHCI_CFG);
+	cqcfg &= ~CQHCI_ENABLE;
+	cqhci_writel(cq_host, cqcfg, CQHCI_CFG);
+
+	cqcfg = cqhci_readl(cq_host, CQHCI_CFG);
+	cqcfg |= CQHCI_ENABLE;
+	cqhci_writel(cq_host, cqcfg, CQHCI_CFG);
+
+	cqhci_halt(mmc, CQHCI_FINISH_HALT_TIMEOUT);
+
+	if (!ok)
+		cqhci_clear_all_tasks(mmc, CQHCI_CLEAR_TIMEOUT);
 
 	cqhci_recover_mrqs(cq_host);
 

From bf62a283a779c03c3d97ca149b8368b37441b352 Mon Sep 17 00:00:00 2001
From: Zheng Yongjun <zhengyongjun3@huawei.com>
Date: Wed, 16 Dec 2020 21:17:37 +0800
Subject: [PATCH 0802/1043] mmc: core: convert comma to semicolon

[ Upstream commit 6b1dc6229aecbcb45e8901576684a8c09e25ad7b ]

Replace a comma between expression statements by a semicolon.

Signed-off-by: Zheng Yongjun <zhengyongjun3@huawei.com>
Link: https://lore.kernel.org/r/20201216131737.14883-1-zhengyongjun3@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Stable-dep-of: 8155d1fa3a74 ("mmc: block: Retry commands in CQE error recovery")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/core/core.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 8f2465394253..9cc4e3a0bc9a 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -547,10 +547,10 @@ int mmc_cqe_recovery(struct mmc_host *host)
 	host->cqe_ops->cqe_recovery_start(host);
 
 	memset(&cmd, 0, sizeof(cmd));
-	cmd.opcode       = MMC_STOP_TRANSMISSION,
-	cmd.flags        = MMC_RSP_R1B | MMC_CMD_AC,
+	cmd.opcode       = MMC_STOP_TRANSMISSION;
+	cmd.flags        = MMC_RSP_R1B | MMC_CMD_AC;
 	cmd.flags       &= ~MMC_RSP_CRC; /* Ignore CRC */
-	cmd.busy_timeout = MMC_CQE_RECOVERY_TIMEOUT,
+	cmd.busy_timeout = MMC_CQE_RECOVERY_TIMEOUT;
 	mmc_wait_for_cmd(host, &cmd, 0);
 
 	memset(&cmd, 0, sizeof(cmd));
@@ -558,7 +558,7 @@ int mmc_cqe_recovery(struct mmc_host *host)
 	cmd.arg          = 1; /* Discard entire queue */
 	cmd.flags        = MMC_RSP_R1B | MMC_CMD_AC;
 	cmd.flags       &= ~MMC_RSP_CRC; /* Ignore CRC */
-	cmd.busy_timeout = MMC_CQE_RECOVERY_TIMEOUT,
+	cmd.busy_timeout = MMC_CQE_RECOVERY_TIMEOUT;
 	err = mmc_wait_for_cmd(host, &cmd, 0);
 
 	host->cqe_ops->cqe_recovery_finish(host);

From 376fabe3677a767e9aa0dd122cddf80340c2332d Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Fri, 3 Nov 2023 10:47:18 +0200
Subject: [PATCH 0803/1043] mmc: block: Retry commands in CQE error recovery

[ Upstream commit 8155d1fa3a747baad5caff5f8303321d68ddd48c ]

It is important that MMC_CMDQ_TASK_MGMT command to discard the queue is
successful because otherwise a subsequent reset might fail to flush the
cache first.  Retry it and the previous STOP command.

Fixes: 72a5af554df8 ("mmc: core: Add support for handling CQE requests")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Link: https://lore.kernel.org/r/20231103084720.6886-5-adrian.hunter@intel.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/core/core.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 9cc4e3a0bc9a..fdeaaae08060 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -551,7 +551,7 @@ int mmc_cqe_recovery(struct mmc_host *host)
 	cmd.flags        = MMC_RSP_R1B | MMC_CMD_AC;
 	cmd.flags       &= ~MMC_RSP_CRC; /* Ignore CRC */
 	cmd.busy_timeout = MMC_CQE_RECOVERY_TIMEOUT;
-	mmc_wait_for_cmd(host, &cmd, 0);
+	mmc_wait_for_cmd(host, &cmd, MMC_CMD_RETRIES);
 
 	memset(&cmd, 0, sizeof(cmd));
 	cmd.opcode       = MMC_CMDQ_TASK_MGMT;
@@ -559,10 +559,13 @@ int mmc_cqe_recovery(struct mmc_host *host)
 	cmd.flags        = MMC_RSP_R1B | MMC_CMD_AC;
 	cmd.flags       &= ~MMC_RSP_CRC; /* Ignore CRC */
 	cmd.busy_timeout = MMC_CQE_RECOVERY_TIMEOUT;
-	err = mmc_wait_for_cmd(host, &cmd, 0);
+	err = mmc_wait_for_cmd(host, &cmd, MMC_CMD_RETRIES);
 
 	host->cqe_ops->cqe_recovery_finish(host);
 
+	if (err)
+		err = mmc_wait_for_cmd(host, &cmd, MMC_CMD_RETRIES);
+
 	mmc_retune_release(host);
 
 	return err;

From b532bc9b73e603452edfb39bbc50b7d9cbbd939e Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Sat, 11 Mar 2023 23:39:55 +0100
Subject: [PATCH 0804/1043] mmc: core: add helpers
 mmc_regulator_enable/disable_vqmmc

[ Upstream commit 8d91f3f8ae57e6292142ca89f322e90fa0d6ac02 ]

There's a number of drivers (e.g. dw_mmc, meson-gx, mmci, sunxi) using
the same mechanism and a private flag vqmmc_enabled to deal with
enabling/disabling the vqmmc regulator.

Move this to the core and create new helpers mmc_regulator_enable_vqmmc
and mmc_regulator_disable_vqmmc.

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Link: https://lore.kernel.org/r/71586432-360f-9b92-17f6-b05a8a971bc2@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Stable-dep-of: 477865af60b2 ("mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/core/regulator.c | 41 ++++++++++++++++++++++++++++++++++++
 include/linux/mmc/host.h     |  3 +++
 2 files changed, 44 insertions(+)

diff --git a/drivers/mmc/core/regulator.c b/drivers/mmc/core/regulator.c
index 609201a467ef..4dcbc2281d2b 100644
--- a/drivers/mmc/core/regulator.c
+++ b/drivers/mmc/core/regulator.c
@@ -271,3 +271,44 @@ int mmc_regulator_get_supply(struct mmc_host *mmc)
 	return 0;
 }
 EXPORT_SYMBOL_GPL(mmc_regulator_get_supply);
+
+/**
+ * mmc_regulator_enable_vqmmc - enable VQMMC regulator for a host
+ * @mmc: the host to regulate
+ *
+ * Returns 0 or errno. Enables the regulator for vqmmc.
+ * Keeps track of the enable status for ensuring that calls to
+ * regulator_enable/disable are balanced.
+ */
+int mmc_regulator_enable_vqmmc(struct mmc_host *mmc)
+{
+	int ret = 0;
+
+	if (!IS_ERR(mmc->supply.vqmmc) && !mmc->vqmmc_enabled) {
+		ret = regulator_enable(mmc->supply.vqmmc);
+		if (ret < 0)
+			dev_err(mmc_dev(mmc), "enabling vqmmc regulator failed\n");
+		else
+			mmc->vqmmc_enabled = true;
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mmc_regulator_enable_vqmmc);
+
+/**
+ * mmc_regulator_disable_vqmmc - disable VQMMC regulator for a host
+ * @mmc: the host to regulate
+ *
+ * Returns 0 or errno. Disables the regulator for vqmmc.
+ * Keeps track of the enable status for ensuring that calls to
+ * regulator_enable/disable are balanced.
+ */
+void mmc_regulator_disable_vqmmc(struct mmc_host *mmc)
+{
+	if (!IS_ERR(mmc->supply.vqmmc) && mmc->vqmmc_enabled) {
+		regulator_disable(mmc->supply.vqmmc);
+		mmc->vqmmc_enabled = false;
+	}
+}
+EXPORT_SYMBOL_GPL(mmc_regulator_disable_vqmmc);
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index fb294cbb9081..fb08b86acdbf 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -405,6 +405,7 @@ struct mmc_host {
 	unsigned int		use_blk_mq:1;	/* use blk-mq */
 	unsigned int		retune_crc_disable:1; /* don't trigger retune upon crc */
 	unsigned int		can_dma_map_merge:1; /* merging can be used */
+	unsigned int		vqmmc_enabled:1; /* vqmmc regulator is enabled */
 
 	int			rescan_disable;	/* disable card detection */
 	int			rescan_entered;	/* used with nonremovable devices */
@@ -546,6 +547,8 @@ static inline int mmc_regulator_set_vqmmc(struct mmc_host *mmc,
 #endif
 
 int mmc_regulator_get_supply(struct mmc_host *mmc);
+int mmc_regulator_enable_vqmmc(struct mmc_host *mmc);
+void mmc_regulator_disable_vqmmc(struct mmc_host *mmc);
 
 static inline int mmc_card_is_removable(struct mmc_host *host)
 {

From 8b76708eb9f1f2168c9d06bd9b921d0e1dbe2fae Mon Sep 17 00:00:00 2001
From: Wenchao Chen <wenchao.chen@unisoc.com>
Date: Wed, 15 Nov 2023 16:34:06 +0800
Subject: [PATCH 0805/1043] mmc: sdhci-sprd: Fix vqmmc not shutting down after
 the card was pulled

[ Upstream commit 477865af60b2117ceaa1d558e03559108c15c78c ]

With cat regulator_summary, we found that vqmmc was not shutting
down after the card was pulled.

cat /sys/kernel/debug/regulator/regulator_summary
1.before fix
1)Insert SD card
 vddsdio		1    1  0 unknown  3500mV 0mA  1200mV  3750mV
    71100000.mmc-vqmmc  1                         0mA  3500mV  3600mV

2)Pull out the SD card
 vddsdio                1    1  0 unknown  3500mV 0mA  1200mV  3750mV
    71100000.mmc-vqmmc  1                         0mA  3500mV  3600mV

2.after fix
1)Insert SD cardt
 vddsdio                1    1  0 unknown  3500mV 0mA  1200mV  3750mV
    71100000.mmc-vqmmc  1                         0mA  3500mV  3600mV

2)Pull out the SD card
 vddsdio		0    1  0 unknown  3500mV 0mA  1200mV  3750mV
    71100000.mmc-vqmmc  0                         0mA  3500mV  3600mV

Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller")
Signed-off-by: Wenchao Chen <wenchao.chen@unisoc.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231115083406.7368-1-wenchao.chen@unisoc.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-sprd.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/drivers/mmc/host/sdhci-sprd.c b/drivers/mmc/host/sdhci-sprd.c
index 540ebccaa9a3..d8e412bbb93b 100644
--- a/drivers/mmc/host/sdhci-sprd.c
+++ b/drivers/mmc/host/sdhci-sprd.c
@@ -392,12 +392,33 @@ static void sdhci_sprd_request_done(struct sdhci_host *host,
 	mmc_request_done(host->mmc, mrq);
 }
 
+static void sdhci_sprd_set_power(struct sdhci_host *host, unsigned char mode,
+				 unsigned short vdd)
+{
+	struct mmc_host *mmc = host->mmc;
+
+	switch (mode) {
+	case MMC_POWER_OFF:
+		mmc_regulator_set_ocr(host->mmc, mmc->supply.vmmc, 0);
+
+		mmc_regulator_disable_vqmmc(mmc);
+		break;
+	case MMC_POWER_ON:
+		mmc_regulator_enable_vqmmc(mmc);
+		break;
+	case MMC_POWER_UP:
+		mmc_regulator_set_ocr(host->mmc, mmc->supply.vmmc, vdd);
+		break;
+	}
+}
+
 static struct sdhci_ops sdhci_sprd_ops = {
 	.read_l = sdhci_sprd_readl,
 	.write_l = sdhci_sprd_writel,
 	.write_w = sdhci_sprd_writew,
 	.write_b = sdhci_sprd_writeb,
 	.set_clock = sdhci_sprd_set_clock,
+	.set_power = sdhci_sprd_set_power,
 	.get_max_clock = sdhci_sprd_get_max_clock,
 	.get_min_clock = sdhci_sprd_get_min_clock,
 	.set_bus_width = sdhci_set_bus_width,
@@ -663,6 +684,10 @@ static int sdhci_sprd_probe(struct platform_device *pdev)
 	host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_SDR104 |
 			 SDHCI_SUPPORT_DDR50);
 
+	ret = mmc_regulator_get_supply(host->mmc);
+	if (ret)
+		goto pm_runtime_disable;
+
 	ret = sdhci_setup_host(host);
 	if (ret)
 		goto pm_runtime_disable;

From b29e6055db1eae2ace70cbe75cbe36385754a958 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Tue, 10 Jan 2023 23:03:18 +0100
Subject: [PATCH 0806/1043] r8169: disable ASPM in case of tx timeout

[ Upstream commit 80c0576ef179311f624bc450fede30a89afe9792 ]

There are still single reports of systems where ASPM incompatibilities
cause tx timeouts. It's not clear whom to blame, so let's disable
ASPM in case of a tx timeout.

v2:
- add one-time warning for informing the user

Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Link: https://lore.kernel.org/r/92369a92-dc32-4529-0509-11459ba0e391@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 59d395ed606d ("r8169: fix deadlock on RTL8125 in jumbo mtu mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index d33720f68c67..759fc7a08960 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -582,6 +582,7 @@ struct rtl8169_tc_offsets {
 enum rtl_flag {
 	RTL_FLAG_TASK_ENABLED = 0,
 	RTL_FLAG_TASK_RESET_PENDING,
+	RTL_FLAG_TASK_TX_TIMEOUT,
 	RTL_FLAG_MAX
 };
 
@@ -4036,7 +4037,7 @@ static void rtl8169_tx_timeout(struct net_device *dev, unsigned int txqueue)
 {
 	struct rtl8169_private *tp = netdev_priv(dev);
 
-	rtl_schedule_task(tp, RTL_FLAG_TASK_RESET_PENDING);
+	rtl_schedule_task(tp, RTL_FLAG_TASK_TX_TIMEOUT);
 }
 
 static int rtl8169_tx_map(struct rtl8169_private *tp, const u32 *opts, u32 len,
@@ -4656,6 +4657,7 @@ static void rtl_task(struct work_struct *work)
 {
 	struct rtl8169_private *tp =
 		container_of(work, struct rtl8169_private, wk.work);
+	int ret;
 
 	rtnl_lock();
 
@@ -4663,7 +4665,17 @@ static void rtl_task(struct work_struct *work)
 	    !test_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags))
 		goto out_unlock;
 
+	if (test_and_clear_bit(RTL_FLAG_TASK_TX_TIMEOUT, tp->wk.flags)) {
+		/* ASPM compatibility issues are a typical reason for tx timeouts */
+		ret = pci_disable_link_state(tp->pci_dev, PCIE_LINK_STATE_L1 |
+							  PCIE_LINK_STATE_L0S);
+		if (!ret)
+			netdev_warn_once(tp->dev, "ASPM disabled on Tx timeout\n");
+		goto reset;
+	}
+
 	if (test_and_clear_bit(RTL_FLAG_TASK_RESET_PENDING, tp->wk.flags)) {
+reset:
 		rtl_reset_work(tp);
 		netif_wake_queue(tp->dev);
 	}

From 2325d3b6b10f17b99d99e66692d2092d66c3eec4 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Sun, 26 Nov 2023 19:36:46 +0100
Subject: [PATCH 0807/1043] r8169: fix deadlock on RTL8125 in jumbo mtu mode

[ Upstream commit 59d395ed606d8df14615712b0cdcdadb2d962175 ]

The original change results in a deadlock if jumbo mtu mode is used.
Reason is that the phydev lock is held when rtl_reset_work() is called
here, and rtl_jumbo_config() calls phy_start_aneg() which also tries
to acquire the phydev lock. Fix this by calling rtl_reset_work()
asynchronously.

Fixes: 621735f59064 ("r8169: fix rare issue with broken rx after link-down on RTL8125")
Reported-by: Ian Chen <free122448@hotmail.com>
Tested-by: Ian Chen <free122448@hotmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/caf6a487-ef8c-4570-88f9-f47a659faf33@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 759fc7a08960..88253cedd9d9 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -582,6 +582,7 @@ struct rtl8169_tc_offsets {
 enum rtl_flag {
 	RTL_FLAG_TASK_ENABLED = 0,
 	RTL_FLAG_TASK_RESET_PENDING,
+	RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE,
 	RTL_FLAG_TASK_TX_TIMEOUT,
 	RTL_FLAG_MAX
 };
@@ -4678,6 +4679,8 @@ static void rtl_task(struct work_struct *work)
 reset:
 		rtl_reset_work(tp);
 		netif_wake_queue(tp->dev);
+	} else if (test_and_clear_bit(RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE, tp->wk.flags)) {
+		rtl_reset_work(tp);
 	}
 out_unlock:
 	rtnl_unlock();
@@ -4711,7 +4714,7 @@ static void r8169_phylink_handler(struct net_device *ndev)
 	} else {
 		/* In few cases rx is broken after link-down otherwise */
 		if (rtl_is_8125(tp))
-			rtl_reset_work(tp);
+			rtl_schedule_task(tp, RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE);
 		pm_runtime_idle(d);
 	}
 

From 9c957e2b5254fc0fd98216b2284b21956e94e1c9 Mon Sep 17 00:00:00 2001
From: Saravana Kannan <saravanak@google.com>
Date: Tue, 17 Oct 2023 18:38:50 -0700
Subject: [PATCH 0808/1043] driver core: Release all resources during unbind
 before updating device links
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 2e84dc37920012b458e9458b19fc4ed33f81bc74 upstream.

This commit fixes a bug in commit 9ed9895370ae ("driver core: Functional
dependencies tracking support") where the device link status was
incorrectly updated in the driver unbind path before all the device's
resources were released.

Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support")
Cc: stable <stable@kernel.org>
Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Closes: https://lore.kernel.org/all/20231014161721.f4iqyroddkcyoefo@pengutronix.de/
Signed-off-by: Saravana Kannan <saravanak@google.com>
Cc: Thierry Reding <thierry.reding@gmail.com>
Cc: Yang Yingliang <yangyingliang@huawei.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Matti Vaittinen <mazziesaccount@gmail.com>
Cc: James Clark <james.clark@arm.com>
Acked-by: "Rafael J. Wysocki" <rafael@kernel.org>
Tested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20231018013851.3303928-1-saravanak@google.com
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/dd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 503c01d4015d..1e8318acf621 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1187,8 +1187,6 @@ static void __device_release_driver(struct device *dev, struct device *parent)
 		else if (drv->remove)
 			drv->remove(dev);
 
-		device_links_driver_cleanup(dev);
-
 		devres_release_all(dev);
 		arch_teardown_dma_ops(dev);
 		kfree(dev->dma_range_map);
@@ -1200,6 +1198,8 @@ static void __device_release_driver(struct device *dev, struct device *parent)
 		pm_runtime_reinit(dev);
 		dev_pm_set_driver_flags(dev, 0);
 
+		device_links_driver_cleanup(dev);
+
 		klist_remove(&dev->p->knode_driver);
 		device_pm_check_callbacks(dev);
 		if (dev->bus)

From d330ef1d295df26d38e7c6d8e74462ab8a396527 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 8 Dec 2023 08:46:16 +0100
Subject: [PATCH 0809/1043] Linux 5.10.203

Link: https://lore.kernel.org/r/20231205031530.557782248@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20231205043610.004070706@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20231205183249.651714114@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index ed0e42c99c90..4cbeb198196b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 202
+SUBLEVEL = 203
 EXTRAVERSION =
 NAME = Dare mighty things
 

From c02da4e69209ac59de406e22129ef29094c3867c Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Wed, 29 Nov 2023 14:30:07 +0000
Subject: [PATCH 0810/1043] Revert "mfd: core: Un-constify mfd_cell.of_reg"

This reverts commit 9f831533d2d094b7e6774bd127dcc92ee3ed6ebc which is
commit 3c70342f1f0045dc827bb2f02d814ce31e0e0d05 upstream.

It breaks the Android ABI and if it is really needed can come back in
the future in an ABI-safe way.

Bug: 161946584
Change-Id: I31531da478d4a3e87c532ab9c85980415e07b945
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/linux/mfd/core.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/mfd/core.h b/include/linux/mfd/core.h
index 8974c7142c94..4b35baa14d30 100644
--- a/include/linux/mfd/core.h
+++ b/include/linux/mfd/core.h
@@ -92,7 +92,7 @@ struct mfd_cell {
 	 * (above) when matching OF nodes with devices that have identical
 	 * compatible strings
 	 */
-	u64 of_reg;
+	const u64 of_reg;
 
 	/* Set to 'true' to use 'of_reg' (above) - allows for of_reg=0 */
 	bool use_of_reg;

From 8f05c3a25663df6ebf7f5d61d90df390a24ac444 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Wed, 29 Nov 2023 14:26:31 +0000
Subject: [PATCH 0811/1043] Revert "arm64/arm: xen: enlighten: Fix KPTI checks"

This reverts commit 666a4120dcf66586bdabd1b67a0d00507394fb14 which is
commit 20f3b8eafe0ba5d3c69d5011a9b07739e9645132 upstream.

It breaks the Android ABI and we do not care about Xen on Android, so it
is safe to revert.

Bug: 161946584
Change-Id: I4bf8a87650256a5f4b2faee626557604631ee286
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 arch/arm/xen/enlighten.c   | 25 +++++++++----------------
 include/linux/cpuhotplug.h |  1 -
 2 files changed, 9 insertions(+), 17 deletions(-)

diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index 27277d6bbfa5..7f1c106b746f 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -159,6 +159,9 @@ static int xen_starting_cpu(unsigned int cpu)
 	BUG_ON(err);
 	per_cpu(xen_vcpu, cpu) = vcpup;
 
+	if (!xen_kernel_unmapped_at_usr())
+		xen_setup_runstate_info(cpu);
+
 after_register_vcpu_info:
 	enable_percpu_irq(xen_events_irq, 0);
 	return 0;
@@ -391,6 +394,9 @@ static int __init xen_guest_init(void)
 		return -EINVAL;
 	}
 
+	if (!xen_kernel_unmapped_at_usr())
+		xen_time_setup_guest();
+
 	if (xen_initial_domain())
 		pvclock_gtod_register_notifier(&xen_pvclock_gtod_notifier);
 
@@ -400,13 +406,7 @@ static int __init xen_guest_init(void)
 }
 early_initcall(xen_guest_init);
 
-static int xen_starting_runstate_cpu(unsigned int cpu)
-{
-	xen_setup_runstate_info(cpu);
-	return 0;
-}
-
-static int __init xen_late_init(void)
+static int __init xen_pm_init(void)
 {
 	if (!xen_domain())
 		return -ENODEV;
@@ -419,16 +419,9 @@ static int __init xen_late_init(void)
 		do_settimeofday64(&ts);
 	}
 
-	if (xen_kernel_unmapped_at_usr())
-		return 0;
-
-	xen_time_setup_guest();
-
-	return cpuhp_setup_state(CPUHP_AP_ARM_XEN_RUNSTATE_STARTING,
-				 "arm/xen_runstate:starting",
-				 xen_starting_runstate_cpu, NULL);
+	return 0;
 }
-late_initcall(xen_late_init);
+late_initcall(xen_pm_init);
 
 
 /* empty stubs */
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index efee21176847..843bb056b8c6 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -144,7 +144,6 @@ enum cpuhp_state {
 	/* Must be the last timer callback */
 	CPUHP_AP_DUMMY_TIMER_STARTING,
 	CPUHP_AP_ARM_XEN_STARTING,
-	CPUHP_AP_ARM_XEN_RUNSTATE_STARTING,
 	CPUHP_AP_ARM_CORESIGHT_STARTING,
 	CPUHP_AP_ARM_CORESIGHT_CTI_STARTING,
 	CPUHP_AP_ARM64_ISNDEP_STARTING,

From ddeac706a10bf235d0e752531d3131c793c373ea Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Wed, 29 Nov 2023 14:33:16 +0000
Subject: [PATCH 0812/1043] Revert "inet: shrink struct flowi_common"

This reverts commit f830d4f6983587e6316050dbc9d94befefe4be36 which is
commit 1726483b79a72e0150734d5367e4a0238bf8fcff upstream.

It only moves things around a structure, AND it saves lots of memory,
but in doing so breaks the stable Android ABI, so it must be reverted
(Android devices have plenty of kernel memory...)  If this is to come
back in the future, it can do so in an abi-safe way.

Bug: 161946584
Change-Id: I5a5a40c6f6982122d766f3fe5cfde3f3514bc9ae
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/net/flow.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/net/flow.h b/include/net/flow.h
index 764b1882b49b..39d0cedcddee 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -39,8 +39,8 @@ struct flowi_common {
 #define FLOWI_FLAG_SKIP_NH_OIF		0x04
 	__u32	flowic_secid;
 	kuid_t  flowic_uid;
-	__u32		flowic_multipath_hash;
 	struct flowi_tunnel flowic_tun_key;
+	__u32		flowic_multipath_hash;
 };
 
 union flowi_uli {

From 53595e1cbfbabc1a8a9ede37988ed3287d9b6020 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Thu, 30 Nov 2023 11:45:36 +0000
Subject: [PATCH 0813/1043] Revert "ipvlan: properly track tx_errors"

This reverts commit 9954a7f3808b22b9e7d9e16c8547eb58784a7357 which is
commit ff672b9ffeb3f82135488ac16c5c5eb4b992999b upstream.

It breaks the build as an ABI-breaking change was reverted before this.
if this is needed, it can be brought back in an abi-safe way, but as
Android does not use the ipvlan code, it's probably not needed.

Bug: 161946584
Change-Id: I7e053b55bea4cac028ed7d65516a886d29c0476d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/net/ipvlan/ipvlan_core.c | 8 ++++----
 drivers/net/ipvlan/ipvlan_main.c | 1 -
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index b5a61b16a7ea..ab09d110760e 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -442,12 +442,12 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb)
 
 	err = ip_local_out(net, skb->sk, skb);
 	if (unlikely(net_xmit_eval(err)))
-		DEV_STATS_INC(dev, tx_errors);
+		dev->stats.tx_errors++;
 	else
 		ret = NET_XMIT_SUCCESS;
 	goto out;
 err:
-	DEV_STATS_INC(dev, tx_errors);
+	dev->stats.tx_errors++;
 	kfree_skb(skb);
 out:
 	return ret;
@@ -483,12 +483,12 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
 
 	err = ip6_local_out(net, skb->sk, skb);
 	if (unlikely(net_xmit_eval(err)))
-		DEV_STATS_INC(dev, tx_errors);
+		dev->stats.tx_errors++;
 	else
 		ret = NET_XMIT_SUCCESS;
 	goto out;
 err:
-	DEV_STATS_INC(dev, tx_errors);
+	dev->stats.tx_errors++;
 	kfree_skb(skb);
 out:
 	return ret;
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index f59ef2e2a614..93be7dd571fc 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -322,7 +322,6 @@ static void ipvlan_get_stats64(struct net_device *dev,
 		s->rx_dropped = rx_errs;
 		s->tx_dropped = tx_drps;
 	}
-	s->tx_errors = DEV_STATS_READ(dev, tx_errors);
 }
 
 static int ipvlan_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)

From 39feca394317e6cc0d8ad6de7c538a166ea755d5 Mon Sep 17 00:00:00 2001
From: Mike Tipton <mdtipton@codeaurora.org>
Date: Fri, 23 Jun 2023 14:50:42 +0200
Subject: [PATCH 0814/1043] UPSTREAM: interconnect: qcom: Add support for
 mask-based BCMs

commit d8630f050d3fd2079f8617dd6c00c6509109c755 upstream.

Some BCMs aren't directly associated with the data path (i.e. ACV) and
therefore don't communicate using BW. Instead, they are simply
enabled/disabled with a simple bit mask. Add support for these.

Origin commit retrieved from:
https://git.codelinaro.org/clo/la/kernel/msm-5.15/-/commit/2d1573e0206998151b342e6b52a4c0f7234d7e36

Change-Id: Iad440f95e2756196de9ed9bc1ea1d543d21c990e
Signed-off-by: Mike Tipton <mdtipton@codeaurora.org>
[narmstrong: removed copyright change from original commit]
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230619-topic-sm8550-upstream-interconnect-mask-vote-v2-1-709474b151cc@linaro.org
Fixes: fafc114a468e ("interconnect: qcom: Add SM8450 interconnect provider driver")
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 610057f4f6e01dd7289f6144059ca6fd87ea3488)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/interconnect/qcom/bcm-voter.c | 5 +++++
 drivers/interconnect/qcom/icc-rpmh.h  | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/drivers/interconnect/qcom/bcm-voter.c b/drivers/interconnect/qcom/bcm-voter.c
index dd0e3bd50b94..1bf16c551fb8 100644
--- a/drivers/interconnect/qcom/bcm-voter.c
+++ b/drivers/interconnect/qcom/bcm-voter.c
@@ -90,6 +90,11 @@ static void bcm_aggregate(struct qcom_icc_bcm *bcm)
 
 		temp = agg_peak[bucket] * bcm->vote_scale;
 		bcm->vote_y[bucket] = bcm_div(temp, bcm->aux_data.unit);
+
+		if (bcm->enable_mask && (bcm->vote_x[bucket] || bcm->vote_y[bucket])) {
+			bcm->vote_x[bucket] = 0;
+			bcm->vote_y[bucket] = bcm->enable_mask;
+		}
 	}
 
 	if (bcm->keepalive && bcm->vote_x[QCOM_ICC_BUCKET_AMC] == 0 &&
diff --git a/drivers/interconnect/qcom/icc-rpmh.h b/drivers/interconnect/qcom/icc-rpmh.h
index e5f61ab989e7..029a350c2884 100644
--- a/drivers/interconnect/qcom/icc-rpmh.h
+++ b/drivers/interconnect/qcom/icc-rpmh.h
@@ -81,6 +81,7 @@ struct qcom_icc_node {
  * @vote_x: aggregated threshold values, represents sum_bw when @type is bw bcm
  * @vote_y: aggregated threshold values, represents peak_bw when @type is bw bcm
  * @vote_scale: scaling factor for vote_x and vote_y
+ * @enable_mask: optional mask to send as vote instead of vote_x/vote_y
  * @dirty: flag used to indicate whether the bcm needs to be committed
  * @keepalive: flag used to indicate whether a keepalive is required
  * @aux_data: auxiliary data used when calculating threshold values and
@@ -97,6 +98,7 @@ struct qcom_icc_bcm {
 	u64 vote_x[QCOM_ICC_NUM_BUCKETS];
 	u64 vote_y[QCOM_ICC_NUM_BUCKETS];
 	u64 vote_scale;
+	u32 enable_mask;
 	bool dirty;
 	bool keepalive;
 	struct bcm_db aux_data;

From 2e1e5e63dd11a95e8d2531f5362dd8f344501fff Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 11 Dec 2023 08:50:08 +0000
Subject: [PATCH 0815/1043] Revert "tracing: Have trace_event_file have ref
 counters"

This reverts commit a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f which is
commit bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 upstream.

It breaks the current Android ABI, and if needed, can be brought back in
an abi-safe way in the future.

Bug: 161946584
Change-Id: If981a67442122352b1836c6e75ba2a462cbc731d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/linux/trace_events.h       |  4 ---
 kernel/trace/trace.c               | 15 -----------
 kernel/trace/trace.h               |  3 ---
 kernel/trace/trace_events.c        | 43 +++++++++++-------------------
 kernel/trace/trace_events_filter.c |  3 ---
 5 files changed, 15 insertions(+), 53 deletions(-)

diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index d0788f879fc8..113b42a10026 100644
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h
@@ -365,7 +365,6 @@ enum {
 	EVENT_FILE_FL_TRIGGER_COND_BIT,
 	EVENT_FILE_FL_PID_FILTER_BIT,
 	EVENT_FILE_FL_WAS_ENABLED_BIT,
-	EVENT_FILE_FL_FREED_BIT,
 };
 
 extern struct trace_event_file *trace_get_event_file(const char *instance,
@@ -504,7 +503,6 @@ extern int __kprobe_event_add_fields(struct dynevent_cmd *cmd, ...);
  *  TRIGGER_COND  - When set, one or more triggers has an associated filter
  *  PID_FILTER    - When set, the event is filtered based on pid
  *  WAS_ENABLED   - Set when enabled to know to clear trace on module removal
- *  FREED         - File descriptor is freed, all fields should be considered invalid
  */
 enum {
 	EVENT_FILE_FL_ENABLED		= (1 << EVENT_FILE_FL_ENABLED_BIT),
@@ -518,7 +516,6 @@ enum {
 	EVENT_FILE_FL_TRIGGER_COND	= (1 << EVENT_FILE_FL_TRIGGER_COND_BIT),
 	EVENT_FILE_FL_PID_FILTER	= (1 << EVENT_FILE_FL_PID_FILTER_BIT),
 	EVENT_FILE_FL_WAS_ENABLED	= (1 << EVENT_FILE_FL_WAS_ENABLED_BIT),
-	EVENT_FILE_FL_FREED		= (1 << EVENT_FILE_FL_FREED_BIT),
 };
 
 struct trace_event_file {
@@ -547,7 +544,6 @@ struct trace_event_file {
 	 * caching and such. Which is mostly OK ;-)
 	 */
 	unsigned long		flags;
-	atomic_t		ref;	/* ref count for opened files */
 	atomic_t		sm_ref;	/* soft-mode reference counter */
 	atomic_t		tm_ref;	/* trigger-mode reference counter */
 };
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 150376107dfd..3992a50cb59a 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4507,20 +4507,6 @@ int tracing_open_file_tr(struct inode *inode, struct file *filp)
 	if (ret)
 		return ret;
 
-	mutex_lock(&event_mutex);
-
-	/* Fail if the file is marked for removal */
-	if (file->flags & EVENT_FILE_FL_FREED) {
-		trace_array_put(file->tr);
-		ret = -ENODEV;
-	} else {
-		event_file_get(file);
-	}
-
-	mutex_unlock(&event_mutex);
-	if (ret)
-		return ret;
-
 	filp->private_data = inode->i_private;
 
 	return 0;
@@ -4531,7 +4517,6 @@ int tracing_release_file_tr(struct inode *inode, struct file *filp)
 	struct trace_event_file *file = inode->i_private;
 
 	trace_array_put(file->tr);
-	event_file_put(file);
 
 	return 0;
 }
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 3926aeaeedad..7ac8b93a47be 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -1780,9 +1780,6 @@ extern int register_event_command(struct event_command *cmd);
 extern int unregister_event_command(struct event_command *cmd);
 extern int register_trigger_hist_enable_disable_cmds(void);
 
-extern void event_file_get(struct trace_event_file *file);
-extern void event_file_put(struct trace_event_file *file);
-
 /**
  * struct event_trigger_ops - callbacks for trace event triggers
  *
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 4b5a8d7275be..c7f0a02442e5 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -746,38 +746,26 @@ static void remove_subsystem(struct trace_subsystem_dir *dir)
 	}
 }
 
-void event_file_get(struct trace_event_file *file)
-{
-	atomic_inc(&file->ref);
-}
-
-void event_file_put(struct trace_event_file *file)
-{
-	if (WARN_ON_ONCE(!atomic_read(&file->ref))) {
-		if (file->flags & EVENT_FILE_FL_FREED)
-			kmem_cache_free(file_cachep, file);
-		return;
-	}
-
-	if (atomic_dec_and_test(&file->ref)) {
-		/* Count should only go to zero when it is freed */
-		if (WARN_ON_ONCE(!(file->flags & EVENT_FILE_FL_FREED)))
-			return;
-		kmem_cache_free(file_cachep, file);
-	}
-}
-
 static void remove_event_file_dir(struct trace_event_file *file)
 {
 	struct dentry *dir = file->dir;
+	struct dentry *child;
 
-	tracefs_remove(dir);
+	if (dir) {
+		spin_lock(&dir->d_lock);	/* probably unneeded */
+		list_for_each_entry(child, &dir->d_subdirs, d_child) {
+			if (d_really_is_positive(child))	/* probably unneeded */
+				d_inode(child)->i_private = NULL;
+		}
+		spin_unlock(&dir->d_lock);
+
+		tracefs_remove(dir);
+	}
 
 	list_del(&file->list);
 	remove_subsystem(file->system);
 	free_event_filter(file->filter);
-	file->flags |= EVENT_FILE_FL_FREED;
-	event_file_put(file);
+	kmem_cache_free(file_cachep, file);
 }
 
 /*
@@ -1150,7 +1138,7 @@ event_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
 		flags = file->flags;
 	mutex_unlock(&event_mutex);
 
-	if (!file || flags & EVENT_FILE_FL_FREED)
+	if (!file)
 		return -ENODEV;
 
 	if (flags & EVENT_FILE_FL_ENABLED &&
@@ -1188,7 +1176,7 @@ event_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
 		ret = -ENODEV;
 		mutex_lock(&event_mutex);
 		file = event_file_data(filp);
-		if (likely(file && !(file->flags & EVENT_FILE_FL_FREED)))
+		if (likely(file))
 			ret = ftrace_event_enable_disable(file, val);
 		mutex_unlock(&event_mutex);
 		break;
@@ -1457,7 +1445,7 @@ event_filter_read(struct file *filp, char __user *ubuf, size_t cnt,
 
 	mutex_lock(&event_mutex);
 	file = event_file_data(filp);
-	if (file && !(file->flags & EVENT_FILE_FL_FREED))
+	if (file)
 		print_event_filter(file, s);
 	mutex_unlock(&event_mutex);
 
@@ -2494,7 +2482,6 @@ trace_create_new_event(struct trace_event_call *call,
 	atomic_set(&file->tm_ref, 0);
 	INIT_LIST_HEAD(&file->triggers);
 	list_add(&file->list, &tr->events);
-	event_file_get(file);
 
 	return file;
 }
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index c1db5b62d811..a255ffbe342f 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1893,9 +1893,6 @@ int apply_event_filter(struct trace_event_file *file, char *filter_string)
 	struct event_filter *filter = NULL;
 	int err;
 
-	if (file->flags & EVENT_FILE_FL_FREED)
-		return -ENODEV;
-
 	if (!strcmp(strstrip(filter_string), "0")) {
 		filter_disable(file);
 		filter = event_filter(file);

From f6509591ffb63eb3a1029bd6377a38f07e5526f9 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 11 Dec 2023 08:52:01 +0000
Subject: [PATCH 0816/1043] Revert "ASoC: soc-card: Add storage for PCI SSID"

This reverts commit 98fa52d89a4f492b1dfd6527b68ca5ae6dc1fc23 which is
commit 47f56e38a199bd45514b8e0142399cba4feeaf1a upstream.

It breaks the current Android ABI, and if needed, can be brought back in an
abi-safe way in the future.

Bug: 161946584
Change-Id: Id1365ae92d3fef88cb8e0575b6b258d244092404
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/sound/soc-card.h | 37 -------------------------------------
 include/sound/soc.h      | 11 -----------
 2 files changed, 48 deletions(-)

diff --git a/include/sound/soc-card.h b/include/sound/soc-card.h
index 9a5429260ece..4f2cc4fb56b7 100644
--- a/include/sound/soc-card.h
+++ b/include/sound/soc-card.h
@@ -40,43 +40,6 @@ int snd_soc_card_add_dai_link(struct snd_soc_card *card,
 void snd_soc_card_remove_dai_link(struct snd_soc_card *card,
 				  struct snd_soc_dai_link *dai_link);
 
-#ifdef CONFIG_PCI
-static inline void snd_soc_card_set_pci_ssid(struct snd_soc_card *card,
-					     unsigned short vendor,
-					     unsigned short device)
-{
-	card->pci_subsystem_vendor = vendor;
-	card->pci_subsystem_device = device;
-	card->pci_subsystem_set = true;
-}
-
-static inline int snd_soc_card_get_pci_ssid(struct snd_soc_card *card,
-					    unsigned short *vendor,
-					    unsigned short *device)
-{
-	if (!card->pci_subsystem_set)
-		return -ENOENT;
-
-	*vendor = card->pci_subsystem_vendor;
-	*device = card->pci_subsystem_device;
-
-	return 0;
-}
-#else /* !CONFIG_PCI */
-static inline void snd_soc_card_set_pci_ssid(struct snd_soc_card *card,
-					     unsigned short vendor,
-					     unsigned short device)
-{
-}
-
-static inline int snd_soc_card_get_pci_ssid(struct snd_soc_card *card,
-					    unsigned short *vendor,
-					    unsigned short *device)
-{
-	return -ENOENT;
-}
-#endif /* CONFIG_PCI */
-
 /* device driver data */
 static inline void snd_soc_card_set_drvdata(struct snd_soc_card *card,
 					    void *data)
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 87681b2ab892..63338f68de48 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -990,17 +990,6 @@ struct snd_soc_card {
 #ifdef CONFIG_DMI
 	char dmi_longname[80];
 #endif /* CONFIG_DMI */
-
-#ifdef CONFIG_PCI
-	/*
-	 * PCI does not define 0 as invalid, so pci_subsystem_set indicates
-	 * whether a value has been written to these fields.
-	 */
-	unsigned short pci_subsystem_vendor;
-	unsigned short pci_subsystem_device;
-	bool pci_subsystem_set;
-#endif /* CONFIG_PCI */
-
 	char topology_shortname[32];
 
 	struct device *dev;

From 76b525ba5973d5eea1bd1b3e636bb0ac36ef09f7 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 11 Dec 2023 12:17:03 +0000
Subject: [PATCH 0817/1043] ANDROID: Fix up ipvlan merge in 5.10.202

In commit 43b781e7cb5c ("ipvlan: add ipvlan_route_v6_outbound()
helper"), DEV_STATS_INC() is used, but that's not a valid api in the
5.10.y Android tree due to it breaking the abi.  So fix this up by hand
to use the "old-style" stats increment call to resolve the build issues.

Fixes: 43b781e7cb5c ("ipvlan: add ipvlan_route_v6_outbound() helper")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id7bdb1b5f742ae32b7f9e8f6db808c5763a8394c
---
 drivers/net/ipvlan/ipvlan_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 77f27bdfac9c..34e4673e5ce5 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -488,7 +488,7 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
 
 	err = ipvlan_route_v6_outbound(dev, skb);
 	if (unlikely(err)) {
-		DEV_STATS_INC(dev, tx_errors);
+		dev->stats.tx_errors++;
 		kfree_skb(skb);
 		return err;
 	}
@@ -497,7 +497,7 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
 
 	err = ip6_local_out(dev_net(dev), skb->sk, skb);
 	if (unlikely(net_xmit_eval(err)))
-		DEV_STATS_INC(dev, tx_errors);
+		dev->stats.tx_errors++;
 	else
 		ret = NET_XMIT_SUCCESS;
 	return ret;

From 84f9dd98b78451b72c1becbd2207539982ade762 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Tue, 12 Dec 2023 08:09:44 +0000
Subject: [PATCH 0818/1043] Revert "wireguard: use DEV_STATS_INC()"

This reverts commit 9942c194834642792331cf002c94c8e6d158609d which is
commit 93da8d75a66568ba4bb5b14ad2833acd7304cd02 upstream.

DEV_STATS_INC() is not in the tree as it breaks the Android abi, so
revert this commit as it breaks the build.

Bug: 161946584
Change-Id: Ifb53ff1c335048ef74c2fc26480a3689448f0808
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/net/wireguard/device.c  |  4 ++--
 drivers/net/wireguard/receive.c | 12 ++++++------
 drivers/net/wireguard/send.c    |  3 +--
 3 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c
index 713ca20feaef..e0693cd965ec 100644
--- a/drivers/net/wireguard/device.c
+++ b/drivers/net/wireguard/device.c
@@ -193,7 +193,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
 	 */
 	while (skb_queue_len(&peer->staged_packet_queue) > MAX_STAGED_PACKETS) {
 		dev_kfree_skb(__skb_dequeue(&peer->staged_packet_queue));
-		DEV_STATS_INC(dev, tx_dropped);
+		++dev->stats.tx_dropped;
 	}
 	skb_queue_splice_tail(&packets, &peer->staged_packet_queue);
 	spin_unlock_bh(&peer->staged_packet_queue.lock);
@@ -211,7 +211,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
 	else if (skb->protocol == htons(ETH_P_IPV6))
 		icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
 err:
-	DEV_STATS_INC(dev, tx_errors);
+	++dev->stats.tx_errors;
 	kfree_skb(skb);
 	return ret;
 }
diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c
index d38b24339a1f..f500aaf67837 100644
--- a/drivers/net/wireguard/receive.c
+++ b/drivers/net/wireguard/receive.c
@@ -423,20 +423,20 @@ static void wg_packet_consume_data_done(struct wg_peer *peer,
 	net_dbg_skb_ratelimited("%s: Packet has unallowed src IP (%pISc) from peer %llu (%pISpfsc)\n",
 				dev->name, skb, peer->internal_id,
 				&peer->endpoint.addr);
-	DEV_STATS_INC(dev, rx_errors);
-	DEV_STATS_INC(dev, rx_frame_errors);
+	++dev->stats.rx_errors;
+	++dev->stats.rx_frame_errors;
 	goto packet_processed;
 dishonest_packet_type:
 	net_dbg_ratelimited("%s: Packet is neither ipv4 nor ipv6 from peer %llu (%pISpfsc)\n",
 			    dev->name, peer->internal_id, &peer->endpoint.addr);
-	DEV_STATS_INC(dev, rx_errors);
-	DEV_STATS_INC(dev, rx_frame_errors);
+	++dev->stats.rx_errors;
+	++dev->stats.rx_frame_errors;
 	goto packet_processed;
 dishonest_packet_size:
 	net_dbg_ratelimited("%s: Packet has incorrect size from peer %llu (%pISpfsc)\n",
 			    dev->name, peer->internal_id, &peer->endpoint.addr);
-	DEV_STATS_INC(dev, rx_errors);
-	DEV_STATS_INC(dev, rx_length_errors);
+	++dev->stats.rx_errors;
+	++dev->stats.rx_length_errors;
 	goto packet_processed;
 packet_processed:
 	dev_kfree_skb(skb);
diff --git a/drivers/net/wireguard/send.c b/drivers/net/wireguard/send.c
index 0d48e0f4a1ba..95c853b59e1d 100644
--- a/drivers/net/wireguard/send.c
+++ b/drivers/net/wireguard/send.c
@@ -333,8 +333,7 @@ static void wg_packet_create_data(struct wg_peer *peer, struct sk_buff *first)
 void wg_packet_purge_staged_packets(struct wg_peer *peer)
 {
 	spin_lock_bh(&peer->staged_packet_queue.lock);
-	DEV_STATS_ADD(peer->device->dev, tx_dropped,
-		      peer->staged_packet_queue.qlen);
+	peer->device->dev->stats.tx_dropped += peer->staged_packet_queue.qlen;
 	__skb_queue_purge(&peer->staged_packet_queue);
 	spin_unlock_bh(&peer->staged_packet_queue.lock);
 }

From b8a7e36e04dc3bd3fb029f17ddd648e9cf0752dc Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Tue, 12 Dec 2023 15:19:29 +0000
Subject: [PATCH 0819/1043] Revert "HID: fix HID device resource race between
 HID core and debugging support"

This reverts commit f8467afa754d734ca061fcaa174b2ceaebcba842 which is
commit fc43e9c857b7aa55efba9398419b14d9e35dcc7d upstream.

It breaks the current Android ABI, and if needed, can be brought back in
an abi-safe way in the future.

Bug: 161946584
Change-Id: I38d2bef8b98b0a915b74889c2bc49e12c118195a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/hid/hid-core.c  | 14 +++-----------
 drivers/hid/hid-debug.c |  3 ---
 include/linux/hid.h     |  3 ---
 3 files changed, 3 insertions(+), 17 deletions(-)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index ef325f178e9a..f950e930edc8 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -703,20 +703,13 @@ static void hid_close_report(struct hid_device *device)
  * Free a device structure, all reports, and all fields.
  */
 
-void hiddev_free(struct kref *ref)
-{
-	struct hid_device *hid = container_of(ref, struct hid_device, ref);
-
-	hid_close_report(hid);
-	kfree(hid->dev_rdesc);
-	kfree(hid);
-}
-
 static void hid_device_release(struct device *dev)
 {
 	struct hid_device *hid = to_hid_device(dev);
 
-	kref_put(&hid->ref, hiddev_free);
+	hid_close_report(hid);
+	kfree(hid->dev_rdesc);
+	kfree(hid);
 }
 
 /*
@@ -2500,7 +2493,6 @@ struct hid_device *hid_allocate_device(void)
 	spin_lock_init(&hdev->debug_list_lock);
 	sema_init(&hdev->driver_input_lock, 1);
 	mutex_init(&hdev->ll_open_lock);
-	kref_init(&hdev->ref);
 
 	return hdev;
 }
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index 81da80f0c75b..1f60a381ae63 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -1082,7 +1082,6 @@ static int hid_debug_events_open(struct inode *inode, struct file *file)
 		goto out;
 	}
 	list->hdev = (struct hid_device *) inode->i_private;
-	kref_get(&list->hdev->ref);
 	file->private_data = list;
 	mutex_init(&list->read_mutex);
 
@@ -1175,8 +1174,6 @@ static int hid_debug_events_release(struct inode *inode, struct file *file)
 	list_del(&list->node);
 	spin_unlock_irqrestore(&list->hdev->debug_list_lock, flags);
 	kfifo_free(&list->hid_debug_fifo);
-
-	kref_put(&list->hdev->ref, hiddev_free);
 	kfree(list);
 
 	return 0;
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 29fb705a27be..7e8a233ad7af 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -624,13 +624,10 @@ struct hid_device {							/* device report descriptor */
 	struct list_head debug_list;
 	spinlock_t  debug_list_lock;
 	wait_queue_head_t debug_wait;
-	struct kref			ref;
 
 	unsigned int id;						/* system unique id */
 };
 
-void hiddev_free(struct kref *ref);
-
 #define to_hid_device(pdev) \
 	container_of(pdev, struct hid_device, dev)
 

From 4b7ed9373abd9b1283ccc9bd9f6d79f20486ccca Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Tue, 12 Dec 2023 15:19:41 +0000
Subject: [PATCH 0820/1043] Revert "HID: core: store the unique system
 identifier in hid_device"

This reverts commit 2f0ea5e0944a912075c0f943483a36e6dd5aac6f which is
commit 1e839143d674603b0bbbc4c513bca35404967dbc upstream.

It breaks the current Android ABI, and if needed, can be brought back in
an abi-safe way in the future.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Idfcb1fccdf3e86ebd34acc41041fe0893ddb0855
---
 drivers/hid/hid-core.c | 4 +---
 include/linux/hid.h    | 2 --
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f950e930edc8..b007074a30ec 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2445,12 +2445,10 @@ int hid_add_device(struct hid_device *hdev)
 			hid_warn(hdev, "bad device descriptor (%d)\n", ret);
 	}
 
-	hdev->id = atomic_inc_return(&id);
-
 	/* XXX hack, any other cleaner solution after the driver core
 	 * is converted to allow more than 20 bytes as the device name? */
 	dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
-		     hdev->vendor, hdev->product, hdev->id);
+		     hdev->vendor, hdev->product, atomic_inc_return(&id));
 
 	hid_debug_register(hdev, dev_name(&hdev->dev));
 	ret = device_add(&hdev->dev);
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 7e8a233ad7af..2ba33d708942 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -624,8 +624,6 @@ struct hid_device {							/* device report descriptor */
 	struct list_head debug_list;
 	spinlock_t  debug_list_lock;
 	wait_queue_head_t debug_wait;
-
-	unsigned int id;						/* system unique id */
 };
 
 #define to_hid_device(pdev) \

From 51753f24099f7d21aa28585be05aefd5c0dad17e Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Tue, 12 Dec 2023 15:22:06 +0000
Subject: [PATCH 0821/1043] Revert "drm/amdgpu: don't use ATRM for external
 devices"

This reverts commit 8d4237a149e32e0243f44c3e368e59cbac0f0822 which is
commit 432e664e7c98c243fab4c3c95bd463bea3aeed28 upstream.

It breaks the current Android ABI, and if needed, can be brought back in
an abi-safe way in the future.

Bug: 161946584
Change-Id: I4465f1886d5a4a886ac4ba6de4e77f14de20a145
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
index 02a73b9e08d7..4b568ee93243 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
@@ -29,7 +29,6 @@
 #include "amdgpu.h"
 #include "atom.h"
 
-#include <linux/device.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
 #include <linux/acpi.h>
@@ -286,10 +285,6 @@ static bool amdgpu_atrm_get_bios(struct amdgpu_device *adev)
 	if (adev->flags & AMD_IS_APU)
 		return false;
 
-	/* ATRM is for on-platform devices only */
-	if (dev_is_removable(&adev->pdev->dev))
-		return false;
-
 	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
 		dhandle = ACPI_HANDLE(&pdev->dev);
 		if (!dhandle)

From 4a3e1eda870eea5d9cc96e14fa4b251872505703 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Tue, 12 Dec 2023 15:22:07 +0000
Subject: [PATCH 0822/1043] Revert "driver core: Move the "removable" attribute
 from USB to core"

This reverts commit 2df04d76c97dfc7ec0c00a949d13049e48790903 which is
commit 70f400d4d957c2453c8689552ff212bc59f88938 upstream.

It breaks the current Android ABI, and if needed, can be brought back in
an abi-safe way in the future.

Bug: 161946584
Change-Id: I0d2a53863c50129aef373dafe91d4554d71f54a8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 Documentation/ABI/testing/sysfs-bus-usb       | 11 ++++++
 .../ABI/testing/sysfs-devices-removable       | 17 ---------
 drivers/base/core.c                           | 28 --------------
 drivers/usb/core/hub.c                        | 13 +++----
 drivers/usb/core/sysfs.c                      | 24 ++++++++++++
 include/linux/device.h                        | 37 -------------------
 include/linux/usb.h                           |  7 ++++
 7 files changed, 48 insertions(+), 89 deletions(-)
 delete mode 100644 Documentation/ABI/testing/sysfs-devices-removable

diff --git a/Documentation/ABI/testing/sysfs-bus-usb b/Documentation/ABI/testing/sysfs-bus-usb
index 73eb23bc1f34..bf2c1968525f 100644
--- a/Documentation/ABI/testing/sysfs-bus-usb
+++ b/Documentation/ABI/testing/sysfs-bus-usb
@@ -154,6 +154,17 @@ Description:
 		files hold a string value (enable or disable) indicating whether
 		or not USB3 hardware LPM U1 or U2 is enabled for the device.
 
+What:		/sys/bus/usb/devices/.../removable
+Date:		February 2012
+Contact:	Matthew Garrett <mjg@redhat.com>
+Description:
+		Some information about whether a given USB device is
+		physically fixed to the platform can be inferred from a
+		combination of hub descriptor bits and platform-specific data
+		such as ACPI. This file will read either "removable" or
+		"fixed" if the information is available, and "unknown"
+		otherwise.
+
 What:		/sys/bus/usb/devices/.../ltm_capable
 Date:		July 2012
 Contact:	Sarah Sharp <sarah.a.sharp@linux.intel.com>
diff --git a/Documentation/ABI/testing/sysfs-devices-removable b/Documentation/ABI/testing/sysfs-devices-removable
deleted file mode 100644
index acf7766e800b..000000000000
--- a/Documentation/ABI/testing/sysfs-devices-removable
+++ /dev/null
@@ -1,17 +0,0 @@
-What:		/sys/devices/.../removable
-Date:		May 2021
-Contact:	Rajat Jain <rajatxjain@gmail.com>
-Description:
-		Information about whether a given device can be removed from the
-		platform by the	user. This is determined by its subsystem in a
-		bus / platform-specific way. This attribute is only present for
-		devices that can support determining such information:
-
-		"removable": device can be removed from the platform by the user
-		"fixed":     device is fixed to the platform / cannot be removed
-			     by the user.
-		"unknown":   The information is unavailable / cannot be deduced.
-
-		Currently this is only supported by USB (which infers the
-		information from a combination of hub descriptor bits and
-		platform-specific data such as ACPI).
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 4e54d0ce9091..a5f85b2cf212 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2338,25 +2338,6 @@ static ssize_t online_store(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RW(online);
 
-static ssize_t removable_show(struct device *dev, struct device_attribute *attr,
-			      char *buf)
-{
-	const char *loc;
-
-	switch (dev->removable) {
-	case DEVICE_REMOVABLE:
-		loc = "removable";
-		break;
-	case DEVICE_FIXED:
-		loc = "fixed";
-		break;
-	default:
-		loc = "unknown";
-	}
-	return sysfs_emit(buf, "%s\n", loc);
-}
-static DEVICE_ATTR_RO(removable);
-
 int device_add_groups(struct device *dev, const struct attribute_group **groups)
 {
 	return sysfs_create_groups(&dev->kobj, groups);
@@ -2534,16 +2515,8 @@ static int device_add_attrs(struct device *dev)
 			goto err_remove_dev_online;
 	}
 
-	if (dev_removable_is_valid(dev)) {
-		error = device_create_file(dev, &dev_attr_removable);
-		if (error)
-			goto err_remove_dev_waiting_for_supplier;
-	}
-
 	return 0;
 
- err_remove_dev_waiting_for_supplier:
-	device_remove_file(dev, &dev_attr_waiting_for_supplier);
  err_remove_dev_online:
 	device_remove_file(dev, &dev_attr_online);
  err_remove_dev_groups:
@@ -2563,7 +2536,6 @@ static void device_remove_attrs(struct device *dev)
 	struct class *class = dev->class;
 	const struct device_type *type = dev->type;
 
-	device_remove_file(dev, &dev_attr_removable);
 	device_remove_file(dev, &dev_attr_waiting_for_supplier);
 	device_remove_file(dev, &dev_attr_online);
 	device_remove_groups(dev, dev->groups);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index dbda2f4ae2cd..f5b4f538a167 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2449,8 +2449,6 @@ static void set_usb_port_removable(struct usb_device *udev)
 	u16 wHubCharacteristics;
 	bool removable = true;
 
-	dev_set_removable(&udev->dev, DEVICE_REMOVABLE_UNKNOWN);
-
 	if (!hdev)
 		return;
 
@@ -2462,11 +2460,11 @@ static void set_usb_port_removable(struct usb_device *udev)
 	 */
 	switch (hub->ports[udev->portnum - 1]->connect_type) {
 	case USB_PORT_CONNECT_TYPE_HOT_PLUG:
-		dev_set_removable(&udev->dev, DEVICE_REMOVABLE);
+		udev->removable = USB_DEVICE_REMOVABLE;
 		return;
 	case USB_PORT_CONNECT_TYPE_HARD_WIRED:
 	case USB_PORT_NOT_USED:
-		dev_set_removable(&udev->dev, DEVICE_FIXED);
+		udev->removable = USB_DEVICE_FIXED;
 		return;
 	default:
 		break;
@@ -2491,9 +2489,9 @@ static void set_usb_port_removable(struct usb_device *udev)
 	}
 
 	if (removable)
-		dev_set_removable(&udev->dev, DEVICE_REMOVABLE);
+		udev->removable = USB_DEVICE_REMOVABLE;
 	else
-		dev_set_removable(&udev->dev, DEVICE_FIXED);
+		udev->removable = USB_DEVICE_FIXED;
 
 }
 
@@ -2565,7 +2563,8 @@ int usb_new_device(struct usb_device *udev)
 	device_enable_async_suspend(&udev->dev);
 
 	/* check whether the hub or firmware marks this port as non-removable */
-	set_usb_port_removable(udev);
+	if (udev->parent)
+		set_usb_port_removable(udev);
 
 	/* Register the device.  The device driver is responsible
 	 * for configuring the device and invoking the add-device
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index 35ce8b87e939..a2ca38e25e0c 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -298,6 +298,29 @@ static ssize_t urbnum_show(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RO(urbnum);
 
+static ssize_t removable_show(struct device *dev, struct device_attribute *attr,
+			      char *buf)
+{
+	struct usb_device *udev;
+	char *state;
+
+	udev = to_usb_device(dev);
+
+	switch (udev->removable) {
+	case USB_DEVICE_REMOVABLE:
+		state = "removable";
+		break;
+	case USB_DEVICE_FIXED:
+		state = "fixed";
+		break;
+	default:
+		state = "unknown";
+	}
+
+	return sprintf(buf, "%s\n", state);
+}
+static DEVICE_ATTR_RO(removable);
+
 static ssize_t ltm_capable_show(struct device *dev,
 				struct device_attribute *attr, char *buf)
 {
@@ -802,6 +825,7 @@ static struct attribute *dev_attrs[] = {
 	&dev_attr_avoid_reset_quirk.attr,
 	&dev_attr_authorized.attr,
 	&dev_attr_remove.attr,
+	&dev_attr_removable.attr,
 	&dev_attr_ltm_capable.attr,
 #ifdef CONFIG_OF
 	&dev_attr_devspec.attr,
diff --git a/include/linux/device.h b/include/linux/device.h
index 30854030077b..d534e7048223 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -351,22 +351,6 @@ enum dl_dev_state {
 	DL_DEV_UNBINDING,
 };
 
-/**
- * enum device_removable - Whether the device is removable. The criteria for a
- * device to be classified as removable is determined by its subsystem or bus.
- * @DEVICE_REMOVABLE_NOT_SUPPORTED: This attribute is not supported for this
- *				    device (default).
- * @DEVICE_REMOVABLE_UNKNOWN:  Device location is Unknown.
- * @DEVICE_FIXED: Device is not removable by the user.
- * @DEVICE_REMOVABLE: Device is removable by the user.
- */
-enum device_removable {
-	DEVICE_REMOVABLE_NOT_SUPPORTED = 0, /* must be 0 */
-	DEVICE_REMOVABLE_UNKNOWN,
-	DEVICE_FIXED,
-	DEVICE_REMOVABLE,
-};
-
 /**
  * struct dev_links_info - Device data related to device links.
  * @suppliers: List of links to supplier devices.
@@ -448,9 +432,6 @@ struct dev_links_info {
  * 		device (i.e. the bus driver that discovered the device).
  * @iommu_group: IOMMU group the device belongs to.
  * @iommu:	Per device generic IOMMU runtime data
- * @removable:  Whether the device can be removed from the system. This
- *              should be set by the subsystem / bus driver that discovered
- *              the device.
  *
  * @offline_disabled: If set, the device is permanently online.
  * @offline:	Set after successful invocation of bus type's .offline().
@@ -561,8 +542,6 @@ struct device {
 	struct iommu_group	*iommu_group;
 	struct dev_iommu	*iommu;
 
-	enum device_removable	removable;
-
 	bool			offline_disabled:1;
 	bool			offline:1;
 	bool			of_node_reused:1;
@@ -812,22 +791,6 @@ static inline bool dev_has_sync_state(struct device *dev)
 	return false;
 }
 
-static inline void dev_set_removable(struct device *dev,
-				     enum device_removable removable)
-{
-	dev->removable = removable;
-}
-
-static inline bool dev_is_removable(struct device *dev)
-{
-	return dev->removable == DEVICE_REMOVABLE;
-}
-
-static inline bool dev_removable_is_valid(struct device *dev)
-{
-	return dev->removable != DEVICE_REMOVABLE_NOT_SUPPORTED;
-}
-
 /*
  * High level routines for use by the bus drivers
  */
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 4fa7c9ffd3a9..57c1a53b0b75 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -494,6 +494,12 @@ struct usb_dev_state;
 
 struct usb_tt;
 
+enum usb_device_removable {
+	USB_DEVICE_REMOVABLE_UNKNOWN = 0,
+	USB_DEVICE_REMOVABLE,
+	USB_DEVICE_FIXED,
+};
+
 enum usb_port_connect_type {
 	USB_PORT_CONNECT_TYPE_UNKNOWN = 0,
 	USB_PORT_CONNECT_TYPE_HOT_PLUG,
@@ -716,6 +722,7 @@ struct usb_device {
 #endif
 	struct wusb_dev *wusb_dev;
 	int slot_id;
+	enum usb_device_removable removable;
 	struct usb2_lpm_parameters l1_params;
 	struct usb3_lpm_parameters u1_params;
 	struct usb3_lpm_parameters u2_params;

From 8b5d58d51fa7524c9b31fe004dbcd6b709c188ce Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Tue, 12 Dec 2023 15:25:46 +0000
Subject: [PATCH 0823/1043] Revert "mmc: sdhci-sprd: Fix vqmmc not shutting
 down after the card was pulled"

This reverts commit 8b76708eb9f1f2168c9d06bd9b921d0e1dbe2fae which is
commit 477865af60b2117ceaa1d558e03559108c15c78c upstream.

It breaks the current Android ABI, and if needed, can be brought back in
an abi-safe way in the future.

Bug: 161946584
Change-Id: I150c03d20a750b0694adaea3c75d5a3bc985e333
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/mmc/host/sdhci-sprd.c | 25 -------------------------
 1 file changed, 25 deletions(-)

diff --git a/drivers/mmc/host/sdhci-sprd.c b/drivers/mmc/host/sdhci-sprd.c
index d8e412bbb93b..540ebccaa9a3 100644
--- a/drivers/mmc/host/sdhci-sprd.c
+++ b/drivers/mmc/host/sdhci-sprd.c
@@ -392,33 +392,12 @@ static void sdhci_sprd_request_done(struct sdhci_host *host,
 	mmc_request_done(host->mmc, mrq);
 }
 
-static void sdhci_sprd_set_power(struct sdhci_host *host, unsigned char mode,
-				 unsigned short vdd)
-{
-	struct mmc_host *mmc = host->mmc;
-
-	switch (mode) {
-	case MMC_POWER_OFF:
-		mmc_regulator_set_ocr(host->mmc, mmc->supply.vmmc, 0);
-
-		mmc_regulator_disable_vqmmc(mmc);
-		break;
-	case MMC_POWER_ON:
-		mmc_regulator_enable_vqmmc(mmc);
-		break;
-	case MMC_POWER_UP:
-		mmc_regulator_set_ocr(host->mmc, mmc->supply.vmmc, vdd);
-		break;
-	}
-}
-
 static struct sdhci_ops sdhci_sprd_ops = {
 	.read_l = sdhci_sprd_readl,
 	.write_l = sdhci_sprd_writel,
 	.write_w = sdhci_sprd_writew,
 	.write_b = sdhci_sprd_writeb,
 	.set_clock = sdhci_sprd_set_clock,
-	.set_power = sdhci_sprd_set_power,
 	.get_max_clock = sdhci_sprd_get_max_clock,
 	.get_min_clock = sdhci_sprd_get_min_clock,
 	.set_bus_width = sdhci_set_bus_width,
@@ -684,10 +663,6 @@ static int sdhci_sprd_probe(struct platform_device *pdev)
 	host->caps1 &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_SDR104 |
 			 SDHCI_SUPPORT_DDR50);
 
-	ret = mmc_regulator_get_supply(host->mmc);
-	if (ret)
-		goto pm_runtime_disable;
-
 	ret = sdhci_setup_host(host);
 	if (ret)
 		goto pm_runtime_disable;

From 70b6573bf979ee3a3b02af244dc16af943c486de Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Tue, 12 Dec 2023 15:25:49 +0000
Subject: [PATCH 0824/1043] Revert "mmc: core: add helpers
 mmc_regulator_enable/disable_vqmmc"

This reverts commit b532bc9b73e603452edfb39bbc50b7d9cbbd939e which is
commit 8d91f3f8ae57e6292142ca89f322e90fa0d6ac02 upstream.

It breaks the current Android ABI, and if needed, can be brought back in
an abi-safe way in the future.

Bug: 161946584
Change-Id: I49cbae8dc7f22b61aa41240cc86c5e19e83f4a00
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 drivers/mmc/core/regulator.c | 41 ------------------------------------
 include/linux/mmc/host.h     |  3 ---
 2 files changed, 44 deletions(-)

diff --git a/drivers/mmc/core/regulator.c b/drivers/mmc/core/regulator.c
index 4dcbc2281d2b..609201a467ef 100644
--- a/drivers/mmc/core/regulator.c
+++ b/drivers/mmc/core/regulator.c
@@ -271,44 +271,3 @@ int mmc_regulator_get_supply(struct mmc_host *mmc)
 	return 0;
 }
 EXPORT_SYMBOL_GPL(mmc_regulator_get_supply);
-
-/**
- * mmc_regulator_enable_vqmmc - enable VQMMC regulator for a host
- * @mmc: the host to regulate
- *
- * Returns 0 or errno. Enables the regulator for vqmmc.
- * Keeps track of the enable status for ensuring that calls to
- * regulator_enable/disable are balanced.
- */
-int mmc_regulator_enable_vqmmc(struct mmc_host *mmc)
-{
-	int ret = 0;
-
-	if (!IS_ERR(mmc->supply.vqmmc) && !mmc->vqmmc_enabled) {
-		ret = regulator_enable(mmc->supply.vqmmc);
-		if (ret < 0)
-			dev_err(mmc_dev(mmc), "enabling vqmmc regulator failed\n");
-		else
-			mmc->vqmmc_enabled = true;
-	}
-
-	return ret;
-}
-EXPORT_SYMBOL_GPL(mmc_regulator_enable_vqmmc);
-
-/**
- * mmc_regulator_disable_vqmmc - disable VQMMC regulator for a host
- * @mmc: the host to regulate
- *
- * Returns 0 or errno. Disables the regulator for vqmmc.
- * Keeps track of the enable status for ensuring that calls to
- * regulator_enable/disable are balanced.
- */
-void mmc_regulator_disable_vqmmc(struct mmc_host *mmc)
-{
-	if (!IS_ERR(mmc->supply.vqmmc) && mmc->vqmmc_enabled) {
-		regulator_disable(mmc->supply.vqmmc);
-		mmc->vqmmc_enabled = false;
-	}
-}
-EXPORT_SYMBOL_GPL(mmc_regulator_disable_vqmmc);
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index e671e48c8c15..45cbfce9aeee 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -421,7 +421,6 @@ struct mmc_host {
 	unsigned int		use_blk_mq:1;	/* use blk-mq */
 	unsigned int		retune_crc_disable:1; /* don't trigger retune upon crc */
 	unsigned int		can_dma_map_merge:1; /* merging can be used */
-	unsigned int		vqmmc_enabled:1; /* vqmmc regulator is enabled */
 
 	int			rescan_disable;	/* disable card detection */
 	int			rescan_entered;	/* used with nonremovable devices */
@@ -573,8 +572,6 @@ static inline int mmc_regulator_set_vqmmc(struct mmc_host *mmc,
 #endif
 
 int mmc_regulator_get_supply(struct mmc_host *mmc);
-int mmc_regulator_enable_vqmmc(struct mmc_host *mmc);
-void mmc_regulator_disable_vqmmc(struct mmc_host *mmc);
 
 static inline int mmc_card_is_removable(struct mmc_host *host)
 {

From 7f4c89400d2997939f6971c7981cc780a219e36b Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Tue, 7 Nov 2023 15:57:13 +0100
Subject: [PATCH 0825/1043] hrtimers: Push pending hrtimers away from outgoing
 CPU earlier

[ Upstream commit 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94 ]

2b8272ff4a70 ("cpu/hotplug: Prevent self deadlock on CPU hot-unplug")
solved the straight forward CPU hotplug deadlock vs. the scheduler
bandwidth timer. Yu discovered a more involved variant where a task which
has a bandwidth timer started on the outgoing CPU holds a lock and then
gets throttled. If the lock required by one of the CPU hotplug callbacks
the hotplug operation deadlocks because the unthrottling timer event is not
handled on the dying CPU and can only be recovered once the control CPU
reaches the hotplug state which pulls the pending hrtimers from the dead
CPU.

Solve this by pushing the hrtimers away from the dying CPU in the dying
callbacks. Nothing can queue a hrtimer on the dying CPU at that point because
all other CPUs spin in stop_machine() with interrupts disabled and once the
operation is finished the CPU is marked offline.

Reported-by: Yu Liao <liaoyu15@huawei.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Liu Tie <liutie4@huawei.com>
Link: https://lore.kernel.org/r/87a5rphara.ffs@tglx
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/cpuhotplug.h |  1 +
 include/linux/hrtimer.h    |  4 ++--
 kernel/cpu.c               |  8 +++++++-
 kernel/time/hrtimer.c      | 33 ++++++++++++---------------------
 4 files changed, 22 insertions(+), 24 deletions(-)

diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index 7cc2889608e0..f5a5df3a8cfd 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -149,6 +149,7 @@ enum cpuhp_state {
 	CPUHP_AP_ARM_CORESIGHT_CTI_STARTING,
 	CPUHP_AP_ARM64_ISNDEP_STARTING,
 	CPUHP_AP_SMPCFD_DYING,
+	CPUHP_AP_HRTIMERS_DYING,
 	CPUHP_AP_X86_TBOOT_DYING,
 	CPUHP_AP_ARM_CACHE_B15_RAC_DYING,
 	CPUHP_AP_ONLINE,
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 7f1b8549ebce..a88be8bd4e1d 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -526,9 +526,9 @@ extern void sysrq_timer_list_show(void);
 
 int hrtimers_prepare_cpu(unsigned int cpu);
 #ifdef CONFIG_HOTPLUG_CPU
-int hrtimers_dead_cpu(unsigned int cpu);
+int hrtimers_cpu_dying(unsigned int cpu);
 #else
-#define hrtimers_dead_cpu	NULL
+#define hrtimers_cpu_dying	NULL
 #endif
 
 #endif
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 008b50da2224..abf717c4f57c 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1595,7 +1595,7 @@ static struct cpuhp_step cpuhp_hp_states[] = {
 	[CPUHP_HRTIMERS_PREPARE] = {
 		.name			= "hrtimers:prepare",
 		.startup.single		= hrtimers_prepare_cpu,
-		.teardown.single	= hrtimers_dead_cpu,
+		.teardown.single	= NULL,
 	},
 	[CPUHP_SMPCFD_PREPARE] = {
 		.name			= "smpcfd:prepare",
@@ -1662,6 +1662,12 @@ static struct cpuhp_step cpuhp_hp_states[] = {
 		.startup.single		= NULL,
 		.teardown.single	= smpcfd_dying_cpu,
 	},
+	[CPUHP_AP_HRTIMERS_DYING] = {
+		.name			= "hrtimers:dying",
+		.startup.single		= NULL,
+		.teardown.single	= hrtimers_cpu_dying,
+	},
+
 	/* Entry state on starting. Interrupts enabled from here on. Transient
 	 * state for synchronsization */
 	[CPUHP_AP_ONLINE] = {
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 70deb2f01e97..ede09dda36e9 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -2114,29 +2114,22 @@ static void migrate_hrtimer_list(struct hrtimer_clock_base *old_base,
 	}
 }
 
-int hrtimers_dead_cpu(unsigned int scpu)
+int hrtimers_cpu_dying(unsigned int dying_cpu)
 {
 	struct hrtimer_cpu_base *old_base, *new_base;
-	int i;
+	int i, ncpu = cpumask_first(cpu_active_mask);
 
-	BUG_ON(cpu_online(scpu));
-	tick_cancel_sched_timer(scpu);
+	tick_cancel_sched_timer(dying_cpu);
+
+	old_base = this_cpu_ptr(&hrtimer_bases);
+	new_base = &per_cpu(hrtimer_bases, ncpu);
 
-	/*
-	 * this BH disable ensures that raise_softirq_irqoff() does
-	 * not wakeup ksoftirqd (and acquire the pi-lock) while
-	 * holding the cpu_base lock
-	 */
-	local_bh_disable();
-	local_irq_disable();
-	old_base = &per_cpu(hrtimer_bases, scpu);
-	new_base = this_cpu_ptr(&hrtimer_bases);
 	/*
 	 * The caller is globally serialized and nobody else
 	 * takes two locks at once, deadlock is not possible.
 	 */
-	raw_spin_lock(&new_base->lock);
-	raw_spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING);
+	raw_spin_lock(&old_base->lock);
+	raw_spin_lock_nested(&new_base->lock, SINGLE_DEPTH_NESTING);
 
 	for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
 		migrate_hrtimer_list(&old_base->clock_base[i],
@@ -2147,15 +2140,13 @@ int hrtimers_dead_cpu(unsigned int scpu)
 	 * The migration might have changed the first expiring softirq
 	 * timer on this CPU. Update it.
 	 */
-	hrtimer_update_softirq_timer(new_base, false);
+	__hrtimer_get_next_event(new_base, HRTIMER_ACTIVE_SOFT);
+	/* Tell the other CPU to retrigger the next event */
+	smp_call_function_single(ncpu, retrigger_next_event, NULL, 0);
 
-	raw_spin_unlock(&old_base->lock);
 	raw_spin_unlock(&new_base->lock);
+	raw_spin_unlock(&old_base->lock);
 
-	/* Check, if we got expired work to do */
-	__hrtimer_peek_ahead_timers();
-	local_irq_enable();
-	local_bh_enable();
 	return 0;
 }
 

From 348111c3be90ec01cdd28a3680057e6a48acadaf Mon Sep 17 00:00:00 2001
From: Jan Bottorff <janb@os.amperecomputing.com>
Date: Thu, 9 Nov 2023 03:19:27 +0000
Subject: [PATCH 0826/1043] i2c: designware: Fix corrupted memory seen in the
 ISR

[ Upstream commit f726eaa787e9f9bc858c902d18a09af6bcbfcdaf ]

When running on a many core ARM64 server, errors were
happening in the ISR that looked like corrupted memory. These
corruptions would fix themselves if small delays were inserted
in the ISR. Errors reported by the driver included "i2c_designware
APMC0D0F:00: i2c_dw_xfer_msg: invalid target address" and
"i2c_designware APMC0D0F:00:controller timed out" during
in-band IPMI SSIF stress tests.

The problem was determined to be memory writes in the driver were not
becoming visible to all cores when execution rapidly shifted between
cores, like when a register write immediately triggers an ISR.
Processors with weak memory ordering, like ARM64, make no
guarantees about the order normal memory writes become globally
visible, unless barrier instructions are used to control ordering.

To solve this, regmap accessor functions configured by this driver
were changed to use non-relaxed forms of the low-level register
access functions, which include a barrier on platforms that require
it. This assures memory writes before a controller register access are
visible to all cores. The community concluded defaulting to correct
operation outweighed defaulting to the small performance gains from
using relaxed access functions. Being a low speed device added weight to
this choice of default register access behavior.

Signed-off-by: Jan Bottorff <janb@os.amperecomputing.com>
Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Tested-by: Serge Semin <fancer.lancer@gmail.com>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-designware-common.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c
index 682fffaab2b4..c9f7783ac7cb 100644
--- a/drivers/i2c/busses/i2c-designware-common.c
+++ b/drivers/i2c/busses/i2c-designware-common.c
@@ -63,7 +63,7 @@ static int dw_reg_read(void *context, unsigned int reg, unsigned int *val)
 {
 	struct dw_i2c_dev *dev = context;
 
-	*val = readl_relaxed(dev->base + reg);
+	*val = readl(dev->base + reg);
 
 	return 0;
 }
@@ -72,7 +72,7 @@ static int dw_reg_write(void *context, unsigned int reg, unsigned int val)
 {
 	struct dw_i2c_dev *dev = context;
 
-	writel_relaxed(val, dev->base + reg);
+	writel(val, dev->base + reg);
 
 	return 0;
 }
@@ -81,7 +81,7 @@ static int dw_reg_read_swab(void *context, unsigned int reg, unsigned int *val)
 {
 	struct dw_i2c_dev *dev = context;
 
-	*val = swab32(readl_relaxed(dev->base + reg));
+	*val = swab32(readl(dev->base + reg));
 
 	return 0;
 }
@@ -90,7 +90,7 @@ static int dw_reg_write_swab(void *context, unsigned int reg, unsigned int val)
 {
 	struct dw_i2c_dev *dev = context;
 
-	writel_relaxed(swab32(val), dev->base + reg);
+	writel(swab32(val), dev->base + reg);
 
 	return 0;
 }
@@ -99,8 +99,8 @@ static int dw_reg_read_word(void *context, unsigned int reg, unsigned int *val)
 {
 	struct dw_i2c_dev *dev = context;
 
-	*val = readw_relaxed(dev->base + reg) |
-		(readw_relaxed(dev->base + reg + 2) << 16);
+	*val = readw(dev->base + reg) |
+		(readw(dev->base + reg + 2) << 16);
 
 	return 0;
 }
@@ -109,8 +109,8 @@ static int dw_reg_write_word(void *context, unsigned int reg, unsigned int val)
 {
 	struct dw_i2c_dev *dev = context;
 
-	writew_relaxed(val, dev->base + reg);
-	writew_relaxed(val >> 16, dev->base + reg + 2);
+	writew(val, dev->base + reg);
+	writew(val >> 16, dev->base + reg + 2);
 
 	return 0;
 }

From e7152a138a5ac77439ff4e7a7533448a7d4c260d Mon Sep 17 00:00:00 2001
From: Jozsef Kadlecsik <kadlec@netfilter.org>
Date: Mon, 13 Nov 2023 21:13:23 +0100
Subject: [PATCH 0827/1043] netfilter: ipset: fix race condition between
 swap/destroy and kernel side add/del/test

[ Upstream commit 28628fa952fefc7f2072ce6e8016968cc452b1ba ]

Linkui Xiao reported that there's a race condition when ipset swap and destroy is
called, which can lead to crash in add/del/test element operations. Swap then
destroy are usual operations to replace a set with another one in a production
system. The issue can in some cases be reproduced with the script:

ipset create hash_ip1 hash:net family inet hashsize 1024 maxelem 1048576
ipset add hash_ip1 172.20.0.0/16
ipset add hash_ip1 192.168.0.0/16
iptables -A INPUT -m set --match-set hash_ip1 src -j ACCEPT
while [ 1 ]
do
	# ... Ongoing traffic...
        ipset create hash_ip2 hash:net family inet hashsize 1024 maxelem 1048576
        ipset add hash_ip2 172.20.0.0/16
        ipset swap hash_ip1 hash_ip2
        ipset destroy hash_ip2
        sleep 0.05
done

In the race case the possible order of the operations are

	CPU0			CPU1
	ip_set_test
				ipset swap hash_ip1 hash_ip2
				ipset destroy hash_ip2
	hash_net_kadt

Swap replaces hash_ip1 with hash_ip2 and then destroy removes hash_ip2 which
is the original hash_ip1. ip_set_test was called on hash_ip1 and because destroy
removed it, hash_net_kadt crashes.

The fix is to force ip_set_swap() to wait for all readers to finish accessing the
old set pointers by calling synchronize_rcu().

The first version of the patch was written by Linkui Xiao <xiaolinkui@kylinos.cn>.

v2: synchronize_rcu() is moved into ip_set_swap() in order not to burden
    ip_set_destroy() unnecessarily when all sets are destroyed.
v3: Florian Westphal pointed out that all netfilter hooks run with rcu_read_lock() held
    and em_ipset.c wraps the entire ip_set_test() in rcu read lock/unlock pair.
    So there's no need to extend the rcu read locked area in ipset itself.

Closes: https://lore.kernel.org/all/69e7963b-e7f8-3ad0-210-7b86eebf7f78@netfilter.org/
Reported by: Linkui Xiao <xiaolinkui@kylinos.cn>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipset/ip_set_core.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 26613e3731d0..24f81826ed4a 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -61,6 +61,8 @@ MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
 	ip_set_dereference((inst)->ip_set_list)[id]
 #define ip_set_ref_netlink(inst,id)	\
 	rcu_dereference_raw((inst)->ip_set_list)[id]
+#define ip_set_dereference_nfnl(p)	\
+	rcu_dereference_check(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET))
 
 /* The set types are implemented in modules and registered set types
  * can be found in ip_set_type_list. Adding/deleting types is
@@ -708,15 +710,10 @@ __ip_set_put_netlink(struct ip_set *set)
 static struct ip_set *
 ip_set_rcu_get(struct net *net, ip_set_id_t index)
 {
-	struct ip_set *set;
 	struct ip_set_net *inst = ip_set_pernet(net);
 
-	rcu_read_lock();
-	/* ip_set_list itself needs to be protected */
-	set = rcu_dereference(inst->ip_set_list)[index];
-	rcu_read_unlock();
-
-	return set;
+	/* ip_set_list and the set pointer need to be protected */
+	return ip_set_dereference_nfnl(inst->ip_set_list)[index];
 }
 
 static inline void
@@ -1407,6 +1404,9 @@ static int ip_set_swap(struct net *net, struct sock *ctnl, struct sk_buff *skb,
 	ip_set(inst, to_id) = from;
 	write_unlock_bh(&ip_set_ref_lock);
 
+	/* Make sure all readers of the old set pointers are completed. */
+	synchronize_rcu();
+
 	return 0;
 }
 

From 9068403d9465d22b48d6fa72e1fcfdd9fd3faf95 Mon Sep 17 00:00:00 2001
From: Alex Pakhunov <alexey.pakhunov@spacex.com>
Date: Mon, 13 Nov 2023 10:23:49 -0800
Subject: [PATCH 0828/1043] tg3: Move the [rt]x_dropped counters to tg3_napi

[ Upstream commit 907d1bdb8b2cc0357d03a1c34d2a08d9943760b1 ]

This change moves [rt]x_dropped counters to tg3_napi so that they can be
updated by a single writer, race-free.

Signed-off-by: Alex Pakhunov <alexey.pakhunov@spacex.com>
Signed-off-by: Vincent Wong <vincent.wong2@spacex.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/20231113182350.37472-1-alexey.pakhunov@spacex.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/tg3.c | 38 +++++++++++++++++++++++++----
 drivers/net/ethernet/broadcom/tg3.h |  4 +--
 2 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 5647833303a4..a2c6c204fe9d 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -6864,7 +6864,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
 				       desc_idx, *post_ptr);
 		drop_it_no_recycle:
 			/* Other statistics kept track of by card. */
-			tp->rx_dropped++;
+			tnapi->rx_dropped++;
 			goto next_pkt;
 		}
 
@@ -8161,7 +8161,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 drop:
 	dev_kfree_skb_any(skb);
 drop_nofree:
-	tp->tx_dropped++;
+	tnapi->tx_dropped++;
 	return NETDEV_TX_OK;
 }
 
@@ -9340,7 +9340,7 @@ static void __tg3_set_rx_mode(struct net_device *);
 /* tp->lock is held. */
 static int tg3_halt(struct tg3 *tp, int kind, bool silent)
 {
-	int err;
+	int err, i;
 
 	tg3_stop_fw(tp);
 
@@ -9361,6 +9361,13 @@ static int tg3_halt(struct tg3 *tp, int kind, bool silent)
 
 		/* And make sure the next sample is new data */
 		memset(tp->hw_stats, 0, sizeof(struct tg3_hw_stats));
+
+		for (i = 0; i < TG3_IRQ_MAX_VECS; ++i) {
+			struct tg3_napi *tnapi = &tp->napi[i];
+
+			tnapi->rx_dropped = 0;
+			tnapi->tx_dropped = 0;
+		}
 	}
 
 	return err;
@@ -11915,6 +11922,9 @@ static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats)
 {
 	struct rtnl_link_stats64 *old_stats = &tp->net_stats_prev;
 	struct tg3_hw_stats *hw_stats = tp->hw_stats;
+	unsigned long rx_dropped;
+	unsigned long tx_dropped;
+	int i;
 
 	stats->rx_packets = old_stats->rx_packets +
 		get_stat64(&hw_stats->rx_ucast_packets) +
@@ -11961,8 +11971,26 @@ static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats)
 	stats->rx_missed_errors = old_stats->rx_missed_errors +
 		get_stat64(&hw_stats->rx_discards);
 
-	stats->rx_dropped = tp->rx_dropped;
-	stats->tx_dropped = tp->tx_dropped;
+	/* Aggregate per-queue counters. The per-queue counters are updated
+	 * by a single writer, race-free. The result computed by this loop
+	 * might not be 100% accurate (counters can be updated in the middle of
+	 * the loop) but the next tg3_get_nstats() will recompute the current
+	 * value so it is acceptable.
+	 *
+	 * Note that these counters wrap around at 4G on 32bit machines.
+	 */
+	rx_dropped = (unsigned long)(old_stats->rx_dropped);
+	tx_dropped = (unsigned long)(old_stats->tx_dropped);
+
+	for (i = 0; i < tp->irq_cnt; i++) {
+		struct tg3_napi *tnapi = &tp->napi[i];
+
+		rx_dropped += tnapi->rx_dropped;
+		tx_dropped += tnapi->tx_dropped;
+	}
+
+	stats->rx_dropped = rx_dropped;
+	stats->tx_dropped = tx_dropped;
 }
 
 static int tg3_get_regs_len(struct net_device *dev)
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 1000c894064f..8d753f8c5b06 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -3018,6 +3018,7 @@ struct tg3_napi {
 	u16				*rx_rcb_prod_idx;
 	struct tg3_rx_prodring_set	prodring;
 	struct tg3_rx_buffer_desc	*rx_rcb;
+	unsigned long			rx_dropped;
 
 	u32				tx_prod	____cacheline_aligned;
 	u32				tx_cons;
@@ -3026,6 +3027,7 @@ struct tg3_napi {
 	u32				prodmbox;
 	struct tg3_tx_buffer_desc	*tx_ring;
 	struct tg3_tx_ring_info		*tx_buffers;
+	unsigned long			tx_dropped;
 
 	dma_addr_t			status_mapping;
 	dma_addr_t			rx_rcb_mapping;
@@ -3219,8 +3221,6 @@ struct tg3 {
 
 
 	/* begin "everything else" cacheline(s) section */
-	unsigned long			rx_dropped;
-	unsigned long			tx_dropped;
 	struct rtnl_link_stats64	net_stats_prev;
 	struct tg3_ethtool_stats	estats_prev;
 

From 96d55414304aa062180980f762eb29674ed12a3a Mon Sep 17 00:00:00 2001
From: Alex Pakhunov <alexey.pakhunov@spacex.com>
Date: Mon, 13 Nov 2023 10:23:50 -0800
Subject: [PATCH 0829/1043] tg3: Increment tx_dropped in tg3_tso_bug()

[ Upstream commit 17dd5efe5f36a96bd78012594fabe21efb01186b ]

tg3_tso_bug() drops a packet if it cannot be segmented for any reason.
The number of discarded frames should be incremented accordingly.

Signed-off-by: Alex Pakhunov <alexey.pakhunov@spacex.com>
Signed-off-by: Vincent Wong <vincent.wong2@spacex.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Link: https://lore.kernel.org/r/20231113182350.37472-2-alexey.pakhunov@spacex.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/tg3.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a2c6c204fe9d..b010f28b0abf 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -7890,8 +7890,10 @@ static int tg3_tso_bug(struct tg3 *tp, struct tg3_napi *tnapi,
 
 	segs = skb_gso_segment(skb, tp->dev->features &
 				    ~(NETIF_F_TSO | NETIF_F_TSO6));
-	if (IS_ERR(segs) || !segs)
+	if (IS_ERR(segs) || !segs) {
+		tnapi->tx_dropped++;
 		goto tg3_tso_bug_end;
+	}
 
 	skb_list_walk_safe(segs, seg, next) {
 		skb_mark_not_on_list(seg);

From 8887047de35803ea636117fe35b03e8cc3a9ea4a Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <masahiroy@kernel.org>
Date: Wed, 15 Nov 2023 13:16:53 +0900
Subject: [PATCH 0830/1043] kconfig: fix memory leak from range properties

[ Upstream commit ae1eff0349f2e908fc083630e8441ea6dc434dc0 ]

Currently, sym_validate_range() duplicates the range string using
xstrdup(), which is overwritten by a subsequent sym_calc_value() call.
It results in a memory leak.

Instead, only the pointer should be copied.

Below is a test case, with a summary from Valgrind.

[Test Kconfig]

  config FOO
          int "foo"
          range 10 20

[Test .config]

  CONFIG_FOO=0

[Before]

  LEAK SUMMARY:
     definitely lost: 3 bytes in 1 blocks
     indirectly lost: 0 bytes in 0 blocks
       possibly lost: 0 bytes in 0 blocks
     still reachable: 17,465 bytes in 21 blocks
          suppressed: 0 bytes in 0 blocks

[After]

  LEAK SUMMARY:
     definitely lost: 0 bytes in 0 blocks
     indirectly lost: 0 bytes in 0 blocks
       possibly lost: 0 bytes in 0 blocks
     still reachable: 17,462 bytes in 20 blocks
          suppressed: 0 bytes in 0 blocks

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/kconfig/symbol.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index ffa3ec65cc90..a2056fa80de2 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c
@@ -123,9 +123,9 @@ static long long sym_get_range_val(struct symbol *sym, int base)
 static void sym_validate_range(struct symbol *sym)
 {
 	struct property *prop;
+	struct symbol *range_sym;
 	int base;
 	long long val, val2;
-	char str[64];
 
 	switch (sym->type) {
 	case S_INT:
@@ -141,17 +141,15 @@ static void sym_validate_range(struct symbol *sym)
 	if (!prop)
 		return;
 	val = strtoll(sym->curr.val, NULL, base);
-	val2 = sym_get_range_val(prop->expr->left.sym, base);
+	range_sym = prop->expr->left.sym;
+	val2 = sym_get_range_val(range_sym, base);
 	if (val >= val2) {
-		val2 = sym_get_range_val(prop->expr->right.sym, base);
+		range_sym = prop->expr->right.sym;
+		val2 = sym_get_range_val(range_sym, base);
 		if (val <= val2)
 			return;
 	}
-	if (sym->type == S_INT)
-		sprintf(str, "%lld", val2);
-	else
-		sprintf(str, "0x%llx", val2);
-	sym->curr.val = xstrdup(str);
+	sym->curr.val = range_sym->curr.val;
 }
 
 static void sym_set_changed(struct symbol *sym)

From 13b1fa5407949fb7ada3d2362c5099e18b2a25c8 Mon Sep 17 00:00:00 2001
From: YuanShang <YuanShang.Mao@amd.com>
Date: Tue, 31 Oct 2023 10:32:37 +0800
Subject: [PATCH 0831/1043] drm/amdgpu: correct chunk_ptr to a pointer to
 chunk.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 50d51374b498457c4dea26779d32ccfed12ddaff ]

The variable "chunk_ptr" should be a pointer pointing
to a struct drm_amdgpu_cs_chunk instead of to a pointer
of that.

Signed-off-by: YuanShang <YuanShang.Mao@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 7f2adac82e3a..addeda42339f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -143,7 +143,7 @@ static int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, union drm_amdgpu_cs
 	}
 
 	for (i = 0; i < p->nchunks; i++) {
-		struct drm_amdgpu_cs_chunk __user **chunk_ptr = NULL;
+		struct drm_amdgpu_cs_chunk __user *chunk_ptr = NULL;
 		struct drm_amdgpu_cs_chunk user_chunk;
 		uint32_t __user *cdata;
 

From 9a861dde99cbea5b5131832ccd92a81f9f0a221e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Samuel=20=C4=8Cavoj?= <samuel@cavoj.net>
Date: Wed, 21 Oct 2020 00:09:44 +0200
Subject: [PATCH 0832/1043] platform/x86: asus-wmi: Add support for
 SW_TABLET_MODE on UX360
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit ea856ec266c1e6aecd2b107032d5b5d661f0686d ]

The UX360CA has a WMI device id 0x00060062, which reports whether the
lid is flipped in tablet mode (1) or in normal laptop mode (0).

Add a quirk (quirk_asus_use_lid_flip_devid) for devices on which this
WMI device should be used to figure out the SW_TABLET_MODE state, as
opposed to the quirk_asus_use_kbd_dock_devid.

Additionally, the device needs to be queried on resume and restore
because the firmware does not generate an event if the laptop is put to
sleep while in tablet mode, flipped to normal mode, and later awoken.

It is assumed other UX360* models have the same WMI device. As such, the
quirk is applied to devices with DMI_MATCH(DMI_PRODUCT_NAME, "UX360").
More devices with this feature need to be tested and added accordingly.

The reason for using an allowlist via the quirk mechanism is that the new
WMI device (0x00060062) is also present on some models which do not have
a 360 degree hinge (at least FX503VD and GL503VD from Hans' DSTS
collection) and therefore its presence cannot be relied on.

Signed-off-by: Samuel Čavoj <samuel@cavoj.net>
Cc: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20201020220944.1075530-1-samuel@cavoj.net
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-nb-wmi.c         | 15 ++++++++
 drivers/platform/x86/asus-wmi.c            | 40 ++++++++++++++++++++++
 drivers/platform/x86/asus-wmi.h            |  1 +
 include/linux/platform_data/x86/asus-wmi.h |  1 +
 4 files changed, 57 insertions(+)

diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index 04503ad6c7fb..f47b6f30599d 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -114,6 +114,11 @@ static struct quirk_entry quirk_asus_use_kbd_dock_devid = {
 	.use_kbd_dock_devid = true,
 };
 
+static struct quirk_entry quirk_asus_use_lid_flip_devid = {
+	.wmi_backlight_set_devstate = true,
+	.use_lid_flip_devid = true,
+};
+
 static int dmi_matched(const struct dmi_system_id *dmi)
 {
 	pr_info("Identified laptop model '%s'\n", dmi->ident);
@@ -443,6 +448,16 @@ static const struct dmi_system_id asus_quirks[] = {
 		},
 		.driver_data = &quirk_asus_use_kbd_dock_devid,
 	},
+	{
+		.callback = dmi_matched,
+		.ident = "ASUS ZenBook Flip UX360",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			/* Match UX360* */
+			DMI_MATCH(DMI_PRODUCT_NAME, "UX360"),
+		},
+		.driver_data = &quirk_asus_use_lid_flip_devid,
+	},
 	{},
 };
 
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index db369cf26111..ca3b97b7a6ad 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -63,6 +63,7 @@ MODULE_LICENSE("GPL");
 #define NOTIFY_KBD_BRTTOGGLE		0xc7
 #define NOTIFY_KBD_FBM			0x99
 #define NOTIFY_KBD_TTP			0xae
+#define NOTIFY_LID_FLIP			0xfa
 
 #define ASUS_WMI_FNLOCK_BIOS_DISABLED	BIT(0)
 
@@ -375,6 +376,20 @@ static int asus_wmi_input_init(struct asus_wmi *asus)
 		}
 	}
 
+	if (asus->driver->quirks->use_lid_flip_devid) {
+		result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP);
+		if (result < 0)
+			asus->driver->quirks->use_lid_flip_devid = 0;
+		if (result >= 0) {
+			input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
+			input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
+		} else if (result == -ENODEV) {
+			pr_err("This device has lid_flip quirk but got ENODEV checking it. This is a bug.");
+		} else {
+			pr_err("Error checking for lid-flip: %d\n", result);
+		}
+	}
+
 	err = input_register_device(asus->inputdev);
 	if (err)
 		goto err_free_dev;
@@ -394,6 +409,18 @@ static void asus_wmi_input_exit(struct asus_wmi *asus)
 	asus->inputdev = NULL;
 }
 
+/* Tablet mode ****************************************************************/
+
+static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus)
+{
+	int result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP);
+
+	if (result >= 0) {
+		input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
+		input_sync(asus->inputdev);
+	}
+}
+
 /* Battery ********************************************************************/
 
 /* The battery maximum charging percentage */
@@ -2130,6 +2157,11 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus)
 		return;
 	}
 
+	if (asus->driver->quirks->use_lid_flip_devid && code == NOTIFY_LID_FLIP) {
+		lid_flip_tablet_mode_get_state(asus);
+		return;
+	}
+
 	if (asus->fan_boost_mode_available && code == NOTIFY_KBD_FBM) {
 		fan_boost_mode_switch_next(asus);
 		return;
@@ -2721,6 +2753,10 @@ static int asus_hotk_resume(struct device *device)
 
 	if (asus_wmi_has_fnlock_key(asus))
 		asus_wmi_fnlock_update(asus);
+
+	if (asus->driver->quirks->use_lid_flip_devid)
+		lid_flip_tablet_mode_get_state(asus);
+
 	return 0;
 }
 
@@ -2759,6 +2795,10 @@ static int asus_hotk_restore(struct device *device)
 
 	if (asus_wmi_has_fnlock_key(asus))
 		asus_wmi_fnlock_update(asus);
+
+	if (asus->driver->quirks->use_lid_flip_devid)
+		lid_flip_tablet_mode_get_state(asus);
+
 	return 0;
 }
 
diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
index 1d0b592e2651..49f2b8f8ad3e 100644
--- a/drivers/platform/x86/asus-wmi.h
+++ b/drivers/platform/x86/asus-wmi.h
@@ -34,6 +34,7 @@ struct quirk_entry {
 	bool wmi_backlight_set_devstate;
 	bool wmi_force_als_set;
 	bool use_kbd_dock_devid;
+	bool use_lid_flip_devid;
 	int wapf;
 	/*
 	 * For machines with AMD graphic chips, it will send out WMI event
diff --git a/include/linux/platform_data/x86/asus-wmi.h b/include/linux/platform_data/x86/asus-wmi.h
index 897b8332a39f..2f274cf52805 100644
--- a/include/linux/platform_data/x86/asus-wmi.h
+++ b/include/linux/platform_data/x86/asus-wmi.h
@@ -62,6 +62,7 @@
 
 /* Misc */
 #define ASUS_WMI_DEVID_CAMERA		0x00060013
+#define ASUS_WMI_DEVID_LID_FLIP		0x00060062
 
 /* Storage */
 #define ASUS_WMI_DEVID_CARDREADER	0x00080013

From 79b86338204312ec3ae7372f877d76ac70c38096 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Thu, 12 Aug 2021 16:55:12 +0200
Subject: [PATCH 0833/1043] platform/x86: asus-nb-wmi: Allow configuring
 SW_TABLET_MODE method with a module option

[ Upstream commit 6be70ccdd989e40af151ce52db5b2d93e97fc9fb ]

Unfortunately we have been unable to find a reliable way to detect if
and how SW_TABLET_MODE reporting is supported, so we are relying on
DMI quirks for this.

Add a module-option to specify the SW_TABLET_MODE method so that this can
be easily tested without needing to rebuild the kernel.

BugLink: https://gitlab.freedesktop.org/libinput/libinput/-/issues/639
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210812145513.39117-1-hdegoede@redhat.com
Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-nb-wmi.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index f47b6f30599d..b7eacf54f286 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -41,6 +41,10 @@ static int wapf = -1;
 module_param(wapf, uint, 0444);
 MODULE_PARM_DESC(wapf, "WAPF value");
 
+static int tablet_mode_sw = -1;
+module_param(tablet_mode_sw, uint, 0444);
+MODULE_PARM_DESC(tablet_mode_sw, "Tablet mode detect: -1:auto 0:disable 1:kbd-dock 2:lid-flip");
+
 static struct quirk_entry *quirks;
 
 static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str,
@@ -477,6 +481,21 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver)
 	else
 		wapf = quirks->wapf;
 
+	switch (tablet_mode_sw) {
+	case 0:
+		quirks->use_kbd_dock_devid = false;
+		quirks->use_lid_flip_devid = false;
+		break;
+	case 1:
+		quirks->use_kbd_dock_devid = true;
+		quirks->use_lid_flip_devid = false;
+		break;
+	case 2:
+		quirks->use_kbd_dock_devid = false;
+		quirks->use_lid_flip_devid = true;
+		break;
+	}
+
 	if (quirks->i8042_filter) {
 		ret = i8042_install_filter(quirks->i8042_filter);
 		if (ret) {

From 3a8fc16d5e789de83c1947dc5aca588e24ae2242 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Thu, 12 Aug 2021 16:55:13 +0200
Subject: [PATCH 0834/1043] platform/x86: asus-nb-wmi: Add
 tablet_mode_sw=lid-flip quirk for the TP200s

[ Upstream commit 411f48bb58f49c40a627b052402a90e8301cd07e ]

The Asus TP200s / E205SA 360 degree hinges 2-in-1 supports reporting
SW_TABLET_MODE info through the ASUS_WMI_DEVID_LID_FLIP WMI device-id.
Add a quirk to enable this.

BugLink: https://gitlab.freedesktop.org/libinput/libinput/-/issues/639
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210812145513.39117-2-hdegoede@redhat.com
Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index b7eacf54f286..59ca3dab59e1 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -462,6 +462,15 @@ static const struct dmi_system_id asus_quirks[] = {
 		},
 		.driver_data = &quirk_asus_use_lid_flip_devid,
 	},
+	{
+		.callback = dmi_matched,
+		.ident = "ASUS TP200s / E205SA",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "E205SA"),
+		},
+		.driver_data = &quirk_asus_use_lid_flip_devid,
+	},
 	{},
 };
 

From ada7c5cc697bae10fda6efde5e84dd1de7f79309 Mon Sep 17 00:00:00 2001
From: "Luke D. Jones" <luke@ljones.dev>
Date: Sat, 7 Aug 2021 14:36:55 +1200
Subject: [PATCH 0835/1043] asus-wmi: Add dgpu disable method

[ Upstream commit 98829e84dc67630efb7de675f0a70066620468a3 ]

In Windows the ASUS Armory Crate program can enable or disable the
dGPU via a WMI call. This functions much the same as various Linux
methods in software where the dGPU is removed from the device tree.

However the WMI call saves the state of dGPU (enabled or not) and
this then changes the dGPU visibility in Linux with no way for
Linux users to re-enable it. We expose the WMI method so users can
see and change the dGPU ACPI state.

Signed-off-by: Luke D. Jones <luke@ljones.dev>
Link: https://lore.kernel.org/r/20210807023656.25020-3-luke@ljones.dev
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-wmi.c            | 98 ++++++++++++++++++++++
 include/linux/platform_data/x86/asus-wmi.h |  3 +
 2 files changed, 101 insertions(+)

diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index ca3b97b7a6ad..93b4c6113083 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -207,6 +207,9 @@ struct asus_wmi {
 	u8 fan_boost_mode_mask;
 	u8 fan_boost_mode;
 
+	bool dgpu_disable_available;
+	bool dgpu_disable;
+
 	bool throttle_thermal_policy_available;
 	u8 throttle_thermal_policy_mode;
 
@@ -421,6 +424,93 @@ static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus)
 	}
 }
 
+/* dGPU ********************************************************************/
+static int dgpu_disable_check_present(struct asus_wmi *asus)
+{
+	u32 result;
+	int err;
+
+	asus->dgpu_disable_available = false;
+
+	err = asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_DGPU, &result);
+	if (err) {
+		if (err == -ENODEV)
+			return 0;
+		return err;
+	}
+
+	if (result & ASUS_WMI_DSTS_PRESENCE_BIT) {
+		asus->dgpu_disable_available = true;
+		asus->dgpu_disable = result & ASUS_WMI_DSTS_STATUS_BIT;
+	}
+
+	return 0;
+}
+
+static int dgpu_disable_write(struct asus_wmi *asus)
+{
+	u32 retval;
+	u8 value;
+	int err;
+
+	/* Don't rely on type conversion */
+	value = asus->dgpu_disable ? 1 : 0;
+
+	err = asus_wmi_set_devstate(ASUS_WMI_DEVID_DGPU, value, &retval);
+	if (err) {
+		pr_warn("Failed to set dgpu disable: %d\n", err);
+		return err;
+	}
+
+	if (retval > 1 || retval < 0) {
+		pr_warn("Failed to set dgpu disable (retval): 0x%x\n", retval);
+		return -EIO;
+	}
+
+	sysfs_notify(&asus->platform_device->dev.kobj, NULL, "dgpu_disable");
+
+	return 0;
+}
+
+static ssize_t dgpu_disable_show(struct device *dev,
+				   struct device_attribute *attr, char *buf)
+{
+	struct asus_wmi *asus = dev_get_drvdata(dev);
+	u8 mode = asus->dgpu_disable;
+
+	return sysfs_emit(buf, "%d\n", mode);
+}
+
+/*
+ * A user may be required to store the value twice, typcial store first, then
+ * rescan PCI bus to activate power, then store a second time to save correctly.
+ * The reason for this is that an extra code path in the ACPI is enabled when
+ * the device and bus are powered.
+ */
+static ssize_t dgpu_disable_store(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t count)
+{
+	bool disable;
+	int result;
+
+	struct asus_wmi *asus = dev_get_drvdata(dev);
+
+	result = kstrtobool(buf, &disable);
+	if (result)
+		return result;
+
+	asus->dgpu_disable = disable;
+
+	result = dgpu_disable_write(asus);
+	if (result)
+		return result;
+
+	return count;
+}
+
+static DEVICE_ATTR_RW(dgpu_disable);
+
 /* Battery ********************************************************************/
 
 /* The battery maximum charging percentage */
@@ -2319,6 +2409,7 @@ static struct attribute *platform_attributes[] = {
 	&dev_attr_camera.attr,
 	&dev_attr_cardr.attr,
 	&dev_attr_touchpad.attr,
+	&dev_attr_dgpu_disable.attr,
 	&dev_attr_lid_resume.attr,
 	&dev_attr_als_enable.attr,
 	&dev_attr_fan_boost_mode.attr,
@@ -2344,6 +2435,8 @@ static umode_t asus_sysfs_is_visible(struct kobject *kobj,
 		devid = ASUS_WMI_DEVID_LID_RESUME;
 	else if (attr == &dev_attr_als_enable.attr)
 		devid = ASUS_WMI_DEVID_ALS_ENABLE;
+	else if (attr == &dev_attr_dgpu_disable.attr)
+		ok = asus->dgpu_disable_available;
 	else if (attr == &dev_attr_fan_boost_mode.attr)
 		ok = asus->fan_boost_mode_available;
 	else if (attr == &dev_attr_throttle_thermal_policy.attr)
@@ -2603,6 +2696,10 @@ static int asus_wmi_add(struct platform_device *pdev)
 	if (err)
 		goto fail_platform;
 
+	err = dgpu_disable_check_present(asus);
+	if (err)
+		goto fail_dgpu_disable;
+
 	err = fan_boost_mode_check_present(asus);
 	if (err)
 		goto fail_fan_boost_mode;
@@ -2699,6 +2796,7 @@ static int asus_wmi_add(struct platform_device *pdev)
 fail_sysfs:
 fail_throttle_thermal_policy:
 fail_fan_boost_mode:
+fail_dgpu_disable:
 fail_platform:
 	kfree(asus);
 	return err;
diff --git a/include/linux/platform_data/x86/asus-wmi.h b/include/linux/platform_data/x86/asus-wmi.h
index 2f274cf52805..7d8d3e9c45d6 100644
--- a/include/linux/platform_data/x86/asus-wmi.h
+++ b/include/linux/platform_data/x86/asus-wmi.h
@@ -89,6 +89,9 @@
 /* Keyboard dock */
 #define ASUS_WMI_DEVID_KBD_DOCK		0x00120063
 
+/* dgpu on/off */
+#define ASUS_WMI_DEVID_DGPU		0x00090020
+
 /* DSTS masks */
 #define ASUS_WMI_DSTS_STATUS_BIT	0x00000001
 #define ASUS_WMI_DSTS_UNKNOWN_BIT	0x00000002

From 97620a08fc1bd2b50fee4063fe92af74c9a95cc9 Mon Sep 17 00:00:00 2001
From: "Luke D. Jones" <luke@ljones.dev>
Date: Sat, 13 Aug 2022 21:27:52 +1200
Subject: [PATCH 0836/1043] platform/x86: asus-wmi: Adjust tablet/lidflip
 handling to use enum

[ Upstream commit 00aa846955fbfb04f7bc0c26c49febfe5395eca1 ]

Due to multiple types of tablet/lidflip, the existing code for
handling these events is refactored to use an enum for each type.

Signed-off-by: Luke D. Jones <luke@ljones.dev>
Link: https://lore.kernel.org/r/20220813092753.6635-1-luke@ljones.dev
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-nb-wmi.c | 13 +++-----
 drivers/platform/x86/asus-wmi.c    | 49 +++++++++++++++++++++---------
 drivers/platform/x86/asus-wmi.h    |  9 ++++--
 3 files changed, 47 insertions(+), 24 deletions(-)

diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index 59ca3dab59e1..f723af0106a1 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -115,12 +115,12 @@ static struct quirk_entry quirk_asus_forceals = {
 };
 
 static struct quirk_entry quirk_asus_use_kbd_dock_devid = {
-	.use_kbd_dock_devid = true,
+	.tablet_switch_mode = asus_wmi_kbd_dock_devid,
 };
 
 static struct quirk_entry quirk_asus_use_lid_flip_devid = {
 	.wmi_backlight_set_devstate = true,
-	.use_lid_flip_devid = true,
+	.tablet_switch_mode = asus_wmi_lid_flip_devid,
 };
 
 static int dmi_matched(const struct dmi_system_id *dmi)
@@ -492,16 +492,13 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver)
 
 	switch (tablet_mode_sw) {
 	case 0:
-		quirks->use_kbd_dock_devid = false;
-		quirks->use_lid_flip_devid = false;
+		quirks->tablet_switch_mode = asus_wmi_no_tablet_switch;
 		break;
 	case 1:
-		quirks->use_kbd_dock_devid = true;
-		quirks->use_lid_flip_devid = false;
+		quirks->tablet_switch_mode = asus_wmi_kbd_dock_devid;
 		break;
 	case 2:
-		quirks->use_kbd_dock_devid = false;
-		quirks->use_lid_flip_devid = true;
+		quirks->tablet_switch_mode = asus_wmi_lid_flip_devid;
 		break;
 	}
 
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 93b4c6113083..80a442a392cb 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -353,8 +353,11 @@ static bool asus_wmi_dev_is_present(struct asus_wmi *asus, u32 dev_id)
 
 static int asus_wmi_input_init(struct asus_wmi *asus)
 {
+	struct device *dev;
 	int err, result;
 
+	dev = &asus->platform_device->dev;
+
 	asus->inputdev = input_allocate_device();
 	if (!asus->inputdev)
 		return -ENOMEM;
@@ -362,35 +365,38 @@ static int asus_wmi_input_init(struct asus_wmi *asus)
 	asus->inputdev->name = asus->driver->input_name;
 	asus->inputdev->phys = asus->driver->input_phys;
 	asus->inputdev->id.bustype = BUS_HOST;
-	asus->inputdev->dev.parent = &asus->platform_device->dev;
+	asus->inputdev->dev.parent = dev;
 	set_bit(EV_REP, asus->inputdev->evbit);
 
 	err = sparse_keymap_setup(asus->inputdev, asus->driver->keymap, NULL);
 	if (err)
 		goto err_free_dev;
 
-	if (asus->driver->quirks->use_kbd_dock_devid) {
+	switch (asus->driver->quirks->tablet_switch_mode) {
+	case asus_wmi_no_tablet_switch:
+		break;
+	case asus_wmi_kbd_dock_devid:
 		result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_KBD_DOCK);
 		if (result >= 0) {
 			input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
 			input_report_switch(asus->inputdev, SW_TABLET_MODE, !result);
 		} else if (result != -ENODEV) {
-			pr_err("Error checking for keyboard-dock: %d\n", result);
+			dev_err(dev, "Error checking for keyboard-dock: %d\n", result);
 		}
-	}
-
-	if (asus->driver->quirks->use_lid_flip_devid) {
+		break;
+	case asus_wmi_lid_flip_devid:
 		result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP);
 		if (result < 0)
-			asus->driver->quirks->use_lid_flip_devid = 0;
+			asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch;
 		if (result >= 0) {
 			input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
 			input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
 		} else if (result == -ENODEV) {
-			pr_err("This device has lid_flip quirk but got ENODEV checking it. This is a bug.");
+			dev_err(dev, "This device has lid_flip quirk but got ENODEV checking it. This is a bug.");
 		} else {
-			pr_err("Error checking for lid-flip: %d\n", result);
+			dev_err(dev, "Error checking for lid-flip: %d\n", result);
 		}
+		break;
 	}
 
 	err = input_register_device(asus->inputdev);
@@ -416,8 +422,9 @@ static void asus_wmi_input_exit(struct asus_wmi *asus)
 
 static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus)
 {
-	int result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP);
+	int result;
 
+	result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP);
 	if (result >= 0) {
 		input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
 		input_sync(asus->inputdev);
@@ -2236,7 +2243,8 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus)
 		return;
 	}
 
-	if (asus->driver->quirks->use_kbd_dock_devid && code == NOTIFY_KBD_DOCK_CHANGE) {
+	if (asus->driver->quirks->tablet_switch_mode == asus_wmi_kbd_dock_devid &&
+	    code == NOTIFY_KBD_DOCK_CHANGE) {
 		result = asus_wmi_get_devstate_simple(asus,
 						      ASUS_WMI_DEVID_KBD_DOCK);
 		if (result >= 0) {
@@ -2247,7 +2255,8 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus)
 		return;
 	}
 
-	if (asus->driver->quirks->use_lid_flip_devid && code == NOTIFY_LID_FLIP) {
+	if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_devid &&
+	    code == NOTIFY_LID_FLIP) {
 		lid_flip_tablet_mode_get_state(asus);
 		return;
 	}
@@ -2852,8 +2861,14 @@ static int asus_hotk_resume(struct device *device)
 	if (asus_wmi_has_fnlock_key(asus))
 		asus_wmi_fnlock_update(asus);
 
-	if (asus->driver->quirks->use_lid_flip_devid)
+	switch (asus->driver->quirks->tablet_switch_mode) {
+	case asus_wmi_no_tablet_switch:
+	case asus_wmi_kbd_dock_devid:
+		break;
+	case asus_wmi_lid_flip_devid:
 		lid_flip_tablet_mode_get_state(asus);
+		break;
+	}
 
 	return 0;
 }
@@ -2894,8 +2909,14 @@ static int asus_hotk_restore(struct device *device)
 	if (asus_wmi_has_fnlock_key(asus))
 		asus_wmi_fnlock_update(asus);
 
-	if (asus->driver->quirks->use_lid_flip_devid)
+	switch (asus->driver->quirks->tablet_switch_mode) {
+	case asus_wmi_no_tablet_switch:
+	case asus_wmi_kbd_dock_devid:
+		break;
+	case asus_wmi_lid_flip_devid:
 		lid_flip_tablet_mode_get_state(asus);
+		break;
+	}
 
 	return 0;
 }
diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
index 49f2b8f8ad3e..f0302a51c519 100644
--- a/drivers/platform/x86/asus-wmi.h
+++ b/drivers/platform/x86/asus-wmi.h
@@ -25,6 +25,12 @@ struct module;
 struct key_entry;
 struct asus_wmi;
 
+enum asus_wmi_tablet_switch_mode {
+	asus_wmi_no_tablet_switch,
+	asus_wmi_kbd_dock_devid,
+	asus_wmi_lid_flip_devid,
+};
+
 struct quirk_entry {
 	bool hotplug_wireless;
 	bool scalar_panel_brightness;
@@ -33,8 +39,7 @@ struct quirk_entry {
 	bool wmi_backlight_native;
 	bool wmi_backlight_set_devstate;
 	bool wmi_force_als_set;
-	bool use_kbd_dock_devid;
-	bool use_lid_flip_devid;
+	enum asus_wmi_tablet_switch_mode tablet_switch_mode;
 	int wapf;
 	/*
 	 * For machines with AMD graphic chips, it will send out WMI event

From 68b795d040072801a23e265e662c8844a1accc39 Mon Sep 17 00:00:00 2001
From: "Luke D. Jones" <luke@ljones.dev>
Date: Sat, 13 Aug 2022 21:27:53 +1200
Subject: [PATCH 0837/1043] platform/x86: asus-wmi: Add support for ROG X13
 tablet mode

[ Upstream commit e397c3c460bf3849384f2f55516d1887617cfca9 ]

Add quirk for ASUS ROG X13 Flow 2-in-1 to enable tablet mode with
lid flip (all screen rotations).

Signed-off-by: Luke D. Jones <luke@ljones.dev>
Link: https://lore.kernel.org/r/20220813092753.6635-2-luke@ljones.dev
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-nb-wmi.c         | 15 +++++++++
 drivers/platform/x86/asus-wmi.c            | 37 ++++++++++++++++++++++
 drivers/platform/x86/asus-wmi.h            |  1 +
 include/linux/platform_data/x86/asus-wmi.h |  1 +
 4 files changed, 54 insertions(+)

diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index f723af0106a1..2857678efa2e 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -123,6 +123,11 @@ static struct quirk_entry quirk_asus_use_lid_flip_devid = {
 	.tablet_switch_mode = asus_wmi_lid_flip_devid,
 };
 
+static struct quirk_entry quirk_asus_tablet_mode = {
+	.wmi_backlight_set_devstate = true,
+	.tablet_switch_mode = asus_wmi_lid_flip_rog_devid,
+};
+
 static int dmi_matched(const struct dmi_system_id *dmi)
 {
 	pr_info("Identified laptop model '%s'\n", dmi->ident);
@@ -471,6 +476,15 @@ static const struct dmi_system_id asus_quirks[] = {
 		},
 		.driver_data = &quirk_asus_use_lid_flip_devid,
 	},
+	{
+		.callback = dmi_matched,
+		.ident = "ASUS ROG FLOW X13",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "GV301Q"),
+		},
+		.driver_data = &quirk_asus_tablet_mode,
+	},
 	{},
 };
 
@@ -581,6 +595,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = {
 	{ KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } },
 	{ KE_IGNORE, 0xC6, },  /* Ambient Light Sensor notification */
 	{ KE_KEY, 0xFA, { KEY_PROG2 } },           /* Lid flip action */
+	{ KE_KEY, 0xBD, { KEY_PROG2 } },           /* Lid flip action on ROG xflow laptops */
 	{ KE_END, 0},
 };
 
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 80a442a392cb..31f5e4df4391 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -64,6 +64,7 @@ MODULE_LICENSE("GPL");
 #define NOTIFY_KBD_FBM			0x99
 #define NOTIFY_KBD_TTP			0xae
 #define NOTIFY_LID_FLIP			0xfa
+#define NOTIFY_LID_FLIP_ROG		0xbd
 
 #define ASUS_WMI_FNLOCK_BIOS_DISABLED	BIT(0)
 
@@ -397,6 +398,19 @@ static int asus_wmi_input_init(struct asus_wmi *asus)
 			dev_err(dev, "Error checking for lid-flip: %d\n", result);
 		}
 		break;
+	case asus_wmi_lid_flip_rog_devid:
+		result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG);
+		if (result < 0)
+			asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch;
+		if (result >= 0) {
+			input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
+			input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
+		} else if (result == -ENODEV) {
+			dev_err(dev, "This device has lid-flip-rog quirk but got ENODEV checking it. This is a bug.");
+		} else {
+			dev_err(dev, "Error checking for lid-flip: %d\n", result);
+		}
+		break;
 	}
 
 	err = input_register_device(asus->inputdev);
@@ -431,6 +445,17 @@ static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus)
 	}
 }
 
+static void lid_flip_rog_tablet_mode_get_state(struct asus_wmi *asus)
+{
+	int result;
+
+	result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG);
+	if (result >= 0) {
+		input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
+		input_sync(asus->inputdev);
+	}
+}
+
 /* dGPU ********************************************************************/
 static int dgpu_disable_check_present(struct asus_wmi *asus)
 {
@@ -2261,6 +2286,12 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus)
 		return;
 	}
 
+	if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_rog_devid &&
+	    code == NOTIFY_LID_FLIP_ROG) {
+		lid_flip_rog_tablet_mode_get_state(asus);
+		return;
+	}
+
 	if (asus->fan_boost_mode_available && code == NOTIFY_KBD_FBM) {
 		fan_boost_mode_switch_next(asus);
 		return;
@@ -2868,6 +2899,9 @@ static int asus_hotk_resume(struct device *device)
 	case asus_wmi_lid_flip_devid:
 		lid_flip_tablet_mode_get_state(asus);
 		break;
+	case asus_wmi_lid_flip_rog_devid:
+		lid_flip_rog_tablet_mode_get_state(asus);
+		break;
 	}
 
 	return 0;
@@ -2916,6 +2950,9 @@ static int asus_hotk_restore(struct device *device)
 	case asus_wmi_lid_flip_devid:
 		lid_flip_tablet_mode_get_state(asus);
 		break;
+	case asus_wmi_lid_flip_rog_devid:
+		lid_flip_rog_tablet_mode_get_state(asus);
+		break;
 	}
 
 	return 0;
diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
index f0302a51c519..b817a312f2e1 100644
--- a/drivers/platform/x86/asus-wmi.h
+++ b/drivers/platform/x86/asus-wmi.h
@@ -29,6 +29,7 @@ enum asus_wmi_tablet_switch_mode {
 	asus_wmi_no_tablet_switch,
 	asus_wmi_kbd_dock_devid,
 	asus_wmi_lid_flip_devid,
+	asus_wmi_lid_flip_rog_devid,
 };
 
 struct quirk_entry {
diff --git a/include/linux/platform_data/x86/asus-wmi.h b/include/linux/platform_data/x86/asus-wmi.h
index 7d8d3e9c45d6..60cad2aac5c1 100644
--- a/include/linux/platform_data/x86/asus-wmi.h
+++ b/include/linux/platform_data/x86/asus-wmi.h
@@ -63,6 +63,7 @@
 /* Misc */
 #define ASUS_WMI_DEVID_CAMERA		0x00060013
 #define ASUS_WMI_DEVID_LID_FLIP		0x00060062
+#define ASUS_WMI_DEVID_LID_FLIP_ROG	0x00060077
 
 /* Storage */
 #define ASUS_WMI_DEVID_CARDREADER	0x00080013

From a113da75908b53aadba5288e0e810ead87d3de51 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Wed, 24 Aug 2022 17:11:44 +0200
Subject: [PATCH 0838/1043] platform/x86: asus-wmi: Simplify tablet-mode-switch
 probing

[ Upstream commit c98dc61ee08f833e68337700546e120e2edac7c9 ]

The 3 different tablet-mode-switch initialization paths repeat a lot
of the same code. Add a helper function for this.

This also makes the error-handling for the kbd_dock_devid case consistent
with the other 2 cases.

Cc: Luke D. Jones <luke@ljones.dev>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20220824151145.1448010-1-hdegoede@redhat.com
Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-wmi.c | 55 +++++++++++++--------------------
 1 file changed, 22 insertions(+), 33 deletions(-)

diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 31f5e4df4391..a1a6e48d0c04 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -351,13 +351,28 @@ static bool asus_wmi_dev_is_present(struct asus_wmi *asus, u32 dev_id)
 }
 
 /* Input **********************************************************************/
+static void asus_wmi_tablet_sw_init(struct asus_wmi *asus, u32 dev_id, int event_code)
+{
+	struct device *dev = &asus->platform_device->dev;
+	int result;
+
+	result = asus_wmi_get_devstate_simple(asus, dev_id);
+	if (result < 0)
+		asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch;
+	if (result >= 0) {
+		input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
+		input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
+	} else if (result == -ENODEV) {
+		dev_err(dev, "This device has tablet-mode-switch quirk but got ENODEV checking it. This is a bug.");
+	} else {
+		dev_err(dev, "Error checking for tablet-mode-switch: %d\n", result);
+	}
+}
 
 static int asus_wmi_input_init(struct asus_wmi *asus)
 {
-	struct device *dev;
-	int err, result;
-
-	dev = &asus->platform_device->dev;
+	struct device *dev = &asus->platform_device->dev;
+	int err;
 
 	asus->inputdev = input_allocate_device();
 	if (!asus->inputdev)
@@ -377,39 +392,13 @@ static int asus_wmi_input_init(struct asus_wmi *asus)
 	case asus_wmi_no_tablet_switch:
 		break;
 	case asus_wmi_kbd_dock_devid:
-		result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_KBD_DOCK);
-		if (result >= 0) {
-			input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
-			input_report_switch(asus->inputdev, SW_TABLET_MODE, !result);
-		} else if (result != -ENODEV) {
-			dev_err(dev, "Error checking for keyboard-dock: %d\n", result);
-		}
+		asus_wmi_tablet_sw_init(asus, ASUS_WMI_DEVID_KBD_DOCK, NOTIFY_KBD_DOCK_CHANGE);
 		break;
 	case asus_wmi_lid_flip_devid:
-		result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP);
-		if (result < 0)
-			asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch;
-		if (result >= 0) {
-			input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
-			input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
-		} else if (result == -ENODEV) {
-			dev_err(dev, "This device has lid_flip quirk but got ENODEV checking it. This is a bug.");
-		} else {
-			dev_err(dev, "Error checking for lid-flip: %d\n", result);
-		}
+		asus_wmi_tablet_sw_init(asus, ASUS_WMI_DEVID_LID_FLIP, NOTIFY_LID_FLIP);
 		break;
 	case asus_wmi_lid_flip_rog_devid:
-		result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG);
-		if (result < 0)
-			asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch;
-		if (result >= 0) {
-			input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
-			input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
-		} else if (result == -ENODEV) {
-			dev_err(dev, "This device has lid-flip-rog quirk but got ENODEV checking it. This is a bug.");
-		} else {
-			dev_err(dev, "Error checking for lid-flip: %d\n", result);
-		}
+		asus_wmi_tablet_sw_init(asus, ASUS_WMI_DEVID_LID_FLIP_ROG, NOTIFY_LID_FLIP_ROG);
 		break;
 	}
 

From 5fe052b8fa4bbcbfe3ce74f3b99062b7a2977634 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Wed, 24 Aug 2022 17:11:45 +0200
Subject: [PATCH 0839/1043] platform/x86: asus-wmi: Simplify tablet-mode-switch
 handling

[ Upstream commit 1ea0d3b46798afc35c3185f6058b8bc08525d56c ]

Simplify tablet-mode-switch handling:
1. The code is the same for all variants, the only difference is the
   dev_id and notify event code. Store the dev_id + code in struct asus_wmi
   and unify the handling
2. Make the new unified asus_wmi_tablet_mode_get_state() check dev_id has
   been set and make it a no-op when not set. This allows calling it
   unconditionally at resume/restore time
3. Simplify the tablet_mode_sw module-param handling, this also allows
   selecting the new lid-flip-rog type through the module-param.

Cc: Luke D. Jones <luke@ljones.dev>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20220824151145.1448010-2-hdegoede@redhat.com
Stable-dep-of: b52cbca22cbf ("platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/asus-nb-wmi.c | 13 +----
 drivers/platform/x86/asus-wmi.c    | 76 ++++++------------------------
 2 files changed, 16 insertions(+), 73 deletions(-)

diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index 2857678efa2e..7b8942fee76d 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -504,17 +504,8 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver)
 	else
 		wapf = quirks->wapf;
 
-	switch (tablet_mode_sw) {
-	case 0:
-		quirks->tablet_switch_mode = asus_wmi_no_tablet_switch;
-		break;
-	case 1:
-		quirks->tablet_switch_mode = asus_wmi_kbd_dock_devid;
-		break;
-	case 2:
-		quirks->tablet_switch_mode = asus_wmi_lid_flip_devid;
-		break;
-	}
+	if (tablet_mode_sw != -1)
+		quirks->tablet_switch_mode = tablet_mode_sw;
 
 	if (quirks->i8042_filter) {
 		ret = i8042_install_filter(quirks->i8042_filter);
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index a1a6e48d0c04..a1008af0741c 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -200,6 +200,9 @@ struct asus_wmi {
 	struct asus_rfkill gps;
 	struct asus_rfkill uwb;
 
+	int tablet_switch_event_code;
+	u32 tablet_switch_dev_id;
+
 	enum fan_type fan_type;
 	int fan_pwm_mode;
 	int agfn_pwm;
@@ -357,11 +360,11 @@ static void asus_wmi_tablet_sw_init(struct asus_wmi *asus, u32 dev_id, int event
 	int result;
 
 	result = asus_wmi_get_devstate_simple(asus, dev_id);
-	if (result < 0)
-		asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch;
 	if (result >= 0) {
 		input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
 		input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
+		asus->tablet_switch_dev_id = dev_id;
+		asus->tablet_switch_event_code = event_code;
 	} else if (result == -ENODEV) {
 		dev_err(dev, "This device has tablet-mode-switch quirk but got ENODEV checking it. This is a bug.");
 	} else {
@@ -423,22 +426,14 @@ static void asus_wmi_input_exit(struct asus_wmi *asus)
 
 /* Tablet mode ****************************************************************/
 
-static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus)
+static void asus_wmi_tablet_mode_get_state(struct asus_wmi *asus)
 {
 	int result;
 
-	result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP);
-	if (result >= 0) {
-		input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
-		input_sync(asus->inputdev);
-	}
-}
+	if (!asus->tablet_switch_dev_id)
+		return;
 
-static void lid_flip_rog_tablet_mode_get_state(struct asus_wmi *asus)
-{
-	int result;
-
-	result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG);
+	result = asus_wmi_get_devstate_simple(asus, asus->tablet_switch_dev_id);
 	if (result >= 0) {
 		input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
 		input_sync(asus->inputdev);
@@ -2212,9 +2207,7 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus)
 {
 	unsigned int key_value = 1;
 	bool autorelease = 1;
-	int result, orig_code;
-
-	orig_code = code;
+	int orig_code = code;
 
 	if (asus->driver->key_filter) {
 		asus->driver->key_filter(asus->driver, &code, &key_value,
@@ -2257,27 +2250,8 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus)
 		return;
 	}
 
-	if (asus->driver->quirks->tablet_switch_mode == asus_wmi_kbd_dock_devid &&
-	    code == NOTIFY_KBD_DOCK_CHANGE) {
-		result = asus_wmi_get_devstate_simple(asus,
-						      ASUS_WMI_DEVID_KBD_DOCK);
-		if (result >= 0) {
-			input_report_switch(asus->inputdev, SW_TABLET_MODE,
-					    !result);
-			input_sync(asus->inputdev);
-		}
-		return;
-	}
-
-	if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_devid &&
-	    code == NOTIFY_LID_FLIP) {
-		lid_flip_tablet_mode_get_state(asus);
-		return;
-	}
-
-	if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_rog_devid &&
-	    code == NOTIFY_LID_FLIP_ROG) {
-		lid_flip_rog_tablet_mode_get_state(asus);
+	if (code == asus->tablet_switch_event_code) {
+		asus_wmi_tablet_mode_get_state(asus);
 		return;
 	}
 
@@ -2881,18 +2855,7 @@ static int asus_hotk_resume(struct device *device)
 	if (asus_wmi_has_fnlock_key(asus))
 		asus_wmi_fnlock_update(asus);
 
-	switch (asus->driver->quirks->tablet_switch_mode) {
-	case asus_wmi_no_tablet_switch:
-	case asus_wmi_kbd_dock_devid:
-		break;
-	case asus_wmi_lid_flip_devid:
-		lid_flip_tablet_mode_get_state(asus);
-		break;
-	case asus_wmi_lid_flip_rog_devid:
-		lid_flip_rog_tablet_mode_get_state(asus);
-		break;
-	}
-
+	asus_wmi_tablet_mode_get_state(asus);
 	return 0;
 }
 
@@ -2932,18 +2895,7 @@ static int asus_hotk_restore(struct device *device)
 	if (asus_wmi_has_fnlock_key(asus))
 		asus_wmi_fnlock_update(asus);
 
-	switch (asus->driver->quirks->tablet_switch_mode) {
-	case asus_wmi_no_tablet_switch:
-	case asus_wmi_kbd_dock_devid:
-		break;
-	case asus_wmi_lid_flip_devid:
-		lid_flip_tablet_mode_get_state(asus);
-		break;
-	case asus_wmi_lid_flip_rog_devid:
-		lid_flip_rog_tablet_mode_get_state(asus);
-		break;
-	}
-
+	asus_wmi_tablet_mode_get_state(asus);
 	return 0;
 }
 

From 7db515e82ab5c292176be123144fc21f4dbb7bf3 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Mon, 20 Nov 2023 16:42:33 +0100
Subject: [PATCH 0840/1043] platform/x86: asus-wmi: Move i8042 filter install
 to shared asus-wmi code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b52cbca22cbf6c9d2700c1e576d0ddcc670e49d5 ]

asus-nb-wmi calls i8042_install_filter() in some cases, but it never
calls i8042_remove_filter(). This means that a dangling pointer to
the filter function is left after rmmod leading to crashes.

Fix this by moving the i8042-filter installation to the shared
asus-wmi code and also remove it from the shared code on driver unbind.

Fixes: b5643539b825 ("platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A")
Cc: Oleksij Rempel <linux@rempel-privat.de>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231120154235.610808-2-hdegoede@redhat.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/Kconfig       |  2 +-
 drivers/platform/x86/asus-nb-wmi.c | 11 -----------
 drivers/platform/x86/asus-wmi.c    |  8 ++++++++
 3 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 84c5b922f245..c14c145b88d8 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -243,6 +243,7 @@ config ASUS_WMI
 	depends on RFKILL || RFKILL = n
 	depends on HOTPLUG_PCI
 	depends on ACPI_VIDEO || ACPI_VIDEO = n
+	depends on SERIO_I8042 || SERIO_I8042 = n
 	select INPUT_SPARSEKMAP
 	select LEDS_CLASS
 	select NEW_LEDS
@@ -256,7 +257,6 @@ config ASUS_WMI
 config ASUS_NB_WMI
 	tristate "Asus Notebook WMI Driver"
 	depends on ASUS_WMI
-	depends on SERIO_I8042 || SERIO_I8042 = n
 	help
 	  This is a driver for newer Asus notebooks. It adds extra features
 	  like wireless radio and bluetooth control, leds, hotkeys, backlight...
diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index 7b8942fee76d..49505939352a 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -490,8 +490,6 @@ static const struct dmi_system_id asus_quirks[] = {
 
 static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver)
 {
-	int ret;
-
 	quirks = &quirk_asus_unknown;
 	dmi_check_system(asus_quirks);
 
@@ -506,15 +504,6 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver)
 
 	if (tablet_mode_sw != -1)
 		quirks->tablet_switch_mode = tablet_mode_sw;
-
-	if (quirks->i8042_filter) {
-		ret = i8042_install_filter(quirks->i8042_filter);
-		if (ret) {
-			pr_warn("Unable to install key filter\n");
-			return;
-		}
-		pr_info("Using i8042 filter function for receiving events\n");
-	}
 }
 
 static const struct key_entry asus_nb_wmi_keymap[] = {
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index a1008af0741c..695907c6503c 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -2779,6 +2779,12 @@ static int asus_wmi_add(struct platform_device *pdev)
 		goto fail_wmi_handler;
 	}
 
+	if (asus->driver->quirks->i8042_filter) {
+		err = i8042_install_filter(asus->driver->quirks->i8042_filter);
+		if (err)
+			pr_warn("Unable to install key filter - %d\n", err);
+	}
+
 	asus_wmi_battery_init(asus);
 
 	asus_wmi_debugfs_init(asus);
@@ -2810,6 +2816,8 @@ static int asus_wmi_remove(struct platform_device *device)
 	struct asus_wmi *asus;
 
 	asus = platform_get_drvdata(device);
+	if (asus->driver->quirks->i8042_filter)
+		i8042_remove_filter(asus->driver->quirks->i8042_filter);
 	wmi_remove_notify_handler(asus->driver->event_guid);
 	asus_wmi_backlight_exit(asus);
 	asus_wmi_input_exit(asus);

From 58ccdcc9d7208f938a13604fec07fc7e521918ae Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Thu, 18 Mar 2021 10:40:30 +0000
Subject: [PATCH 0841/1043] of: base: Fix some formatting issues and provide
 missing descriptions

[ Upstream commit 3637d49e11219512920aca8b8ccd0994be33fa8b ]

Fixes the following W=1 kernel build warning(s):

 drivers/of/base.c:315: warning: Function parameter or member 'cpun' not described in '__of_find_n_match_cpu_property'
 drivers/of/base.c:315: warning: Function parameter or member 'prop_name' not described in '__of_find_n_match_cpu_property'
 drivers/of/base.c:315: warning: Function parameter or member 'cpu' not described in '__of_find_n_match_cpu_property'
 drivers/of/base.c:315: warning: Function parameter or member 'thread' not described in '__of_find_n_match_cpu_property'
 drivers/of/base.c:315: warning: expecting prototype for property holds the physical id of the(). Prototype was for __of_find_n_match_cpu_property() instead
 drivers/of/base.c:1139: warning: Function parameter or member 'match' not described in 'of_find_matching_node_and_match'
 drivers/of/base.c:1779: warning: Function parameter or member 'np' not described in '__of_add_property'
 drivers/of/base.c:1779: warning: Function parameter or member 'prop' not described in '__of_add_property'
 drivers/of/base.c:1800: warning: Function parameter or member 'np' not described in 'of_add_property'
 drivers/of/base.c:1800: warning: Function parameter or member 'prop' not described in 'of_add_property'
 drivers/of/base.c:1849: warning: Function parameter or member 'np' not described in 'of_remove_property'
 drivers/of/base.c:1849: warning: Function parameter or member 'prop' not described in 'of_remove_property'
 drivers/of/base.c:2137: warning: Function parameter or member 'dn' not described in 'of_console_check'
 drivers/of/base.c:2137: warning: Function parameter or member 'name' not described in 'of_console_check'
 drivers/of/base.c:2137: warning: Function parameter or member 'index' not described in 'of_console_check'

Cc: Rob Herring <robh+dt@kernel.org>
Cc: Frank Rowand <frowand.list@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: devicetree@vger.kernel.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20210318104036.3175910-5-lee.jones@linaro.org
Stable-dep-of: d79972789d17 ("of: dynamic: Fix of_reconfig_get_state_change() return value documentation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/of/base.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/of/base.c b/drivers/of/base.c
index a44a0e7ba251..fa45a681267c 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -305,7 +305,7 @@ bool __weak arch_match_cpu_phys_id(int cpu, u64 phys_id)
 	return (u32)phys_id == cpu;
 }
 
-/**
+/*
  * Checks if the given "prop_name" property holds the physical id of the
  * core/thread corresponding to the logical cpu 'cpu'. If 'thread' is not
  * NULL, local thread number within the core is returned in it.
@@ -1128,7 +1128,7 @@ EXPORT_SYMBOL(of_match_node);
  *			will; typically, you pass what the previous call
  *			returned. of_node_put() will be called on it
  *	@matches:	array of of device match structures to search in
- *	@match		Updated to point at the matches entry which matched
+ *	@match:		Updated to point at the matches entry which matched
  *
  *	Returns a node pointer with refcount incremented, use
  *	of_node_put() on it when done.
@@ -1779,6 +1779,8 @@ EXPORT_SYMBOL(of_count_phandle_with_args);
 
 /**
  * __of_add_property - Add a property to a node without lock operations
+ * @np:		Caller's Device Node
+ * @prob:	Property to add
  */
 int __of_add_property(struct device_node *np, struct property *prop)
 {
@@ -1800,6 +1802,8 @@ int __of_add_property(struct device_node *np, struct property *prop)
 
 /**
  * of_add_property - Add a property to a node
+ * @np:		Caller's Device Node
+ * @prob:	Property to add
  */
 int of_add_property(struct device_node *np, struct property *prop)
 {
@@ -1844,6 +1848,8 @@ int __of_remove_property(struct device_node *np, struct property *prop)
 
 /**
  * of_remove_property - Remove a property from a node.
+ * @np:		Caller's Device Node
+ * @prob:	Property to remove
  *
  * Note that we don't actually remove it, since we have given out
  * who-knows-how-many pointers to the data using get-property.
@@ -2130,9 +2136,9 @@ EXPORT_SYMBOL_GPL(of_alias_get_highest_id);
 
 /**
  * of_console_check() - Test and setup console for DT setup
- * @dn - Pointer to device node
- * @name - Name to use for preferred console without index. ex. "ttyS"
- * @index - Index to use for preferred console.
+ * @dn: Pointer to device node
+ * @name: Name to use for preferred console without index. ex. "ttyS"
+ * @index: Index to use for preferred console.
  *
  * Check if the given device node matches the stdout-path property in the
  * /chosen node. If it does then register it as the preferred console and return

From f58e3b3652fc3cc6dca2c9b8c0fd9716653ee7ae Mon Sep 17 00:00:00 2001
From: Rob Herring <robh@kernel.org>
Date: Fri, 26 Mar 2021 13:26:06 -0600
Subject: [PATCH 0842/1043] of: Fix kerneldoc output formatting

[ Upstream commit 62f026f082e4d762a47b43ea693b38f025122332 ]

The indentation of the kerneldoc comments affects the output formatting.
Leading tabs in particular don't work, sections need to be indented
under the section header, and several code blocks are reformatted.

Cc: Frank Rowand <frowand.list@gmail.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Rob Herring <robh@kernel.org>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Link: https://lore.kernel.org/r/20210326192606.3702739-1-robh@kernel.org
Stable-dep-of: d79972789d17 ("of: dynamic: Fix of_reconfig_get_state_change() return value documentation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/of/base.c | 265 +++++++++++++++++++++++-----------------------
 drivers/of/fdt.c  |   9 +-
 2 files changed, 136 insertions(+), 138 deletions(-)

diff --git a/drivers/of/base.c b/drivers/of/base.c
index fa45a681267c..85a55cfd00f1 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -651,11 +651,11 @@ bool of_device_is_big_endian(const struct device_node *device)
 EXPORT_SYMBOL(of_device_is_big_endian);
 
 /**
- *	of_get_parent - Get a node's parent if any
- *	@node:	Node to get parent
+ * of_get_parent - Get a node's parent if any
+ * @node:	Node to get parent
  *
- *	Returns a node pointer with refcount incremented, use
- *	of_node_put() on it when done.
+ * Return: A node pointer with refcount incremented, use
+ * of_node_put() on it when done.
  */
 struct device_node *of_get_parent(const struct device_node *node)
 {
@@ -673,15 +673,15 @@ struct device_node *of_get_parent(const struct device_node *node)
 EXPORT_SYMBOL(of_get_parent);
 
 /**
- *	of_get_next_parent - Iterate to a node's parent
- *	@node:	Node to get parent of
+ * of_get_next_parent - Iterate to a node's parent
+ * @node:	Node to get parent of
  *
- *	This is like of_get_parent() except that it drops the
- *	refcount on the passed node, making it suitable for iterating
- *	through a node's parents.
+ * This is like of_get_parent() except that it drops the
+ * refcount on the passed node, making it suitable for iterating
+ * through a node's parents.
  *
- *	Returns a node pointer with refcount incremented, use
- *	of_node_put() on it when done.
+ * Return: A node pointer with refcount incremented, use
+ * of_node_put() on it when done.
  */
 struct device_node *of_get_next_parent(struct device_node *node)
 {
@@ -719,13 +719,13 @@ static struct device_node *__of_get_next_child(const struct device_node *node,
 	     child = __of_get_next_child(parent, child))
 
 /**
- *	of_get_next_child - Iterate a node childs
- *	@node:	parent node
- *	@prev:	previous child of the parent node, or NULL to get first
+ * of_get_next_child - Iterate a node childs
+ * @node:	parent node
+ * @prev:	previous child of the parent node, or NULL to get first
  *
- *	Returns a node pointer with refcount incremented, use of_node_put() on
- *	it when done. Returns NULL when prev is the last child. Decrements the
- *	refcount of prev.
+ * Return: A node pointer with refcount incremented, use of_node_put() on
+ * it when done. Returns NULL when prev is the last child. Decrements the
+ * refcount of prev.
  */
 struct device_node *of_get_next_child(const struct device_node *node,
 	struct device_node *prev)
@@ -741,12 +741,12 @@ struct device_node *of_get_next_child(const struct device_node *node,
 EXPORT_SYMBOL(of_get_next_child);
 
 /**
- *	of_get_next_available_child - Find the next available child node
- *	@node:	parent node
- *	@prev:	previous child of the parent node, or NULL to get first
+ * of_get_next_available_child - Find the next available child node
+ * @node:	parent node
+ * @prev:	previous child of the parent node, or NULL to get first
  *
- *      This function is like of_get_next_child(), except that it
- *      automatically skips any disabled nodes (i.e. status = "disabled").
+ * This function is like of_get_next_child(), except that it
+ * automatically skips any disabled nodes (i.e. status = "disabled").
  */
 struct device_node *of_get_next_available_child(const struct device_node *node,
 	struct device_node *prev)
@@ -772,12 +772,12 @@ struct device_node *of_get_next_available_child(const struct device_node *node,
 EXPORT_SYMBOL(of_get_next_available_child);
 
 /**
- *	of_get_next_cpu_node - Iterate on cpu nodes
- *	@prev:	previous child of the /cpus node, or NULL to get first
+ * of_get_next_cpu_node - Iterate on cpu nodes
+ * @prev:	previous child of the /cpus node, or NULL to get first
  *
- *	Returns a cpu node pointer with refcount incremented, use of_node_put()
- *	on it when done. Returns NULL when prev is the last child. Decrements
- *	the refcount of prev.
+ * Return: A cpu node pointer with refcount incremented, use of_node_put()
+ * on it when done. Returns NULL when prev is the last child. Decrements
+ * the refcount of prev.
  */
 struct device_node *of_get_next_cpu_node(struct device_node *prev)
 {
@@ -834,15 +834,15 @@ struct device_node *of_get_compatible_child(const struct device_node *parent,
 EXPORT_SYMBOL(of_get_compatible_child);
 
 /**
- *	of_get_child_by_name - Find the child node by name for a given parent
- *	@node:	parent node
- *	@name:	child name to look for.
+ * of_get_child_by_name - Find the child node by name for a given parent
+ * @node:	parent node
+ * @name:	child name to look for.
  *
- *      This function looks for child node for given matching name
+ * This function looks for child node for given matching name
  *
- *	Returns a node pointer if found, with refcount incremented, use
- *	of_node_put() on it when done.
- *	Returns NULL if node is not found.
+ * Return: A node pointer if found, with refcount incremented, use
+ * of_node_put() on it when done.
+ * Returns NULL if node is not found.
  */
 struct device_node *of_get_child_by_name(const struct device_node *node,
 				const char *name)
@@ -893,22 +893,22 @@ struct device_node *__of_find_node_by_full_path(struct device_node *node,
 }
 
 /**
- *	of_find_node_opts_by_path - Find a node matching a full OF path
- *	@path: Either the full path to match, or if the path does not
- *	       start with '/', the name of a property of the /aliases
- *	       node (an alias).  In the case of an alias, the node
- *	       matching the alias' value will be returned.
- *	@opts: Address of a pointer into which to store the start of
- *	       an options string appended to the end of the path with
- *	       a ':' separator.
+ * of_find_node_opts_by_path - Find a node matching a full OF path
+ * @path: Either the full path to match, or if the path does not
+ *       start with '/', the name of a property of the /aliases
+ *       node (an alias).  In the case of an alias, the node
+ *       matching the alias' value will be returned.
+ * @opts: Address of a pointer into which to store the start of
+ *       an options string appended to the end of the path with
+ *       a ':' separator.
  *
- *	Valid paths:
- *		/foo/bar	Full path
- *		foo		Valid alias
- *		foo/bar		Valid alias + relative path
+ * Valid paths:
+ *  * /foo/bar	Full path
+ *  * foo	Valid alias
+ *  * foo/bar	Valid alias + relative path
  *
- *	Returns a node pointer with refcount incremented, use
- *	of_node_put() on it when done.
+ * Return: A node pointer with refcount incremented, use
+ * of_node_put() on it when done.
  */
 struct device_node *of_find_node_opts_by_path(const char *path, const char **opts)
 {
@@ -958,15 +958,15 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
 EXPORT_SYMBOL(of_find_node_opts_by_path);
 
 /**
- *	of_find_node_by_name - Find a node by its "name" property
- *	@from:	The node to start searching from or NULL; the node
+ * of_find_node_by_name - Find a node by its "name" property
+ * @from:	The node to start searching from or NULL; the node
  *		you pass will not be searched, only the next one
  *		will. Typically, you pass what the previous call
  *		returned. of_node_put() will be called on @from.
- *	@name:	The name string to match against
+ * @name:	The name string to match against
  *
- *	Returns a node pointer with refcount incremented, use
- *	of_node_put() on it when done.
+ * Return: A node pointer with refcount incremented, use
+ * of_node_put() on it when done.
  */
 struct device_node *of_find_node_by_name(struct device_node *from,
 	const char *name)
@@ -985,16 +985,16 @@ struct device_node *of_find_node_by_name(struct device_node *from,
 EXPORT_SYMBOL(of_find_node_by_name);
 
 /**
- *	of_find_node_by_type - Find a node by its "device_type" property
- *	@from:	The node to start searching from, or NULL to start searching
+ * of_find_node_by_type - Find a node by its "device_type" property
+ * @from:	The node to start searching from, or NULL to start searching
  *		the entire device tree. The node you pass will not be
  *		searched, only the next one will; typically, you pass
  *		what the previous call returned. of_node_put() will be
  *		called on from for you.
- *	@type:	The type string to match against
+ * @type:	The type string to match against
  *
- *	Returns a node pointer with refcount incremented, use
- *	of_node_put() on it when done.
+ * Return: A node pointer with refcount incremented, use
+ * of_node_put() on it when done.
  */
 struct device_node *of_find_node_by_type(struct device_node *from,
 	const char *type)
@@ -1013,18 +1013,18 @@ struct device_node *of_find_node_by_type(struct device_node *from,
 EXPORT_SYMBOL(of_find_node_by_type);
 
 /**
- *	of_find_compatible_node - Find a node based on type and one of the
+ * of_find_compatible_node - Find a node based on type and one of the
  *                                tokens in its "compatible" property
- *	@from:		The node to start searching from or NULL, the node
- *			you pass will not be searched, only the next one
- *			will; typically, you pass what the previous call
- *			returned. of_node_put() will be called on it
- *	@type:		The type string to match "device_type" or NULL to ignore
- *	@compatible:	The string to match to one of the tokens in the device
- *			"compatible" list.
+ * @from:	The node to start searching from or NULL, the node
+ *		you pass will not be searched, only the next one
+ *		will; typically, you pass what the previous call
+ *		returned. of_node_put() will be called on it
+ * @type:	The type string to match "device_type" or NULL to ignore
+ * @compatible:	The string to match to one of the tokens in the device
+ *		"compatible" list.
  *
- *	Returns a node pointer with refcount incremented, use
- *	of_node_put() on it when done.
+ * Return: A node pointer with refcount incremented, use
+ * of_node_put() on it when done.
  */
 struct device_node *of_find_compatible_node(struct device_node *from,
 	const char *type, const char *compatible)
@@ -1044,16 +1044,16 @@ struct device_node *of_find_compatible_node(struct device_node *from,
 EXPORT_SYMBOL(of_find_compatible_node);
 
 /**
- *	of_find_node_with_property - Find a node which has a property with
- *                                   the given name.
- *	@from:		The node to start searching from or NULL, the node
- *			you pass will not be searched, only the next one
- *			will; typically, you pass what the previous call
- *			returned. of_node_put() will be called on it
- *	@prop_name:	The name of the property to look for.
+ * of_find_node_with_property - Find a node which has a property with
+ *                              the given name.
+ * @from:	The node to start searching from or NULL, the node
+ *		you pass will not be searched, only the next one
+ *		will; typically, you pass what the previous call
+ *		returned. of_node_put() will be called on it
+ * @prop_name:	The name of the property to look for.
  *
- *	Returns a node pointer with refcount incremented, use
- *	of_node_put() on it when done.
+ * Return: A node pointer with refcount incremented, use
+ * of_node_put() on it when done.
  */
 struct device_node *of_find_node_with_property(struct device_node *from,
 	const char *prop_name)
@@ -1102,10 +1102,10 @@ const struct of_device_id *__of_match_node(const struct of_device_id *matches,
 
 /**
  * of_match_node - Tell if a device_node has a matching of_match structure
- *	@matches:	array of of device match structures to search in
- *	@node:		the of device structure to match against
+ * @matches:	array of of device match structures to search in
+ * @node:	the of device structure to match against
  *
- *	Low level utility function used by device matching.
+ * Low level utility function used by device matching.
  */
 const struct of_device_id *of_match_node(const struct of_device_id *matches,
 					 const struct device_node *node)
@@ -1121,17 +1121,17 @@ const struct of_device_id *of_match_node(const struct of_device_id *matches,
 EXPORT_SYMBOL(of_match_node);
 
 /**
- *	of_find_matching_node_and_match - Find a node based on an of_device_id
- *					  match table.
- *	@from:		The node to start searching from or NULL, the node
- *			you pass will not be searched, only the next one
- *			will; typically, you pass what the previous call
- *			returned. of_node_put() will be called on it
- *	@matches:	array of of device match structures to search in
- *	@match:		Updated to point at the matches entry which matched
+ * of_find_matching_node_and_match - Find a node based on an of_device_id
+ *				     match table.
+ * @from:	The node to start searching from or NULL, the node
+ *		you pass will not be searched, only the next one
+ *		will; typically, you pass what the previous call
+ *		returned. of_node_put() will be called on it
+ * @matches:	array of of device match structures to search in
+ * @match:	Updated to point at the matches entry which matched
  *
- *	Returns a node pointer with refcount incremented, use
- *	of_node_put() on it when done.
+ * Return: A node pointer with refcount incremented, use
+ * of_node_put() on it when done.
  */
 struct device_node *of_find_matching_node_and_match(struct device_node *from,
 					const struct of_device_id *matches,
@@ -1465,21 +1465,21 @@ EXPORT_SYMBOL(of_parse_phandle);
  * Caller is responsible to call of_node_put() on the returned out_args->np
  * pointer.
  *
- * Example:
+ * Example::
  *
- * phandle1: node1 {
+ *  phandle1: node1 {
  *	#list-cells = <2>;
- * }
+ *  };
  *
- * phandle2: node2 {
+ *  phandle2: node2 {
  *	#list-cells = <1>;
- * }
+ *  };
  *
- * node3 {
+ *  node3 {
  *	list = <&phandle1 1 2 &phandle2 3>;
- * }
+ *  };
  *
- * To get a device_node of the `node2' node you may call this:
+ * To get a device_node of the ``node2`` node you may call this:
  * of_parse_phandle_with_args(node3, "list", "#list-cells", 1, &args);
  */
 int of_parse_phandle_with_args(const struct device_node *np, const char *list_name,
@@ -1517,29 +1517,29 @@ EXPORT_SYMBOL(of_parse_phandle_with_args);
  * Caller is responsible to call of_node_put() on the returned out_args->np
  * pointer.
  *
- * Example:
+ * Example::
  *
- * phandle1: node1 {
- *	#list-cells = <2>;
- * }
+ *  phandle1: node1 {
+ *  	#list-cells = <2>;
+ *  };
  *
- * phandle2: node2 {
- *	#list-cells = <1>;
- * }
+ *  phandle2: node2 {
+ *  	#list-cells = <1>;
+ *  };
  *
- * phandle3: node3 {
- * 	#list-cells = <1>;
- * 	list-map = <0 &phandle2 3>,
- * 		   <1 &phandle2 2>,
- * 		   <2 &phandle1 5 1>;
- *	list-map-mask = <0x3>;
- * };
+ *  phandle3: node3 {
+ *  	#list-cells = <1>;
+ *  	list-map = <0 &phandle2 3>,
+ *  		   <1 &phandle2 2>,
+ *  		   <2 &phandle1 5 1>;
+ *  	list-map-mask = <0x3>;
+ *  };
  *
- * node4 {
- *	list = <&phandle1 1 2 &phandle3 0>;
- * }
+ *  node4 {
+ *  	list = <&phandle1 1 2 &phandle3 0>;
+ *  };
  *
- * To get a device_node of the `node2' node you may call this:
+ * To get a device_node of the ``node2`` node you may call this:
  * of_parse_phandle_with_args(node4, "list", "list", 1, &args);
  */
 int of_parse_phandle_with_args_map(const struct device_node *np,
@@ -1699,19 +1699,19 @@ EXPORT_SYMBOL(of_parse_phandle_with_args_map);
  * Caller is responsible to call of_node_put() on the returned out_args->np
  * pointer.
  *
- * Example:
+ * Example::
  *
- * phandle1: node1 {
- * }
+ *  phandle1: node1 {
+ *  };
  *
- * phandle2: node2 {
- * }
+ *  phandle2: node2 {
+ *  };
  *
- * node3 {
- *	list = <&phandle1 0 2 &phandle2 2 3>;
- * }
+ *  node3 {
+ *  	list = <&phandle1 0 2 &phandle2 2 3>;
+ *  };
  *
- * To get a device_node of the `node2' node you may call this:
+ * To get a device_node of the ``node2`` node you may call this:
  * of_parse_phandle_with_fixed_args(node3, "list", 2, 1, &args);
  */
 int of_parse_phandle_with_fixed_args(const struct device_node *np,
@@ -1957,13 +1957,12 @@ static void of_alias_add(struct alias_prop *ap, struct device_node *np,
 
 /**
  * of_alias_scan - Scan all properties of the 'aliases' node
+ * @dt_alloc:	An allocator that provides a virtual address to memory
+ *		for storing the resulting tree
  *
  * The function scans all the properties of the 'aliases' node and populates
  * the global lookup table with the properties.  It returns the
  * number of alias properties found, or an error code in case of failure.
- *
- * @dt_alloc:	An allocator that provides a virtual address to memory
- *		for storing the resulting tree
  */
 void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
 {
@@ -2158,12 +2157,12 @@ bool of_console_check(struct device_node *dn, char *name, int index)
 EXPORT_SYMBOL_GPL(of_console_check);
 
 /**
- *	of_find_next_cache_node - Find a node's subsidiary cache
- *	@np:	node of type "cpu" or "cache"
+ * of_find_next_cache_node - Find a node's subsidiary cache
+ * @np:	node of type "cpu" or "cache"
  *
- *	Returns a node pointer with refcount incremented, use
- *	of_node_put() on it when done.  Caller should hold a reference
- *	to np.
+ * Return: A node pointer with refcount incremented, use
+ * of_node_put() on it when done.  Caller should hold a reference
+ * to np.
  */
 struct device_node *of_find_next_cache_node(const struct device_node *np)
 {
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 5a1b8688b460..81e03bd89675 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -349,11 +349,6 @@ static int unflatten_dt_nodes(const void *blob,
 
 /**
  * __unflatten_device_tree - create tree of device_nodes from flat blob
- *
- * unflattens a device-tree, creating the
- * tree of struct device_node. It also fills the "name" and "type"
- * pointers of the nodes so the normal device-tree walking functions
- * can be used.
  * @blob: The blob to expand
  * @dad: Parent device node
  * @mynodes: The device_node tree created by the call
@@ -361,6 +356,10 @@ static int unflatten_dt_nodes(const void *blob,
  * for the resulting tree
  * @detached: if true set OF_DETACHED on @mynodes
  *
+ * unflattens a device-tree, creating the tree of struct device_node. It also
+ * fills the "name" and "type" pointers of the nodes so the normal device-tree
+ * walking functions can be used.
+ *
  * Returns NULL on failure or the memory chunk containing the unflattened
  * device tree on success.
  */

From 08dbdacbfe2ec7ea12eed07fd3a0fe97d301a383 Mon Sep 17 00:00:00 2001
From: Rob Herring <robh@kernel.org>
Date: Thu, 25 Mar 2021 10:47:12 -0600
Subject: [PATCH 0843/1043] of: Add missing 'Return' section in kerneldoc
 comments

[ Upstream commit 8c8239c2c1fb82f171cb22a707f3bb88a2f22109 ]

Many of the DT kerneldoc comments are lacking a 'Return' section. Let's
add the section in cases we have a description of return values. There's
still some cases where the return values are not documented.

Cc: Frank Rowand <frowand.list@gmail.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Rob Herring <robh@kernel.org>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Link: https://lore.kernel.org/r/20210325164713.1296407-8-robh@kernel.org
Stable-dep-of: d79972789d17 ("of: dynamic: Fix of_reconfig_get_state_change() return value documentation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/of/base.c     | 39 +++++++++++++------------
 drivers/of/dynamic.c  | 19 ++++++++-----
 drivers/of/fdt.c      |  8 +++---
 drivers/of/irq.c      | 14 ++++-----
 drivers/of/overlay.c  | 16 +++++------
 drivers/of/platform.c | 10 +++----
 drivers/of/property.c | 66 +++++++++++++++++++++++++++----------------
 include/linux/of.h    | 63 ++++++++++++++++++++++++++---------------
 8 files changed, 140 insertions(+), 95 deletions(-)

diff --git a/drivers/of/base.c b/drivers/of/base.c
index 85a55cfd00f1..eb02974f36bd 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -244,7 +244,7 @@ struct device_node *__of_find_all_nodes(struct device_node *prev)
  * @prev:	Previous node or NULL to start iteration
  *		of_node_put() will be called on it
  *
- * Returns a node pointer with refcount incremented, use
+ * Return: A node pointer with refcount incremented, use
  * of_node_put() on it when done.
  */
 struct device_node *of_find_all_nodes(struct device_node *prev)
@@ -374,7 +374,7 @@ bool __weak arch_find_n_match_cpu_physical_id(struct device_node *cpun,
  * before booting secondary cores. This function uses arch_match_cpu_phys_id
  * which can be overridden by architecture specific implementation.
  *
- * Returns a node pointer for the logical cpu with refcount incremented, use
+ * Return: A node pointer for the logical cpu with refcount incremented, use
  * of_node_put() on it when done. Returns NULL if not found.
  */
 struct device_node *of_get_cpu_node(int cpu, unsigned int *thread)
@@ -394,8 +394,8 @@ EXPORT_SYMBOL(of_get_cpu_node);
  *
  * @cpu_node: Pointer to the device_node for CPU.
  *
- * Returns the logical CPU number of the given CPU device_node.
- * Returns -ENODEV if the CPU is not found.
+ * Return: The logical CPU number of the given CPU device_node or -ENODEV if the
+ * CPU is not found.
  */
 int of_cpu_node_to_id(struct device_node *cpu_node)
 {
@@ -427,7 +427,7 @@ EXPORT_SYMBOL(of_cpu_node_to_id);
  * bindings. This function check for both and returns the idle state node for
  * the requested index.
  *
- * In case an idle state node is found at @index, the refcount is incremented
+ * Return: An idle state node if found at @index. The refcount is incremented
  * for it, so call of_node_put() on it when done. Returns NULL if not found.
  */
 struct device_node *of_get_cpu_state_node(struct device_node *cpu_node,
@@ -561,7 +561,7 @@ int of_device_compatible_match(struct device_node *device,
  * of_machine_is_compatible - Test root of device tree for a given compatible value
  * @compat: compatible string to look for in root node's compatible property.
  *
- * Returns a positive integer if the root node has the given value in its
+ * Return: A positive integer if the root node has the given value in its
  * compatible property.
  */
 int of_machine_is_compatible(const char *compat)
@@ -583,7 +583,7 @@ EXPORT_SYMBOL(of_machine_is_compatible);
  *
  *  @device: Node to check for availability, with locks already held
  *
- *  Returns true if the status property is absent or set to "okay" or "ok",
+ *  Return: True if the status property is absent or set to "okay" or "ok",
  *  false otherwise
  */
 static bool __of_device_is_available(const struct device_node *device)
@@ -611,7 +611,7 @@ static bool __of_device_is_available(const struct device_node *device)
  *
  *  @device: Node to check for availability
  *
- *  Returns true if the status property is absent or set to "okay" or "ok",
+ *  Return: True if the status property is absent or set to "okay" or "ok",
  *  false otherwise
  */
 bool of_device_is_available(const struct device_node *device)
@@ -632,7 +632,7 @@ EXPORT_SYMBOL(of_device_is_available);
  *
  *  @device: Node to check for endianness
  *
- *  Returns true if the device has a "big-endian" property, or if the kernel
+ *  Return: True if the device has a "big-endian" property, or if the kernel
  *  was compiled for BE *and* the device has a "native-endian" property.
  *  Returns false otherwise.
  *
@@ -816,7 +816,7 @@ EXPORT_SYMBOL(of_get_next_cpu_node);
  * Lookup child node whose compatible property contains the given compatible
  * string.
  *
- * Returns a node pointer with refcount incremented, use of_node_put() on it
+ * Return: a node pointer with refcount incremented, use of_node_put() on it
  * when done; or NULL if not found.
  */
 struct device_node *of_get_compatible_child(const struct device_node *parent,
@@ -1170,7 +1170,7 @@ EXPORT_SYMBOL(of_find_matching_node_and_match);
  * It does this by stripping the manufacturer prefix (as delimited by a ',')
  * from the first entry in the compatible list property.
  *
- * This routine returns 0 on success, <0 on failure.
+ * Return: This routine returns 0 on success, <0 on failure.
  */
 int of_modalias_node(struct device_node *node, char *modalias, int len)
 {
@@ -1190,7 +1190,7 @@ EXPORT_SYMBOL_GPL(of_modalias_node);
  * of_find_node_by_phandle - Find a node given a phandle
  * @handle:	phandle of the node to find
  *
- * Returns a node pointer with refcount incremented, use
+ * Return: A node pointer with refcount incremented, use
  * of_node_put() on it when done.
  */
 struct device_node *of_find_node_by_phandle(phandle handle)
@@ -1431,7 +1431,7 @@ static int __of_parse_phandle_with_args(const struct device_node *np,
  * @index: For properties holding a table of phandles, this is the index into
  *         the table
  *
- * Returns the device_node pointer with refcount incremented.  Use
+ * Return: The device_node pointer with refcount incremented.  Use
  * of_node_put() on it when done.
  */
 struct device_node *of_parse_phandle(const struct device_node *np,
@@ -1731,7 +1731,7 @@ EXPORT_SYMBOL(of_parse_phandle_with_fixed_args);
  * @list_name:	property name that contains a list
  * @cells_name:	property name that specifies phandles' arguments count
  *
- * Returns the number of phandle + argument tuples within a property. It
+ * Return: The number of phandle + argument tuples within a property. It
  * is a typical pattern to encode a list of phandle and variable
  * arguments into a single property. The number of arguments is encoded
  * by a property in the phandle-target node. For example, a gpios
@@ -2031,7 +2031,9 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
  * @stem:	Alias stem of the given device_node
  *
  * The function travels the lookup table to get the alias id for the given
- * device_node and alias stem.  It returns the alias id if found.
+ * device_node and alias stem.
+ *
+ * Return: The alias id if found.
  */
 int of_alias_get_id(struct device_node *np, const char *stem)
 {
@@ -2140,8 +2142,9 @@ EXPORT_SYMBOL_GPL(of_alias_get_highest_id);
  * @index: Index to use for preferred console.
  *
  * Check if the given device node matches the stdout-path property in the
- * /chosen node. If it does then register it as the preferred console and return
- * TRUE. Otherwise return FALSE.
+ * /chosen node. If it does then register it as the preferred console.
+ *
+ * Return: TRUE if console successfully setup. Otherwise return FALSE.
  */
 bool of_console_check(struct device_node *dn, char *name, int index)
 {
@@ -2192,7 +2195,7 @@ struct device_node *of_find_next_cache_node(const struct device_node *np)
  *
  * @cpu: cpu number(logical index) for which the last cache level is needed
  *
- * Returns the the level at which the last cache is present. It is exactly
+ * Return: The the level at which the last cache is present. It is exactly
  * same as  the total number of cache levels for the given logical cpu.
  */
 int of_find_last_cache_level(unsigned int cpu)
diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index 7d0232af9c23..1f55e4691900 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -27,7 +27,7 @@ static struct device_node *kobj_to_device_node(struct kobject *kobj)
  * @node:	Node to inc refcount, NULL is supported to simplify writing of
  *		callers
  *
- * Returns node.
+ * Return: The node with refcount incremented.
  */
 struct device_node *of_node_get(struct device_node *node)
 {
@@ -103,7 +103,8 @@ int of_reconfig_notify(unsigned long action, struct of_reconfig_data *p)
  * @arg		- argument of the of notifier
  *
  * Returns the new state of a device based on the notifier used.
- * Returns 0 on device going from enabled to disabled, 1 on device
+ *
+ * Return: 0 on device going from enabled to disabled, 1 on device
  * going from disabled to enabled and -1 on no change.
  */
 int of_reconfig_get_state_change(unsigned long action, struct of_reconfig_data *pr)
@@ -370,7 +371,8 @@ void of_node_release(struct kobject *kobj)
  * property structure and the property name & contents. The property's
  * flags have the OF_DYNAMIC bit set so that we can differentiate between
  * dynamically allocated properties and not.
- * Returns the newly allocated property or NULL on out of memory error.
+ *
+ * Return: The newly allocated property or NULL on out of memory error.
  */
 struct property *__of_prop_dup(const struct property *prop, gfp_t allocflags)
 {
@@ -413,7 +415,7 @@ struct property *__of_prop_dup(const struct property *prop, gfp_t allocflags)
  * another node.  The node data are dynamically allocated and all the node
  * flags have the OF_DYNAMIC & OF_DETACHED bits set.
  *
- * Returns the newly allocated node or NULL on out of memory error.
+ * Return: The newly allocated node or NULL on out of memory error.
  */
 struct device_node *__of_node_dup(const struct device_node *np,
 				  const char *full_name)
@@ -764,7 +766,8 @@ static int __of_changeset_apply(struct of_changeset *ocs)
  * Any side-effects of live tree state changes are applied here on
  * success, like creation/destruction of devices and side-effects
  * like creation of sysfs properties and directories.
- * Returns 0 on success, a negative error value in case of an error.
+ *
+ * Return: 0 on success, a negative error value in case of an error.
  * On error the partially applied effects are reverted.
  */
 int of_changeset_apply(struct of_changeset *ocs)
@@ -858,7 +861,8 @@ static int __of_changeset_revert(struct of_changeset *ocs)
  * was before the application.
  * Any side-effects like creation/destruction of devices and
  * removal of sysfs properties and directories are applied.
- * Returns 0 on success, a negative error value in case of an error.
+ *
+ * Return: 0 on success, a negative error value in case of an error.
  */
 int of_changeset_revert(struct of_changeset *ocs)
 {
@@ -886,7 +890,8 @@ EXPORT_SYMBOL_GPL(of_changeset_revert);
  * + OF_RECONFIG_ADD_PROPERTY
  * + OF_RECONFIG_REMOVE_PROPERTY,
  * + OF_RECONFIG_UPDATE_PROPERTY
- * Returns 0 on success, a negative error value in case of an error.
+ *
+ * Return: 0 on success, a negative error value in case of an error.
  */
 int of_changeset_action(struct of_changeset *ocs, unsigned long action,
 		struct device_node *np, struct property *prop)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 81e03bd89675..384510d0200c 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -282,7 +282,7 @@ static void reverse_nodes(struct device_node *parent)
  * @dad: Parent struct device_node
  * @nodepp: The device_node tree created by the call
  *
- * It returns the size of unflattened device tree or error code
+ * Return: The size of unflattened device tree or error code
  */
 static int unflatten_dt_nodes(const void *blob,
 			      void *mem,
@@ -360,7 +360,7 @@ static int unflatten_dt_nodes(const void *blob,
  * fills the "name" and "type" pointers of the nodes so the normal device-tree
  * walking functions can be used.
  *
- * Returns NULL on failure or the memory chunk containing the unflattened
+ * Return: NULL on failure or the memory chunk containing the unflattened
  * device tree on success.
  */
 void *__unflatten_device_tree(const void *blob,
@@ -441,7 +441,7 @@ static DEFINE_MUTEX(of_fdt_unflatten_mutex);
  * pointers of the nodes so the normal device-tree walking functions
  * can be used.
  *
- * Returns NULL on failure or the memory chunk containing the unflattened
+ * Return: NULL on failure or the memory chunk containing the unflattened
  * device tree on success.
  */
 void *of_fdt_unflatten_tree(const unsigned long *blob,
@@ -715,7 +715,7 @@ const void *__init of_get_flat_dt_prop(unsigned long node, const char *name,
  * @node: node to test
  * @compat: compatible string to compare with compatible list.
  *
- * On match, returns a non-zero value with smaller values returned for more
+ * Return: a non-zero value on match with smaller values returned for more
  * specific compatible values.
  */
 static int of_fdt_is_compatible(const void *blob,
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 25d17b8a1a1a..352e14b007e7 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -48,7 +48,7 @@ EXPORT_SYMBOL_GPL(irq_of_parse_and_map);
  * of_irq_find_parent - Given a device node, find its interrupt parent node
  * @child: pointer to device node
  *
- * Returns a pointer to the interrupt parent node, or NULL if the interrupt
+ * Return: A pointer to the interrupt parent node, or NULL if the interrupt
  * parent could not be determined.
  */
 struct device_node *of_irq_find_parent(struct device_node *child)
@@ -81,14 +81,14 @@ EXPORT_SYMBOL_GPL(of_irq_find_parent);
  * @addr:	address specifier (start of "reg" property of the device) in be32 format
  * @out_irq:	structure of_phandle_args updated by this function
  *
- * Returns 0 on success and a negative number on error
- *
  * This function is a low-level interrupt tree walking function. It
  * can be used to do a partial walk with synthetized reg and interrupts
  * properties, for example when resolving PCI interrupts when no device
  * node exist for the parent. It takes an interrupt specifier structure as
  * input, walks the tree looking for any interrupt-map properties, translates
  * the specifier for each map, and then returns the translated map.
+ *
+ * Return: 0 on success and a negative number on error
  */
 int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq)
 {
@@ -380,7 +380,7 @@ EXPORT_SYMBOL_GPL(of_irq_to_resource);
  * @dev: pointer to device tree node
  * @index: zero-based index of the IRQ
  *
- * Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or
+ * Return: Linux IRQ number on success, or 0 on the IRQ mapping failure, or
  * -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case
  * of any other failure.
  */
@@ -407,7 +407,7 @@ EXPORT_SYMBOL_GPL(of_irq_get);
  * @dev: pointer to device tree node
  * @name: IRQ name
  *
- * Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or
+ * Return: Linux IRQ number on success, or 0 on the IRQ mapping failure, or
  * -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case
  * of any other failure.
  */
@@ -447,7 +447,7 @@ int of_irq_count(struct device_node *dev)
  * @res: array of resources to fill in
  * @nr_irqs: the number of IRQs (and upper bound for num of @res elements)
  *
- * Returns the size of the filled in table (up to @nr_irqs).
+ * Return: The size of the filled in table (up to @nr_irqs).
  */
 int of_irq_to_resource_table(struct device_node *dev, struct resource *res,
 		int nr_irqs)
@@ -602,7 +602,7 @@ static u32 __of_msi_map_id(struct device *dev, struct device_node **np,
  * Walk up the device hierarchy looking for devices with a "msi-map"
  * property.  If found, apply the mapping to @id_in.
  *
- * Returns the mapped MSI ID.
+ * Return: The mapped MSI ID.
  */
 u32 of_msi_map_id(struct device *dev, struct device_node *msi_np, u32 id_in)
 {
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 67b404f36e79..3ac874e2be08 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -296,7 +296,7 @@ static struct property *dup_and_fixup_symbol_prop(
  *
  * Update of property in symbols node is not allowed.
  *
- * Returns 0 on success, -ENOMEM if memory allocation failure, or -EINVAL if
+ * Return: 0 on success, -ENOMEM if memory allocation failure, or -EINVAL if
  * invalid @overlay.
  */
 static int add_changeset_property(struct overlay_changeset *ovcs,
@@ -401,7 +401,7 @@ static int add_changeset_property(struct overlay_changeset *ovcs,
  *
  * NOTE_2: Multiple mods of created nodes not supported.
  *
- * Returns 0 on success, -ENOMEM if memory allocation failure, or -EINVAL if
+ * Return: 0 on success, -ENOMEM if memory allocation failure, or -EINVAL if
  * invalid @overlay.
  */
 static int add_changeset_node(struct overlay_changeset *ovcs,
@@ -473,7 +473,7 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
  *
  * Do not allow symbols node to have any children.
  *
- * Returns 0 on success, -ENOMEM if memory allocation failure, or -EINVAL if
+ * Return: 0 on success, -ENOMEM if memory allocation failure, or -EINVAL if
  * invalid @overlay_node.
  */
 static int build_changeset_next_level(struct overlay_changeset *ovcs,
@@ -604,7 +604,7 @@ static int find_dup_cset_prop(struct overlay_changeset *ovcs,
  * the same node or duplicate {add, delete, or update} properties entries
  * for the same property.
  *
- * Returns 0 on success, or -EINVAL if duplicate changeset entry found.
+ * Return: 0 on success, or -EINVAL if duplicate changeset entry found.
  */
 static int changeset_dup_entry_check(struct overlay_changeset *ovcs)
 {
@@ -628,7 +628,7 @@ static int changeset_dup_entry_check(struct overlay_changeset *ovcs)
  * any portions of the changeset that were successfully created will remain
  * in @ovcs->cset.
  *
- * Returns 0 on success, -ENOMEM if memory allocation failure, or -EINVAL if
+ * Return: 0 on success, -ENOMEM if memory allocation failure, or -EINVAL if
  * invalid overlay in @ovcs->fragments[].
  */
 static int build_changeset(struct overlay_changeset *ovcs)
@@ -724,7 +724,7 @@ static struct device_node *find_target(struct device_node *info_node)
  * the top level of @tree.  The relevant top level nodes are the fragment
  * nodes and the __symbols__ node.  Any other top level node will be ignored.
  *
- * Returns 0 on success, -ENOMEM if memory allocation failure, -EINVAL if error
+ * Return: 0 on success, -ENOMEM if memory allocation failure, -EINVAL if error
  * detected in @tree, or -ENOSPC if idr_alloc() error.
  */
 static int init_overlay_changeset(struct overlay_changeset *ovcs,
@@ -1179,7 +1179,7 @@ static int overlay_removal_is_ok(struct overlay_changeset *remove_ovcs)
  * If an error is returned by an overlay changeset post-remove notifier
  * then no further overlay changeset post-remove notifier will be called.
  *
- * Returns 0 on success, or a negative error number.  *ovcs_id is set to
+ * Return: 0 on success, or a negative error number.  *ovcs_id is set to
  * zero after reverting the changeset, even if a subsequent error occurs.
  */
 int of_overlay_remove(int *ovcs_id)
@@ -1257,7 +1257,7 @@ EXPORT_SYMBOL_GPL(of_overlay_remove);
  *
  * Removes all overlays from the system in the correct order.
  *
- * Returns 0 on success, or a negative error number
+ * Return: 0 on success, or a negative error number
  */
 int of_overlay_remove_all(void)
 {
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index b557a0fcd4ba..43748c6480c8 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -44,7 +44,7 @@ static const struct of_device_id of_skipped_node_table[] = {
  * Takes a reference to the embedded struct device which needs to be dropped
  * after use.
  *
- * Returns platform_device pointer, or NULL if not found
+ * Return: platform_device pointer, or NULL if not found
  */
 struct platform_device *of_find_device_by_node(struct device_node *np)
 {
@@ -160,7 +160,7 @@ EXPORT_SYMBOL(of_device_alloc);
  * @platform_data: pointer to populate platform_data pointer with
  * @parent: Linux device model parent device.
  *
- * Returns pointer to created platform device, or NULL if a device was not
+ * Return: Pointer to created platform device, or NULL if a device was not
  * registered.  Unavailable devices will not get registered.
  */
 static struct platform_device *of_platform_device_create_pdata(
@@ -204,7 +204,7 @@ static struct platform_device *of_platform_device_create_pdata(
  * @bus_id: name to assign device
  * @parent: Linux device model parent device.
  *
- * Returns pointer to created platform device, or NULL if a device was not
+ * Return: Pointer to created platform device, or NULL if a device was not
  * registered.  Unavailable devices will not get registered.
  */
 struct platform_device *of_platform_device_create(struct device_node *np,
@@ -463,7 +463,7 @@ EXPORT_SYMBOL(of_platform_bus_probe);
  * New board support should be using this function instead of
  * of_platform_bus_probe().
  *
- * Returns 0 on success, < 0 on failure.
+ * Return: 0 on success, < 0 on failure.
  */
 int of_platform_populate(struct device_node *root,
 			const struct of_device_id *matches,
@@ -608,7 +608,7 @@ static void devm_of_platform_populate_release(struct device *dev, void *res)
  * Similar to of_platform_populate(), but will automatically call
  * of_platform_depopulate() when the device is unbound from the bus.
  *
- * Returns 0 on success, < 0 on failure.
+ * Return: 0 on success, < 0 on failure.
  */
 int devm_of_platform_populate(struct device *dev)
 {
diff --git a/drivers/of/property.c b/drivers/of/property.c
index 8f998351bf4f..a411460d2b21 100644
--- a/drivers/of/property.c
+++ b/drivers/of/property.c
@@ -60,9 +60,11 @@ EXPORT_SYMBOL(of_graph_is_present);
  * @elem_size:	size of the individual element
  *
  * Search for a property in a device node and count the number of elements of
- * size elem_size in it. Returns number of elements on sucess, -EINVAL if the
- * property does not exist or its length does not match a multiple of elem_size
- * and -ENODATA if the property does not have a value.
+ * size elem_size in it.
+ *
+ * Return: The number of elements on sucess, -EINVAL if the property does not
+ * exist or its length does not match a multiple of elem_size and -ENODATA if
+ * the property does not have a value.
  */
 int of_property_count_elems_of_size(const struct device_node *np,
 				const char *propname, int elem_size)
@@ -94,8 +96,9 @@ EXPORT_SYMBOL_GPL(of_property_count_elems_of_size);
  * @len:	if !=NULL, actual length is written to here
  *
  * Search for a property in a device node and valid the requested size.
- * Returns the property value on success, -EINVAL if the property does not
- *  exist, -ENODATA if property does not have a value, and -EOVERFLOW if the
+ *
+ * Return: The property value on success, -EINVAL if the property does not
+ * exist, -ENODATA if property does not have a value, and -EOVERFLOW if the
  * property data is too small or too large.
  *
  */
@@ -128,7 +131,9 @@ static void *of_find_property_value_of_size(const struct device_node *np,
  * @out_value:	pointer to return value, modified only if no error.
  *
  * Search for a property in a device node and read nth 32-bit value from
- * it. Returns 0 on success, -EINVAL if the property does not exist,
+ * it.
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist,
  * -ENODATA if property does not have a value, and -EOVERFLOW if the
  * property data isn't large enough.
  *
@@ -160,7 +165,9 @@ EXPORT_SYMBOL_GPL(of_property_read_u32_index);
  * @out_value:	pointer to return value, modified only if no error.
  *
  * Search for a property in a device node and read nth 64-bit value from
- * it. Returns 0 on success, -EINVAL if the property does not exist,
+ * it.
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist,
  * -ENODATA if property does not have a value, and -EOVERFLOW if the
  * property data isn't large enough.
  *
@@ -195,12 +202,14 @@ EXPORT_SYMBOL_GPL(of_property_read_u64_index);
  *		sz_min will be read.
  *
  * Search for a property in a device node and read 8-bit value(s) from
- * it. Returns number of elements read on success, -EINVAL if the property
- * does not exist, -ENODATA if property does not have a value, and -EOVERFLOW
- * if the property data is smaller than sz_min or longer than sz_max.
+ * it.
  *
  * dts entry of array should be like:
- *	property = /bits/ 8 <0x50 0x60 0x70>;
+ *  ``property = /bits/ 8 <0x50 0x60 0x70>;``
+ *
+ * Return: The number of elements read on success, -EINVAL if the property
+ * does not exist, -ENODATA if property does not have a value, and -EOVERFLOW
+ * if the property data is smaller than sz_min or longer than sz_max.
  *
  * The out_values is modified only if a valid u8 value can be decoded.
  */
@@ -243,12 +252,14 @@ EXPORT_SYMBOL_GPL(of_property_read_variable_u8_array);
  *		sz_min will be read.
  *
  * Search for a property in a device node and read 16-bit value(s) from
- * it. Returns number of elements read on success, -EINVAL if the property
- * does not exist, -ENODATA if property does not have a value, and -EOVERFLOW
- * if the property data is smaller than sz_min or longer than sz_max.
+ * it.
  *
  * dts entry of array should be like:
- *	property = /bits/ 16 <0x5000 0x6000 0x7000>;
+ *  ``property = /bits/ 16 <0x5000 0x6000 0x7000>;``
+ *
+ * Return: The number of elements read on success, -EINVAL if the property
+ * does not exist, -ENODATA if property does not have a value, and -EOVERFLOW
+ * if the property data is smaller than sz_min or longer than sz_max.
  *
  * The out_values is modified only if a valid u16 value can be decoded.
  */
@@ -291,7 +302,9 @@ EXPORT_SYMBOL_GPL(of_property_read_variable_u16_array);
  *		sz_min will be read.
  *
  * Search for a property in a device node and read 32-bit value(s) from
- * it. Returns number of elements read on success, -EINVAL if the property
+ * it.
+ *
+ * Return: The number of elements read on success, -EINVAL if the property
  * does not exist, -ENODATA if property does not have a value, and -EOVERFLOW
  * if the property data is smaller than sz_min or longer than sz_max.
  *
@@ -330,7 +343,9 @@ EXPORT_SYMBOL_GPL(of_property_read_variable_u32_array);
  * @out_value:	pointer to return value, modified only if return value is 0.
  *
  * Search for a property in a device node and read a 64-bit value from
- * it. Returns 0 on success, -EINVAL if the property does not exist,
+ * it.
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist,
  * -ENODATA if property does not have a value, and -EOVERFLOW if the
  * property data isn't large enough.
  *
@@ -365,7 +380,9 @@ EXPORT_SYMBOL_GPL(of_property_read_u64);
  *		sz_min will be read.
  *
  * Search for a property in a device node and read 64-bit value(s) from
- * it. Returns number of elements read on success, -EINVAL if the property
+ * it.
+ *
+ * Return: The number of elements read on success, -EINVAL if the property
  * does not exist, -ENODATA if property does not have a value, and -EOVERFLOW
  * if the property data is smaller than sz_min or longer than sz_max.
  *
@@ -407,10 +424,11 @@ EXPORT_SYMBOL_GPL(of_property_read_variable_u64_array);
  *		return value is 0.
  *
  * Search for a property in a device tree node and retrieve a null
- * terminated string value (pointer to data, not a copy). Returns 0 on
- * success, -EINVAL if the property does not exist, -ENODATA if property
- * does not have a value, and -EILSEQ if the string is not null-terminated
- * within the length of the property data.
+ * terminated string value (pointer to data, not a copy).
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist, -ENODATA if
+ * property does not have a value, and -EILSEQ if the string is not
+ * null-terminated within the length of the property data.
  *
  * The out_string pointer is modified only if a valid string can be decoded.
  */
@@ -774,7 +792,7 @@ EXPORT_SYMBOL(of_graph_get_remote_port_parent);
  * @node: pointer to a local endpoint device_node
  *
  * Return: Remote port node associated with remote endpoint node linked
- *	   to @node. Use of_node_put() on it when done.
+ * to @node. Use of_node_put() on it when done.
  */
 struct device_node *of_graph_get_remote_port(const struct device_node *node)
 {
@@ -807,7 +825,7 @@ EXPORT_SYMBOL(of_graph_get_endpoint_count);
  * @endpoint: identifier (value of reg property) of the endpoint node
  *
  * Return: Remote device node associated with remote endpoint node linked
- *	   to @node. Use of_node_put() on it when done.
+ * to @node. Use of_node_put() on it when done.
  */
 struct device_node *of_graph_get_remote_node(const struct device_node *node,
 					     u32 port, u32 endpoint)
diff --git a/include/linux/of.h b/include/linux/of.h
index 0f4e81e6fb23..57f2d3dddc0c 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -424,12 +424,14 @@ extern int of_detach_node(struct device_node *);
  * @sz:		number of array elements to read
  *
  * Search for a property in a device node and read 8-bit value(s) from
- * it. Returns 0 on success, -EINVAL if the property does not exist,
- * -ENODATA if property does not have a value, and -EOVERFLOW if the
- * property data isn't large enough.
+ * it.
  *
  * dts entry of array should be like:
- *	property = /bits/ 8 <0x50 0x60 0x70>;
+ *  ``property = /bits/ 8 <0x50 0x60 0x70>;``
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist,
+ * -ENODATA if property does not have a value, and -EOVERFLOW if the
+ * property data isn't large enough.
  *
  * The out_values is modified only if a valid u8 value can be decoded.
  */
@@ -454,12 +456,14 @@ static inline int of_property_read_u8_array(const struct device_node *np,
  * @sz:		number of array elements to read
  *
  * Search for a property in a device node and read 16-bit value(s) from
- * it. Returns 0 on success, -EINVAL if the property does not exist,
- * -ENODATA if property does not have a value, and -EOVERFLOW if the
- * property data isn't large enough.
+ * it.
  *
  * dts entry of array should be like:
- *	property = /bits/ 16 <0x5000 0x6000 0x7000>;
+ *  ``property = /bits/ 16 <0x5000 0x6000 0x7000>;``
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist,
+ * -ENODATA if property does not have a value, and -EOVERFLOW if the
+ * property data isn't large enough.
  *
  * The out_values is modified only if a valid u16 value can be decoded.
  */
@@ -485,7 +489,9 @@ static inline int of_property_read_u16_array(const struct device_node *np,
  * @sz:		number of array elements to read
  *
  * Search for a property in a device node and read 32-bit value(s) from
- * it. Returns 0 on success, -EINVAL if the property does not exist,
+ * it.
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist,
  * -ENODATA if property does not have a value, and -EOVERFLOW if the
  * property data isn't large enough.
  *
@@ -513,7 +519,9 @@ static inline int of_property_read_u32_array(const struct device_node *np,
  * @sz:		number of array elements to read
  *
  * Search for a property in a device node and read 64-bit value(s) from
- * it. Returns 0 on success, -EINVAL if the property does not exist,
+ * it.
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist,
  * -ENODATA if property does not have a value, and -EOVERFLOW if the
  * property data isn't large enough.
  *
@@ -1063,7 +1071,9 @@ static inline bool of_node_is_type(const struct device_node *np, const char *typ
  * @propname:	name of the property to be searched.
  *
  * Search for a property in a device node and count the number of u8 elements
- * in it. Returns number of elements on sucess, -EINVAL if the property does
+ * in it.
+ *
+ * Return: The number of elements on sucess, -EINVAL if the property does
  * not exist or its length does not match a multiple of u8 and -ENODATA if the
  * property does not have a value.
  */
@@ -1080,7 +1090,9 @@ static inline int of_property_count_u8_elems(const struct device_node *np,
  * @propname:	name of the property to be searched.
  *
  * Search for a property in a device node and count the number of u16 elements
- * in it. Returns number of elements on sucess, -EINVAL if the property does
+ * in it.
+ *
+ * Return: The number of elements on sucess, -EINVAL if the property does
  * not exist or its length does not match a multiple of u16 and -ENODATA if the
  * property does not have a value.
  */
@@ -1097,7 +1109,9 @@ static inline int of_property_count_u16_elems(const struct device_node *np,
  * @propname:	name of the property to be searched.
  *
  * Search for a property in a device node and count the number of u32 elements
- * in it. Returns number of elements on sucess, -EINVAL if the property does
+ * in it.
+ *
+ * Return: The number of elements on sucess, -EINVAL if the property does
  * not exist or its length does not match a multiple of u32 and -ENODATA if the
  * property does not have a value.
  */
@@ -1114,7 +1128,9 @@ static inline int of_property_count_u32_elems(const struct device_node *np,
  * @propname:	name of the property to be searched.
  *
  * Search for a property in a device node and count the number of u64 elements
- * in it. Returns number of elements on sucess, -EINVAL if the property does
+ * in it.
+ *
+ * Return: The number of elements on sucess, -EINVAL if the property does
  * not exist or its length does not match a multiple of u64 and -ENODATA if the
  * property does not have a value.
  */
@@ -1135,7 +1151,7 @@ static inline int of_property_count_u64_elems(const struct device_node *np,
  * Search for a property in a device tree node and retrieve a list of
  * terminated string values (pointer to data, not a copy) in that property.
  *
- * If @out_strs is NULL, the number of strings in the property is returned.
+ * Return: If @out_strs is NULL, the number of strings in the property is returned.
  */
 static inline int of_property_read_string_array(const struct device_node *np,
 						const char *propname, const char **out_strs,
@@ -1151,10 +1167,11 @@ static inline int of_property_read_string_array(const struct device_node *np,
  * @propname:	name of the property to be searched.
  *
  * Search for a property in a device tree node and retrieve the number of null
- * terminated string contain in it. Returns the number of strings on
- * success, -EINVAL if the property does not exist, -ENODATA if property
- * does not have a value, and -EILSEQ if the string is not null-terminated
- * within the length of the property data.
+ * terminated string contain in it.
+ *
+ * Return: The number of strings on success, -EINVAL if the property does not
+ * exist, -ENODATA if property does not have a value, and -EILSEQ if the string
+ * is not null-terminated within the length of the property data.
  */
 static inline int of_property_count_strings(const struct device_node *np,
 					    const char *propname)
@@ -1174,7 +1191,8 @@ static inline int of_property_count_strings(const struct device_node *np,
  * Search for a property in a device tree node and retrieve a null
  * terminated string value (pointer to data, not a copy) in the list of strings
  * contained in that property.
- * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist, -ENODATA if
  * property does not have a value, and -EILSEQ if the string is not
  * null-terminated within the length of the property data.
  *
@@ -1194,7 +1212,8 @@ static inline int of_property_read_string_index(const struct device_node *np,
  * @propname:	name of the property to be searched.
  *
  * Search for a property in a device node.
- * Returns true if the property exists false otherwise.
+ *
+ * Return: true if the property exists false otherwise.
  */
 static inline bool of_property_read_bool(const struct device_node *np,
 					 const char *propname)
@@ -1440,7 +1459,7 @@ static inline int of_reconfig_get_state_change(unsigned long action,
  * of_device_is_system_power_controller - Tells if system-power-controller is found for device_node
  * @np: Pointer to the given device_node
  *
- * return true if present false otherwise
+ * Return: true if present false otherwise
  */
 static inline bool of_device_is_system_power_controller(const struct device_node *np)
 {

From ba6dc2f56441a7a68d572005713f91b9947d4940 Mon Sep 17 00:00:00 2001
From: Luca Ceresoli <luca.ceresoli@bootlin.com>
Date: Thu, 23 Nov 2023 15:47:18 +0100
Subject: [PATCH 0844/1043] of: dynamic: Fix of_reconfig_get_state_change()
 return value documentation

[ Upstream commit d79972789d17499b6091ded2fc0c6763c501a5ba ]

The documented numeric return values do not match the actual returned
values. Fix them by using the enum names instead of raw numbers.

Fixes: b53a2340d0d3 ("of/reconfig: Add of_reconfig_get_state_change() of notifier helper.")
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Link: https://lore.kernel.org/r/20231123-fix-of_reconfig_get_state_change-docs-v1-1-f51892050ff9@bootlin.com
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/of/dynamic.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index 1f55e4691900..b6a3ee65437b 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -104,8 +104,9 @@ int of_reconfig_notify(unsigned long action, struct of_reconfig_data *p)
  *
  * Returns the new state of a device based on the notifier used.
  *
- * Return: 0 on device going from enabled to disabled, 1 on device
- * going from disabled to enabled and -1 on no change.
+ * Return: OF_RECONFIG_CHANGE_REMOVE on device going from enabled to
+ * disabled, OF_RECONFIG_CHANGE_ADD on device going from disabled to
+ * enabled and OF_RECONFIG_NO_CHANGE on no change.
  */
 int of_reconfig_get_state_change(unsigned long action, struct of_reconfig_data *pr)
 {

From 7827c1802dacb03267aad78905a9998fd59c6926 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 29 Nov 2023 16:06:30 +0000
Subject: [PATCH 0845/1043] ipv6: fix potential NULL deref in fib6_add()

[ Upstream commit 75475bb51e78a3f54ad2f69380f2a1c985e85f2d ]

If fib6_find_prefix() returns NULL, we should silently fallback
using fib6_null_entry regardless of RT6_DEBUG value.

syzbot reported:

WARNING: CPU: 0 PID: 5477 at net/ipv6/ip6_fib.c:1516 fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516
Modules linked in:
CPU: 0 PID: 5477 Comm: syz-executor.0 Not tainted 6.7.0-rc2-syzkaller-00029-g9b6de136b5f0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516
Code: 00 48 8b 54 24 68 e8 42 22 00 00 48 85 c0 74 14 49 89 c6 e8 d5 d3 c2 f7 eb 5d e8 ce d3 c2 f7 e9 ca 00 00 00 e8 c4 d3 c2 f7 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 38 80 3c 01 00
RSP: 0018:ffffc90005067740 EFLAGS: 00010293
RAX: ffffffff89cba5bc RBX: ffffc90005067ab0 RCX: ffff88801a2e9dc0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90005067980 R08: ffffffff89cbca85 R09: 1ffff110040d4b85
R10: dffffc0000000000 R11: ffffed10040d4b86 R12: 00000000ffffffff
R13: 1ffff110051c3904 R14: ffff8880206a5c00 R15: ffff888028e1c820
FS: 00007f763783c6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f763783bff8 CR3: 000000007f74d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__ip6_ins_rt net/ipv6/route.c:1303 [inline]
ip6_route_add+0x88/0x120 net/ipv6/route.c:3847
ipv6_route_ioctl+0x525/0x7b0 net/ipv6/route.c:4467
inet6_ioctl+0x21a/0x270 net/ipv6/af_inet6.c:575
sock_do_ioctl+0x152/0x460 net/socket.c:1220
sock_ioctl+0x615/0x8c0 net/socket.c:1339
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82

Fixes: 7bbfe00e0252 ("ipv6: fix general protection fault in fib6_add()")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Wei Wang <weiwan@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20231129160630.3509216-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/ip6_fib.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index c783b9123132..608205c632c8 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1499,13 +1499,9 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt,
 			if (!pn_leaf && !(pn->fn_flags & RTN_RTINFO)) {
 				pn_leaf = fib6_find_prefix(info->nl_net, table,
 							   pn);
-#if RT6_DEBUG >= 2
-				if (!pn_leaf) {
-					WARN_ON(!pn_leaf);
+				if (!pn_leaf)
 					pn_leaf =
 					    info->nl_net->ipv6.fib6_null_entry;
-				}
-#endif
 				fib6_info_hold(pn_leaf);
 				rcu_assign_pointer(pn->leaf, pn_leaf);
 			}

From 909de62207eaae4c875342f969fbeab7e96bb333 Mon Sep 17 00:00:00 2001
From: Subbaraya Sundeep <sbhatta@marvell.com>
Date: Wed, 29 Nov 2023 10:53:42 +0530
Subject: [PATCH 0846/1043] octeontx2-pf: Add missing mutex lock in
 otx2_get_pauseparam

[ Upstream commit 9572c949385aa2ef10368287c439bcb7935137c8 ]

All the mailbox messages sent to AF needs to be guarded
by mutex lock. Add the missing lock in otx2_get_pauseparam
function.

Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool")
Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
index c6d408de0605..fc4ca8246df2 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
@@ -254,9 +254,12 @@ static void otx2_get_pauseparam(struct net_device *netdev,
 	if (is_otx2_lbkvf(pfvf->pdev))
 		return;
 
+	mutex_lock(&pfvf->mbox.lock);
 	req = otx2_mbox_alloc_msg_cgx_cfg_pause_frm(&pfvf->mbox);
-	if (!req)
+	if (!req) {
+		mutex_unlock(&pfvf->mbox.lock);
 		return;
+	}
 
 	if (!otx2_sync_mbox_msg(&pfvf->mbox)) {
 		rsp = (struct cgx_pause_frm_cfg *)
@@ -264,6 +267,7 @@ static void otx2_get_pauseparam(struct net_device *netdev,
 		pause->rx_pause = rsp->rx_pause;
 		pause->tx_pause = rsp->tx_pause;
 	}
+	mutex_unlock(&pfvf->mbox.lock);
 }
 
 static int otx2_set_pauseparam(struct net_device *netdev,

From d3f4792836877e4aec2e09edf1f968b5a7670ce0 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Wed, 29 Nov 2023 21:58:53 -0800
Subject: [PATCH 0847/1043] hv_netvsc: rndis_filter needs to select NLS

[ Upstream commit 6c89f49964375c904cea33c0247467873f4daf2c ]

rndis_filter uses utf8s_to_utf16s() which is provided by setting
NLS, so select NLS to fix the build error:

ERROR: modpost: "utf8s_to_utf16s" [drivers/net/hyperv/hv_netvsc.ko] undefined!

Fixes: 1ce09e899d28 ("hyperv: Add support for setting MAC from within guests")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: K. Y. Srinivasan <kys@microsoft.com>
Cc: Wei Liu <wei.liu@kernel.org>
Cc: Dexuan Cui <decui@microsoft.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Simon Horman <horms@kernel.org> # build-tested
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20231130055853.19069-1-rdunlap@infradead.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/hyperv/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/hyperv/Kconfig b/drivers/net/hyperv/Kconfig
index ca7bf7f897d3..c8cbd85adcf9 100644
--- a/drivers/net/hyperv/Kconfig
+++ b/drivers/net/hyperv/Kconfig
@@ -3,5 +3,6 @@ config HYPERV_NET
 	tristate "Microsoft Hyper-V virtual network driver"
 	depends on HYPERV
 	select UCS2_STRING
+	select NLS
 	help
 	  Select this option to enable the Hyper-V virtual network driver.

From a657bddfb4c5ee0fb09f2a4ae05949a86c0f6d52 Mon Sep 17 00:00:00 2001
From: David Thompson <davthompson@nvidia.com>
Date: Thu, 30 Nov 2023 13:35:15 -0500
Subject: [PATCH 0848/1043] mlxbf-bootctl: correctly identify secure boot with
 development keys
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d4eef75279f5e9d594f5785502038c763ce42268 ]

The secure boot state of the BlueField SoC is represented by two bits:
                0 = production state
                1 = secure boot enabled
                2 = non-secure (secure boot disabled)
                3 = RMA state
There is also a single bit to indicate whether production keys or
development keys are being used when secure boot is enabled.
This single bit (specified by MLXBF_BOOTCTL_SB_DEV_MASK) only has
meaning if secure boot state equals 1 (secure boot enabled).

The secure boot states are as follows:
- “GA secured” is when secure boot is enabled with official production keys.
- “Secured (development)” is when secure boot is enabled with development keys.

Without this fix “GA Secured” is displayed on development cards which is
misleading. This patch updates the logic in "lifecycle_state_show()" to
handle the case where the SoC is configured for secure boot and is using
development keys.

Fixes: 79e29cb8fbc5c ("platform/mellanox: Add bootctl driver for Mellanox BlueField Soc")
Reviewed-by: Khalil Blaiech <kblaiech@nvidia.com>
Signed-off-by: David Thompson <davthompson@nvidia.com>
Link: https://lore.kernel.org/r/20231130183515.17214-1-davthompson@nvidia.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/mellanox/mlxbf-bootctl.c | 39 +++++++++++++++--------
 1 file changed, 26 insertions(+), 13 deletions(-)

diff --git a/drivers/platform/mellanox/mlxbf-bootctl.c b/drivers/platform/mellanox/mlxbf-bootctl.c
index 5d21c6adf1ab..9911d4f85469 100644
--- a/drivers/platform/mellanox/mlxbf-bootctl.c
+++ b/drivers/platform/mellanox/mlxbf-bootctl.c
@@ -17,6 +17,7 @@
 
 #define MLXBF_BOOTCTL_SB_SECURE_MASK		0x03
 #define MLXBF_BOOTCTL_SB_TEST_MASK		0x0c
+#define MLXBF_BOOTCTL_SB_DEV_MASK		BIT(4)
 
 #define MLXBF_SB_KEY_NUM			4
 
@@ -37,11 +38,18 @@ static struct mlxbf_bootctl_name boot_names[] = {
 	{ MLXBF_BOOTCTL_NONE, "none" },
 };
 
+enum {
+	MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION = 0,
+	MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE = 1,
+	MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE = 2,
+	MLXBF_BOOTCTL_SB_LIFECYCLE_RMA = 3
+};
+
 static const char * const mlxbf_bootctl_lifecycle_states[] = {
-	[0] = "Production",
-	[1] = "GA Secured",
-	[2] = "GA Non-Secured",
-	[3] = "RMA",
+	[MLXBF_BOOTCTL_SB_LIFECYCLE_PRODUCTION] = "Production",
+	[MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE] = "GA Secured",
+	[MLXBF_BOOTCTL_SB_LIFECYCLE_GA_NON_SECURE] = "GA Non-Secured",
+	[MLXBF_BOOTCTL_SB_LIFECYCLE_RMA] = "RMA",
 };
 
 /* ARM SMC call which is atomic and no need for lock. */
@@ -165,25 +173,30 @@ static ssize_t second_reset_action_store(struct device *dev,
 static ssize_t lifecycle_state_show(struct device *dev,
 				    struct device_attribute *attr, char *buf)
 {
+	int status_bits;
+	int use_dev_key;
+	int test_state;
 	int lc_state;
 
-	lc_state = mlxbf_bootctl_smc(MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS,
-				     MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE);
-	if (lc_state < 0)
-		return lc_state;
+	status_bits = mlxbf_bootctl_smc(MLXBF_BOOTCTL_GET_TBB_FUSE_STATUS,
+					MLXBF_BOOTCTL_FUSE_STATUS_LIFECYCLE);
+	if (status_bits < 0)
+		return status_bits;
 
-	lc_state &=
-		MLXBF_BOOTCTL_SB_TEST_MASK | MLXBF_BOOTCTL_SB_SECURE_MASK;
+	use_dev_key = status_bits & MLXBF_BOOTCTL_SB_DEV_MASK;
+	test_state = status_bits & MLXBF_BOOTCTL_SB_TEST_MASK;
+	lc_state = status_bits & MLXBF_BOOTCTL_SB_SECURE_MASK;
 
 	/*
 	 * If the test bits are set, we specify that the current state may be
 	 * due to using the test bits.
 	 */
-	if (lc_state & MLXBF_BOOTCTL_SB_TEST_MASK) {
-		lc_state &= MLXBF_BOOTCTL_SB_SECURE_MASK;
-
+	if (test_state) {
 		return sprintf(buf, "%s(test)\n",
 			       mlxbf_bootctl_lifecycle_states[lc_state]);
+	} else if (use_dev_key &&
+		   (lc_state == MLXBF_BOOTCTL_SB_LIFECYCLE_GA_SECURE)) {
+		return sprintf(buf, "Secured (development)\n");
 	}
 
 	return sprintf(buf, "%s\n", mlxbf_bootctl_lifecycle_states[lc_state]);

From effb9ad00447c20acab4c41491baf9b4225d5581 Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Sun, 14 Mar 2021 14:08:36 -0400
Subject: [PATCH 0849/1043] net: arcnet: com20020 fix error handling

[ Upstream commit 6577b9a551aedb86bca6d4438c28386361845108 ]

There are two issues when handling error case in com20020pci_probe()

1. priv might be not initialized yet when calling com20020pci_remove()
from com20020pci_probe(), since the priv is set at the very last but it
can jump to error handling in the middle and priv remains NULL.
2. memory leak - the net device is allocated in alloc_arcdev but not
properly released if error happens in the middle of the big for loop

[    1.529110] BUG: kernel NULL pointer dereference, address: 0000000000000008
[    1.531447] RIP: 0010:com20020pci_remove+0x15/0x60 [com20020_pci]
[    1.536805] Call Trace:
[    1.536939]  com20020pci_probe+0x3f2/0x48c [com20020_pci]
[    1.537226]  local_pci_probe+0x48/0x80
[    1.539918]  com20020pci_init+0x3f/0x1000 [com20020_pci]

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 6b17a597fc2f ("arcnet: restoring support for multiple Sohard Arcnet cards")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/arcnet/com20020-pci.c | 34 +++++++++++++++++--------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
index b4f8798d8c50..28dccbc0e8d8 100644
--- a/drivers/net/arcnet/com20020-pci.c
+++ b/drivers/net/arcnet/com20020-pci.c
@@ -127,6 +127,8 @@ static int com20020pci_probe(struct pci_dev *pdev,
 	int i, ioaddr, ret;
 	struct resource *r;
 
+	ret = 0;
+
 	if (pci_enable_device(pdev))
 		return -EIO;
 
@@ -142,6 +144,8 @@ static int com20020pci_probe(struct pci_dev *pdev,
 	priv->ci = ci;
 	mm = &ci->misc_map;
 
+	pci_set_drvdata(pdev, priv);
+
 	INIT_LIST_HEAD(&priv->list_dev);
 
 	if (mm->size) {
@@ -164,7 +168,7 @@ static int com20020pci_probe(struct pci_dev *pdev,
 		dev = alloc_arcdev(device);
 		if (!dev) {
 			ret = -ENOMEM;
-			goto out_port;
+			break;
 		}
 		dev->dev_port = i;
 
@@ -181,7 +185,7 @@ static int com20020pci_probe(struct pci_dev *pdev,
 			pr_err("IO region %xh-%xh already allocated\n",
 			       ioaddr, ioaddr + cm->size - 1);
 			ret = -EBUSY;
-			goto out_port;
+			goto err_free_arcdev;
 		}
 
 		/* Dummy access after Reset
@@ -219,18 +223,18 @@ static int com20020pci_probe(struct pci_dev *pdev,
 		if (arcnet_inb(ioaddr, COM20020_REG_R_STATUS) == 0xFF) {
 			pr_err("IO address %Xh is empty!\n", ioaddr);
 			ret = -EIO;
-			goto out_port;
+			goto err_free_arcdev;
 		}
 		if (com20020_check(dev)) {
 			ret = -EIO;
-			goto out_port;
+			goto err_free_arcdev;
 		}
 
 		card = devm_kzalloc(&pdev->dev, sizeof(struct com20020_dev),
 				    GFP_KERNEL);
 		if (!card) {
 			ret = -ENOMEM;
-			goto out_port;
+			goto err_free_arcdev;
 		}
 
 		card->index = i;
@@ -256,29 +260,29 @@ static int com20020pci_probe(struct pci_dev *pdev,
 
 		ret = devm_led_classdev_register(&pdev->dev, &card->tx_led);
 		if (ret)
-			goto out_port;
+			goto err_free_arcdev;
 
 		ret = devm_led_classdev_register(&pdev->dev, &card->recon_led);
 		if (ret)
-			goto out_port;
+			goto err_free_arcdev;
 
 		dev_set_drvdata(&dev->dev, card);
 
 		ret = com20020_found(dev, IRQF_SHARED);
 		if (ret)
-			goto out_port;
+			goto err_free_arcdev;
 
 		devm_arcnet_led_init(dev, dev->dev_id, i);
 
 		list_add(&card->list, &priv->list_dev);
+		continue;
+
+err_free_arcdev:
+		free_arcdev(dev);
+		break;
 	}
-
-	pci_set_drvdata(pdev, priv);
-
-	return 0;
-
-out_port:
-	com20020pci_remove(pdev);
+	if (ret)
+		com20020pci_remove(pdev);
 	return ret;
 }
 

From d54f5a5bc85afd01b0a00689b795e31db54adc15 Mon Sep 17 00:00:00 2001
From: Thomas Reichinger <thomas.reichinger@sohard.de>
Date: Thu, 30 Nov 2023 12:35:03 +0100
Subject: [PATCH 0850/1043] arcnet: restoring support for multiple Sohard
 Arcnet cards

[ Upstream commit 6b17a597fc2f13aaaa0a2780eb7edb9ae7ac9aea ]

Probe of Sohard Arcnet cards fails,
if 2 or more cards are installed in a system.
See kernel log:
[    2.759203] arcnet: arcnet loaded
[    2.763648] arcnet:com20020: COM20020 chipset support (by David Woodhouse et al.)
[    2.770585] arcnet:com20020_pci: COM20020 PCI support
[    2.772295] com20020 0000:02:00.0: enabling device (0000 -> 0003)
[    2.772354] (unnamed net_device) (uninitialized): PLX-PCI Controls
...
[    3.071301] com20020 0000:02:00.0 arc0-0 (uninitialized): PCI COM20020: station FFh found at F080h, IRQ 101.
[    3.071305] com20020 0000:02:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s
[    3.071534] com20020 0000:07:00.0: enabling device (0000 -> 0003)
[    3.071581] (unnamed net_device) (uninitialized): PLX-PCI Controls
...
[    3.369501] com20020 0000:07:00.0: Led pci:green:tx:0-0 renamed to pci:green:tx:0-0_1 due to name collision
[    3.369535] com20020 0000:07:00.0: Led pci:red:recon:0-0 renamed to pci:red:recon:0-0_1 due to name collision
[    3.370586] com20020 0000:07:00.0 arc0-0 (uninitialized): PCI COM20020: station E1h found at C000h, IRQ 35.
[    3.370589] com20020 0000:07:00.0 arc0-0 (uninitialized): Using CKP 64 - data rate 2.5 Mb/s
[    3.370608] com20020: probe of 0000:07:00.0 failed with error -5

commit 5ef216c1f848 ("arcnet: com20020-pci: add rotary index support")
changes the device name of all COM20020 based PCI cards,
even if only some cards support this:
	snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i);

The error happens because all Sohard Arcnet cards would be called arc0-0,
since the Sohard Arcnet cards don't have a PLX rotary coder.
I.e. EAE Arcnet cards have a PLX rotary coder,
which sets the first decimal, ensuring unique devices names.

This patch adds two new card feature flags to indicate
which cards support LEDs and the PLX rotary coder.
For EAE based cards the names still depend on the PLX rotary coder
(untested, since missing EAE hardware).
For Sohard based cards, this patch will result in devices
being called arc0, arc1, ... (tested).

Signed-off-by: Thomas Reichinger <thomas.reichinger@sohard.de>
Fixes: 5ef216c1f848 ("arcnet: com20020-pci: add rotary index support")
Link: https://lore.kernel.org/r/20231130113503.6812-1-thomas.reichinger@sohard.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/arcnet/arcdevice.h    |  2 +
 drivers/net/arcnet/com20020-pci.c | 89 ++++++++++++++++---------------
 2 files changed, 48 insertions(+), 43 deletions(-)

diff --git a/drivers/net/arcnet/arcdevice.h b/drivers/net/arcnet/arcdevice.h
index 5d4a4c7efbbf..deeabd6ec2e8 100644
--- a/drivers/net/arcnet/arcdevice.h
+++ b/drivers/net/arcnet/arcdevice.h
@@ -186,6 +186,8 @@ do {									\
 #define ARC_IS_5MBIT    1   /* card default speed is 5MBit */
 #define ARC_CAN_10MBIT  2   /* card uses COM20022, supporting 10MBit,
 				 but default is 2.5MBit. */
+#define ARC_HAS_LED     4   /* card has software controlled LEDs */
+#define ARC_HAS_ROTARY  8   /* card has rotary encoder */
 
 /* information needed to define an encapsulation driver */
 struct ArcProto {
diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
index 28dccbc0e8d8..9d9e4200064f 100644
--- a/drivers/net/arcnet/com20020-pci.c
+++ b/drivers/net/arcnet/com20020-pci.c
@@ -213,12 +213,13 @@ static int com20020pci_probe(struct pci_dev *pdev,
 		if (!strncmp(ci->name, "EAE PLX-PCI FB2", 15))
 			lp->backplane = 1;
 
-		/* Get the dev_id from the PLX rotary coder */
-		if (!strncmp(ci->name, "EAE PLX-PCI MA1", 15))
-			dev_id_mask = 0x3;
-		dev->dev_id = (inb(priv->misc + ci->rotary) >> 4) & dev_id_mask;
-
-		snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i);
+		if (ci->flags & ARC_HAS_ROTARY) {
+			/* Get the dev_id from the PLX rotary coder */
+			if (!strncmp(ci->name, "EAE PLX-PCI MA1", 15))
+				dev_id_mask = 0x3;
+			dev->dev_id = (inb(priv->misc + ci->rotary) >> 4) & dev_id_mask;
+			snprintf(dev->name, sizeof(dev->name), "arc%d-%d", dev->dev_id, i);
+		}
 
 		if (arcnet_inb(ioaddr, COM20020_REG_R_STATUS) == 0xFF) {
 			pr_err("IO address %Xh is empty!\n", ioaddr);
@@ -230,6 +231,10 @@ static int com20020pci_probe(struct pci_dev *pdev,
 			goto err_free_arcdev;
 		}
 
+		ret = com20020_found(dev, IRQF_SHARED);
+		if (ret)
+			goto err_free_arcdev;
+
 		card = devm_kzalloc(&pdev->dev, sizeof(struct com20020_dev),
 				    GFP_KERNEL);
 		if (!card) {
@@ -239,41 +244,39 @@ static int com20020pci_probe(struct pci_dev *pdev,
 
 		card->index = i;
 		card->pci_priv = priv;
-		card->tx_led.brightness_set = led_tx_set;
-		card->tx_led.default_trigger = devm_kasprintf(&pdev->dev,
-						GFP_KERNEL, "arc%d-%d-tx",
-						dev->dev_id, i);
-		card->tx_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
-						"pci:green:tx:%d-%d",
-						dev->dev_id, i);
 
-		card->tx_led.dev = &dev->dev;
-		card->recon_led.brightness_set = led_recon_set;
-		card->recon_led.default_trigger = devm_kasprintf(&pdev->dev,
-						GFP_KERNEL, "arc%d-%d-recon",
-						dev->dev_id, i);
-		card->recon_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
-						"pci:red:recon:%d-%d",
-						dev->dev_id, i);
-		card->recon_led.dev = &dev->dev;
+		if (ci->flags & ARC_HAS_LED) {
+			card->tx_led.brightness_set = led_tx_set;
+			card->tx_led.default_trigger = devm_kasprintf(&pdev->dev,
+							GFP_KERNEL, "arc%d-%d-tx",
+							dev->dev_id, i);
+			card->tx_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
+							"pci:green:tx:%d-%d",
+							dev->dev_id, i);
+
+			card->tx_led.dev = &dev->dev;
+			card->recon_led.brightness_set = led_recon_set;
+			card->recon_led.default_trigger = devm_kasprintf(&pdev->dev,
+							GFP_KERNEL, "arc%d-%d-recon",
+							dev->dev_id, i);
+			card->recon_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
+							"pci:red:recon:%d-%d",
+							dev->dev_id, i);
+			card->recon_led.dev = &dev->dev;
+
+			ret = devm_led_classdev_register(&pdev->dev, &card->tx_led);
+			if (ret)
+				goto err_free_arcdev;
+
+			ret = devm_led_classdev_register(&pdev->dev, &card->recon_led);
+			if (ret)
+				goto err_free_arcdev;
+
+			dev_set_drvdata(&dev->dev, card);
+			devm_arcnet_led_init(dev, dev->dev_id, i);
+		}
+
 		card->dev = dev;
-
-		ret = devm_led_classdev_register(&pdev->dev, &card->tx_led);
-		if (ret)
-			goto err_free_arcdev;
-
-		ret = devm_led_classdev_register(&pdev->dev, &card->recon_led);
-		if (ret)
-			goto err_free_arcdev;
-
-		dev_set_drvdata(&dev->dev, card);
-
-		ret = com20020_found(dev, IRQF_SHARED);
-		if (ret)
-			goto err_free_arcdev;
-
-		devm_arcnet_led_init(dev, dev->dev_id, i);
-
 		list_add(&card->list, &priv->list_dev);
 		continue;
 
@@ -329,7 +332,7 @@ static struct com20020_pci_card_info card_info_5mbit = {
 };
 
 static struct com20020_pci_card_info card_info_sohard = {
-	.name = "PLX-PCI",
+	.name = "SOHARD SH ARC-PCI",
 	.devcount = 1,
 	/* SOHARD needs PCI base addr 4 */
 	.chan_map_tbl = {
@@ -364,7 +367,7 @@ static struct com20020_pci_card_info card_info_eae_arc1 = {
 		},
 	},
 	.rotary = 0x0,
-	.flags = ARC_CAN_10MBIT,
+	.flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT,
 };
 
 static struct com20020_pci_card_info card_info_eae_ma1 = {
@@ -396,7 +399,7 @@ static struct com20020_pci_card_info card_info_eae_ma1 = {
 		},
 	},
 	.rotary = 0x0,
-	.flags = ARC_CAN_10MBIT,
+	.flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT,
 };
 
 static struct com20020_pci_card_info card_info_eae_fb2 = {
@@ -421,7 +424,7 @@ static struct com20020_pci_card_info card_info_eae_fb2 = {
 		},
 	},
 	.rotary = 0x0,
-	.flags = ARC_CAN_10MBIT,
+	.flags = ARC_HAS_ROTARY | ARC_HAS_LED | ARC_CAN_10MBIT,
 };
 
 static const struct pci_device_id com20020pci_id_table[] = {

From 2093072ed72b792b0d7b54fc681dc08e8388df4c Mon Sep 17 00:00:00 2001
From: Ivan Vecera <ivecera@redhat.com>
Date: Fri, 10 Nov 2023 09:12:09 +0100
Subject: [PATCH 0851/1043] i40e: Fix unexpected MFS warning message

[ Upstream commit 7d9f22b3d3ef379ed05bd3f3e2de83dfa8da8258 ]

Commit 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") added
a warning message that reports unexpected size of port's MFS (max
frame size) value. This message use for the port number local
variable 'i' that is wrong.
In i40e_probe() this 'i' variable is used only to iterate VSIs
to find FDIR VSI:

<code>
...
/* if FDIR VSI was set up, start it now */
        for (i = 0; i < pf->num_alloc_vsi; i++) {
                if (pf->vsi[i] && pf->vsi[i]->type == I40E_VSI_FDIR) {
                        i40e_vsi_open(pf->vsi[i]);
                        break;
                }
        }
...
</code>

So the warning message use for the port number index of FDIR VSI
if this exists or pf->num_alloc_vsi if not.

Fix the message by using 'pf->hw.port' for the port number.

Fixes: 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set")
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 64e1f6f407b4..36e387ae967f 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -15480,7 +15480,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	       I40E_PRTGL_SAH_MFS_MASK) >> I40E_PRTGL_SAH_MFS_SHIFT;
 	if (val < MAX_FRAME_SIZE_DEFAULT)
 		dev_warn(&pdev->dev, "MFS for port %x has been set below the default: %x\n",
-			 i, val);
+			 pf->hw.port, val);
 
 	/* Add a filter to drop all Flow control frames from any VSI from being
 	 * transmitted. By doing so we stop a malicious VF from sending out

From 49809af89c07c51eecba64abb013c78ff6812156 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Mon, 4 Dec 2023 10:40:04 +0800
Subject: [PATCH 0852/1043] net: bnxt: fix a potential use-after-free in
 bnxt_init_tc

[ Upstream commit d007caaaf052f82ca2340d4c7b32d04a3f5dbf3f ]

When flow_indr_dev_register() fails, bnxt_init_tc will free
bp->tc_info through kfree(). However, the caller function
bnxt_init_one() will ignore this failure and call
bnxt_shutdown_tc() on failure of bnxt_dl_register(), where
a use-after-free happens. Fix this issue by setting
bp->tc_info to NULL after kfree().

Fixes: 627c89d00fb9 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Link: https://lore.kernel.org/r/20231204024004.8245-1-dinghao.liu@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 3e9b1f59e381..775d0b7521ca 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -2061,6 +2061,7 @@ int bnxt_init_tc(struct bnxt *bp)
 	rhashtable_destroy(&tc_info->flow_table);
 free_tc_info:
 	kfree(tc_info);
+	bp->tc_info = NULL;
 	return rc;
 }
 

From b41bf6ac24859f006eed531f5c109a4720666dbb Mon Sep 17 00:00:00 2001
From: Shannon Nelson <shannon.nelson@amd.com>
Date: Mon, 4 Dec 2023 11:22:33 -0800
Subject: [PATCH 0853/1043] ionic: fix snprintf format length warning

[ Upstream commit 0ceb3860a67652f9d36dfdecfcd2cb3eb2f4537d ]

Our friendly kernel test robot has reminded us that with a new
check we have a warning about a potential string truncation.
In this case it really doesn't hurt anything, but it is worth
addressing especially since there really is no reason to reserve
so many bytes for our queue names.  It seems that cutting the
queue name buffer length in half stops the complaint.

Fixes: c06107cabea3 ("ionic: more ionic name tweaks")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202311300201.lO8v7mKU-lkp@intel.com/
Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
Reviewed-by: Brett Creeley <brett.creeley@amd.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://lore.kernel.org/r/20231204192234.21017-2-shannon.nelson@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/pensando/ionic/ionic_dev.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.h b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
index 6c243b17312c..64d27e8e0772 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.h
+++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
@@ -191,7 +191,7 @@ struct ionic_desc_info {
 	void *cb_arg;
 };
 
-#define IONIC_QUEUE_NAME_MAX_SZ		32
+#define IONIC_QUEUE_NAME_MAX_SZ		16
 
 struct ionic_queue {
 	struct device *dev;

From 860d53a347e4bbd149d6edb3a3d525bfd0e7d171 Mon Sep 17 00:00:00 2001
From: Brett Creeley <brett.creeley@amd.com>
Date: Mon, 4 Dec 2023 11:22:34 -0800
Subject: [PATCH 0854/1043] ionic: Fix dim work handling in split interrupt
 mode

[ Upstream commit 4115ba677c35f694b62298e55f0e04ce84eed469 ]

Currently ionic_dim_work() is incorrect when in
split interrupt mode. This is because the interrupt
rate is only being changed for the Rx side even for
dim running on Tx. Fix this by using the qcq from
the container_of macro. Also, introduce some local
variables for a bit of cleanup.

Fixes: a6ff85e0a2d9 ("ionic: remove intr coalesce update from napi")
Signed-off-by: Brett Creeley <brett.creeley@amd.com>
Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://lore.kernel.org/r/20231204192234.21017-3-shannon.nelson@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/pensando/ionic/ionic_lif.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
index 098772601df8..49c28134ac2c 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -45,24 +45,24 @@ static void ionic_lif_queue_identify(struct ionic_lif *lif);
 static void ionic_dim_work(struct work_struct *work)
 {
 	struct dim *dim = container_of(work, struct dim, work);
+	struct ionic_intr_info *intr;
 	struct dim_cq_moder cur_moder;
 	struct ionic_qcq *qcq;
+	struct ionic_lif *lif;
 	u32 new_coal;
 
 	cur_moder = net_dim_get_rx_moderation(dim->mode, dim->profile_ix);
 	qcq = container_of(dim, struct ionic_qcq, dim);
-	new_coal = ionic_coal_usec_to_hw(qcq->q.lif->ionic, cur_moder.usec);
+	lif = qcq->q.lif;
+	new_coal = ionic_coal_usec_to_hw(lif->ionic, cur_moder.usec);
 	new_coal = new_coal ? new_coal : 1;
 
-	if (qcq->intr.dim_coal_hw != new_coal) {
-		unsigned int qi = qcq->cq.bound_q->index;
-		struct ionic_lif *lif = qcq->q.lif;
-
-		qcq->intr.dim_coal_hw = new_coal;
+	intr = &qcq->intr;
+	if (intr->dim_coal_hw != new_coal) {
+		intr->dim_coal_hw = new_coal;
 
 		ionic_intr_coal_init(lif->ionic->idev.intr_ctrl,
-				     lif->rxqcqs[qi]->intr.index,
-				     qcq->intr.dim_coal_hw);
+				     intr->index, intr->dim_coal_hw);
 	}
 
 	dim->state = DIM_START_MEASURE;

From f253568348307dd0b841fd56a3ed90fc0cfb105d Mon Sep 17 00:00:00 2001
From: Shigeru Yoshida <syoshida@redhat.com>
Date: Sun, 3 Dec 2023 01:14:41 +0900
Subject: [PATCH 0855/1043] ipv4: ip_gre: Avoid skb_pull() failure in
 ipgre_xmit()

[ Upstream commit 80d875cfc9d3711a029f234ef7d680db79e8fa4b ]

In ipgre_xmit(), skb_pull() may fail even if pskb_inet_may_pull() returns
true. For example, applications can use PF_PACKET to create a malformed
packet with no IP header. This type of packet causes a problem such as
uninit-value access.

This patch ensures that skb_pull() can pull the required size by checking
the skb with pskb_network_may_pull() before skb_pull().

Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Suman Ghosh <sumang@marvell.com>
Link: https://lore.kernel.org/r/20231202161441.221135-1-syoshida@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/ip_gre.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 9d1a50657104..a6ad0fe1387c 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -629,15 +629,18 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
 	}
 
 	if (dev->header_ops) {
+		int pull_len = tunnel->hlen + sizeof(struct iphdr);
+
 		if (skb_cow_head(skb, 0))
 			goto free_skb;
 
 		tnl_params = (const struct iphdr *)skb->data;
 
-		/* Pull skb since ip_tunnel_xmit() needs skb->data pointing
-		 * to gre header.
-		 */
-		skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
+		if (!pskb_network_may_pull(skb, pull_len))
+			goto free_skb;
+
+		/* ip_tunnel_xmit() needs skb->data pointing to gre header. */
+		skb_pull(skb, pull_len);
 		skb_reset_mac_header(skb);
 
 		if (skb->ip_summed == CHECKSUM_PARTIAL &&

From e94b6e964018720215386912d6e41293930d6474 Mon Sep 17 00:00:00 2001
From: Yonglong Liu <liuyonglong@huawei.com>
Date: Mon, 4 Dec 2023 22:32:32 +0800
Subject: [PATCH 0856/1043] net: hns: fix fake link up on xge port

[ Upstream commit f708aba40f9c1eeb9c7e93ed4863b5f85b09b288 ]

If a xge port just connect with an optical module and no fiber,
it may have a fake link up because there may be interference on
the hardware. This patch adds an anti-shake to avoid the problem.
And the time of anti-shake is base on tests.

Fixes: b917078c1c10 ("net: hns: Add ACPI support to check SFP present")
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
index 4a448138b4ec..1f44a6463f45 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
@@ -66,6 +66,27 @@ static enum mac_mode hns_get_enet_interface(const struct hns_mac_cb *mac_cb)
 	}
 }
 
+static u32 hns_mac_link_anti_shake(struct mac_driver *mac_ctrl_drv)
+{
+#define HNS_MAC_LINK_WAIT_TIME 5
+#define HNS_MAC_LINK_WAIT_CNT 40
+
+	u32 link_status = 0;
+	int i;
+
+	if (!mac_ctrl_drv->get_link_status)
+		return link_status;
+
+	for (i = 0; i < HNS_MAC_LINK_WAIT_CNT; i++) {
+		msleep(HNS_MAC_LINK_WAIT_TIME);
+		mac_ctrl_drv->get_link_status(mac_ctrl_drv, &link_status);
+		if (!link_status)
+			break;
+	}
+
+	return link_status;
+}
+
 void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status)
 {
 	struct mac_driver *mac_ctrl_drv;
@@ -83,6 +104,14 @@ void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status)
 							       &sfp_prsnt);
 		if (!ret)
 			*link_status = *link_status && sfp_prsnt;
+
+		/* for FIBER port, it may have a fake link up.
+		 * when the link status changes from down to up, we need to do
+		 * anti-shake. the anti-shake time is base on tests.
+		 * only FIBER port need to do this.
+		 */
+		if (*link_status && !mac_cb->link)
+			*link_status = hns_mac_link_anti_shake(mac_ctrl_drv);
 	}
 
 	mac_cb->link = *link_status;

From f1a6a94912f8dff6e5650c483cc6cfe509f7a103 Mon Sep 17 00:00:00 2001
From: Phil Sutter <phil@nwl.cc>
Date: Tue, 5 Dec 2023 21:58:12 +0100
Subject: [PATCH 0857/1043] netfilter: xt_owner: Fix for unsafe access of
 sk->sk_socket

[ Upstream commit 7ae836a3d630e146b732fe8ef7d86b243748751f ]

A concurrently running sock_orphan() may NULL the sk_socket pointer in
between check and deref. Follow other users (like nft_meta.c for
instance) and acquire sk_callback_lock before dereferencing sk_socket.

Fixes: 0265ab44bacc ("[NETFILTER]: merge ipt_owner/ip6t_owner in xt_owner")
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/xt_owner.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index e85ce69924ae..50332888c8d2 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -76,18 +76,23 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		 */
 		return false;
 
-	filp = sk->sk_socket->file;
-	if (filp == NULL)
+	read_lock_bh(&sk->sk_callback_lock);
+	filp = sk->sk_socket ? sk->sk_socket->file : NULL;
+	if (filp == NULL) {
+		read_unlock_bh(&sk->sk_callback_lock);
 		return ((info->match ^ info->invert) &
 		       (XT_OWNER_UID | XT_OWNER_GID)) == 0;
+	}
 
 	if (info->match & XT_OWNER_UID) {
 		kuid_t uid_min = make_kuid(net->user_ns, info->uid_min);
 		kuid_t uid_max = make_kuid(net->user_ns, info->uid_max);
 		if ((uid_gte(filp->f_cred->fsuid, uid_min) &&
 		     uid_lte(filp->f_cred->fsuid, uid_max)) ^
-		    !(info->invert & XT_OWNER_UID))
+		    !(info->invert & XT_OWNER_UID)) {
+			read_unlock_bh(&sk->sk_callback_lock);
 			return false;
+		}
 	}
 
 	if (info->match & XT_OWNER_GID) {
@@ -112,10 +117,13 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
 			}
 		}
 
-		if (match ^ !(info->invert & XT_OWNER_GID))
+		if (match ^ !(info->invert & XT_OWNER_GID)) {
+			read_unlock_bh(&sk->sk_callback_lock);
 			return false;
+		}
 	}
 
+	read_unlock_bh(&sk->sk_callback_lock);
 	return true;
 }
 

From b17a886ed29f3b70b78ccf632dad03e0c69e3c1a Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Tue, 5 Dec 2023 16:18:41 +0000
Subject: [PATCH 0858/1043] tcp: do not accept ACK of bytes we never sent

[ Upstream commit 3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 ]

This patch is based on a detailed report and ideas from Yepeng Pan
and Christian Rossow.

ACK seq validation is currently following RFC 5961 5.2 guidelines:

   The ACK value is considered acceptable only if
   it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <=
   SND.NXT).  All incoming segments whose ACK value doesn't satisfy the
   above condition MUST be discarded and an ACK sent back.  It needs to
   be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a
   duplicate (SEG.ACK < SND.UNA), it can be ignored.  If the ACK
   acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an
   ACK, drop the segment, and return".  The "ignored" above implies that
   the processing of the incoming data segment continues, which means
   the ACK value is treated as acceptable.  This mitigation makes the
   ACK check more stringent since any ACK < SND.UNA wouldn't be
   accepted, instead only ACKs that are in the range ((SND.UNA -
   MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through.

This can be refined for new (and possibly spoofed) flows,
by not accepting ACK for bytes that were never sent.

This greatly improves TCP security at a little cost.

I added a Fixes: tag to make sure this patch will reach stable trees,
even if the 'blamed' patch was adhering to the RFC.

tp->bytes_acked was added in linux-4.2

Following packetdrill test (courtesy of Yepeng Pan) shows
the issue at hand:

0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+0 bind(3, ..., ...) = 0
+0 listen(3, 1024) = 0

// ---------------- Handshake ------------------- //

// when window scale is set to 14 the window size can be extended to
// 65535 * (2^14) = 1073725440. Linux would accept an ACK packet
// with ack number in (Server_ISN+1-1073725440. Server_ISN+1)
// ,though this ack number acknowledges some data never
// sent by the server.

+0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14>
+0 > S. 0:0(0) ack 1 <...>
+0 < . 1:1(0) ack 1 win 65535
+0 accept(3, ..., ...) = 4

// For the established connection, we send an ACK packet,
// the ack packet uses ack number 1 - 1073725300 + 2^32,
// where 2^32 is used to wrap around.
// Note: we used 1073725300 instead of 1073725440 to avoid possible
// edge cases.
// 1 - 1073725300 + 2^32 = 3221241997

// Oops, old kernels happily accept this packet.
+0 < . 1:1001(1000) ack 3221241997 win 65535

// After the kernel fix the following will be replaced by a challenge ACK,
// and prior malicious frame would be dropped.
+0 > . 1:1(0) ack 1001

Fixes: 354e4aa391ed ("tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Yepeng Pan <yepeng.pan@cispa.de>
Reported-by: Christian Rossow <rossow@cispa.de>
Acked-by: Neal Cardwell <ncardwell@google.com>
Link: https://lore.kernel.org/r/20231205161841.2702925-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_input.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a8948c76d19b..0f9fe5edad14 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3772,8 +3772,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 	 * then we can probably ignore it.
 	 */
 	if (before(ack, prior_snd_una)) {
+		u32 max_window;
+
+		/* do not accept ACK for bytes we never sent. */
+		max_window = min_t(u64, tp->max_window, tp->bytes_acked);
 		/* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */
-		if (before(ack, prior_snd_una - tp->max_window)) {
+		if (before(ack, prior_snd_una - max_window)) {
 			if (!(flag & FLAG_NO_CHALLENGE_ACK))
 				tcp_send_challenge_ack(sk, skb);
 			return -1;

From 3c852b26a55e259e26fa5a0d4a53f8a7fcd73bef Mon Sep 17 00:00:00 2001
From: John Fastabend <john.fastabend@gmail.com>
Date: Wed, 6 Dec 2023 15:27:06 -0800
Subject: [PATCH 0859/1043] bpf: sockmap, updating the sg structure should also
 update curr

[ Upstream commit bb9aefde5bbaf6c168c77ba635c155b4980c2287 ]

Curr pointer should be updated when the sg structure is shifted.

Fixes: 7246d8ed4dcce ("bpf: helper to pop data from messages")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/20231206232706.374377-3-john.fastabend@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/filter.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index ea8ab9c70483..6cfc8fb0562a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2595,6 +2595,22 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes)
 	return 0;
 }
 
+static void sk_msg_reset_curr(struct sk_msg *msg)
+{
+	u32 i = msg->sg.start;
+	u32 len = 0;
+
+	do {
+		len += sk_msg_elem(msg, i)->length;
+		sk_msg_iter_var_next(i);
+		if (len >= msg->sg.size)
+			break;
+	} while (i != msg->sg.end);
+
+	msg->sg.curr = i;
+	msg->sg.copybreak = 0;
+}
+
 static const struct bpf_func_proto bpf_msg_cork_bytes_proto = {
 	.func           = bpf_msg_cork_bytes,
 	.gpl_only       = false,
@@ -2714,6 +2730,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_msg *, msg, u32, start,
 		      msg->sg.end - shift + NR_MSG_FRAG_IDS :
 		      msg->sg.end - shift;
 out:
+	sk_msg_reset_curr(msg);
 	msg->data = sg_virt(&msg->sg.data[first_sge]) + start - offset;
 	msg->data_end = msg->data + bytes;
 	return 0;
@@ -2850,6 +2867,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
 		msg->sg.data[new] = rsge;
 	}
 
+	sk_msg_reset_curr(msg);
 	sk_msg_compute_data_pointers(msg);
 	return 0;
 }
@@ -3018,6 +3036,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
 
 	sk_mem_uncharge(msg->sk, len - pop);
 	msg->sg.size -= (len - pop);
+	sk_msg_reset_curr(msg);
 	sk_msg_compute_data_pointers(msg);
 	return 0;
 }

From a953e45ebeae9a5ce342c012f7eb2a92cc8af89b Mon Sep 17 00:00:00 2001
From: Sumit Garg <sumit.garg@linaro.org>
Date: Thu, 2 Nov 2023 13:00:55 +0530
Subject: [PATCH 0860/1043] tee: optee: Fix supplicant based device enumeration

[ Upstream commit 7269cba53d906cf257c139d3b3a53ad272176bca ]

Currently supplicant dependent optee device enumeration only registers
devices whenever tee-supplicant is invoked for the first time. But it
forgets to remove devices when tee-supplicant daemon stops running and
closes its context gracefully. This leads to following error for fTPM
driver during reboot/shutdown:

[   73.466791] tpm tpm0: ftpm_tee_tpm_op_send: SUBMIT_COMMAND invoke error: 0xffff3024

Fix this by adding an attribute for supplicant dependent devices so that
the user-space service can detect and detach supplicant devices before
closing the supplicant:

$ for dev in /sys/bus/tee/devices/*; do if [[ -f "$dev/need_supplicant" && -f "$dev/driver/unbind" ]]; \
      then echo $(basename "$dev") > $dev/driver/unbind; fi done

Reported-by: Jan Kiszka <jan.kiszka@siemens.com>
Closes: https://github.com/OP-TEE/optee_os/issues/6094
Fixes: 5f178bb71e3a ("optee: enable support for multi-stage bus enumeration")
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
[jw: fixed up Date documentation]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ABI/testing/sysfs-bus-optee-devices         |  9 +++++++++
 drivers/tee/optee/device.c                      | 17 +++++++++++++++--
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/Documentation/ABI/testing/sysfs-bus-optee-devices b/Documentation/ABI/testing/sysfs-bus-optee-devices
index 0f58701367b6..af31e5a22d89 100644
--- a/Documentation/ABI/testing/sysfs-bus-optee-devices
+++ b/Documentation/ABI/testing/sysfs-bus-optee-devices
@@ -6,3 +6,12 @@ Description:
 		OP-TEE bus provides reference to registered drivers under this directory. The <uuid>
 		matches Trusted Application (TA) driver and corresponding TA in secure OS. Drivers
 		are free to create needed API under optee-ta-<uuid> directory.
+
+What:		/sys/bus/tee/devices/optee-ta-<uuid>/need_supplicant
+Date:		November 2023
+KernelVersion:	6.7
+Contact:	op-tee@lists.trustedfirmware.org
+Description:
+		Allows to distinguish whether an OP-TEE based TA/device requires user-space
+		tee-supplicant to function properly or not. This attribute will be present for
+		devices which depend on tee-supplicant to be running.
diff --git a/drivers/tee/optee/device.c b/drivers/tee/optee/device.c
index 60ffc54da003..3cb39f02fae0 100644
--- a/drivers/tee/optee/device.c
+++ b/drivers/tee/optee/device.c
@@ -60,7 +60,16 @@ static void optee_release_device(struct device *dev)
 	kfree(optee_device);
 }
 
-static int optee_register_device(const uuid_t *device_uuid)
+static ssize_t need_supplicant_show(struct device *dev,
+				    struct device_attribute *attr,
+				    char *buf)
+{
+	return 0;
+}
+
+static DEVICE_ATTR_RO(need_supplicant);
+
+static int optee_register_device(const uuid_t *device_uuid, u32 func)
 {
 	struct tee_client_device *optee_device = NULL;
 	int rc;
@@ -83,6 +92,10 @@ static int optee_register_device(const uuid_t *device_uuid)
 		put_device(&optee_device->dev);
 	}
 
+	if (func == PTA_CMD_GET_DEVICES_SUPP)
+		device_create_file(&optee_device->dev,
+				   &dev_attr_need_supplicant);
+
 	return rc;
 }
 
@@ -143,7 +156,7 @@ static int __optee_enumerate_devices(u32 func)
 	num_devices = shm_size / sizeof(uuid_t);
 
 	for (idx = 0; idx < num_devices; idx++) {
-		rc = optee_register_device(&device_uuid[idx]);
+		rc = optee_register_device(&device_uuid[idx], func);
 		if (rc)
 			goto out_shm;
 	}

From 02916f39b8e81121531cb9a1c18845f358ac3601 Mon Sep 17 00:00:00 2001
From: Alex Bee <knaerzche@gmail.com>
Date: Sun, 5 Nov 2023 23:36:16 +0000
Subject: [PATCH 0861/1043] arm64: dts: rockchip: Expand reg size of vdec node
 for RK3399

[ Upstream commit 35938c18291b5da7422b2fac6dac0af11aa8d0d7 ]

Expand the reg size for the vdec node to include cache/performance
registers the rkvdec driver writes to. Also add missing clocks to the
related power-domain.

Fixes: cbd7214402ec ("arm64: dts: rockchip: Define the rockchip Video Decoder node on rk3399")
Signed-off-by: Alex Bee <knaerzche@gmail.com>
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Link: https://lore.kernel.org/r/20231105233630.3927502-10-jonas@kwiboo.se
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/rockchip/rk3399.dtsi | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index c5f3d4f8f4d2..3180f576ed02 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -1022,7 +1022,9 @@ power-domain@RK3399_PD_VCODEC {
 			power-domain@RK3399_PD_VDU {
 				reg = <RK3399_PD_VDU>;
 				clocks = <&cru ACLK_VDU>,
-					 <&cru HCLK_VDU>;
+					 <&cru HCLK_VDU>,
+					 <&cru SCLK_VDU_CA>,
+					 <&cru SCLK_VDU_CORE>;
 				pm_qos = <&qos_video_m1_r>,
 					 <&qos_video_m1_w>;
 			};
@@ -1276,7 +1278,7 @@ vpu_mmu: iommu@ff650800 {
 
 	vdec: video-codec@ff660000 {
 		compatible = "rockchip,rk3399-vdec";
-		reg = <0x0 0xff660000 0x0 0x400>;
+		reg = <0x0 0xff660000 0x0 0x480>;
 		interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH 0>;
 		clocks = <&cru ACLK_VDU>, <&cru HCLK_VDU>,
 			 <&cru SCLK_VDU_CA>, <&cru SCLK_VDU_CORE>;

From 58a7281feb1a45f7a604b785bc331fa11c5aaa87 Mon Sep 17 00:00:00 2001
From: Jack Wang <jinpu.wang@ionos.com>
Date: Mon, 20 Nov 2023 16:41:44 +0100
Subject: [PATCH 0862/1043] RDMA/rtrs-clt: Remove the warnings for req in_use
 check

[ Upstream commit 0c8bb6eb70ca41031f663b4481aac9ac78b53bc6 ]

As we chain the WR during write request: memory registration,
rdma write, local invalidate, if only the last WR fail to send due
to send queue overrun, the server can send back the reply, while
client mark the req->in_use to false in case of error in rtrs_clt_req
when error out from rtrs_post_rdma_write_sg.

Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
Reviewed-by: Md Haris Iqbal <haris.iqbal@ionos.com>
Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
Link: https://lore.kernel.org/r/20231120154146.920486-8-haris.iqbal@ionos.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
index 1a5805260778..e8b2b58cc9bc 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -387,7 +387,7 @@ static void complete_rdma_req(struct rtrs_clt_io_req *req, int errno,
 	struct rtrs_clt_sess *sess;
 	int err;
 
-	if (WARN_ON(!req->in_use))
+	if (!req->in_use)
 		return;
 	if (WARN_ON(!req->con))
 		return;

From c0a428245a83fb3610e075fd056acdcdc49620be Mon Sep 17 00:00:00 2001
From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Date: Tue, 21 Nov 2023 00:29:47 -0800
Subject: [PATCH 0863/1043] RDMA/bnxt_re: Correct module description string

[ Upstream commit 422b19f7f006e813ee0865aadce6a62b3c263c42 ]

The word "Driver" is repeated twice in the "modinfo bnxt_re"
output description. Fix it.

Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Link: https://lore.kernel.org/r/1700555387-6277-1-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/bnxt_re/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 8a618769915d..76030eac49a3 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -70,7 +70,7 @@ static char version[] =
 		BNXT_RE_DESC "\n";
 
 MODULE_AUTHOR("Eddie Wai <eddie.wai@broadcom.com>");
-MODULE_DESCRIPTION(BNXT_RE_DESC " Driver");
+MODULE_DESCRIPTION(BNXT_RE_DESC);
 MODULE_LICENSE("Dual BSD/GPL");
 
 /* globals */

From 9dfd8624181557821638c6f3fe81e45402d1c011 Mon Sep 17 00:00:00 2001
From: Armin Wolf <W_Armin@gmx.de>
Date: Fri, 24 Nov 2023 19:27:47 +0100
Subject: [PATCH 0864/1043] hwmon: (acpi_power_meter) Fix 4.29 MW bug

[ Upstream commit 1fefca6c57fb928d2131ff365270cbf863d89c88 ]

The ACPI specification says:

"If an error occurs while obtaining the meter reading or if the value
is not available then an Integer with all bits set is returned"

Since the "integer" is 32 bits in case of the ACPI power meter,
userspace will get a power reading of 2^32 * 1000 miliwatts (~4.29 MW)
in case of such an error. This was discovered due to a lm_sensors
bugreport (https://github.com/lm-sensors/lm-sensors/issues/460).
Fix this by returning -ENODATA instead.

Tested-by: <urbinek@gmail.com>
Fixes: de584afa5e18 ("hwmon driver for ACPI 4.0 power meters")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://lore.kernel.org/r/20231124182747.13956-1-W_Armin@gmx.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/acpi_power_meter.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
index a270b975e90b..5794d44538e9 100644
--- a/drivers/hwmon/acpi_power_meter.c
+++ b/drivers/hwmon/acpi_power_meter.c
@@ -32,6 +32,7 @@ ACPI_MODULE_NAME(ACPI_POWER_METER_NAME);
 #define POWER_METER_CAN_NOTIFY	(1 << 3)
 #define POWER_METER_IS_BATTERY	(1 << 8)
 #define UNKNOWN_HYSTERESIS	0xFFFFFFFF
+#define UNKNOWN_POWER		0xFFFFFFFF
 
 #define METER_NOTIFY_CONFIG	0x80
 #define METER_NOTIFY_TRIP	0x81
@@ -343,6 +344,9 @@ static ssize_t show_power(struct device *dev,
 	update_meter(resource);
 	mutex_unlock(&resource->lock);
 
+	if (resource->power == UNKNOWN_POWER)
+		return -ENODATA;
+
 	return sprintf(buf, "%llu\n", resource->power * 1000);
 }
 

From 888580bfaaf52c04259d07689cad343a6cd680f8 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Mon, 4 Dec 2023 15:41:56 +0800
Subject: [PATCH 0865/1043] ASoC: wm_adsp: fix memleak in
 wm_adsp_buffer_populate

[ Upstream commit 29046a78a3c0a1f8fa0427f164caa222f003cf5b ]

When wm_adsp_buffer_read() fails, we should free buf->regions.
Otherwise, the callers of wm_adsp_buffer_populate() will
directly free buf on failure, which makes buf->regions a leaked
memory.

Fixes: a792af69b08f ("ASoC: wm_adsp: Refactor compress stream initialisation")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20231204074158.12026-1-dinghao.liu@zju.edu.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm_adsp.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 10189f44af28..ef7936fce7a2 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -3763,12 +3763,12 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf)
 		ret = wm_adsp_buffer_read(buf, caps->region_defs[i].base_offset,
 					  &region->base_addr);
 		if (ret < 0)
-			return ret;
+			goto err;
 
 		ret = wm_adsp_buffer_read(buf, caps->region_defs[i].size_offset,
 					  &offset);
 		if (ret < 0)
-			return ret;
+			goto err;
 
 		region->cumulative_size = offset;
 
@@ -3779,6 +3779,10 @@ static int wm_adsp_buffer_populate(struct wm_adsp_compr_buf *buf)
 	}
 
 	return 0;
+
+err:
+	kfree(buf->regions);
+	return ret;
 }
 
 static void wm_adsp_buffer_clear(struct wm_adsp_compr_buf *buf)

From a28083d41c90b38bacc1ca8fbe017180289d41e4 Mon Sep 17 00:00:00 2001
From: Petr Pavlu <petr.pavlu@suse.com>
Date: Tue, 5 Dec 2023 17:17:35 +0100
Subject: [PATCH 0866/1043] tracing: Fix a warning when allocating buffered
 events fails

[ Upstream commit 34209fe83ef8404353f91ab4ea4035dbc9922d04 ]

Function trace_buffered_event_disable() produces an unexpected warning
when the previous call to trace_buffered_event_enable() fails to
allocate pages for buffered events.

The situation can occur as follows:

* The counter trace_buffered_event_ref is at 0.

* The soft mode gets enabled for some event and
  trace_buffered_event_enable() is called. The function increments
  trace_buffered_event_ref to 1 and starts allocating event pages.

* The allocation fails for some page and trace_buffered_event_disable()
  is called for cleanup.

* Function trace_buffered_event_disable() decrements
  trace_buffered_event_ref back to 0, recognizes that it was the last
  use of buffered events and frees all allocated pages.

* The control goes back to trace_buffered_event_enable() which returns.
  The caller of trace_buffered_event_enable() has no information that
  the function actually failed.

* Some time later, the soft mode is disabled for the same event.
  Function trace_buffered_event_disable() is called. It warns on
  "WARN_ON_ONCE(!trace_buffered_event_ref)" and returns.

Buffered events are just an optimization and can handle failures. Make
trace_buffered_event_enable() exit on the first failure and left any
cleanup later to when trace_buffered_event_disable() is called.

Link: https://lore.kernel.org/all/20231127151248.7232-2-petr.pavlu@suse.com/
Link: https://lkml.kernel.org/r/20231205161736.19663-3-petr.pavlu@suse.com

Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events")
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 89a8bb8e24df..bcf48ee4f20d 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2687,8 +2687,11 @@ void trace_buffered_event_enable(void)
 	for_each_tracing_cpu(cpu) {
 		page = alloc_pages_node(cpu_to_node(cpu),
 					GFP_KERNEL | __GFP_NORETRY, 0);
-		if (!page)
-			goto failed;
+		/* This is just an optimization and can handle failures */
+		if (!page) {
+			pr_err("Failed to allocate event buffer\n");
+			break;
+		}
 
 		event = page_address(page);
 		memset(event, 0, sizeof(*event));
@@ -2702,10 +2705,6 @@ void trace_buffered_event_enable(void)
 			WARN_ON_ONCE(1);
 		preempt_enable();
 	}
-
-	return;
- failed:
-	trace_buffered_event_disable();
 }
 
 static void enable_trace_buffered_event(void *data)

From 04769017dec9d49d1de756b3d20059a155fb2ef9 Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Thu, 23 Nov 2023 16:19:41 +0800
Subject: [PATCH 0867/1043] scsi: be2iscsi: Fix a memleak in
 beiscsi_init_wrb_handle()

[ Upstream commit 235f2b548d7f4ac5931d834f05d3f7f5166a2e72 ]

When an error occurs in the for loop of beiscsi_init_wrb_handle(), we
should free phwi_ctxt->be_wrbq before returning an error code to prevent
potential memleak.

Fixes: a7909b396ba7 ("[SCSI] be2iscsi: Fix dynamic CID allocation Mechanism in driver")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Link: https://lore.kernel.org/r/20231123081941.24854-1-dinghao.liu@zju.edu.cn
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/be2iscsi/be_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index b977e039bb78..5e5c359eaf98 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -2694,6 +2694,7 @@ static int beiscsi_init_wrb_handle(struct beiscsi_hba *phba)
 		kfree(pwrb_context->pwrb_handle_base);
 		kfree(pwrb_context->pwrb_handle_basestd);
 	}
+	kfree(phwi_ctxt->be_wrbq);
 	return -ENOMEM;
 }
 

From f337ccfa9f6d580eb33671f767c9a16638734f86 Mon Sep 17 00:00:00 2001
From: Kunwu Chan <chentao@kylinos.cn>
Date: Wed, 22 Nov 2023 14:46:36 +0800
Subject: [PATCH 0868/1043] ARM: imx: Check return value of devm_kasprintf in
 imx_mmdc_perf_init

[ Upstream commit 1c2b1049af3f86545fcc5fae0fc725fb64b3a09e ]

devm_kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure. Ensure the allocation was successful
by checking the pointer validity.

Release the id allocated in 'mmdc_pmu_init' when 'devm_kasprintf'
return NULL

Suggested-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver")
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-imx/mmdc.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
index b9efe9da06e0..3d76e8c28c51 100644
--- a/arch/arm/mach-imx/mmdc.c
+++ b/arch/arm/mach-imx/mmdc.c
@@ -502,6 +502,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
 
 	name = devm_kasprintf(&pdev->dev,
 				GFP_KERNEL, "mmdc%d", ret);
+	if (!name) {
+		ret = -ENOMEM;
+		goto pmu_release_id;
+	}
 
 	pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;
 	pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data;
@@ -524,9 +528,10 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
 
 pmu_register_err:
 	pr_warn("MMDC Perf PMU failed (%d), disabled\n", ret);
-	ida_simple_remove(&mmdc_ida, pmu_mmdc->id);
 	cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node);
 	hrtimer_cancel(&pmu_mmdc->hrtimer);
+pmu_release_id:
+	ida_simple_remove(&mmdc_ida, pmu_mmdc->id);
 pmu_free:
 	kfree(pmu_mmdc);
 	return ret;

From cb3543fdaac1d1c9e9f8a860056452a7def9525d Mon Sep 17 00:00:00 2001
From: Philipp Zabel <p.zabel@pengutronix.de>
Date: Mon, 27 Nov 2023 17:05:01 +0100
Subject: [PATCH 0869/1043] ARM: dts: imx7: Declare timers compatible with
 fsl,imx6dl-gpt

[ Upstream commit 397caf68e2d36532054cb14ae8995537f27f8b61 ]

The timer nodes declare compatibility with "fsl,imx6sx-gpt", which
itself is compatible with "fsl,imx6dl-gpt". Switch the fallback
compatible from "fsl,imx6sx-gpt" to "fsl,imx6dl-gpt".

Fixes: 949673450291 ("ARM: dts: add imx7d soc dtsi file")
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Roland Hieber <rhi@pengutronix.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx7s.dtsi | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
index 854c380cccea..03bde2fb9bb1 100644
--- a/arch/arm/boot/dts/imx7s.dtsi
+++ b/arch/arm/boot/dts/imx7s.dtsi
@@ -437,7 +437,7 @@ iomuxc_lpsr: iomuxc-lpsr@302c0000 {
 			};
 
 			gpt1: timer@302d0000 {
-				compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+				compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt";
 				reg = <0x302d0000 0x10000>;
 				interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clks IMX7D_GPT1_ROOT_CLK>,
@@ -446,7 +446,7 @@ gpt1: timer@302d0000 {
 			};
 
 			gpt2: timer@302e0000 {
-				compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+				compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt";
 				reg = <0x302e0000 0x10000>;
 				interrupts = <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clks IMX7D_GPT2_ROOT_CLK>,
@@ -456,7 +456,7 @@ gpt2: timer@302e0000 {
 			};
 
 			gpt3: timer@302f0000 {
-				compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+				compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt";
 				reg = <0x302f0000 0x10000>;
 				interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clks IMX7D_GPT3_ROOT_CLK>,
@@ -466,7 +466,7 @@ gpt3: timer@302f0000 {
 			};
 
 			gpt4: timer@30300000 {
-				compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+				compatible = "fsl,imx7d-gpt", "fsl,imx6dl-gpt";
 				reg = <0x30300000 0x10000>;
 				interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clks IMX7D_GPT4_ROOT_CLK>,

From 1f1c2a3452fb3f9a6b9bb6048af06be5a74f67ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20L=C3=A9ger?= <cleger@rivosinc.com>
Date: Fri, 3 Nov 2023 10:02:23 +0100
Subject: [PATCH 0870/1043] riscv: fix misaligned access handling of C.SWSP and
 C.SDSP
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 22e0eb04837a63af111fae35a92f7577676b9bc8 ]

This is a backport of a fix that was done in OpenSBI: ec0559eb315b
("lib: sbi_misaligned_ldst: Fix handling of C.SWSP and C.SDSP").

Unlike C.LWSP/C.LDSP, these encodings can be used with the zero
register, so checking that the rs2 field is non-zero is unnecessary.

Additionally, the previous check was incorrect since it was checking
the immediate field of the instruction instead of the rs2 field.

Fixes: 956d705dd279 ("riscv: Unaligned load/store handling for M_MODE")
Signed-off-by: Clément Léger <cleger@rivosinc.com>
Link: https://lore.kernel.org/r/20231103090223.702340-1-cleger@rivosinc.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/kernel/traps_misaligned.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/arch/riscv/kernel/traps_misaligned.c b/arch/riscv/kernel/traps_misaligned.c
index 46c4dafe3ba0..b246c3dc6993 100644
--- a/arch/riscv/kernel/traps_misaligned.c
+++ b/arch/riscv/kernel/traps_misaligned.c
@@ -344,16 +344,14 @@ int handle_misaligned_store(struct pt_regs *regs)
 	} else if ((insn & INSN_MASK_C_SD) == INSN_MATCH_C_SD) {
 		len = 8;
 		val.data_ulong = GET_RS2S(insn, regs);
-	} else if ((insn & INSN_MASK_C_SDSP) == INSN_MATCH_C_SDSP &&
-		   ((insn >> SH_RD) & 0x1f)) {
+	} else if ((insn & INSN_MASK_C_SDSP) == INSN_MATCH_C_SDSP) {
 		len = 8;
 		val.data_ulong = GET_RS2C(insn, regs);
 #endif
 	} else if ((insn & INSN_MASK_C_SW) == INSN_MATCH_C_SW) {
 		len = 4;
 		val.data_ulong = GET_RS2S(insn, regs);
-	} else if ((insn & INSN_MASK_C_SWSP) == INSN_MATCH_C_SWSP &&
-		   ((insn >> SH_RD) & 0x1f)) {
+	} else if ((insn & INSN_MASK_C_SWSP) == INSN_MATCH_C_SWSP) {
 		len = 4;
 		val.data_ulong = GET_RS2C(insn, regs);
 	} else {

From 0ff1c0f5a45f7f66c3d6e71a54bef78e5c75196c Mon Sep 17 00:00:00 2001
From: Jason Zhang <jason.zhang@rock-chips.com>
Date: Wed, 6 Dec 2023 09:31:39 +0800
Subject: [PATCH 0871/1043] ALSA: pcm: fix out-of-bounds in snd_pcm_state_names

commit 2b3a7a302c9804e463f2ea5b54dc3a6ad106a344 upstream.

The pcm state can be SNDRV_PCM_STATE_DISCONNECTED at disconnect
callback, and there is not an entry of SNDRV_PCM_STATE_DISCONNECTED
in snd_pcm_state_names.

This patch adds the missing entry to resolve this issue.

cat /proc/asound/card2/pcm0p/sub0/status
That results in stack traces like the following:

[   99.702732][ T5171] Unexpected kernel BRK exception at EL1
[   99.702774][ T5171] Internal error: BRK handler: f2005512 [#1] PREEMPT SMP
[   99.703858][ T5171] Modules linked in: bcmdhd(E) (...)
[   99.747425][ T5171] CPU: 3 PID: 5171 Comm: cat Tainted: G         C OE     5.10.189-android13-4-00003-g4a17384380d8-ab11086999 #1
[   99.748447][ T5171] Hardware name: Rockchip RK3588 CVTE V10 Board (DT)
[   99.749024][ T5171] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
[   99.749616][ T5171] pc : snd_pcm_substream_proc_status_read+0x264/0x2bc
[   99.750204][ T5171] lr : snd_pcm_substream_proc_status_read+0xa4/0x2bc
[   99.750778][ T5171] sp : ffffffc0175abae0
[   99.751132][ T5171] x29: ffffffc0175abb80 x28: ffffffc009a2c498
[   99.751665][ T5171] x27: 0000000000000001 x26: ffffff810cbae6e8
[   99.752199][ T5171] x25: 0000000000400cc0 x24: ffffffc0175abc60
[   99.752729][ T5171] x23: 0000000000000000 x22: ffffff802f558400
[   99.753263][ T5171] x21: ffffff81d8d8ff00 x20: ffffff81020cdc00
[   99.753795][ T5171] x19: ffffff802d110000 x18: ffffffc014fbd058
[   99.754326][ T5171] x17: 0000000000000000 x16: 0000000000000000
[   99.754861][ T5171] x15: 000000000000c276 x14: ffffffff9a976fda
[   99.755392][ T5171] x13: 0000000065689089 x12: 000000000000d72e
[   99.755923][ T5171] x11: ffffff802d110000 x10: 00000000000000e0
[   99.756457][ T5171] x9 : 9c431600c8385d00 x8 : 0000000000000008
[   99.756990][ T5171] x7 : 0000000000000000 x6 : 000000000000003f
[   99.757522][ T5171] x5 : 0000000000000040 x4 : ffffffc0175abb70
[   99.758056][ T5171] x3 : 0000000000000001 x2 : 0000000000000001
[   99.758588][ T5171] x1 : 0000000000000000 x0 : 0000000000000000
[   99.759123][ T5171] Call trace:
[   99.759404][ T5171]  snd_pcm_substream_proc_status_read+0x264/0x2bc
[   99.759958][ T5171]  snd_info_seq_show+0x54/0xa4
[   99.760370][ T5171]  seq_read_iter+0x19c/0x7d4
[   99.760770][ T5171]  seq_read+0xf0/0x128
[   99.761117][ T5171]  proc_reg_read+0x100/0x1f8
[   99.761515][ T5171]  vfs_read+0xf4/0x354
[   99.761869][ T5171]  ksys_read+0x7c/0x148
[   99.762226][ T5171]  __arm64_sys_read+0x20/0x30
[   99.762625][ T5171]  el0_svc_common+0xd0/0x1e4
[   99.763023][ T5171]  el0_svc+0x28/0x98
[   99.763358][ T5171]  el0_sync_handler+0x8c/0xf0
[   99.763759][ T5171]  el0_sync+0x1b8/0x1c0
[   99.764118][ T5171] Code: d65f03c0 b9406102 17ffffae 94191565 (d42aa240)
[   99.764715][ T5171] ---[ end trace 1eeffa3e17c58e10 ]---
[   99.780720][ T5171] Kernel panic - not syncing: BRK handler: Fatal exception

Signed-off-by: Jason Zhang <jason.zhang@rock-chips.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20231206013139.20506-1-jason.zhang@rock-chips.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/pcm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 59d222446d77..bec81f6ba6ba 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -251,6 +251,7 @@ static const char * const snd_pcm_state_names[] = {
 	STATE(DRAINING),
 	STATE(PAUSED),
 	STATE(SUSPENDED),
+	STATE(DISCONNECTED),
 };
 
 static const char * const snd_pcm_access_names[] = {

From 3764b24499e826f936412780afe51fdf7883a6cf Mon Sep 17 00:00:00 2001
From: Bin Li <bin.li@canonical.com>
Date: Mon, 4 Dec 2023 18:04:50 +0800
Subject: [PATCH 0872/1043] ALSA: hda/realtek: Enable headset on Lenovo M90
 Gen5

commit 6f7e4664e597440dfbdb8b2931c561b717030d07 upstream.

Lenovo M90 Gen5 is equipped with ALC897, and it needs
ALC897_FIXUP_HEADSET_MIC_PIN quirk to make its headset mic work.

Signed-off-by: Bin Li <bin.li@canonical.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20231204100450.642783-1-bin.li@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3d94a2f41d82..d9140630cf3d 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -11227,6 +11227,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x17aa, 0x32f7, "Lenovo ThinkCentre M90", ALC897_FIXUP_HEADSET_MIC_PIN),
 	SND_PCI_QUIRK(0x17aa, 0x3321, "Lenovo ThinkCentre M70 Gen4", ALC897_FIXUP_HEADSET_MIC_PIN),
 	SND_PCI_QUIRK(0x17aa, 0x331b, "Lenovo ThinkCentre M90 Gen4", ALC897_FIXUP_HEADSET_MIC_PIN),
+	SND_PCI_QUIRK(0x17aa, 0x3364, "Lenovo ThinkCentre M90 Gen5", ALC897_FIXUP_HEADSET_MIC_PIN),
 	SND_PCI_QUIRK(0x17aa, 0x3742, "Lenovo TianYi510Pro-14IOB", ALC897_FIXUP_HEADSET_MIC_PIN2),
 	SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
 	SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),

From 8df769d92b1c7e71050dda6198120c131924a134 Mon Sep 17 00:00:00 2001
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Date: Wed, 29 Nov 2023 23:15:47 +0900
Subject: [PATCH 0873/1043] nilfs2: fix missing error check for
 sb_set_blocksize call

commit d61d0ab573649789bf9eb909c89a1a193b2e3d10 upstream.

When mounting a filesystem image with a block size larger than the page
size, nilfs2 repeatedly outputs long error messages with stack traces to
the kernel log, such as the following:

 getblk(): invalid block size 8192 requested
 logical block size: 512
 ...
 Call Trace:
  dump_stack_lvl+0x92/0xd4
  dump_stack+0xd/0x10
  bdev_getblk+0x33a/0x354
  __breadahead+0x11/0x80
  nilfs_search_super_root+0xe2/0x704 [nilfs2]
  load_nilfs+0x72/0x504 [nilfs2]
  nilfs_mount+0x30f/0x518 [nilfs2]
  legacy_get_tree+0x1b/0x40
  vfs_get_tree+0x18/0xc4
  path_mount+0x786/0xa88
  __ia32_sys_mount+0x147/0x1a8
  __do_fast_syscall_32+0x56/0xc8
  do_fast_syscall_32+0x29/0x58
  do_SYSENTER_32+0x15/0x18
  entry_SYSENTER_32+0x98/0xf1
 ...

This overloads the system logger.  And to make matters worse, it sometimes
crashes the kernel with a memory access violation.

This is because the return value of the sb_set_blocksize() call, which
should be checked for errors, is not checked.

The latter issue is due to out-of-buffer memory being accessed based on a
large block size that caused sb_set_blocksize() to fail for buffers read
with the initial minimum block size that remained unupdated in the
super_block structure.

Since nilfs2 mkfs tool does not accept block sizes larger than the system
page size, this has been overlooked.  However, it is possible to create
this situation by intentionally modifying the tool or by passing a
filesystem image created on a system with a large page size to a system
with a smaller page size and mounting it.

Fix this issue by inserting the expected error handling for the call to
sb_set_blocksize().

Link: https://lkml.kernel.org/r/20231129141547.4726-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nilfs2/the_nilfs.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 1566e86e8e55..a8374d89da7c 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -717,7 +717,11 @@ int init_nilfs(struct the_nilfs *nilfs, struct super_block *sb, char *data)
 			goto failed_sbh;
 		}
 		nilfs_release_super_block(nilfs);
-		sb_set_blocksize(sb, blocksize);
+		if (!sb_set_blocksize(sb, blocksize)) {
+			nilfs_err(sb, "bad blocksize %d", blocksize);
+			err = -EINVAL;
+			goto out;
+		}
 
 		err = nilfs_load_super_block(nilfs, sb, blocksize, &sbp);
 		if (err)

From 35a7f92507dcda27f455bad9d0b2162d38abfe79 Mon Sep 17 00:00:00 2001
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Date: Tue, 5 Dec 2023 17:59:47 +0900
Subject: [PATCH 0874/1043] nilfs2: prevent WARNING in
 nilfs_sufile_set_segment_usage()

commit 675abf8df1353e0e3bde314993e0796c524cfbf0 upstream.

If nilfs2 reads a disk image with corrupted segment usage metadata, and
its segment usage information is marked as an error for the segment at the
write location, nilfs_sufile_set_segment_usage() can trigger WARN_ONs
during log writing.

Segments newly allocated for writing with nilfs_sufile_alloc() will not
have this error flag set, but this unexpected situation will occur if the
segment indexed by either nilfs->ns_segnum or nilfs->ns_nextnum (active
segment) was marked in error.

Fix this issue by inserting a sanity check to treat it as a file system
corruption.

Since error returns are not allowed during the execution phase where
nilfs_sufile_set_segment_usage() is used, this inserts the sanity check
into nilfs_sufile_mark_dirty() which pre-reads the buffer containing the
segment usage record to be updated and sets it up in a dirty state for
writing.

In addition, nilfs_sufile_set_segment_usage() is also called when
canceling log writing and undoing segment usage update, so in order to
avoid issuing the same kernel warning in that case, in case of
cancellation, avoid checking the error flag in
nilfs_sufile_set_segment_usage().

Link: https://lkml.kernel.org/r/20231205085947.4431-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+14e9f834f6ddecece094@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=14e9f834f6ddecece094
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nilfs2/sufile.c | 44 ++++++++++++++++++++++++++++++++++++--------
 1 file changed, 36 insertions(+), 8 deletions(-)

diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
index b3abe69382fd..23b4b8863e7f 100644
--- a/fs/nilfs2/sufile.c
+++ b/fs/nilfs2/sufile.c
@@ -501,15 +501,38 @@ int nilfs_sufile_mark_dirty(struct inode *sufile, __u64 segnum)
 
 	down_write(&NILFS_MDT(sufile)->mi_sem);
 	ret = nilfs_sufile_get_segment_usage_block(sufile, segnum, 0, &bh);
-	if (!ret) {
-		mark_buffer_dirty(bh);
-		nilfs_mdt_mark_dirty(sufile);
-		kaddr = kmap_atomic(bh->b_page);
-		su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr);
-		nilfs_segment_usage_set_dirty(su);
+	if (ret)
+		goto out_sem;
+
+	kaddr = kmap_atomic(bh->b_page);
+	su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr);
+	if (unlikely(nilfs_segment_usage_error(su))) {
+		struct the_nilfs *nilfs = sufile->i_sb->s_fs_info;
+
 		kunmap_atomic(kaddr);
 		brelse(bh);
+		if (nilfs_segment_is_active(nilfs, segnum)) {
+			nilfs_error(sufile->i_sb,
+				    "active segment %llu is erroneous",
+				    (unsigned long long)segnum);
+		} else {
+			/*
+			 * Segments marked erroneous are never allocated by
+			 * nilfs_sufile_alloc(); only active segments, ie,
+			 * the segments indexed by ns_segnum or ns_nextnum,
+			 * can be erroneous here.
+			 */
+			WARN_ON_ONCE(1);
+		}
+		ret = -EIO;
+	} else {
+		nilfs_segment_usage_set_dirty(su);
+		kunmap_atomic(kaddr);
+		mark_buffer_dirty(bh);
+		nilfs_mdt_mark_dirty(sufile);
+		brelse(bh);
 	}
+out_sem:
 	up_write(&NILFS_MDT(sufile)->mi_sem);
 	return ret;
 }
@@ -536,9 +559,14 @@ int nilfs_sufile_set_segment_usage(struct inode *sufile, __u64 segnum,
 
 	kaddr = kmap_atomic(bh->b_page);
 	su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr);
-	WARN_ON(nilfs_segment_usage_error(su));
-	if (modtime)
+	if (modtime) {
+		/*
+		 * Check segusage error and set su_lastmod only when updating
+		 * this entry with a valid timestamp, not for cancellation.
+		 */
+		WARN_ON_ONCE(nilfs_segment_usage_error(su));
 		su->su_lastmod = cpu_to_le64(modtime);
+	}
 	su->su_nblocks = cpu_to_le32(nblocks);
 	kunmap_atomic(kaddr);
 

From 2f7368f336ee146e048b3496fd9584f88df3d14d Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@linux.ibm.com>
Date: Mon, 20 Nov 2023 19:37:17 +0100
Subject: [PATCH 0875/1043] checkstack: fix printed address

commit ee34db3f271cea4d4252048617919c2caafe698b upstream.

All addresses printed by checkstack have an extra incorrect 0 appended at
the end.

This was introduced with commit 677f1410e058 ("scripts/checkstack.pl: don't
display $dre as different entity"): since then the address is taken from
the line which contains the function name, instead of the line which
contains stack consumption. E.g. on s390:

0000000000100a30 <do_one_initcall>:
...
  100a44:       e3 f0 ff 70 ff 71       lay     %r15,-144(%r15)

So the used regex which matches spaces and hexadecimal numbers to extract
an address now matches a different substring. Subsequently replacing spaces
with 0 appends a zero at the and, instead of replacing leading spaces.

Fix this by using the proper regex, and simplify the code a bit.

Link: https://lkml.kernel.org/r/20231120183719.2188479-2-hca@linux.ibm.com
Fixes: 677f1410e058 ("scripts/checkstack.pl: don't display $dre as different entity")
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Cc: Maninder Singh <maninder1.s@samsung.com>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Cc: Vaneet Narang <v.narang@samsung.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/checkstack.pl | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl
index d2c38584ece6..758884b61f92 100755
--- a/scripts/checkstack.pl
+++ b/scripts/checkstack.pl
@@ -142,15 +142,11 @@ $total_size = 0;
 while (my $line = <STDIN>) {
 	if ($line =~ m/$funcre/) {
 		$func = $1;
-		next if $line !~ m/^($xs*)/;
+		next if $line !~ m/^($x*)/;
 		if ($total_size > $min_stack) {
 			push @stack, "$intro$total_size\n";
 		}
-
-		$addr = $1;
-		$addr =~ s/ /0/g;
-		$addr = "0x$addr";
-
+		$addr = "0x$1";
 		$intro = "$addr $func [$file]:";
 		my $padlen = 56 - length($intro);
 		while ($padlen > 0) {

From 97c2b3b2329d23615c1fac4bc5b6f3cf96ebd363 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Date: Tue, 5 Dec 2023 16:52:09 -0500
Subject: [PATCH 0876/1043] tracing: Always update snapshot buffer size

commit 7be76461f302ec05cbd62b90b2a05c64299ca01f upstream.

It use to be that only the top level instance had a snapshot buffer (for
latency tracers like wakeup and irqsoff). The update of the ring buffer
size would check if the instance was the top level and if so, it would
also update the snapshot buffer as it needs to be the same as the main
buffer.

Now that lower level instances also has a snapshot buffer, they too need
to update their snapshot buffer sizes when the main buffer is changed,
otherwise the following can be triggered:

 # cd /sys/kernel/tracing
 # echo 1500 > buffer_size_kb
 # mkdir instances/foo
 # echo irqsoff > instances/foo/current_tracer
 # echo 1000 > instances/foo/buffer_size_kb

Produces:

 WARNING: CPU: 2 PID: 856 at kernel/trace/trace.c:1938 update_max_tr_single.part.0+0x27d/0x320

Which is:

	ret = ring_buffer_swap_cpu(tr->max_buffer.buffer, tr->array_buffer.buffer, cpu);

	if (ret == -EBUSY) {
		[..]
	}

	WARN_ON_ONCE(ret && ret != -EAGAIN && ret != -EBUSY);  <== here

That's because ring_buffer_swap_cpu() has:

	int ret = -EINVAL;

	[..]

	/* At least make sure the two buffers are somewhat the same */
	if (cpu_buffer_a->nr_pages != cpu_buffer_b->nr_pages)
		goto out;

	[..]
 out:
	return ret;
 }

Instead, update all instances' snapshot buffer sizes when their main
buffer size is updated.

Link: https://lkml.kernel.org/r/20231205220010.454662151@goodmis.org

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Fixes: 6d9b3fa5e7f6 ("tracing: Move tracing_max_latency into trace_array")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index bcf48ee4f20d..88a4e9dba3b1 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -5943,8 +5943,7 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
 		return ret;
 
 #ifdef CONFIG_TRACER_MAX_TRACE
-	if (!(tr->flags & TRACE_ARRAY_FL_GLOBAL) ||
-	    !tr->current_trace->use_max_tr)
+	if (!tr->current_trace->use_max_tr)
 		goto out;
 
 	ret = ring_buffer_resize(tr->max_buffer.buffer, size, cpu);

From ad9efb0b275a98cba10b1a00f0aaf6337f81a08e Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Date: Tue, 5 Dec 2023 16:52:11 -0500
Subject: [PATCH 0877/1043] tracing: Disable snapshot buffer when stopping
 instance tracers

commit b538bf7d0ec11ca49f536dfda742a5f6db90a798 upstream.

It use to be that only the top level instance had a snapshot buffer (for
latency tracers like wakeup and irqsoff). When stopping a tracer in an
instance would not disable the snapshot buffer. This could have some
unintended consequences if the irqsoff tracer is enabled.

Consolidate the tracing_start/stop() with tracing_start/stop_tr() so that
all instances behave the same. The tracing_start/stop() functions will
just call their respective tracing_start/stop_tr() with the global_array
passed in.

Link: https://lkml.kernel.org/r/20231205220011.041220035@goodmis.org

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Fixes: 6d9b3fa5e7f6 ("tracing: Move tracing_max_latency into trace_array")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 148 ++++++++++++++++---------------------------
 1 file changed, 53 insertions(+), 95 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 88a4e9dba3b1..cac15b3a6af0 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2287,49 +2287,6 @@ int is_tracing_stopped(void)
 	return global_trace.stop_count;
 }
 
-/**
- * tracing_start - quick start of the tracer
- *
- * If tracing is enabled but was stopped by tracing_stop,
- * this will start the tracer back up.
- */
-void tracing_start(void)
-{
-	struct trace_buffer *buffer;
-	unsigned long flags;
-
-	if (tracing_disabled)
-		return;
-
-	raw_spin_lock_irqsave(&global_trace.start_lock, flags);
-	if (--global_trace.stop_count) {
-		if (global_trace.stop_count < 0) {
-			/* Someone screwed up their debugging */
-			WARN_ON_ONCE(1);
-			global_trace.stop_count = 0;
-		}
-		goto out;
-	}
-
-	/* Prevent the buffers from switching */
-	arch_spin_lock(&global_trace.max_lock);
-
-	buffer = global_trace.array_buffer.buffer;
-	if (buffer)
-		ring_buffer_record_enable(buffer);
-
-#ifdef CONFIG_TRACER_MAX_TRACE
-	buffer = global_trace.max_buffer.buffer;
-	if (buffer)
-		ring_buffer_record_enable(buffer);
-#endif
-
-	arch_spin_unlock(&global_trace.max_lock);
-
- out:
-	raw_spin_unlock_irqrestore(&global_trace.start_lock, flags);
-}
-
 static void tracing_start_tr(struct trace_array *tr)
 {
 	struct trace_buffer *buffer;
@@ -2338,25 +2295,70 @@ static void tracing_start_tr(struct trace_array *tr)
 	if (tracing_disabled)
 		return;
 
-	/* If global, we need to also start the max tracer */
-	if (tr->flags & TRACE_ARRAY_FL_GLOBAL)
-		return tracing_start();
-
 	raw_spin_lock_irqsave(&tr->start_lock, flags);
-
 	if (--tr->stop_count) {
-		if (tr->stop_count < 0) {
+		if (WARN_ON_ONCE(tr->stop_count < 0)) {
 			/* Someone screwed up their debugging */
-			WARN_ON_ONCE(1);
 			tr->stop_count = 0;
 		}
 		goto out;
 	}
 
+	/* Prevent the buffers from switching */
+	arch_spin_lock(&tr->max_lock);
+
 	buffer = tr->array_buffer.buffer;
 	if (buffer)
 		ring_buffer_record_enable(buffer);
 
+#ifdef CONFIG_TRACER_MAX_TRACE
+	buffer = tr->max_buffer.buffer;
+	if (buffer)
+		ring_buffer_record_enable(buffer);
+#endif
+
+	arch_spin_unlock(&tr->max_lock);
+
+ out:
+	raw_spin_unlock_irqrestore(&tr->start_lock, flags);
+}
+
+/**
+ * tracing_start - quick start of the tracer
+ *
+ * If tracing is enabled but was stopped by tracing_stop,
+ * this will start the tracer back up.
+ */
+void tracing_start(void)
+
+{
+	return tracing_start_tr(&global_trace);
+}
+
+static void tracing_stop_tr(struct trace_array *tr)
+{
+	struct trace_buffer *buffer;
+	unsigned long flags;
+
+	raw_spin_lock_irqsave(&tr->start_lock, flags);
+	if (tr->stop_count++)
+		goto out;
+
+	/* Prevent the buffers from switching */
+	arch_spin_lock(&tr->max_lock);
+
+	buffer = tr->array_buffer.buffer;
+	if (buffer)
+		ring_buffer_record_disable(buffer);
+
+#ifdef CONFIG_TRACER_MAX_TRACE
+	buffer = tr->max_buffer.buffer;
+	if (buffer)
+		ring_buffer_record_disable(buffer);
+#endif
+
+	arch_spin_unlock(&tr->max_lock);
+
  out:
 	raw_spin_unlock_irqrestore(&tr->start_lock, flags);
 }
@@ -2369,51 +2371,7 @@ static void tracing_start_tr(struct trace_array *tr)
  */
 void tracing_stop(void)
 {
-	struct trace_buffer *buffer;
-	unsigned long flags;
-
-	raw_spin_lock_irqsave(&global_trace.start_lock, flags);
-	if (global_trace.stop_count++)
-		goto out;
-
-	/* Prevent the buffers from switching */
-	arch_spin_lock(&global_trace.max_lock);
-
-	buffer = global_trace.array_buffer.buffer;
-	if (buffer)
-		ring_buffer_record_disable(buffer);
-
-#ifdef CONFIG_TRACER_MAX_TRACE
-	buffer = global_trace.max_buffer.buffer;
-	if (buffer)
-		ring_buffer_record_disable(buffer);
-#endif
-
-	arch_spin_unlock(&global_trace.max_lock);
-
- out:
-	raw_spin_unlock_irqrestore(&global_trace.start_lock, flags);
-}
-
-static void tracing_stop_tr(struct trace_array *tr)
-{
-	struct trace_buffer *buffer;
-	unsigned long flags;
-
-	/* If global, we need to also stop the max tracer */
-	if (tr->flags & TRACE_ARRAY_FL_GLOBAL)
-		return tracing_stop();
-
-	raw_spin_lock_irqsave(&tr->start_lock, flags);
-	if (tr->stop_count++)
-		goto out;
-
-	buffer = tr->array_buffer.buffer;
-	if (buffer)
-		ring_buffer_record_disable(buffer);
-
- out:
-	raw_spin_unlock_irqrestore(&tr->start_lock, flags);
+	return tracing_stop_tr(&global_trace);
 }
 
 static int trace_save_cmdline(struct task_struct *tsk)

From 85e86d6989aad6f99fa637ae4cf986cd0e02979d Mon Sep 17 00:00:00 2001
From: Petr Pavlu <petr.pavlu@suse.com>
Date: Tue, 5 Dec 2023 17:17:34 +0100
Subject: [PATCH 0878/1043] tracing: Fix incomplete locking when disabling
 buffered events

commit 7fed14f7ac9cf5e38c693836fe4a874720141845 upstream.

The following warning appears when using buffered events:

[  203.556451] WARNING: CPU: 53 PID: 10220 at kernel/trace/ring_buffer.c:3912 ring_buffer_discard_commit+0x2eb/0x420
[...]
[  203.670690] CPU: 53 PID: 10220 Comm: stress-ng-sysin Tainted: G            E      6.7.0-rc2-default #4 56e6d0fcf5581e6e51eaaecbdaec2a2338c80f3a
[  203.670704] Hardware name: Intel Corp. GROVEPORT/GROVEPORT, BIOS GVPRCRB1.86B.0016.D04.1705030402 05/03/2017
[  203.670709] RIP: 0010:ring_buffer_discard_commit+0x2eb/0x420
[  203.735721] Code: 4c 8b 4a 50 48 8b 42 48 49 39 c1 0f 84 b3 00 00 00 49 83 e8 01 75 b1 48 8b 42 10 f0 ff 40 08 0f 0b e9 fc fe ff ff f0 ff 47 08 <0f> 0b e9 77 fd ff ff 48 8b 42 10 f0 ff 40 08 0f 0b e9 f5 fe ff ff
[  203.735734] RSP: 0018:ffffb4ae4f7b7d80 EFLAGS: 00010202
[  203.735745] RAX: 0000000000000000 RBX: ffffb4ae4f7b7de0 RCX: ffff8ac10662c000
[  203.735754] RDX: ffff8ac0c750be00 RSI: ffff8ac10662c000 RDI: ffff8ac0c004d400
[  203.781832] RBP: ffff8ac0c039cea0 R08: 0000000000000000 R09: 0000000000000000
[  203.781839] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[  203.781842] R13: ffff8ac10662c000 R14: ffff8ac0c004d400 R15: ffff8ac10662c008
[  203.781846] FS:  00007f4cd8a67740(0000) GS:ffff8ad798880000(0000) knlGS:0000000000000000
[  203.781851] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  203.781855] CR2: 0000559766a74028 CR3: 00000001804c4000 CR4: 00000000001506f0
[  203.781862] Call Trace:
[  203.781870]  <TASK>
[  203.851949]  trace_event_buffer_commit+0x1ea/0x250
[  203.851967]  trace_event_raw_event_sys_enter+0x83/0xe0
[  203.851983]  syscall_trace_enter.isra.0+0x182/0x1a0
[  203.851990]  do_syscall_64+0x3a/0xe0
[  203.852075]  entry_SYSCALL_64_after_hwframe+0x6e/0x76
[  203.852090] RIP: 0033:0x7f4cd870fa77
[  203.982920] Code: 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 b8 89 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e9 43 0e 00 f7 d8 64 89 01 48
[  203.982932] RSP: 002b:00007fff99717dd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000089
[  203.982942] RAX: ffffffffffffffda RBX: 0000558ea1d7b6f0 RCX: 00007f4cd870fa77
[  203.982948] RDX: 0000000000000000 RSI: 00007fff99717de0 RDI: 0000558ea1d7b6f0
[  203.982957] RBP: 00007fff99717de0 R08: 00007fff997180e0 R09: 00007fff997180e0
[  203.982962] R10: 00007fff997180e0 R11: 0000000000000246 R12: 00007fff99717f40
[  204.049239] R13: 00007fff99718590 R14: 0000558e9f2127a8 R15: 00007fff997180b0
[  204.049256]  </TASK>

For instance, it can be triggered by running these two commands in
parallel:

 $ while true; do
    echo hist:key=id.syscall:val=hitcount > \
      /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger;
  done
 $ stress-ng --sysinfo $(nproc)

The warning indicates that the current ring_buffer_per_cpu is not in the
committing state. It happens because the active ring_buffer_event
doesn't actually come from the ring_buffer_per_cpu but is allocated from
trace_buffered_event.

The bug is in function trace_buffered_event_disable() where the
following normally happens:

* The code invokes disable_trace_buffered_event() via
  smp_call_function_many() and follows it by synchronize_rcu(). This
  increments the per-CPU variable trace_buffered_event_cnt on each
  target CPU and grants trace_buffered_event_disable() the exclusive
  access to the per-CPU variable trace_buffered_event.

* Maintenance is performed on trace_buffered_event, all per-CPU event
  buffers get freed.

* The code invokes enable_trace_buffered_event() via
  smp_call_function_many(). This decrements trace_buffered_event_cnt and
  releases the access to trace_buffered_event.

A problem is that smp_call_function_many() runs a given function on all
target CPUs except on the current one. The following can then occur:

* Task X executing trace_buffered_event_disable() runs on CPU 0.

* The control reaches synchronize_rcu() and the task gets rescheduled on
  another CPU 1.

* The RCU synchronization finishes. At this point,
  trace_buffered_event_disable() has the exclusive access to all
  trace_buffered_event variables except trace_buffered_event[CPU0]
  because trace_buffered_event_cnt[CPU0] is never incremented and if the
  buffer is currently unused, remains set to 0.

* A different task Y is scheduled on CPU 0 and hits a trace event. The
  code in trace_event_buffer_lock_reserve() sees that
  trace_buffered_event_cnt[CPU0] is set to 0 and decides the use the
  buffer provided by trace_buffered_event[CPU0].

* Task X continues its execution in trace_buffered_event_disable(). The
  code incorrectly frees the event buffer pointed by
  trace_buffered_event[CPU0] and resets the variable to NULL.

* Task Y writes event data to the now freed buffer and later detects the
  created inconsistency.

The issue is observable since commit dea499781a11 ("tracing: Fix warning
in trace_buffered_event_disable()") which moved the call of
trace_buffered_event_disable() in __ftrace_event_enable_disable()
earlier, prior to invoking call->class->reg(.. TRACE_REG_UNREGISTER ..).
The underlying problem in trace_buffered_event_disable() is however
present since the original implementation in commit 0fc1b09ff1ff
("tracing: Use temp buffer when filtering events").

Fix the problem by replacing the two smp_call_function_many() calls with
on_each_cpu_mask() which invokes a given callback on all CPUs.

Link: https://lore.kernel.org/all/20231127151248.7232-2-petr.pavlu@suse.com/
Link: https://lkml.kernel.org/r/20231205161736.19663-2-petr.pavlu@suse.com

Cc: stable@vger.kernel.org
Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events")
Fixes: dea499781a11 ("tracing: Fix warning in trace_buffered_event_disable()")
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index cac15b3a6af0..a13718126a4d 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2697,11 +2697,9 @@ void trace_buffered_event_disable(void)
 	if (--trace_buffered_event_ref)
 		return;
 
-	preempt_disable();
 	/* For each CPU, set the buffer as used. */
-	smp_call_function_many(tracing_buffer_mask,
-			       disable_trace_buffered_event, NULL, 1);
-	preempt_enable();
+	on_each_cpu_mask(tracing_buffer_mask, disable_trace_buffered_event,
+			 NULL, true);
 
 	/* Wait for all current users to finish */
 	synchronize_rcu();
@@ -2716,11 +2714,9 @@ void trace_buffered_event_disable(void)
 	 */
 	smp_wmb();
 
-	preempt_disable();
 	/* Do the work on each cpu */
-	smp_call_function_many(tracing_buffer_mask,
-			       enable_trace_buffered_event, NULL, 1);
-	preempt_enable();
+	on_each_cpu_mask(tracing_buffer_mask, enable_trace_buffered_event, NULL,
+			 true);
 }
 
 static struct trace_buffer *temp_buffer;

From 0d0564cfb746abff4c57a2d78788b0aaf8c4cb63 Mon Sep 17 00:00:00 2001
From: Petr Pavlu <petr.pavlu@suse.com>
Date: Tue, 5 Dec 2023 17:17:36 +0100
Subject: [PATCH 0879/1043] tracing: Fix a possible race when disabling
 buffered events

commit c0591b1cccf708a47bc465c62436d669a4213323 upstream.

Function trace_buffered_event_disable() is responsible for freeing pages
backing buffered events and this process can run concurrently with
trace_event_buffer_lock_reserve().

The following race is currently possible:

* Function trace_buffered_event_disable() is called on CPU 0. It
  increments trace_buffered_event_cnt on each CPU and waits via
  synchronize_rcu() for each user of trace_buffered_event to complete.

* After synchronize_rcu() is finished, function
  trace_buffered_event_disable() has the exclusive access to
  trace_buffered_event. All counters trace_buffered_event_cnt are at 1
  and all pointers trace_buffered_event are still valid.

* At this point, on a different CPU 1, the execution reaches
  trace_event_buffer_lock_reserve(). The function calls
  preempt_disable_notrace() and only now enters an RCU read-side
  critical section. The function proceeds and reads a still valid
  pointer from trace_buffered_event[CPU1] into the local variable
  "entry". However, it doesn't yet read trace_buffered_event_cnt[CPU1]
  which happens later.

* Function trace_buffered_event_disable() continues. It frees
  trace_buffered_event[CPU1] and decrements
  trace_buffered_event_cnt[CPU1] back to 0.

* Function trace_event_buffer_lock_reserve() continues. It reads and
  increments trace_buffered_event_cnt[CPU1] from 0 to 1. This makes it
  believe that it can use the "entry" that it already obtained but the
  pointer is now invalid and any access results in a use-after-free.

Fix the problem by making a second synchronize_rcu() call after all
trace_buffered_event values are set to NULL. This waits on all potential
users in trace_event_buffer_lock_reserve() that still read a previous
pointer from trace_buffered_event.

Link: https://lore.kernel.org/all/20231127151248.7232-2-petr.pavlu@suse.com/
Link: https://lkml.kernel.org/r/20231205161736.19663-4-petr.pavlu@suse.com

Cc: stable@vger.kernel.org
Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events")
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index a13718126a4d..adabf4f0b081 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2708,13 +2708,17 @@ void trace_buffered_event_disable(void)
 		free_page((unsigned long)per_cpu(trace_buffered_event, cpu));
 		per_cpu(trace_buffered_event, cpu) = NULL;
 	}
-	/*
-	 * Make sure trace_buffered_event is NULL before clearing
-	 * trace_buffered_event_cnt.
-	 */
-	smp_wmb();
 
-	/* Do the work on each cpu */
+	/*
+	 * Wait for all CPUs that potentially started checking if they can use
+	 * their event buffer only after the previous synchronize_rcu() call and
+	 * they still read a valid pointer from trace_buffered_event. It must be
+	 * ensured they don't see cleared trace_buffered_event_cnt else they
+	 * could wrongly decide to use the pointed-to buffer which is now freed.
+	 */
+	synchronize_rcu();
+
+	/* For each CPU, relinquish the buffer */
 	on_each_cpu_mask(tracing_buffer_mask, enable_trace_buffered_event, NULL,
 			 true);
 }

From 9bceffa42320c863e5b5a0b80eb2a2baf6e97ec4 Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Fri, 1 Dec 2023 14:10:21 +0100
Subject: [PATCH 0880/1043] packet: Move reference count in packet_sock to
 atomic_long_t

commit db3fadacaf0c817b222090290d06ca2a338422d0 upstream.

In some potential instances the reference count on struct packet_sock
could be saturated and cause overflows which gets the kernel a bit
confused. To prevent this, move to a 64-bit atomic reference count on
64-bit architectures to prevent the possibility of this type to overflow.

Because we can not handle saturation, using refcount_t is not possible
in this place. Maybe someday in the future if it changes it could be
used. Also, instead of using plain atomic64_t, use atomic_long_t instead.
32-bit machines tend to be memory-limited (i.e. anything that increases
a reference uses so much memory that you can't actually get to 2**32
references). 32-bit architectures also tend to have serious problems
with 64-bit atomics. Hence, atomic_long_t is the more natural solution.

Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk>
Co-developed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@kernel.org
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20231201131021.19999-1-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/packet/af_packet.c | 16 ++++++++--------
 net/packet/internal.h  |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index bbdb32acac32..b292d58fdcc4 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4248,7 +4248,7 @@ static void packet_mm_open(struct vm_area_struct *vma)
 	struct sock *sk = sock->sk;
 
 	if (sk)
-		atomic_inc(&pkt_sk(sk)->mapped);
+		atomic_long_inc(&pkt_sk(sk)->mapped);
 }
 
 static void packet_mm_close(struct vm_area_struct *vma)
@@ -4258,7 +4258,7 @@ static void packet_mm_close(struct vm_area_struct *vma)
 	struct sock *sk = sock->sk;
 
 	if (sk)
-		atomic_dec(&pkt_sk(sk)->mapped);
+		atomic_long_dec(&pkt_sk(sk)->mapped);
 }
 
 static const struct vm_operations_struct packet_mmap_ops = {
@@ -4353,7 +4353,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
 
 	err = -EBUSY;
 	if (!closing) {
-		if (atomic_read(&po->mapped))
+		if (atomic_long_read(&po->mapped))
 			goto out;
 		if (packet_read_pending(rb))
 			goto out;
@@ -4456,7 +4456,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
 
 	err = -EBUSY;
 	mutex_lock(&po->pg_vec_lock);
-	if (closing || atomic_read(&po->mapped) == 0) {
+	if (closing || atomic_long_read(&po->mapped) == 0) {
 		err = 0;
 		spin_lock_bh(&rb_queue->lock);
 		swap(rb->pg_vec, pg_vec);
@@ -4474,9 +4474,9 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
 		po->prot_hook.func = (po->rx_ring.pg_vec) ?
 						tpacket_rcv : packet_rcv;
 		skb_queue_purge(rb_queue);
-		if (atomic_read(&po->mapped))
-			pr_err("packet_mmap: vma is busy: %d\n",
-			       atomic_read(&po->mapped));
+		if (atomic_long_read(&po->mapped))
+			pr_err("packet_mmap: vma is busy: %ld\n",
+			       atomic_long_read(&po->mapped));
 	}
 	mutex_unlock(&po->pg_vec_lock);
 
@@ -4554,7 +4554,7 @@ static int packet_mmap(struct file *file, struct socket *sock,
 		}
 	}
 
-	atomic_inc(&po->mapped);
+	atomic_long_inc(&po->mapped);
 	vma->vm_ops = &packet_mmap_ops;
 	err = 0;
 
diff --git a/net/packet/internal.h b/net/packet/internal.h
index 3938cb413d5d..69e58cb74492 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -126,7 +126,7 @@ struct packet_sock {
 	__be16			num;
 	struct packet_rollover	*rollover;
 	struct packet_mclist	*mclist;
-	atomic_t		mapped;
+	atomic_long_t		mapped;
 	enum tpacket_versions	tp_version;
 	unsigned int		tp_hdrlen;
 	unsigned int		tp_reserve;

From 0a9f3e1f570fceb537091e736830d802c767c9a5 Mon Sep 17 00:00:00 2001
From: Eugen Hristev <eugen.hristev@collabora.com>
Date: Mon, 14 Aug 2023 09:50:42 +0300
Subject: [PATCH 0881/1043] arm64: dts: mediatek: mt7622: fix memory node
 warning check

commit 8e6ecbfd44b5542a7598c1c5fc9c6dcb5d367f2a upstream.

dtbs_check throws a warning at the memory node:
Warning (unit_address_vs_reg): /memory: node has a reg or ranges property, but no unit name

fix by adding the address into the node name.

Cc: stable@vger.kernel.org
Fixes: 0b6286dd96c0 ("arm64: dts: mt7622: add bananapi BPI-R64 board")
Signed-off-by: Eugen Hristev <eugen.hristev@collabora.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20230814065042.4973-1-eugen.hristev@collabora.com
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 2 +-
 arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
index 3053f484c8cc..7e6cffdc5a55 100644
--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
@@ -69,7 +69,7 @@ red {
 		};
 	};
 
-	memory {
+	memory@40000000 {
 		reg = <0 0x40000000 0 0x40000000>;
 	};
 
diff --git a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
index 08ad0ffb24df..993f033d0bf0 100644
--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
@@ -55,7 +55,7 @@ wps {
 		};
 	};
 
-	memory {
+	memory@40000000 {
 		reg = <0 0x40000000 0 0x20000000>;
 	};
 

From 7f6daf9ee3e78b10349528dfa42145cd26cd5383 Mon Sep 17 00:00:00 2001
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Date: Wed, 25 Oct 2023 11:38:15 +0200
Subject: [PATCH 0882/1043] arm64: dts: mediatek: mt8173-evb: Fix
 regulator-fixed node names

commit 24165c5dad7ba7c7624d05575a5e0cc851396c71 upstream.

Fix a unit_address_vs_reg warning for the USB VBUS fixed regulators
by renaming the regulator nodes from regulator@{0,1} to regulator-usb-p0
and regulator-usb-p1.

Cc: stable@vger.kernel.org
Fixes: c0891284a74a ("arm64: dts: mediatek: add USB3 DRD driver")
Link: https://lore.kernel.org/r/20231025093816.44327-8-angelogioacchino.delregno@collabora.com
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
index 6dffada2e66b..2b66afcf026e 100644
--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
@@ -43,7 +43,7 @@ extcon_usb: extcon_iddig {
 		id-gpio = <&pio 16 GPIO_ACTIVE_HIGH>;
 	};
 
-	usb_p1_vbus: regulator@0 {
+	usb_p1_vbus: regulator-usb-p1 {
 		compatible = "regulator-fixed";
 		regulator-name = "usb_vbus";
 		regulator-min-microvolt = <5000000>;
@@ -52,7 +52,7 @@ usb_p1_vbus: regulator@0 {
 		enable-active-high;
 	};
 
-	usb_p0_vbus: regulator@1 {
+	usb_p0_vbus: regulator-usb-p0 {
 		compatible = "regulator-fixed";
 		regulator-name = "vbus";
 		regulator-min-microvolt = <5000000>;

From 3cd3eea1f745bf7cda780f71f357707c4ef40877 Mon Sep 17 00:00:00 2001
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Date: Wed, 25 Oct 2023 11:38:13 +0200
Subject: [PATCH 0883/1043] arm64: dts: mediatek: mt8183: Fix unit address for
 scp reserved memory

commit 19cba9a6c071db57888dc6b2ec1d9bf8996ea681 upstream.

The reserved memory for scp had node name "scp_mem_region" and also
without unit-address: change the name to "memory@(address)".
This fixes a unit_address_vs_reg warning.

Cc: stable@vger.kernel.org
Fixes: 1652dbf7363a ("arm64: dts: mt8183: add scp node")
Link: https://lore.kernel.org/r/20231025093816.44327-6-angelogioacchino.delregno@collabora.com
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/boot/dts/mediatek/mt8183-evb.dts    | 2 +-
 arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt8183-evb.dts b/arch/arm64/boot/dts/mediatek/mt8183-evb.dts
index cba2d8933e79..1d2d2e7239a3 100644
--- a/arch/arm64/boot/dts/mediatek/mt8183-evb.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8183-evb.dts
@@ -30,7 +30,7 @@ reserved-memory {
 		#address-cells = <2>;
 		#size-cells = <2>;
 		ranges;
-		scp_mem_reserved: scp_mem_region {
+		scp_mem_reserved: memory@50000000 {
 			compatible = "shared-dma-pool";
 			reg = <0 0x50000000 0 0x2900000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
index 85f7c33ba446..a4f860bb4a84 100644
--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
@@ -95,7 +95,7 @@ reserved_memory: reserved-memory {
 		#size-cells = <2>;
 		ranges;
 
-		scp_mem_reserved: scp_mem_region {
+		scp_mem_reserved: memory@50000000 {
 			compatible = "shared-dma-pool";
 			reg = <0 0x50000000 0 0x2900000>;
 			no-map;

From ee2719b59fb437240295538f282d9c9022c1bd74 Mon Sep 17 00:00:00 2001
From: Su Hui <suhui@nfschina.com>
Date: Mon, 20 Nov 2023 17:55:23 +0800
Subject: [PATCH 0884/1043] misc: mei: client.c: return negative error code in
 mei_cl_write

[ Upstream commit 8f06aee8089cf42fd99a20184501bd1347ce61b9 ]

mei_msg_hdr_init() return negative error code, rets should be
'PTR_ERR(mei_hdr)' rather than '-PTR_ERR(mei_hdr)'.

Fixes: 0cd7c01a60f8 ("mei: add support for mei extended header.")
Signed-off-by: Su Hui <suhui@nfschina.com>
Link: https://lore.kernel.org/r/20231120095523.178385-1-suhui@nfschina.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/mei/client.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index d5c3f7d54634..1c9ced7383b6 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -1969,7 +1969,7 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb)
 
 	mei_hdr = mei_msg_hdr_init(cb);
 	if (IS_ERR(mei_hdr)) {
-		rets = -PTR_ERR(mei_hdr);
+		rets = PTR_ERR(mei_hdr);
 		mei_hdr = NULL;
 		goto err;
 	}

From bceeaa5cdace450de7f7575ce942303a20c35526 Mon Sep 17 00:00:00 2001
From: Su Hui <suhui@nfschina.com>
Date: Mon, 20 Nov 2023 17:55:26 +0800
Subject: [PATCH 0885/1043] misc: mei: client.c: fix problem of return
 '-EOVERFLOW' in mei_cl_write

[ Upstream commit ee6236027218f8531916f1c5caa5dc330379f287 ]

Clang static analyzer complains that value stored to 'rets' is never
read.Let 'buf_len = -EOVERFLOW' to make sure we can return '-EOVERFLOW'.

Fixes: 8c8d964ce90f ("mei: move hbuf_depth from the mei device to the hw modules")
Signed-off-by: Su Hui <suhui@nfschina.com>
Link: https://lore.kernel.org/r/20231120095523.178385-2-suhui@nfschina.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/mei/client.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 1c9ced7383b6..aa87542f116c 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -1993,7 +1993,7 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb)
 
 	hbuf_slots = mei_hbuf_empty_slots(dev);
 	if (hbuf_slots < 0) {
-		rets = -EOVERFLOW;
+		buf_len = -EOVERFLOW;
 		goto out;
 	}
 

From 7123b54c8b5f6e3a816a1d2b8fda468f5c1ab6d7 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Date: Wed, 6 Dec 2023 10:02:44 -0500
Subject: [PATCH 0886/1043] ring-buffer: Force absolute timestamp on discard of
 event

[ Upstream commit b2dd797543cfa6580eac8408dd67fa02164d9e56 ]

There's a race where if an event is discarded from the ring buffer and an
interrupt were to happen at that time and insert an event, the time stamp
is still used from the discarded event as an offset. This can screw up the
timings.

If the event is going to be discarded, set the "before_stamp" to zero.
When a new event comes in, it compares the "before_stamp" with the
"write_stamp" and if they are not equal, it will insert an absolute
timestamp. This will prevent the timings from getting out of sync due to
the discarded event.

Link: https://lore.kernel.org/linux-trace-kernel/20231206100244.5130f9b3@gandalf.local.home

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Fixes: 6f6be606e763f ("ring-buffer: Force before_stamp and write_stamp to be different on discard")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/ring_buffer.c | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 0938222b4598..7e1148aafd28 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2903,22 +2903,19 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
 			local_read(&bpage->write) & ~RB_WRITE_MASK;
 		unsigned long event_length = rb_event_length(event);
 
+		/*
+		 * For the before_stamp to be different than the write_stamp
+		 * to make sure that the next event adds an absolute
+		 * value and does not rely on the saved write stamp, which
+		 * is now going to be bogus.
+		 */
+		rb_time_set(&cpu_buffer->before_stamp, 0);
+
 		/* Something came in, can't discard */
 		if (!rb_time_cmpxchg(&cpu_buffer->write_stamp,
 				       write_stamp, write_stamp - delta))
 			return 0;
 
-		/*
-		 * It's possible that the event time delta is zero
-		 * (has the same time stamp as the previous event)
-		 * in which case write_stamp and before_stamp could
-		 * be the same. In such a case, force before_stamp
-		 * to be different than write_stamp. It doesn't
-		 * matter what it is, as long as its different.
-		 */
-		if (!delta)
-			rb_time_set(&cpu_buffer->before_stamp, 0);
-
 		/*
 		 * If an event were to come in now, it would see that the
 		 * write_stamp and the before_stamp are different, and assume

From 21beb0d86ff061f9b1fb9d7cb4697a529ebabc7e Mon Sep 17 00:00:00 2001
From: Zheng Yejian <zhengyejian1@huawei.com>
Date: Wed, 5 Jul 2023 08:27:05 +0800
Subject: [PATCH 0887/1043] tracing: Set actual size after ring buffer resize

[ Upstream commit 6d98a0f2ac3c021d21be66fa34e992137cd25bcb ]

Currently we can resize trace ringbuffer by writing a value into file
'buffer_size_kb', then by reading the file, we get the value that is
usually what we wrote. However, this value may be not actual size of
trace ring buffer because of the round up when doing resize in kernel,
and the actual size would be more useful.

Link: https://lore.kernel.org/linux-trace-kernel/20230705002705.576633-1-zhengyejian1@huawei.com

Cc: <mhiramat@kernel.org>
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Stable-dep-of: d78ab792705c ("tracing: Stop current tracer when resizing buffer")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index adabf4f0b081..2c9769e1f765 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -5852,6 +5852,15 @@ static void set_buffer_entries(struct array_buffer *buf, unsigned long val)
 		per_cpu_ptr(buf->data, cpu)->entries = val;
 }
 
+static void update_buffer_entries(struct array_buffer *buf, int cpu)
+{
+	if (cpu == RING_BUFFER_ALL_CPUS) {
+		set_buffer_entries(buf, ring_buffer_size(buf->buffer, 0));
+	} else {
+		per_cpu_ptr(buf->data, cpu)->entries = ring_buffer_size(buf->buffer, cpu);
+	}
+}
+
 #ifdef CONFIG_TRACER_MAX_TRACE
 /* resize @tr's buffer to the size of @size_tr's entries */
 static int resize_buffer_duplicate_size(struct array_buffer *trace_buf,
@@ -5929,18 +5938,12 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
 		return ret;
 	}
 
-	if (cpu == RING_BUFFER_ALL_CPUS)
-		set_buffer_entries(&tr->max_buffer, size);
-	else
-		per_cpu_ptr(tr->max_buffer.data, cpu)->entries = size;
+	update_buffer_entries(&tr->max_buffer, cpu);
 
  out:
 #endif /* CONFIG_TRACER_MAX_TRACE */
 
-	if (cpu == RING_BUFFER_ALL_CPUS)
-		set_buffer_entries(&tr->array_buffer, size);
-	else
-		per_cpu_ptr(tr->array_buffer.data, cpu)->entries = size;
+	update_buffer_entries(&tr->array_buffer, cpu);
 
 	return ret;
 }

From f460ff26bd99722cc108fcecb95bca3adeeb1eb1 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Date: Tue, 5 Dec 2023 16:52:10 -0500
Subject: [PATCH 0888/1043] tracing: Stop current tracer when resizing buffer

[ Upstream commit d78ab792705c7be1b91243b2544d1a79406a2ad7 ]

When the ring buffer is being resized, it can cause side effects to the
running tracer. For instance, there's a race with irqsoff tracer that
swaps individual per cpu buffers between the main buffer and the snapshot
buffer. The resize operation modifies the main buffer and then the
snapshot buffer. If a swap happens in between those two operations it will
break the tracer.

Simply stop the running tracer before resizing the buffers and enable it
again when finished.

Link: https://lkml.kernel.org/r/20231205220010.748996423@goodmis.org

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Fixes: 3928a8a2d9808 ("ftrace: make work with new ring buffer")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 2c9769e1f765..4e0411b19ef9 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -5905,9 +5905,12 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
 	if (!tr->array_buffer.buffer)
 		return 0;
 
+	/* Do not allow tracing while resizng ring buffer */
+	tracing_stop_tr(tr);
+
 	ret = ring_buffer_resize(tr->array_buffer.buffer, size, cpu);
 	if (ret < 0)
-		return ret;
+		goto out_start;
 
 #ifdef CONFIG_TRACER_MAX_TRACE
 	if (!tr->current_trace->use_max_tr)
@@ -5935,7 +5938,7 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
 			WARN_ON(1);
 			tracing_disabled = 1;
 		}
-		return ret;
+		goto out_start;
 	}
 
 	update_buffer_entries(&tr->max_buffer, cpu);
@@ -5944,7 +5947,8 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
 #endif /* CONFIG_TRACER_MAX_TRACE */
 
 	update_buffer_entries(&tr->array_buffer, cpu);
-
+ out_start:
+	tracing_start_tr(tr);
 	return ret;
 }
 

From 8bd3d61624d503ebe8b8469021a03bef359f89de Mon Sep 17 00:00:00 2001
From: Namhyung Kim <namhyung@kernel.org>
Date: Thu, 16 Jun 2022 11:06:23 -0700
Subject: [PATCH 0889/1043] perf/core: Add a new read format to get a number of
 lost samples

[ Upstream commit 119a784c81270eb88e573174ed2209225d646656 ]

Sometimes we want to know an accurate number of samples even if it's
lost.  Currenlty PERF_RECORD_LOST is generated for a ring-buffer which
might be shared with other events.  So it's hard to know per-event
lost count.

Add event->lost_samples field and PERF_FORMAT_LOST to retrieve it from
userspace.

Original-patch-by: Jiri Olsa <jolsa@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20220616180623.1358843-1-namhyung@kernel.org
Stable-dep-of: 382c27f4ed28 ("perf: Fix perf_event_validate_size()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/perf_event.h      |  2 ++
 include/uapi/linux/perf_event.h |  5 ++++-
 kernel/events/core.c            | 21 ++++++++++++++++++---
 kernel/events/ring_buffer.c     |  5 ++++-
 4 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 50557d903a05..3b038a2cc007 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -744,6 +744,8 @@ struct perf_event {
 	struct pid_namespace		*ns;
 	u64				id;
 
+	atomic64_t			lost_samples;
+
 	u64				(*clock)(void);
 	perf_overflow_handler_t		overflow_handler;
 	void				*overflow_handler_context;
diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
index b95d3c485d27..6ca63ab6bee5 100644
--- a/include/uapi/linux/perf_event.h
+++ b/include/uapi/linux/perf_event.h
@@ -279,6 +279,7 @@ enum {
  *	  { u64		time_enabled; } && PERF_FORMAT_TOTAL_TIME_ENABLED
  *	  { u64		time_running; } && PERF_FORMAT_TOTAL_TIME_RUNNING
  *	  { u64		id;           } && PERF_FORMAT_ID
+ *	  { u64		lost;         } && PERF_FORMAT_LOST
  *	} && !PERF_FORMAT_GROUP
  *
  *	{ u64		nr;
@@ -286,6 +287,7 @@ enum {
  *	  { u64		time_running; } && PERF_FORMAT_TOTAL_TIME_RUNNING
  *	  { u64		value;
  *	    { u64	id;           } && PERF_FORMAT_ID
+ *	    { u64	lost;         } && PERF_FORMAT_LOST
  *	  }		cntr[nr];
  *	} && PERF_FORMAT_GROUP
  * };
@@ -295,8 +297,9 @@ enum perf_event_read_format {
 	PERF_FORMAT_TOTAL_TIME_RUNNING		= 1U << 1,
 	PERF_FORMAT_ID				= 1U << 2,
 	PERF_FORMAT_GROUP			= 1U << 3,
+	PERF_FORMAT_LOST			= 1U << 4,
 
-	PERF_FORMAT_MAX = 1U << 4,		/* non-ABI */
+	PERF_FORMAT_MAX = 1U << 5,		/* non-ABI */
 };
 
 #define PERF_ATTR_SIZE_VER0	64	/* sizeof first published struct */
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 5072635f0b0c..f7ac1b24f93e 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1927,6 +1927,9 @@ static void __perf_event_read_size(struct perf_event *event, int nr_siblings)
 	if (event->attr.read_format & PERF_FORMAT_ID)
 		entry += sizeof(u64);
 
+	if (event->attr.read_format & PERF_FORMAT_LOST)
+		entry += sizeof(u64);
+
 	if (event->attr.read_format & PERF_FORMAT_GROUP) {
 		nr += nr_siblings;
 		size += sizeof(u64);
@@ -5283,11 +5286,15 @@ static int __perf_read_group_add(struct perf_event *leader,
 	values[n++] += perf_event_count(leader);
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(leader);
+	if (read_format & PERF_FORMAT_LOST)
+		values[n++] = atomic64_read(&leader->lost_samples);
 
 	for_each_sibling_event(sub, leader) {
 		values[n++] += perf_event_count(sub);
 		if (read_format & PERF_FORMAT_ID)
 			values[n++] = primary_event_id(sub);
+		if (read_format & PERF_FORMAT_LOST)
+			values[n++] = atomic64_read(&sub->lost_samples);
 	}
 
 unlock:
@@ -5341,7 +5348,7 @@ static int perf_read_one(struct perf_event *event,
 				 u64 read_format, char __user *buf)
 {
 	u64 enabled, running;
-	u64 values[4];
+	u64 values[5];
 	int n = 0;
 
 	values[n++] = __perf_event_read_value(event, &enabled, &running);
@@ -5351,6 +5358,8 @@ static int perf_read_one(struct perf_event *event,
 		values[n++] = running;
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(event);
+	if (read_format & PERF_FORMAT_LOST)
+		values[n++] = atomic64_read(&event->lost_samples);
 
 	if (copy_to_user(buf, values, n * sizeof(u64)))
 		return -EFAULT;
@@ -6830,7 +6839,7 @@ static void perf_output_read_one(struct perf_output_handle *handle,
 				 u64 enabled, u64 running)
 {
 	u64 read_format = event->attr.read_format;
-	u64 values[4];
+	u64 values[5];
 	int n = 0;
 
 	values[n++] = perf_event_count(event);
@@ -6844,6 +6853,8 @@ static void perf_output_read_one(struct perf_output_handle *handle,
 	}
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(event);
+	if (read_format & PERF_FORMAT_LOST)
+		values[n++] = atomic64_read(&event->lost_samples);
 
 	__output_copy(handle, values, n * sizeof(u64));
 }
@@ -6854,7 +6865,7 @@ static void perf_output_read_group(struct perf_output_handle *handle,
 {
 	struct perf_event *leader = event->group_leader, *sub;
 	u64 read_format = event->attr.read_format;
-	u64 values[5];
+	u64 values[6];
 	int n = 0;
 
 	values[n++] = 1 + leader->nr_siblings;
@@ -6872,6 +6883,8 @@ static void perf_output_read_group(struct perf_output_handle *handle,
 	values[n++] = perf_event_count(leader);
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(leader);
+	if (read_format & PERF_FORMAT_LOST)
+		values[n++] = atomic64_read(&leader->lost_samples);
 
 	__output_copy(handle, values, n * sizeof(u64));
 
@@ -6885,6 +6898,8 @@ static void perf_output_read_group(struct perf_output_handle *handle,
 		values[n++] = perf_event_count(sub);
 		if (read_format & PERF_FORMAT_ID)
 			values[n++] = primary_event_id(sub);
+		if (read_format & PERF_FORMAT_LOST)
+			values[n++] = atomic64_read(&sub->lost_samples);
 
 		__output_copy(handle, values, n * sizeof(u64));
 	}
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 01351e7e2543..ca27946fdaaf 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -172,8 +172,10 @@ __perf_output_begin(struct perf_output_handle *handle,
 		goto out;
 
 	if (unlikely(rb->paused)) {
-		if (rb->nr_pages)
+		if (rb->nr_pages) {
 			local_inc(&rb->lost);
+			atomic64_inc(&event->lost_samples);
+		}
 		goto out;
 	}
 
@@ -254,6 +256,7 @@ __perf_output_begin(struct perf_output_handle *handle,
 
 fail:
 	local_inc(&rb->lost);
+	atomic64_inc(&event->lost_samples);
 	perf_output_put_handle(handle);
 out:
 	rcu_read_unlock();

From 208dd116f96ea19e5d38d7b80fce49bc5ce1bbe8 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Wed, 29 Nov 2023 15:24:52 +0100
Subject: [PATCH 0890/1043] perf: Fix perf_event_validate_size()

[ Upstream commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b ]

Budimir noted that perf_event_validate_size() only checks the size of
the newly added event, even though the sizes of all existing events
can also change due to not all events having the same read_format.

When we attach the new event, perf_group_attach(), we do re-compute
the size for all events.

Fixes: a723968c0ed3 ("perf: Fix u16 overflows")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/events/core.c | 61 +++++++++++++++++++++++++++-----------------
 1 file changed, 38 insertions(+), 23 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index f7ac1b24f93e..0a6855d64803 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1912,31 +1912,34 @@ static inline void perf_event__state_init(struct perf_event *event)
 					      PERF_EVENT_STATE_INACTIVE;
 }
 
-static void __perf_event_read_size(struct perf_event *event, int nr_siblings)
+static int __perf_event_read_size(u64 read_format, int nr_siblings)
 {
 	int entry = sizeof(u64); /* value */
 	int size = 0;
 	int nr = 1;
 
-	if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
+	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
 		size += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
+	if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
 		size += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_ID)
+	if (read_format & PERF_FORMAT_ID)
 		entry += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_LOST)
+	if (read_format & PERF_FORMAT_LOST)
 		entry += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_GROUP) {
+	if (read_format & PERF_FORMAT_GROUP) {
 		nr += nr_siblings;
 		size += sizeof(u64);
 	}
 
-	size += entry * nr;
-	event->read_size = size;
+	/*
+	 * Since perf_event_validate_size() limits this to 16k and inhibits
+	 * adding more siblings, this will never overflow.
+	 */
+	return size + nr * entry;
 }
 
 static void __perf_event_header_size(struct perf_event *event, u64 sample_type)
@@ -1980,8 +1983,9 @@ static void __perf_event_header_size(struct perf_event *event, u64 sample_type)
  */
 static void perf_event__header_size(struct perf_event *event)
 {
-	__perf_event_read_size(event,
-			       event->group_leader->nr_siblings);
+	event->read_size =
+		__perf_event_read_size(event->attr.read_format,
+				       event->group_leader->nr_siblings);
 	__perf_event_header_size(event, event->attr.sample_type);
 }
 
@@ -2012,24 +2016,35 @@ static void perf_event__id_header_size(struct perf_event *event)
 	event->id_header_size = size;
 }
 
+/*
+ * Check that adding an event to the group does not result in anybody
+ * overflowing the 64k event limit imposed by the output buffer.
+ *
+ * Specifically, check that the read_size for the event does not exceed 16k,
+ * read_size being the one term that grows with groups size. Since read_size
+ * depends on per-event read_format, also (re)check the existing events.
+ *
+ * This leaves 48k for the constant size fields and things like callchains,
+ * branch stacks and register sets.
+ */
 static bool perf_event_validate_size(struct perf_event *event)
 {
-	/*
-	 * The values computed here will be over-written when we actually
-	 * attach the event.
-	 */
-	__perf_event_read_size(event, event->group_leader->nr_siblings + 1);
-	__perf_event_header_size(event, event->attr.sample_type & ~PERF_SAMPLE_READ);
-	perf_event__id_header_size(event);
+	struct perf_event *sibling, *group_leader = event->group_leader;
 
-	/*
-	 * Sum the lot; should not exceed the 64k limit we have on records.
-	 * Conservative limit to allow for callchains and other variable fields.
-	 */
-	if (event->read_size + event->header_size +
-	    event->id_header_size + sizeof(struct perf_event_header) >= 16*1024)
+	if (__perf_event_read_size(event->attr.read_format,
+				   group_leader->nr_siblings + 1) > 16*1024)
 		return false;
 
+	if (__perf_event_read_size(group_leader->attr.read_format,
+				   group_leader->nr_siblings + 1) > 16*1024)
+		return false;
+
+	for_each_sibling_event(sibling, group_leader) {
+		if (__perf_event_read_size(sibling->attr.read_format,
+					   group_leader->nr_siblings + 1) > 16*1024)
+			return false;
+	}
+
 	return true;
 }
 

From b5862e5ca58f55649117ebd5488cf6eefe4dc652 Mon Sep 17 00:00:00 2001
From: Boerge Struempfel <boerge.struempfel@gmail.com>
Date: Wed, 29 Nov 2023 16:23:07 +0100
Subject: [PATCH 0891/1043] gpiolib: sysfs: Fix error handling on failed export

[ Upstream commit 95dd1e34ff5bbee93a28ff3947eceaf6de811b1a ]

If gpio_set_transitory() fails, we should free the GPIO again. Most
notably, the flag FLAG_REQUESTED has previously been set in
gpiod_request_commit(), and should be reset on failure.

To my knowledge, this does not affect any current users, since the
gpio_set_transitory() mainly returns 0 and -ENOTSUPP, which is converted
to 0. However the gpio_set_transitory() function calles the .set_config()
function of the corresponding GPIO chip and there are some GPIO drivers in
which some (unlikely) branches return other values like -EPROBE_DEFER,
and -EINVAL. In these cases, the above mentioned FLAG_REQUESTED would not
be reset, which results in the pin being blocked until the next reboot.

Fixes: e10f72bf4b3e ("gpio: gpiolib: Generalise state persistence beyond sleep")
Signed-off-by: Boerge Struempfel <boerge.struempfel@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpiolib-sysfs.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
index fa5d945b2f28..f45ba0f789d4 100644
--- a/drivers/gpio/gpiolib-sysfs.c
+++ b/drivers/gpio/gpiolib-sysfs.c
@@ -491,14 +491,17 @@ static ssize_t export_store(struct class *class,
 	}
 
 	status = gpiod_set_transitory(desc, false);
-	if (!status) {
-		status = gpiod_export(desc, true);
-		if (status < 0)
-			gpiod_free(desc);
-		else
-			set_bit(FLAG_SYSFS, &desc->flags);
+	if (status) {
+		gpiod_free(desc);
+		goto done;
 	}
 
+	status = gpiod_export(desc, true);
+	if (status < 0)
+		gpiod_free(desc);
+	else
+		set_bit(FLAG_SYSFS, &desc->flags);
+
 done:
 	if (status)
 		pr_debug("%s: status %d\n", __func__, status);

From d4fb20dcc13b37ee4f02025cd1dc8054d6027721 Mon Sep 17 00:00:00 2001
From: Prike Liang <Prike.Liang@amd.com>
Date: Wed, 8 Nov 2023 14:38:29 +0800
Subject: [PATCH 0892/1043] drm/amdgpu: correct the amdgpu runtime dereference
 usage count

[ Upstream commit c6df7f313794c3ad41a49b9a7c95da369db607f3 ]

Fix the amdgpu runpm dereference usage count.

Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index 7cc7af2a6822..3671a700189d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -299,13 +299,11 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
 		adev->have_disp_power_ref = true;
 		return ret;
 	}
-	/* if we have no active crtcs, then drop the power ref
-	   we got before */
-	if (!active && adev->have_disp_power_ref) {
-		pm_runtime_put_autosuspend(dev->dev);
+	/* if we have no active crtcs, then go to
+	 * drop the power ref we got before
+	 */
+	if (!active && adev->have_disp_power_ref)
 		adev->have_disp_power_ref = false;
-	}
-
 out:
 	/* drop the power reference we got coming in here */
 	pm_runtime_put_autosuspend(dev->dev);

From 558b6a4368327735a4299e56df1be909c1ef4d07 Mon Sep 17 00:00:00 2001
From: Konstantin Aladyshev <aladyshev22@gmail.com>
Date: Wed, 6 Dec 2023 11:07:44 +0300
Subject: [PATCH 0893/1043] usb: gadget: f_hid: fix report descriptor
 allocation

commit 61890dc28f7d9e9aac8a9471302613824c22fae4 upstream.

The commit 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs
cdev") has introduced a bug that leads to hid device corruption after
the replug operation.
Reverse device managed memory allocation for the report descriptor
to fix the issue.

Tested:
This change was tested on the AMD EthanolX CRB server with the BMC
based on the OpenBMC distribution. The BMC provides KVM functionality
via the USB gadget device:
- before: KVM page refresh results in a broken USB device,
- after: KVM page refresh works without any issues.

Fixes: 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev")
Cc: stable@vger.kernel.org
Signed-off-by: Konstantin Aladyshev <aladyshev22@gmail.com>
Link: https://lore.kernel.org/r/20231206080744.253-2-aladyshev22@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/function/f_hid.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index e7cf56b13c64..ba018aeb21d8 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -88,6 +88,7 @@ static void hidg_release(struct device *dev)
 {
 	struct f_hidg *hidg = container_of(dev, struct f_hidg, dev);
 
+	kfree(hidg->report_desc);
 	kfree(hidg->set_report_buf);
 	kfree(hidg);
 }
@@ -1287,9 +1288,9 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
 	hidg->report_length = opts->report_length;
 	hidg->report_desc_length = opts->report_desc_length;
 	if (opts->report_desc) {
-		hidg->report_desc = devm_kmemdup(&hidg->dev, opts->report_desc,
-						 opts->report_desc_length,
-						 GFP_KERNEL);
+		hidg->report_desc = kmemdup(opts->report_desc,
+					    opts->report_desc_length,
+					    GFP_KERNEL);
 		if (!hidg->report_desc) {
 			put_device(&hidg->dev);
 			--opts->refcnt;

From 9caaf469afd4bded5c0aca216d0e03fa9287c566 Mon Sep 17 00:00:00 2001
From: Cameron Williams <cang1@live.co.uk>
Date: Thu, 2 Nov 2023 21:10:40 +0000
Subject: [PATCH 0894/1043] parport: Add support for Brainboxes IX/UC/PX
 parallel cards

commit 1a031f6edc460e9562098bdedc3918da07c30a6e upstream.

Adds support for Intashield IX-500/IX-550, UC-146/UC-157, PX-146/PX-157,
PX-203 and PX-475 (LPT port)

Cc: stable@vger.kernel.org
Signed-off-by: Cameron Williams <cang1@live.co.uk>
Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Link: https://lore.kernel.org/r/AS4PR02MB790389C130410BD864C8DCC9C4A6A@AS4PR02MB7903.eurprd02.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/parport/parport_pc.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
index 925be41eeebe..de5a823f3031 100644
--- a/drivers/parport/parport_pc.c
+++ b/drivers/parport/parport_pc.c
@@ -2613,6 +2613,8 @@ enum parport_pc_pci_cards {
 	netmos_9865,
 	quatech_sppxp100,
 	wch_ch382l,
+	brainboxes_uc146,
+	brainboxes_px203,
 };
 
 
@@ -2676,6 +2678,8 @@ static struct parport_pc_pci {
 	/* netmos_9865 */               { 1, { { 0, -1 }, } },
 	/* quatech_sppxp100 */		{ 1, { { 0, 1 }, } },
 	/* wch_ch382l */		{ 1, { { 2, -1 }, } },
+	/* brainboxes_uc146 */	{ 1, { { 3, -1 }, } },
+	/* brainboxes_px203 */	{ 1, { { 0, -1 }, } },
 };
 
 static const struct pci_device_id parport_pc_pci_tbl[] = {
@@ -2767,6 +2771,23 @@ static const struct pci_device_id parport_pc_pci_tbl[] = {
 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, quatech_sppxp100 },
 	/* WCH CH382L PCI-E single parallel port card */
 	{ 0x1c00, 0x3050, 0x1c00, 0x3050, 0, 0, wch_ch382l },
+	/* Brainboxes IX-500/550 */
+	{ PCI_VENDOR_ID_INTASHIELD, 0x402a,
+	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, oxsemi_pcie_pport },
+	/* Brainboxes UC-146/UC-157 */
+	{ PCI_VENDOR_ID_INTASHIELD, 0x0be1,
+	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc146 },
+	{ PCI_VENDOR_ID_INTASHIELD, 0x0be2,
+	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc146 },
+	/* Brainboxes PX-146/PX-257 */
+	{ PCI_VENDOR_ID_INTASHIELD, 0x401c,
+	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, oxsemi_pcie_pport },
+	/* Brainboxes PX-203 */
+	{ PCI_VENDOR_ID_INTASHIELD, 0x4007,
+	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_px203 },
+	/* Brainboxes PX-475 */
+	{ PCI_VENDOR_ID_INTASHIELD, 0x401f,
+	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, oxsemi_pcie_pport },
 	{ 0, } /* terminate list */
 };
 MODULE_DEVICE_TABLE(pci, parport_pc_pci_tbl);

From f16d5355aab7c370824a760832935fa734598040 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Tue, 5 Dec 2023 11:05:48 +0200
Subject: [PATCH 0895/1043] Revert "xhci: Loosen RPM as default policy to cover
 for AMD xHC 1.1"

commit 24be0b3c40594a14b65141ced486ae327398faf8 upstream.

This reverts commit 4baf1218150985ee3ab0a27220456a1f027ea0ac.

Enabling runtime pm as default for all AMD xHC 1.1 controllers caused
regression. An initial attempt to fix those was done in commit a5d6264b638e
("xhci: Enable RPM on controllers that support low-power states") but new
issues are still seen.

Revert this to get those AMD xHC 1.1 systems working

This patch went to stable an needs to be reverted from there as well.

Fixes: 4baf12181509 ("xhci: Loosen RPM as default policy to cover for AMD xHC 1.1")
Link: https://lore.kernel.org/linux-usb/55c50bf5-bffb-454e-906e-4408c591cb63@molgen.mpg.de
Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://lore.kernel.org/r/20231205090548.1377667-1-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-pci.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 0933a94ebe29..53f832787350 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -345,8 +345,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
 	/* xHC spec requires PCI devices to support D3hot and D3cold */
 	if (xhci->hci_version >= 0x120)
 		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
-	else if (pdev->vendor == PCI_VENDOR_ID_AMD && xhci->hci_version >= 0x110)
-		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
 
 	if (xhci->quirks & XHCI_RESET_ON_RESUME)
 		xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,

From 713f6ff32651d4da07790cce55ab9d5dea9ca3d7 Mon Sep 17 00:00:00 2001
From: RD Babiera <rdbabiera@google.com>
Date: Wed, 29 Nov 2023 19:23:50 +0000
Subject: [PATCH 0896/1043] usb: typec: class: fix typec_altmode_put_partner to
 put plugs

commit b17b7fe6dd5c6ff74b38b0758ca799cdbb79e26e upstream.

When typec_altmode_put_partner is called by a plug altmode upon release,
the port altmode the plug belongs to will not remove its reference to the
plug. The check to see if the altmode being released evaluates against the
released altmode's partner instead of the calling altmode itself, so change
adev in typec_altmode_put_partner to properly refer to the altmode being
released.

typec_altmode_set_partner is not run for port altmodes, so also add a check
in typec_altmode_release to prevent typec_altmode_put_partner() calls on
port altmode release.

Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
Cc: stable@vger.kernel.org
Signed-off-by: RD Babiera <rdbabiera@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20231129192349.1773623-2-rdbabiera@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/class.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
index 9d3a35b2046d..18b35e817361 100644
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -194,7 +194,7 @@ static void typec_altmode_put_partner(struct altmode *altmode)
 	if (!partner)
 		return;
 
-	adev = &partner->adev;
+	adev = &altmode->adev;
 
 	if (is_typec_plug(adev->dev.parent)) {
 		struct typec_plug *plug = to_typec_plug(adev->dev.parent);
@@ -424,7 +424,8 @@ static void typec_altmode_release(struct device *dev)
 {
 	struct altmode *alt = to_altmode(to_typec_altmode(dev));
 
-	typec_altmode_put_partner(alt);
+	if (!is_typec_port(dev->parent))
+		typec_altmode_put_partner(alt);
 
 	altmode_id_remove(alt->adev.dev.parent, alt->id);
 	kfree(alt);

From e4ed3247465e9d91e1f4800f846deca439931a72 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Wed, 22 Nov 2023 18:15:03 +0100
Subject: [PATCH 0897/1043] ARM: PL011: Fix DMA support

commit 58ac1b3799799069d53f5bf95c093f2fe8dd3cc5 upstream.

Since there is no guarantee that the memory returned by
dma_alloc_coherent() is associated with a 'struct page', using the
architecture specific phys_to_page() is wrong, but using
virt_to_page() would be as well.

Stop using sg lists altogether and just use the *_single() functions
instead. This also simplifies the code a bit since the scatterlists in
this driver always have only one entry anyway.

https://lore.kernel.org/lkml/86db0fe5-930d-4cbb-bd7d-03367da38951@app.fastmail.com/
    Use consistent names for dma buffers

gc: Add a commit log from the initial thread:
https://lore.kernel.org/lkml/86db0fe5-930d-4cbb-bd7d-03367da38951@app.fastmail.com/
    Use consistent names for dma buffers

Fixes: cb06ff102e2d7 ("ARM: PL011: Add support for Rx DMA buffer polling.")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Tested-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20231122171503.235649-1-gregory.clement@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/amba-pl011.c | 112 +++++++++++++++-----------------
 1 file changed, 54 insertions(+), 58 deletions(-)

diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 348d4b2a391a..d4a93a94b4ca 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -222,17 +222,18 @@ static struct vendor_data vendor_zte = {
 
 /* Deals with DMA transactions */
 
-struct pl011_sgbuf {
-	struct scatterlist sg;
-	char *buf;
+struct pl011_dmabuf {
+	dma_addr_t		dma;
+	size_t			len;
+	char			*buf;
 };
 
 struct pl011_dmarx_data {
 	struct dma_chan		*chan;
 	struct completion	complete;
 	bool			use_buf_b;
-	struct pl011_sgbuf	sgbuf_a;
-	struct pl011_sgbuf	sgbuf_b;
+	struct pl011_dmabuf	dbuf_a;
+	struct pl011_dmabuf	dbuf_b;
 	dma_cookie_t		cookie;
 	bool			running;
 	struct timer_list	timer;
@@ -245,7 +246,8 @@ struct pl011_dmarx_data {
 
 struct pl011_dmatx_data {
 	struct dma_chan		*chan;
-	struct scatterlist	sg;
+	dma_addr_t		dma;
+	size_t			len;
 	char			*buf;
 	bool			queued;
 };
@@ -366,32 +368,24 @@ static int pl011_fifo_to_tty(struct uart_amba_port *uap)
 
 #define PL011_DMA_BUFFER_SIZE PAGE_SIZE
 
-static int pl011_sgbuf_init(struct dma_chan *chan, struct pl011_sgbuf *sg,
+static int pl011_dmabuf_init(struct dma_chan *chan, struct pl011_dmabuf *db,
 	enum dma_data_direction dir)
 {
-	dma_addr_t dma_addr;
-
-	sg->buf = dma_alloc_coherent(chan->device->dev,
-		PL011_DMA_BUFFER_SIZE, &dma_addr, GFP_KERNEL);
-	if (!sg->buf)
+	db->buf = dma_alloc_coherent(chan->device->dev, PL011_DMA_BUFFER_SIZE,
+				     &db->dma, GFP_KERNEL);
+	if (!db->buf)
 		return -ENOMEM;
-
-	sg_init_table(&sg->sg, 1);
-	sg_set_page(&sg->sg, phys_to_page(dma_addr),
-		PL011_DMA_BUFFER_SIZE, offset_in_page(dma_addr));
-	sg_dma_address(&sg->sg) = dma_addr;
-	sg_dma_len(&sg->sg) = PL011_DMA_BUFFER_SIZE;
+	db->len = PL011_DMA_BUFFER_SIZE;
 
 	return 0;
 }
 
-static void pl011_sgbuf_free(struct dma_chan *chan, struct pl011_sgbuf *sg,
+static void pl011_dmabuf_free(struct dma_chan *chan, struct pl011_dmabuf *db,
 	enum dma_data_direction dir)
 {
-	if (sg->buf) {
+	if (db->buf) {
 		dma_free_coherent(chan->device->dev,
-			PL011_DMA_BUFFER_SIZE, sg->buf,
-			sg_dma_address(&sg->sg));
+				  PL011_DMA_BUFFER_SIZE, db->buf, db->dma);
 	}
 }
 
@@ -552,8 +546,8 @@ static void pl011_dma_tx_callback(void *data)
 
 	spin_lock_irqsave(&uap->port.lock, flags);
 	if (uap->dmatx.queued)
-		dma_unmap_sg(dmatx->chan->device->dev, &dmatx->sg, 1,
-			     DMA_TO_DEVICE);
+		dma_unmap_single(dmatx->chan->device->dev, dmatx->dma,
+				dmatx->len, DMA_TO_DEVICE);
 
 	dmacr = uap->dmacr;
 	uap->dmacr = dmacr & ~UART011_TXDMAE;
@@ -639,18 +633,19 @@ static int pl011_dma_tx_refill(struct uart_amba_port *uap)
 			memcpy(&dmatx->buf[first], &xmit->buf[0], second);
 	}
 
-	dmatx->sg.length = count;
-
-	if (dma_map_sg(dma_dev->dev, &dmatx->sg, 1, DMA_TO_DEVICE) != 1) {
+	dmatx->len = count;
+	dmatx->dma = dma_map_single(dma_dev->dev, dmatx->buf, count,
+				    DMA_TO_DEVICE);
+	if (dmatx->dma == DMA_MAPPING_ERROR) {
 		uap->dmatx.queued = false;
 		dev_dbg(uap->port.dev, "unable to map TX DMA\n");
 		return -EBUSY;
 	}
 
-	desc = dmaengine_prep_slave_sg(chan, &dmatx->sg, 1, DMA_MEM_TO_DEV,
+	desc = dmaengine_prep_slave_single(chan, dmatx->dma, dmatx->len, DMA_MEM_TO_DEV,
 					     DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
 	if (!desc) {
-		dma_unmap_sg(dma_dev->dev, &dmatx->sg, 1, DMA_TO_DEVICE);
+		dma_unmap_single(dma_dev->dev, dmatx->dma, dmatx->len, DMA_TO_DEVICE);
 		uap->dmatx.queued = false;
 		/*
 		 * If DMA cannot be used right now, we complete this
@@ -814,8 +809,8 @@ __acquires(&uap->port.lock)
 	dmaengine_terminate_async(uap->dmatx.chan);
 
 	if (uap->dmatx.queued) {
-		dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1,
-			     DMA_TO_DEVICE);
+		dma_unmap_single(uap->dmatx.chan->device->dev, uap->dmatx.dma,
+				 uap->dmatx.len, DMA_TO_DEVICE);
 		uap->dmatx.queued = false;
 		uap->dmacr &= ~UART011_TXDMAE;
 		pl011_write(uap->dmacr, uap, REG_DMACR);
@@ -829,15 +824,15 @@ static int pl011_dma_rx_trigger_dma(struct uart_amba_port *uap)
 	struct dma_chan *rxchan = uap->dmarx.chan;
 	struct pl011_dmarx_data *dmarx = &uap->dmarx;
 	struct dma_async_tx_descriptor *desc;
-	struct pl011_sgbuf *sgbuf;
+	struct pl011_dmabuf *dbuf;
 
 	if (!rxchan)
 		return -EIO;
 
 	/* Start the RX DMA job */
-	sgbuf = uap->dmarx.use_buf_b ?
-		&uap->dmarx.sgbuf_b : &uap->dmarx.sgbuf_a;
-	desc = dmaengine_prep_slave_sg(rxchan, &sgbuf->sg, 1,
+	dbuf = uap->dmarx.use_buf_b ?
+		&uap->dmarx.dbuf_b : &uap->dmarx.dbuf_a;
+	desc = dmaengine_prep_slave_single(rxchan, dbuf->dma, dbuf->len,
 					DMA_DEV_TO_MEM,
 					DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
 	/*
@@ -877,8 +872,8 @@ static void pl011_dma_rx_chars(struct uart_amba_port *uap,
 			       bool readfifo)
 {
 	struct tty_port *port = &uap->port.state->port;
-	struct pl011_sgbuf *sgbuf = use_buf_b ?
-		&uap->dmarx.sgbuf_b : &uap->dmarx.sgbuf_a;
+	struct pl011_dmabuf *dbuf = use_buf_b ?
+		&uap->dmarx.dbuf_b : &uap->dmarx.dbuf_a;
 	int dma_count = 0;
 	u32 fifotaken = 0; /* only used for vdbg() */
 
@@ -887,7 +882,7 @@ static void pl011_dma_rx_chars(struct uart_amba_port *uap,
 
 	if (uap->dmarx.poll_rate) {
 		/* The data can be taken by polling */
-		dmataken = sgbuf->sg.length - dmarx->last_residue;
+		dmataken = dbuf->len - dmarx->last_residue;
 		/* Recalculate the pending size */
 		if (pending >= dmataken)
 			pending -= dmataken;
@@ -901,7 +896,7 @@ static void pl011_dma_rx_chars(struct uart_amba_port *uap,
 		 * Note that tty_insert_flip_buf() tries to take as many chars
 		 * as it can.
 		 */
-		dma_count = tty_insert_flip_string(port, sgbuf->buf + dmataken,
+		dma_count = tty_insert_flip_string(port, dbuf->buf + dmataken,
 				pending);
 
 		uap->port.icount.rx += dma_count;
@@ -912,7 +907,7 @@ static void pl011_dma_rx_chars(struct uart_amba_port *uap,
 
 	/* Reset the last_residue for Rx DMA poll */
 	if (uap->dmarx.poll_rate)
-		dmarx->last_residue = sgbuf->sg.length;
+		dmarx->last_residue = dbuf->len;
 
 	/*
 	 * Only continue with trying to read the FIFO if all DMA chars have
@@ -949,8 +944,8 @@ static void pl011_dma_rx_irq(struct uart_amba_port *uap)
 {
 	struct pl011_dmarx_data *dmarx = &uap->dmarx;
 	struct dma_chan *rxchan = dmarx->chan;
-	struct pl011_sgbuf *sgbuf = dmarx->use_buf_b ?
-		&dmarx->sgbuf_b : &dmarx->sgbuf_a;
+	struct pl011_dmabuf *dbuf = dmarx->use_buf_b ?
+		&dmarx->dbuf_b : &dmarx->dbuf_a;
 	size_t pending;
 	struct dma_tx_state state;
 	enum dma_status dmastat;
@@ -972,7 +967,7 @@ static void pl011_dma_rx_irq(struct uart_amba_port *uap)
 	pl011_write(uap->dmacr, uap, REG_DMACR);
 	uap->dmarx.running = false;
 
-	pending = sgbuf->sg.length - state.residue;
+	pending = dbuf->len - state.residue;
 	BUG_ON(pending > PL011_DMA_BUFFER_SIZE);
 	/* Then we terminate the transfer - we now know our residue */
 	dmaengine_terminate_all(rxchan);
@@ -999,8 +994,8 @@ static void pl011_dma_rx_callback(void *data)
 	struct pl011_dmarx_data *dmarx = &uap->dmarx;
 	struct dma_chan *rxchan = dmarx->chan;
 	bool lastbuf = dmarx->use_buf_b;
-	struct pl011_sgbuf *sgbuf = dmarx->use_buf_b ?
-		&dmarx->sgbuf_b : &dmarx->sgbuf_a;
+	struct pl011_dmabuf *dbuf = dmarx->use_buf_b ?
+		&dmarx->dbuf_b : &dmarx->dbuf_a;
 	size_t pending;
 	struct dma_tx_state state;
 	int ret;
@@ -1018,7 +1013,7 @@ static void pl011_dma_rx_callback(void *data)
 	 * the DMA irq handler. So we check the residue here.
 	 */
 	rxchan->device->device_tx_status(rxchan, dmarx->cookie, &state);
-	pending = sgbuf->sg.length - state.residue;
+	pending = dbuf->len - state.residue;
 	BUG_ON(pending > PL011_DMA_BUFFER_SIZE);
 	/* Then we terminate the transfer - we now know our residue */
 	dmaengine_terminate_all(rxchan);
@@ -1070,16 +1065,16 @@ static void pl011_dma_rx_poll(struct timer_list *t)
 	unsigned long flags = 0;
 	unsigned int dmataken = 0;
 	unsigned int size = 0;
-	struct pl011_sgbuf *sgbuf;
+	struct pl011_dmabuf *dbuf;
 	int dma_count;
 	struct dma_tx_state state;
 
-	sgbuf = dmarx->use_buf_b ? &uap->dmarx.sgbuf_b : &uap->dmarx.sgbuf_a;
+	dbuf = dmarx->use_buf_b ? &uap->dmarx.dbuf_b : &uap->dmarx.dbuf_a;
 	rxchan->device->device_tx_status(rxchan, dmarx->cookie, &state);
 	if (likely(state.residue < dmarx->last_residue)) {
-		dmataken = sgbuf->sg.length - dmarx->last_residue;
+		dmataken = dbuf->len - dmarx->last_residue;
 		size = dmarx->last_residue - state.residue;
-		dma_count = tty_insert_flip_string(port, sgbuf->buf + dmataken,
+		dma_count = tty_insert_flip_string(port, dbuf->buf + dmataken,
 				size);
 		if (dma_count == size)
 			dmarx->last_residue =  state.residue;
@@ -1126,7 +1121,7 @@ static void pl011_dma_startup(struct uart_amba_port *uap)
 		return;
 	}
 
-	sg_init_one(&uap->dmatx.sg, uap->dmatx.buf, PL011_DMA_BUFFER_SIZE);
+	uap->dmatx.len = PL011_DMA_BUFFER_SIZE;
 
 	/* The DMA buffer is now the FIFO the TTY subsystem can use */
 	uap->port.fifosize = PL011_DMA_BUFFER_SIZE;
@@ -1136,7 +1131,7 @@ static void pl011_dma_startup(struct uart_amba_port *uap)
 		goto skip_rx;
 
 	/* Allocate and map DMA RX buffers */
-	ret = pl011_sgbuf_init(uap->dmarx.chan, &uap->dmarx.sgbuf_a,
+	ret = pl011_dmabuf_init(uap->dmarx.chan, &uap->dmarx.dbuf_a,
 			       DMA_FROM_DEVICE);
 	if (ret) {
 		dev_err(uap->port.dev, "failed to init DMA %s: %d\n",
@@ -1144,12 +1139,12 @@ static void pl011_dma_startup(struct uart_amba_port *uap)
 		goto skip_rx;
 	}
 
-	ret = pl011_sgbuf_init(uap->dmarx.chan, &uap->dmarx.sgbuf_b,
+	ret = pl011_dmabuf_init(uap->dmarx.chan, &uap->dmarx.dbuf_b,
 			       DMA_FROM_DEVICE);
 	if (ret) {
 		dev_err(uap->port.dev, "failed to init DMA %s: %d\n",
 			"RX buffer B", ret);
-		pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_a,
+		pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a,
 				 DMA_FROM_DEVICE);
 		goto skip_rx;
 	}
@@ -1203,8 +1198,9 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap)
 		/* In theory, this should already be done by pl011_dma_flush_buffer */
 		dmaengine_terminate_all(uap->dmatx.chan);
 		if (uap->dmatx.queued) {
-			dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1,
-				     DMA_TO_DEVICE);
+			dma_unmap_single(uap->dmatx.chan->device->dev,
+					 uap->dmatx.dma, uap->dmatx.len,
+					 DMA_TO_DEVICE);
 			uap->dmatx.queued = false;
 		}
 
@@ -1215,8 +1211,8 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap)
 	if (uap->using_rx_dma) {
 		dmaengine_terminate_all(uap->dmarx.chan);
 		/* Clean up the RX DMA */
-		pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_a, DMA_FROM_DEVICE);
-		pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_b, DMA_FROM_DEVICE);
+		pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, DMA_FROM_DEVICE);
+		pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_b, DMA_FROM_DEVICE);
 		if (uap->dmarx.poll_rate)
 			del_timer_sync(&uap->dmarx.timer);
 		uap->using_rx_dma = false;

From 863bacf3a3f37bc40632bad1155a57d752ad7981 Mon Sep 17 00:00:00 2001
From: Daniel Mack <daniel@zonque.org>
Date: Thu, 23 Nov 2023 08:28:18 +0100
Subject: [PATCH 0898/1043] serial: sc16is7xx: address RX timeout interrupt
 errata

commit 08ce9a1b72e38cf44c300a44ac5858533eb3c860 upstream.

This device has a silicon bug that makes it report a timeout interrupt
but no data in the FIFO.

The datasheet states the following in the errata section 18.1.4:

  "If the host reads the receive FIFO at the same time as a
  time-out interrupt condition happens, the host might read 0xCC
  (time-out) in the Interrupt Indication Register (IIR), but bit 0
  of the Line Status Register (LSR) is not set (means there is no
  data in the receive FIFO)."

The errata description seems to indicate it concerns only polled mode of
operation when reading bit 0 of the LSR register. However, tests have
shown and NXP has confirmed that the RXLVL register also yields 0 when
the bug is triggered, and hence the IRQ driven implementation in this
driver is equally affected.

This bug has hit us on production units and when it does, sc16is7xx_irq()
would spin forever because sc16is7xx_port_irq() keeps seeing an
interrupt in the IIR register that is not cleared because the driver
does not call into sc16is7xx_handle_rx() unless the RXLVL register
reports at least one byte in the FIFO.

Fix this by always reading one byte from the FIFO when this condition
is detected in order to clear the interrupt. This approach was
confirmed to be correct by NXP through their support channels.

Tested by: Hugo Villeneuve <hvilleneuve@dimonoff.com>

Signed-off-by: Daniel Mack <daniel@zonque.org>
Co-Developed-by: Maxim Popov <maxim.snafu@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231123072818.1394539-1-daniel@zonque.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/sc16is7xx.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index c681ed589303..fd9be81bcfd8 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -694,6 +694,18 @@ static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
 		case SC16IS7XX_IIR_RTOI_SRC:
 		case SC16IS7XX_IIR_XOFFI_SRC:
 			rxlen = sc16is7xx_port_read(port, SC16IS7XX_RXLVL_REG);
+
+			/*
+			 * There is a silicon bug that makes the chip report a
+			 * time-out interrupt but no data in the FIFO. This is
+			 * described in errata section 18.1.4.
+			 *
+			 * When this happens, read one byte from the FIFO to
+			 * clear the interrupt.
+			 */
+			if (iir == SC16IS7XX_IIR_RTOI_SRC && !rxlen)
+				rxlen = 1;
+
 			if (rxlen)
 				sc16is7xx_handle_rx(port, rxlen, iir);
 			break;

From b74ace5dec53c89bcda010204a5b6ec2589fa673 Mon Sep 17 00:00:00 2001
From: Ronald Wahl <ronald.wahl@raritan.com>
Date: Tue, 31 Oct 2023 12:09:09 +0100
Subject: [PATCH 0899/1043] serial: 8250: 8250_omap: Clear UART_HAS_RHR_IT_DIS
 bit

commit 8973ab7a2441b286218f4a5c4c33680e2f139996 upstream.

This fixes commit 439c7183e5b9 ("serial: 8250: 8250_omap: Disable RX
interrupt after DMA enable") which unfortunately set the
UART_HAS_RHR_IT_DIS bit in the UART_OMAP_IER2 register and never
cleared it.

Cc: stable@vger.kernel.org
Fixes: 439c7183e5b9 ("serial: 8250: 8250_omap: Disable RX interrupt after DMA enable")
Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
Link: https://lore.kernel.org/r/20231031110909.11695-1-rwahl@gmx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_omap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index e7e84aa2c5f8..724d82bde877 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -844,7 +844,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
 	if (priv->habit & UART_HAS_RHR_IT_DIS) {
 		reg = serial_in(p, UART_OMAP_IER2);
 		reg &= ~UART_OMAP_IER2_RHR_IT_DIS;
-		serial_out(p, UART_OMAP_IER2, UART_OMAP_IER2_RHR_IT_DIS);
+		serial_out(p, UART_OMAP_IER2, reg);
 	}
 
 	dmaengine_tx_status(rxchan, cookie, &state);
@@ -986,7 +986,7 @@ static int omap_8250_rx_dma(struct uart_8250_port *p)
 	if (priv->habit & UART_HAS_RHR_IT_DIS) {
 		reg = serial_in(p, UART_OMAP_IER2);
 		reg |= UART_OMAP_IER2_RHR_IT_DIS;
-		serial_out(p, UART_OMAP_IER2, UART_OMAP_IER2_RHR_IT_DIS);
+		serial_out(p, UART_OMAP_IER2, reg);
 	}
 
 	dma_async_issue_pending(dma->rxchan);

From 8ffaaf80c64c341cd12c6038be7336fe3e97f263 Mon Sep 17 00:00:00 2001
From: Ronald Wahl <ronald.wahl@raritan.com>
Date: Wed, 1 Nov 2023 18:14:31 +0100
Subject: [PATCH 0900/1043] serial: 8250: 8250_omap: Do not start RX DMA on
 THRI interrupt

commit c6bb057418876cdfdd29a6f7b8cef54539ee8811 upstream.

Starting RX DMA on THRI interrupt is too early because TX may not have
finished yet.

This change is inspired by commit 90b8596ac460 ("serial: 8250: Prevent
starting up DMA Rx on THRI interrupt") and fixes DMA issues I had with
an AM62 SoC that is using the 8250 OMAP variant.

Cc: stable@vger.kernel.org
Fixes: c26389f998a8 ("serial: 8250: 8250_omap: Add DMA support for UARTs on K3 SoCs")
Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
Link: https://lore.kernel.org/r/20231101171431.16495-1-rwahl@gmx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_omap.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index 724d82bde877..bd4118f1b694 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -1209,10 +1209,12 @@ static int omap_8250_dma_handle_irq(struct uart_port *port)
 
 	status = serial_port_in(port, UART_LSR);
 
-	if (priv->habit & UART_HAS_EFR2)
-		am654_8250_handle_rx_dma(up, iir, status);
-	else
-		status = omap_8250_handle_rx_dma(up, iir, status);
+	if ((iir & 0x3f) != UART_IIR_THRI) {
+		if (priv->habit & UART_HAS_EFR2)
+			am654_8250_handle_rx_dma(up, iir, status);
+		else
+			status = omap_8250_handle_rx_dma(up, iir, status);
+	}
 
 	serial8250_modem_status(up);
 	if (status & UART_LSR_THRE && up->dma->tx_err) {

From 6059c313ff9ca953f39550daebd72bc43172924d Mon Sep 17 00:00:00 2001
From: Ronald Wahl <ronald.wahl@raritan.com>
Date: Tue, 31 Oct 2023 14:12:42 +0100
Subject: [PATCH 0901/1043] serial: 8250_omap: Add earlycon support for the
 AM654 UART controller

commit 8e42c301ce64e0dcca547626eb486877d502d336 upstream.

Currently there is no support for earlycon on the AM654 UART
controller. This commit adds it.

Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
Link: https://lore.kernel.org/r/20231031131242.15516-1-rwahl@gmx.de
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_early.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/8250/8250_early.c b/drivers/tty/serial/8250/8250_early.c
index 70d7826788f5..ccacbf0f14b3 100644
--- a/drivers/tty/serial/8250/8250_early.c
+++ b/drivers/tty/serial/8250/8250_early.c
@@ -199,6 +199,7 @@ static int __init early_omap8250_setup(struct earlycon_device *device,
 OF_EARLYCON_DECLARE(omap8250, "ti,omap2-uart", early_omap8250_setup);
 OF_EARLYCON_DECLARE(omap8250, "ti,omap3-uart", early_omap8250_setup);
 OF_EARLYCON_DECLARE(omap8250, "ti,omap4-uart", early_omap8250_setup);
+OF_EARLYCON_DECLARE(omap8250, "ti,am654-uart", early_omap8250_setup);
 
 #endif
 

From ab8816a7c2c6b28c775252c81cbc30035f1d4c33 Mon Sep 17 00:00:00 2001
From: "Borislav Petkov (AMD)" <bp@alien8.de>
Date: Fri, 1 Dec 2023 19:37:27 +0100
Subject: [PATCH 0902/1043] x86/CPU/AMD: Check vendor in the AMD microcode
 callback

commit 9b8493dc43044376716d789d07699f17d538a7c4 upstream.

Commit in Fixes added an AMD-specific microcode callback. However, it
didn't check the CPU vendor the kernel runs on explicitly.

The only reason the Zenbleed check in it didn't run on other x86 vendors
hardware was pure coincidental luck:

  if (!cpu_has_amd_erratum(c, amd_zenbleed))
	  return;

gives true on other vendors because they don't have those families and
models.

However, with the removal of the cpu_has_amd_erratum() in

  05f5f73936fa ("x86/CPU/AMD: Drop now unused CPU erratum checking function")

that coincidental condition is gone, leading to the zenbleed check
getting executed on other vendors too.

Add the explicit vendor check for the whole callback as it should've
been done in the first place.

Fixes: 522b1d69219d ("x86/cpu/amd: Add a Zenbleed fix")
Cc: <stable@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20231201184226.16749-1-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/amd.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index d254e02aa179..f29c6bed9d65 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -1328,6 +1328,9 @@ static void zenbleed_check_cpu(void *unused)
 
 void amd_check_microcode(void)
 {
+	if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
+		return;
+
 	on_each_cpu(zenbleed_check_cpu, NULL, 1);
 }
 

From e0e897ddf392804fc2f27ebc9cce8917a1178d3e Mon Sep 17 00:00:00 2001
From: Claudio Imbrenda <imbrenda@linux.ibm.com>
Date: Thu, 9 Nov 2023 13:36:24 +0100
Subject: [PATCH 0903/1043] KVM: s390/mm: Properly reset no-dat

commit 27072b8e18a73ffeffb1c140939023915a35134b upstream.

When the CMMA state needs to be reset, the no-dat bit also needs to be
reset. Failure to do so could cause issues in the guest, since the
guest expects the bit to be cleared after a reset.

Cc: <stable@vger.kernel.org>
Reviewed-by: Nico Boehr <nrb@linux.ibm.com>
Message-ID: <20231109123624.37314-1-imbrenda@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/mm/pgtable.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 1c05caf68e7d..5b62e385af38 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -717,7 +717,7 @@ void ptep_zap_unused(struct mm_struct *mm, unsigned long addr,
 		pte_clear(mm, addr, ptep);
 	}
 	if (reset)
-		pgste_val(pgste) &= ~_PGSTE_GPS_USAGE_MASK;
+		pgste_val(pgste) &= ~(_PGSTE_GPS_USAGE_MASK | _PGSTE_GPS_NODAT);
 	pgste_set_unlock(ptep, pgste);
 	preempt_enable();
 }

From ff803322e9351019e373178582798689fe04b37a Mon Sep 17 00:00:00 2001
From: Jiaxun Yang <jiaxun.yang@flygoat.com>
Date: Tue, 7 Nov 2023 11:15:18 +0000
Subject: [PATCH 0904/1043] MIPS: Loongson64: Reserve vgabios memory on boot

commit 8f7aa77a463f47c9e00592d02747a9fcf2271543 upstream.

vgabios is passed from firmware to kernel on Loongson64 systems.
Sane firmware will keep this pointer in reserved memory space
passed from the firmware but insane firmware keeps it in low
memory before kernel entry that is not reserved.

Previously kernel won't try to allocate memory from low memory
before kernel entry on boot, but after converting to memblock
it will do that.

Fix by resversing those memory on early boot.

Cc: stable@vger.kernel.org
Fixes: a94e4f24ec83 ("MIPS: init: Drop boot_mem_map")
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/loongson64/init.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/mips/loongson64/init.c b/arch/mips/loongson64/init.c
index 052cce6a8a99..4071cc8841e3 100644
--- a/arch/mips/loongson64/init.c
+++ b/arch/mips/loongson64/init.c
@@ -140,6 +140,11 @@ static __init void reserve_pio_range(void)
 			}
 		}
 	}
+
+	/* Reserve vgabios if it comes from firmware */
+	if (loongson_sysconf.vgabios_addr)
+		memblock_reserve(virt_to_phys((void *)loongson_sysconf.vgabios_addr),
+				SZ_256K);
 }
 
 void __init arch_init_irq(void)

From 3ee7e2faef87594228eb2622f8c25c0495ea50a1 Mon Sep 17 00:00:00 2001
From: Jiaxun Yang <jiaxun.yang@flygoat.com>
Date: Tue, 7 Nov 2023 11:15:19 +0000
Subject: [PATCH 0905/1043] MIPS: Loongson64: Enable DMA noncoherent support

commit edc0378eee00200a5bedf1bb9f00ad390e0d1bd4 upstream.

There are some Loongson64 systems come with broken coherent DMA
support, firmware will set a bit in boot_param and pass nocoherentio
in cmdline.

However nonconherent support was missed out when spin off Loongson-2EF
form Loongson64, and that boot_param change never made itself into
upstream.

Support DMA noncoherent properly to get those systems working.

Cc: stable@vger.kernel.org
Fixes: 71e2f4dd5a65 ("MIPS: Fork loongson2ef from loongson64")
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/Kconfig                                  |  2 ++
 arch/mips/include/asm/mach-loongson64/boot_param.h |  3 ++-
 arch/mips/loongson64/env.c                         | 10 +++++++++-
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 57839f63074f..18ebacf29889 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -468,6 +468,7 @@ config MACH_LOONGSON2EF
 
 config MACH_LOONGSON64
 	bool "Loongson 64-bit family of machines"
+	select ARCH_DMA_DEFAULT_COHERENT
 	select ARCH_SPARSEMEM_ENABLE
 	select ARCH_MIGHT_HAVE_PC_PARPORT
 	select ARCH_MIGHT_HAVE_PC_SERIO
@@ -1379,6 +1380,7 @@ config CPU_LOONGSON64
 	select CPU_SUPPORTS_MSA
 	select CPU_DIEI_BROKEN if !LOONGSON3_ENHANCEMENT
 	select CPU_MIPSR2_IRQ_VI
+	select DMA_NONCOHERENT
 	select WEAK_ORDERING
 	select WEAK_REORDERING_BEYOND_LLSC
 	select MIPS_ASID_BITS_VARIABLE
diff --git a/arch/mips/include/asm/mach-loongson64/boot_param.h b/arch/mips/include/asm/mach-loongson64/boot_param.h
index afc92b7a61c6..de0bd14d798a 100644
--- a/arch/mips/include/asm/mach-loongson64/boot_param.h
+++ b/arch/mips/include/asm/mach-loongson64/boot_param.h
@@ -117,7 +117,8 @@ struct irq_source_routing_table {
 	u64 pci_io_start_addr;
 	u64 pci_io_end_addr;
 	u64 pci_config_addr;
-	u32 dma_mask_bits;
+	u16 dma_mask_bits;
+	u16 dma_noncoherent;
 } __packed;
 
 struct interface_info {
diff --git a/arch/mips/loongson64/env.c b/arch/mips/loongson64/env.c
index 134cb8e9efc2..a59bae36f86a 100644
--- a/arch/mips/loongson64/env.c
+++ b/arch/mips/loongson64/env.c
@@ -13,6 +13,8 @@
  * Copyright (C) 2009 Lemote Inc.
  * Author: Wu Zhangjin, wuzhangjin@gmail.com
  */
+
+#include <linux/dma-map-ops.h>
 #include <linux/export.h>
 #include <linux/pci_ids.h>
 #include <asm/bootinfo.h>
@@ -131,8 +133,14 @@ void __init prom_init_env(void)
 	loongson_sysconf.pci_io_base = eirq_source->pci_io_start_addr;
 	loongson_sysconf.dma_mask_bits = eirq_source->dma_mask_bits;
 	if (loongson_sysconf.dma_mask_bits < 32 ||
-		loongson_sysconf.dma_mask_bits > 64)
+			loongson_sysconf.dma_mask_bits > 64) {
 		loongson_sysconf.dma_mask_bits = 32;
+		dma_default_coherent = true;
+	} else {
+		dma_default_coherent = !eirq_source->dma_noncoherent;
+	}
+
+	pr_info("Firmware: Coherent DMA: %s\n", dma_default_coherent ? "on" : "off");
 
 	loongson_sysconf.restart_addr = boot_p->reset_system.ResetWarm;
 	loongson_sysconf.poweroff_addr = boot_p->reset_system.Shutdown;

From 3fe1ea5f921bf5b71cbfdc4469fb96c05936610e Mon Sep 17 00:00:00 2001
From: Pavel Begunkov <asml.silence@gmail.com>
Date: Wed, 6 Dec 2023 13:26:47 +0000
Subject: [PATCH 0906/1043] io_uring/af_unix: disable sending io_uring over
 sockets

commit 705318a99a138c29a512a72c3e0043b3cd7f55f4 upstream.

File reference cycles have caused lots of problems for io_uring
in the past, and it still doesn't work exactly right and races with
unix_stream_read_generic(). The safest fix would be to completely
disallow sending io_uring files via sockets via SCM_RIGHT, so there
are no possible cycles invloving registered files and thus rendering
SCM accounting on the io_uring side unnecessary.

Cc:  <stable@vger.kernel.org>
Fixes: 0091bfc81741b ("io_uring/af_unix: defer registered files gc to io_uring release")
Reported-and-suggested-by: Jann Horn <jannh@google.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/c716c88321939156909cfa1bd8b0faaf1c804103.1701868795.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 io_uring/io_uring.c | 55 ---------------------------------------------
 net/core/scm.c      |  6 +++++
 2 files changed, 6 insertions(+), 55 deletions(-)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 0c4f159865b9..aa15e8d878a9 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -8452,49 +8452,6 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
 	return ret;
 }
 
-static int io_sqe_file_register(struct io_ring_ctx *ctx, struct file *file,
-				int index)
-{
-#if defined(CONFIG_UNIX)
-	struct sock *sock = ctx->ring_sock->sk;
-	struct sk_buff_head *head = &sock->sk_receive_queue;
-	struct sk_buff *skb;
-
-	/*
-	 * See if we can merge this file into an existing skb SCM_RIGHTS
-	 * file set. If there's no room, fall back to allocating a new skb
-	 * and filling it in.
-	 */
-	spin_lock_irq(&head->lock);
-	skb = skb_peek(head);
-	if (skb) {
-		struct scm_fp_list *fpl = UNIXCB(skb).fp;
-
-		if (fpl->count < SCM_MAX_FD) {
-			__skb_unlink(skb, head);
-			spin_unlock_irq(&head->lock);
-			fpl->fp[fpl->count] = get_file(file);
-			unix_inflight(fpl->user, fpl->fp[fpl->count]);
-			fpl->count++;
-			spin_lock_irq(&head->lock);
-			__skb_queue_head(head, skb);
-		} else {
-			skb = NULL;
-		}
-	}
-	spin_unlock_irq(&head->lock);
-
-	if (skb) {
-		fput(file);
-		return 0;
-	}
-
-	return __io_sqe_files_scm(ctx, 1, index);
-#else
-	return 0;
-#endif
-}
-
 static int io_queue_rsrc_removal(struct io_rsrc_data *data, unsigned idx,
 				 struct io_rsrc_node *node, void *rsrc)
 {
@@ -8552,12 +8509,6 @@ static int io_install_fixed_file(struct io_kiocb *req, struct file *file,
 
 	*io_get_tag_slot(ctx->file_data, slot_index) = 0;
 	io_fixed_file_set(file_slot, file);
-	ret = io_sqe_file_register(ctx, file, slot_index);
-	if (ret) {
-		file_slot->file_ptr = 0;
-		goto err;
-	}
-
 	ret = 0;
 err:
 	if (needs_switch)
@@ -8671,12 +8622,6 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
 			}
 			*io_get_tag_slot(data, i) = tag;
 			io_fixed_file_set(file_slot, file);
-			err = io_sqe_file_register(ctx, file, i);
-			if (err) {
-				file_slot->file_ptr = 0;
-				fput(file);
-				break;
-			}
 		}
 	}
 
diff --git a/net/core/scm.c b/net/core/scm.c
index 8156d4fb8a39..3c7f160720d3 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -26,6 +26,7 @@
 #include <linux/nsproxy.h>
 #include <linux/slab.h>
 #include <linux/errqueue.h>
+#include <linux/io_uring.h>
 
 #include <linux/uaccess.h>
 
@@ -103,6 +104,11 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
 
 		if (fd < 0 || !(file = fget_raw(fd)))
 			return -EBADF;
+		/* don't allow io_uring files */
+		if (io_uring_get_socket(file)) {
+			fput(file);
+			return -EINVAL;
+		}
 		*fpp++ = file;
 		fpl->count++;
 	}

From df6cb4c43098dfa5ebb3cd478d4b6e5155addc4d Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@nvidia.com>
Date: Mon, 11 Dec 2023 14:37:37 +0200
Subject: [PATCH 0907/1043] netlink: don't call ->netlink_bind with table lock
 held

From: Florian Westphal <fw@strlen.de>

commit f2764bd4f6a8dffaec3e220728385d9756b3c2cb upstream.

When I added support to allow generic netlink multicast groups to be
restricted to subscribers with CAP_NET_ADMIN I was unaware that a
genl_bind implementation already existed in the past.

It was reverted due to ABBA deadlock:

1. ->netlink_bind gets called with the table lock held.
2. genetlink bind callback is invoked, it grabs the genl lock.

But when a new genl subsystem is (un)registered, these two locks are
taken in reverse order.

One solution would be to revert again and add a comment in genl
referring 1e82a62fec613, "genetlink: remove genl_bind").

This would need a second change in mptcp to not expose the raw token
value anymore, e.g.  by hashing the token with a secret key so userspace
can still associate subflow events with the correct mptcp connection.

However, Paolo Abeni reminded me to double-check why the netlink table is
locked in the first place.

I can't find one.  netlink_bind() is already called without this lock
when userspace joins a group via NETLINK_ADD_MEMBERSHIP setsockopt.
Same holds for the netlink_unbind operation.

Digging through the history, commit f773608026ee1
("netlink: access nlk groups safely in netlink bind and getname")
expanded the lock scope.

commit 3a20773beeeeade ("net: netlink: cap max groups which will be considered in netlink_bind()")
... removed the nlk->ngroups access that the lock scope
extension was all about.

Reduce the lock scope again and always call ->netlink_bind without
the table lock.

The Fixes tag should be vs. the patch mentioned in the link below,
but that one got squash-merged into the patch that came earlier in the
series.

Fixes: 4d54cc32112d8d ("mptcp: avoid lock_fast usage in accept path")
Link: https://lore.kernel.org/mptcp/20210213000001.379332-8-mathew.j.martineau@linux.intel.com/T/#u
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Xin Long <lucien.xin@gmail.com>
Cc: Johannes Berg <johannes.berg@intel.com>
Cc: Sean Tranchetti <stranche@codeaurora.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netlink/af_netlink.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 9737c3229c12..901358a5b593 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1021,7 +1021,6 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
 			return -EINVAL;
 	}
 
-	netlink_lock_table();
 	if (nlk->netlink_bind && groups) {
 		int group;
 
@@ -1033,13 +1032,14 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
 			if (!err)
 				continue;
 			netlink_undo_bind(group, groups, sk);
-			goto unlock;
+			return err;
 		}
 	}
 
 	/* No need for barriers here as we return to user-space without
 	 * using any of the bound attributes.
 	 */
+	netlink_lock_table();
 	if (!bound) {
 		err = nladdr->nl_pid ?
 			netlink_insert(sk, nladdr->nl_pid) :

From 015870c10c45902882d2d4adad17f162df144104 Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@nvidia.com>
Date: Mon, 11 Dec 2023 14:37:38 +0200
Subject: [PATCH 0908/1043] genetlink: add CAP_NET_ADMIN test for multicast
 bind

This is a partial backport of upstream commit 4d54cc32112d ("mptcp:
avoid lock_fast usage in accept path"). It is only a partial backport
because the patch in the link below was erroneously squash-merged into
upstream commit 4d54cc32112d ("mptcp: avoid lock_fast usage in accept
path"). Below is the original patch description from Florian Westphal:

"
genetlink sets NL_CFG_F_NONROOT_RECV for its netlink socket so anyone can
subscribe to multicast messages.

rtnetlink doesn't allow this unconditionally,  rtnetlink_bind() restricts
bind requests to CAP_NET_ADMIN for a few groups.

This allows to set GENL_UNS_ADMIN_PERM flag on genl mcast groups to
mandate CAP_NET_ADMIN.

This will be used by the upcoming mptcp netlink event facility which
exposes the token (mptcp connection identifier) to userspace.
"

Link: https://lore.kernel.org/mptcp/20210213000001.379332-8-mathew.j.martineau@linux.intel.com/
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/genetlink.h |  1 +
 net/netlink/genetlink.c | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index e55ec1597ce7..7cb3fa8310ed 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -14,6 +14,7 @@
  */
 struct genl_multicast_group {
 	char			name[GENL_NAMSIZ];
+	u8			flags;
 };
 
 struct genl_ops;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 9fd7ba01b9f8..4dce39013d75 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1364,11 +1364,43 @@ static struct genl_family genl_ctrl __ro_after_init = {
 	.netnsok = true,
 };
 
+static int genl_bind(struct net *net, int group)
+{
+	const struct genl_family *family;
+	unsigned int id;
+	int ret = 0;
+
+	genl_lock_all();
+
+	idr_for_each_entry(&genl_fam_idr, family, id) {
+		const struct genl_multicast_group *grp;
+		int i;
+
+		if (family->n_mcgrps == 0)
+			continue;
+
+		i = group - family->mcgrp_offset;
+		if (i < 0 || i >= family->n_mcgrps)
+			continue;
+
+		grp = &family->mcgrps[i];
+		if ((grp->flags & GENL_UNS_ADMIN_PERM) &&
+		    !ns_capable(net->user_ns, CAP_NET_ADMIN))
+			ret = -EPERM;
+
+		break;
+	}
+
+	genl_unlock_all();
+	return ret;
+}
+
 static int __net_init genl_pernet_init(struct net *net)
 {
 	struct netlink_kernel_cfg cfg = {
 		.input		= genl_rcv,
 		.flags		= NL_CFG_F_NONROOT_RECV,
+		.bind		= genl_bind,
 	};
 
 	/* we'll bump the group number right afterwards */

From ad2223a16925c20155294fdec7ae67127d8e16e1 Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@nvidia.com>
Date: Mon, 11 Dec 2023 14:37:39 +0200
Subject: [PATCH 0909/1043] psample: Require 'CAP_NET_ADMIN' when joining
 "packets" group

commit 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 upstream.

The "psample" generic netlink family notifies sampled packets over the
"packets" multicast group. This is problematic since by default generic
netlink allows non-root users to listen to these notifications.

Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will
prevent non-root users or root without the 'CAP_NET_ADMIN' capability
(in the user namespace owning the network namespace) from joining the
group.

Tested using [1].

Before:

 # capsh -- -c ./psample_repo
 # capsh --drop=cap_net_admin -- -c ./psample_repo

After:

 # capsh -- -c ./psample_repo
 # capsh --drop=cap_net_admin -- -c ./psample_repo
 Failed to join "packets" multicast group

[1]
 $ cat psample.c
 #include <stdio.h>
 #include <netlink/genl/ctrl.h>
 #include <netlink/genl/genl.h>
 #include <netlink/socket.h>

 int join_grp(struct nl_sock *sk, const char *grp_name)
 {
 	int grp, err;

 	grp = genl_ctrl_resolve_grp(sk, "psample", grp_name);
 	if (grp < 0) {
 		fprintf(stderr, "Failed to resolve \"%s\" multicast group\n",
 			grp_name);
 		return grp;
 	}

 	err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE);
 	if (err) {
 		fprintf(stderr, "Failed to join \"%s\" multicast group\n",
 			grp_name);
 		return err;
 	}

 	return 0;
 }

 int main(int argc, char **argv)
 {
 	struct nl_sock *sk;
 	int err;

 	sk = nl_socket_alloc();
 	if (!sk) {
 		fprintf(stderr, "Failed to allocate socket\n");
 		return -1;
 	}

 	err = genl_connect(sk);
 	if (err) {
 		fprintf(stderr, "Failed to connect socket\n");
 		return err;
 	}

 	err = join_grp(sk, "config");
 	if (err)
 		return err;

 	err = join_grp(sk, "packets");
 	if (err)
 		return err;

 	return 0;
 }
 $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c

Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20231206213102.1824398-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/psample/psample.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/psample/psample.c b/net/psample/psample.c
index 482c07f2766b..5913da77c71d 100644
--- a/net/psample/psample.c
+++ b/net/psample/psample.c
@@ -30,7 +30,8 @@ enum psample_nl_multicast_groups {
 
 static const struct genl_multicast_group psample_nl_mcgrps[] = {
 	[PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME },
-	[PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME },
+	[PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME,
+				      .flags = GENL_UNS_ADMIN_PERM },
 };
 
 static struct genl_family psample_nl_family __ro_after_init;

From e844a9309f517c2b4c2a8a4a5ebfc31f0d6648c6 Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@nvidia.com>
Date: Mon, 11 Dec 2023 14:37:40 +0200
Subject: [PATCH 0910/1043] drop_monitor: Require 'CAP_SYS_ADMIN' when joining
 "events" group

commit e03781879a0d524ce3126678d50a80484a513c4b upstream.

The "NET_DM" generic netlink family notifies drop locations over the
"events" multicast group. This is problematic since by default generic
netlink allows non-root users to listen to these notifications.

Fix by adding a new field to the generic netlink multicast group
structure that when set prevents non-root users or root without the
'CAP_SYS_ADMIN' capability (in the user namespace owning the network
namespace) from joining the group. Set this field for the "events"
group. Use 'CAP_SYS_ADMIN' rather than 'CAP_NET_ADMIN' because of the
nature of the information that is shared over this group.

Note that the capability check in this case will always be performed
against the initial user namespace since the family is not netns aware
and only operates in the initial network namespace.

A new field is added to the structure rather than using the "flags"
field because the existing field uses uAPI flags and it is inappropriate
to add a new uAPI flag for an internal kernel check. In net-next we can
rework the "flags" field to use internal flags and fold the new field
into it. But for now, in order to reduce the amount of changes, add a
new field.

Since the information can only be consumed by root, mark the control
plane operations that start and stop the tracing as root-only using the
'GENL_ADMIN_PERM' flag.

Tested using [1].

Before:

 # capsh -- -c ./dm_repo
 # capsh --drop=cap_sys_admin -- -c ./dm_repo

After:

 # capsh -- -c ./dm_repo
 # capsh --drop=cap_sys_admin -- -c ./dm_repo
 Failed to join "events" multicast group

[1]
 $ cat dm.c
 #include <stdio.h>
 #include <netlink/genl/ctrl.h>
 #include <netlink/genl/genl.h>
 #include <netlink/socket.h>

 int main(int argc, char **argv)
 {
 	struct nl_sock *sk;
 	int grp, err;

 	sk = nl_socket_alloc();
 	if (!sk) {
 		fprintf(stderr, "Failed to allocate socket\n");
 		return -1;
 	}

 	err = genl_connect(sk);
 	if (err) {
 		fprintf(stderr, "Failed to connect socket\n");
 		return err;
 	}

 	grp = genl_ctrl_resolve_grp(sk, "NET_DM", "events");
 	if (grp < 0) {
 		fprintf(stderr,
 			"Failed to resolve \"events\" multicast group\n");
 		return grp;
 	}

 	err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE);
 	if (err) {
 		fprintf(stderr, "Failed to join \"events\" multicast group\n");
 		return err;
 	}

 	return 0;
 }
 $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o dm_repo dm.c

Fixes: 9a8afc8d3962 ("Network Drop Monitor: Adding drop monitor implementation & Netlink protocol")
Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20231206213102.1824398-3-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/genetlink.h | 2 ++
 net/core/drop_monitor.c | 4 +++-
 net/netlink/genetlink.c | 3 +++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 7cb3fa8310ed..3057c8e6dcfe 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -11,10 +11,12 @@
 /**
  * struct genl_multicast_group - generic netlink multicast group
  * @name: name of the multicast group, names are per-family
+ * @cap_sys_admin: whether %CAP_SYS_ADMIN is required for binding
  */
 struct genl_multicast_group {
 	char			name[GENL_NAMSIZ];
 	u8			flags;
+	u8			cap_sys_admin:1;
 };
 
 struct genl_ops;
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index ed9dd17f9348..7742ee689141 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -183,7 +183,7 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
 }
 
 static const struct genl_multicast_group dropmon_mcgrps[] = {
-	{ .name = "events", },
+	{ .name = "events", .cap_sys_admin = 1 },
 };
 
 static void send_dm_alert(struct work_struct *work)
@@ -1616,11 +1616,13 @@ static const struct genl_small_ops dropmon_ops[] = {
 		.cmd = NET_DM_CMD_START,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 		.doit = net_dm_cmd_trace,
+		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NET_DM_CMD_STOP,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 		.doit = net_dm_cmd_trace,
+		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NET_DM_CMD_CONFIG_GET,
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 4dce39013d75..e9035de65546 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1387,6 +1387,9 @@ static int genl_bind(struct net *net, int group)
 		if ((grp->flags & GENL_UNS_ADMIN_PERM) &&
 		    !ns_capable(net->user_ns, CAP_NET_ADMIN))
 			ret = -EPERM;
+		if (grp->cap_sys_admin &&
+		    !ns_capable(net->user_ns, CAP_SYS_ADMIN))
+			ret = -EPERM;
 
 		break;
 	}

From bf72b44fe81be08a9fcd58aabf417cd3337ffc99 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Fri, 1 Dec 2023 15:47:13 +0100
Subject: [PATCH 0911/1043] netfilter: nft_set_pipapo: skip inactive elements
 during set walk

commit 317eb9685095678f2c9f5a8189de698c5354316a upstream.

Otherwise set elements can be deactivated twice which will cause a crash.

Reported-by: Xingyuan Mo <hdthky0@gmail.com>
Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nft_set_pipapo.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index fbfcc3275cad..bc30bd121ff2 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -2028,6 +2028,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set,
 
 		e = f->mt[r].e;
 
+		if (!nft_set_elem_active(&e->ext, iter->genmask))
+			goto cont;
+
 		elem.priv = e;
 
 		iter->err = iter->fn(ctx, set, iter, &elem);

From bdb26b819955edd296d722b34ba30bff6b0df730 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Fri, 20 Jan 2023 15:34:41 +0100
Subject: [PATCH 0912/1043] platform/x86: asus-wmi: Fix kbd_dock_devid
 tablet-switch reporting

commit fdcc0602d64f22185f61c70747214b630049cc33 upstream.

Commit 1ea0d3b46798 ("platform/x86: asus-wmi: Simplify tablet-mode-switch
handling") unified the asus-wmi tablet-switch handling, but it did not take
into account that the value returned for the kbd_dock_devid WMI method is
inverted where as the other ones are not inverted.

This causes asus-wmi to report an inverted tablet-switch state for devices
which use the kbd_dock_devid, which causes libinput to ignore touchpad
events while the affected T10x model 2-in-1s are docked.

Add inverting of the return value in the kbd_dock_devid case to fix this.

Fixes: 1ea0d3b46798 ("platform/x86: asus-wmi: Simplify tablet-mode-switch handling")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20230120143441.527334-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/x86/asus-wmi.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 695907c6503c..931656494768 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -202,6 +202,7 @@ struct asus_wmi {
 
 	int tablet_switch_event_code;
 	u32 tablet_switch_dev_id;
+	bool tablet_switch_inverted;
 
 	enum fan_type fan_type;
 	int fan_pwm_mode;
@@ -354,6 +355,13 @@ static bool asus_wmi_dev_is_present(struct asus_wmi *asus, u32 dev_id)
 }
 
 /* Input **********************************************************************/
+static void asus_wmi_tablet_sw_report(struct asus_wmi *asus, bool value)
+{
+	input_report_switch(asus->inputdev, SW_TABLET_MODE,
+			    asus->tablet_switch_inverted ? !value : value);
+	input_sync(asus->inputdev);
+}
+
 static void asus_wmi_tablet_sw_init(struct asus_wmi *asus, u32 dev_id, int event_code)
 {
 	struct device *dev = &asus->platform_device->dev;
@@ -362,7 +370,7 @@ static void asus_wmi_tablet_sw_init(struct asus_wmi *asus, u32 dev_id, int event
 	result = asus_wmi_get_devstate_simple(asus, dev_id);
 	if (result >= 0) {
 		input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
-		input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
+		asus_wmi_tablet_sw_report(asus, result);
 		asus->tablet_switch_dev_id = dev_id;
 		asus->tablet_switch_event_code = event_code;
 	} else if (result == -ENODEV) {
@@ -395,6 +403,7 @@ static int asus_wmi_input_init(struct asus_wmi *asus)
 	case asus_wmi_no_tablet_switch:
 		break;
 	case asus_wmi_kbd_dock_devid:
+		asus->tablet_switch_inverted = true;
 		asus_wmi_tablet_sw_init(asus, ASUS_WMI_DEVID_KBD_DOCK, NOTIFY_KBD_DOCK_CHANGE);
 		break;
 	case asus_wmi_lid_flip_devid:
@@ -434,10 +443,8 @@ static void asus_wmi_tablet_mode_get_state(struct asus_wmi *asus)
 		return;
 
 	result = asus_wmi_get_devstate_simple(asus, asus->tablet_switch_dev_id);
-	if (result >= 0) {
-		input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
-		input_sync(asus->inputdev);
-	}
+	if (result >= 0)
+		asus_wmi_tablet_sw_report(asus, result);
 }
 
 /* dGPU ********************************************************************/

From a8b781c410a5987dd16b4d81e1269b4ff68c5dc2 Mon Sep 17 00:00:00 2001
From: Namhyung Kim <namhyung@kernel.org>
Date: Thu, 18 Aug 2022 17:36:41 -0700
Subject: [PATCH 0913/1043] tools headers UAPI: Sync linux/perf_event.h with
 the kernel sources

commit 65ba872a6971c11ceb342c3330f059289c0e6bdb upstream.

To pick the trivial change in:

  119a784c81270eb8 ("perf/core: Add a new read format to get a number of lost samples")

Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20220819003644.508916-2-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/include/uapi/linux/perf_event.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/include/uapi/linux/perf_event.h b/tools/include/uapi/linux/perf_event.h
index b95d3c485d27..6ca63ab6bee5 100644
--- a/tools/include/uapi/linux/perf_event.h
+++ b/tools/include/uapi/linux/perf_event.h
@@ -279,6 +279,7 @@ enum {
  *	  { u64		time_enabled; } && PERF_FORMAT_TOTAL_TIME_ENABLED
  *	  { u64		time_running; } && PERF_FORMAT_TOTAL_TIME_RUNNING
  *	  { u64		id;           } && PERF_FORMAT_ID
+ *	  { u64		lost;         } && PERF_FORMAT_LOST
  *	} && !PERF_FORMAT_GROUP
  *
  *	{ u64		nr;
@@ -286,6 +287,7 @@ enum {
  *	  { u64		time_running; } && PERF_FORMAT_TOTAL_TIME_RUNNING
  *	  { u64		value;
  *	    { u64	id;           } && PERF_FORMAT_ID
+ *	    { u64	lost;         } && PERF_FORMAT_LOST
  *	  }		cntr[nr];
  *	} && PERF_FORMAT_GROUP
  * };
@@ -295,8 +297,9 @@ enum perf_event_read_format {
 	PERF_FORMAT_TOTAL_TIME_RUNNING		= 1U << 1,
 	PERF_FORMAT_ID				= 1U << 2,
 	PERF_FORMAT_GROUP			= 1U << 3,
+	PERF_FORMAT_LOST			= 1U << 4,
 
-	PERF_FORMAT_MAX = 1U << 4,		/* non-ABI */
+	PERF_FORMAT_MAX = 1U << 5,		/* non-ABI */
 };
 
 #define PERF_ATTR_SIZE_VER0	64	/* sizeof first published struct */

From 91b70f60c8e558ae13a7153d2c5d91642c90aaab Mon Sep 17 00:00:00 2001
From: "Luke D. Jones" <luke@ljones.dev>
Date: Sat, 13 Aug 2022 10:25:04 +1200
Subject: [PATCH 0914/1043] platform/x86: asus-wmi: Document the dgpu_disable
 sysfs attribute

commit 7e64c486e807c8edfbd3a0c8e44ad7a1896dbec8 upstream.

The dgpu_disable attribute was not documented, this adds the
required documentation.

Fixes: 98829e84dc67 ("asus-wmi: Add dgpu disable method")
Signed-off-by: Luke D. Jones <luke@ljones.dev>
Link: https://lore.kernel.org/r/20220812222509.292692-2-luke@ljones.dev
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/ABI/testing/sysfs-platform-asus-wmi | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Documentation/ABI/testing/sysfs-platform-asus-wmi b/Documentation/ABI/testing/sysfs-platform-asus-wmi
index 04885738cf15..0f8f0772d6f3 100644
--- a/Documentation/ABI/testing/sysfs-platform-asus-wmi
+++ b/Documentation/ABI/testing/sysfs-platform-asus-wmi
@@ -57,3 +57,12 @@ Description:
 			* 0 - default,
 			* 1 - overboost,
 			* 2 - silent
+
+What:		/sys/devices/platform/<platform>/dgpu_disable
+Date:		Aug 2022
+KernelVersion:	5.17
+Contact:	"Luke Jones" <luke@ljones.dev>
+Description:
+		Disable discrete GPU:
+			* 0 - Enable dGPU,
+			* 1 - Disable dGPU

From d7c3a467f47a947c81021be01c0035c4b30920f0 Mon Sep 17 00:00:00 2001
From: Adrian Hunter <adrian.hunter@intel.com>
Date: Fri, 3 Nov 2023 10:47:17 +0200
Subject: [PATCH 0915/1043] mmc: block: Be sure to wait while busy in CQE error
 recovery

commit c616696a902987352426fdaeec1b0b3240949e6b upstream.

STOP command does not guarantee to wait while busy, but subsequent command
MMC_CMDQ_TASK_MGMT to discard the queue will fail if the card is busy, so
be sure to wait by employing mmc_poll_for_busy().

Fixes: 72a5af554df8 ("mmc: core: Add support for handling CQE requests")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Reviewed-by: Christian Loehle <christian.loehle@arm.com>
Link: https://lore.kernel.org/r/20231103084720.6886-4-adrian.hunter@intel.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Tested-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/core/core.c    | 2 ++
 drivers/mmc/core/mmc_ops.c | 3 ++-
 drivers/mmc/core/mmc_ops.h | 1 +
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index fdeaaae08060..d5ca59bd1c99 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -553,6 +553,8 @@ int mmc_cqe_recovery(struct mmc_host *host)
 	cmd.busy_timeout = MMC_CQE_RECOVERY_TIMEOUT;
 	mmc_wait_for_cmd(host, &cmd, MMC_CMD_RETRIES);
 
+	mmc_poll_for_busy(host->card, MMC_CQE_RECOVERY_TIMEOUT, MMC_BUSY_IO);
+
 	memset(&cmd, 0, sizeof(cmd));
 	cmd.opcode       = MMC_CMDQ_TASK_MGMT;
 	cmd.arg          = 1; /* Discard entire queue */
diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
index ebad70e4481a..b6bb7f7faee2 100644
--- a/drivers/mmc/core/mmc_ops.c
+++ b/drivers/mmc/core/mmc_ops.c
@@ -452,7 +452,7 @@ static int mmc_busy_status(struct mmc_card *card, bool retry_crc_err,
 	u32 status = 0;
 	int err;
 
-	if (host->ops->card_busy) {
+	if (busy_cmd != MMC_BUSY_IO && host->ops->card_busy) {
 		*busy = host->ops->card_busy(host);
 		return 0;
 	}
@@ -473,6 +473,7 @@ static int mmc_busy_status(struct mmc_card *card, bool retry_crc_err,
 		err = R1_STATUS(status) ? -EIO : 0;
 		break;
 	case MMC_BUSY_HPI:
+	case MMC_BUSY_IO:
 		break;
 	default:
 		err = -EINVAL;
diff --git a/drivers/mmc/core/mmc_ops.h b/drivers/mmc/core/mmc_ops.h
index 632009260e51..e3cbb1ddc31c 100644
--- a/drivers/mmc/core/mmc_ops.h
+++ b/drivers/mmc/core/mmc_ops.h
@@ -14,6 +14,7 @@ enum mmc_busy_cmd {
 	MMC_BUSY_CMD6,
 	MMC_BUSY_ERASE,
 	MMC_BUSY_HPI,
+	MMC_BUSY_IO,
 };
 
 struct mmc_host;

From 8cb1209989fb333a24dee33c21e43043108c5024 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 11 Dec 2023 15:52:30 +0100
Subject: [PATCH 0916/1043] Revert "btrfs: add dmesg output for first mount and
 last unmount of a filesystem"

This reverts commit 2d6c2238acf8043ec71cdede3542efd54e02798a which is
commit 2db313205f8b96eea467691917138d646bb50aef upstream.

As pointed out by many, the disk_super structure is NOT initialized
before it is dereferenced in the function
fs/btrfs/disk-io.c:open_ctree() that this commit adds, so something went
wrong here.

Revert it for now until it gets straightened out.

Link: https://lore.kernel.org/r/5b0eb360-3765-40e1-854a-9da6d97eb405@roeck-us.net
Link: https://lore.kernel.org/r/20231209172836.GA2154579@dev-arch.thelio-3990X
Reported-by: Guenter Roeck <linux@roeck-us.net>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Cc: Anand Jain <anand.jain@oracle.com>
Cc: Qu Wenruo <wqu@suse.com>
Cc: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/disk-io.c | 1 -
 fs/btrfs/super.c   | 5 +----
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index cd689d5c4c82..0e25a3f64b2e 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2972,7 +2972,6 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_device
 		goto fail_alloc;
 	}
 
-	btrfs_info(fs_info, "first mount of filesystem %pU", disk_super->fsid);
 	/*
 	 * Verify the type first, if that or the checksum value are
 	 * corrupted, we'll find out
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index fd4edd966450..ea731fa8bd35 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -318,10 +318,7 @@ void __btrfs_panic(struct btrfs_fs_info *fs_info, const char *function,
 
 static void btrfs_put_super(struct super_block *sb)
 {
-	struct btrfs_fs_info *fs_info = btrfs_sb(sb);
-
-	btrfs_info(fs_info, "last unmount of filesystem %pU", fs_info->fs_devices->fsid);
-	close_ctree(fs_info);
+	close_ctree(btrfs_sb(sb));
 }
 
 enum {

From 0b1711b486deb27f6698b53cf2ff2eff75a9a5bb Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Mon, 4 Dec 2023 14:01:59 +0000
Subject: [PATCH 0917/1043] cifs: Fix non-availability of dedup breaking
 generic/304

[ Upstream commit 691a41d8da4b34fe72f09393505f55f28a8f34ec ]

Deduplication isn't supported on cifs, but cifs doesn't reject it, instead
treating it as extent duplication/cloning.  This can cause generic/304 to go
silly and run for hours on end.

Fix cifs to indicate EOPNOTSUPP if REMAP_FILE_DEDUP is set in
->remap_file_range().

Note that it's unclear whether or not commit b073a08016a1 is meant to cause
cifs to return an error if REMAP_FILE_DEDUP.

Fixes: b073a08016a1 ("cifs: fix that return -EINVAL when do dedupe operation")
Cc: stable@vger.kernel.org
Suggested-by: Dave Chinner <david@fromorbit.com>
cc: Xiaoli Feng <fengxiaoli0714@gmail.com>
cc: Shyam Prasad N <nspmangalore@gmail.com>
cc: Rohith Surabattula <rohiths.msft@gmail.com>
cc: Jeff Layton <jlayton@kernel.org>
cc: Darrick Wong <darrick.wong@oracle.com>
cc: fstests@vger.kernel.org
cc: linux-cifs@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
Link: https://lore.kernel.org/r/3876191.1701555260@warthog.procyon.org.uk/
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/cifsfs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index b87d6792b14a..16155529e449 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1093,7 +1093,9 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
 	unsigned int xid;
 	int rc;
 
-	if (remap_flags & ~(REMAP_FILE_DEDUP | REMAP_FILE_ADVISORY))
+	if (remap_flags & REMAP_FILE_DEDUP)
+		return -EOPNOTSUPP;
+	if (remap_flags & ~REMAP_FILE_ADVISORY)
 		return -EINVAL;
 
 	cifs_dbg(FYI, "clone range\n");

From 12467ad3f3d4f5321c1052cd978846e552a5847d Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.com>
Date: Tue, 5 Dec 2023 21:49:29 -0300
Subject: [PATCH 0918/1043] smb: client: fix potential NULL deref in
 parse_dfs_referrals()

[ Upstream commit 92414333eb375ed64f4ae92d34d579e826936480 ]

If server returned no data for FSCTL_DFS_GET_REFERRALS, @dfs_rsp will
remain NULL and then parse_dfs_referrals() will dereference it.

Fix this by returning -EIO when no output data is returned.

Besides, we can't fix it in SMB2_ioctl() as some FSCTLs are allowed to
return no data as per MS-SMB2 2.2.32.

Fixes: 9d49640a21bf ("CIFS: implement get_dfs_refer for SMB2+")
Cc: stable@vger.kernel.org
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/smb2ops.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 015b7b37edee..e58525a95827 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -2765,6 +2765,8 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses,
 				(char **)&dfs_rsp, &dfs_rsp_size);
 	} while (rc == -EAGAIN);
 
+	if (!rc && !dfs_rsp)
+		rc = -EIO;
 	if (rc) {
 		if ((rc != -ENOENT) && (rc != -EOPNOTSUPP))
 			cifs_tcon_dbg(VFS, "ioctl error in %s rc=%d\n", __func__, rc);

From 9e0ca920123f58135a1e59c6e2baef4d6bc8f8dd Mon Sep 17 00:00:00 2001
From: Mukesh Ojha <quic_mojha@quicinc.com>
Date: Tue, 13 Sep 2022 18:20:24 +0530
Subject: [PATCH 0919/1043] devcoredump : Serialize devcd_del work

[ Upstream commit 01daccf748323dfc61112f474cf2ba81015446b0 ]

In following scenario(diagram), when one thread X running dev_coredumpm()
adds devcd device to the framework which sends uevent notification to
userspace and another thread Y reads this uevent and call to
devcd_data_write() which eventually try to delete the queued timer that
is not initialized/queued yet.

So, debug object reports some warning and in the meantime, timer is
initialized and queued from X path. and from Y path, it gets reinitialized
again and timer->entry.pprev=NULL and try_to_grab_pending() stucks.

To fix this, introduce mutex and a boolean flag to serialize the behaviour.

 	cpu0(X)			                cpu1(Y)

    dev_coredump() uevent sent to user space
    device_add()  ======================> user space process Y reads the
                                          uevents writes to devcd fd
                                          which results into writes to

                                         devcd_data_write()
                                           mod_delayed_work()
                                             try_to_grab_pending()
                                               del_timer()
                                                 debug_assert_init()
   INIT_DELAYED_WORK()
   schedule_delayed_work()
                                                   debug_object_fixup()
                                                     timer_fixup_assert_init()
                                                       timer_setup()
                                                         do_init_timer()
                                                       /*
                                                        Above call reinitializes
                                                        the timer to
                                                        timer->entry.pprev=NULL
                                                        and this will be checked
                                                        later in timer_pending() call.
                                                       */
                                                 timer_pending()
                                                  !hlist_unhashed_lockless(&timer->entry)
                                                    !h->pprev
                                                /*
                                                  del_timer() checks h->pprev and finds
                                                  it to be NULL due to which
                                                  try_to_grab_pending() stucks.
                                                */

Link: https://lore.kernel.org/lkml/2e1f81e2-428c-f11f-ce92-eb11048cb271@quicinc.com/
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Link: https://lore.kernel.org/r/1663073424-13663-1-git-send-email-quic_mojha@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: af54d778a038 ("devcoredump: Send uevent once devcd is ready")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/devcoredump.c | 83 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 81 insertions(+), 2 deletions(-)

diff --git a/drivers/base/devcoredump.c b/drivers/base/devcoredump.c
index 9243468e2c99..ef23c1c33eb2 100644
--- a/drivers/base/devcoredump.c
+++ b/drivers/base/devcoredump.c
@@ -29,6 +29,47 @@ struct devcd_entry {
 	struct device devcd_dev;
 	void *data;
 	size_t datalen;
+	/*
+	 * Here, mutex is required to serialize the calls to del_wk work between
+	 * user/kernel space which happens when devcd is added with device_add()
+	 * and that sends uevent to user space. User space reads the uevents,
+	 * and calls to devcd_data_write() which try to modify the work which is
+	 * not even initialized/queued from devcoredump.
+	 *
+	 *
+	 *
+	 *        cpu0(X)                                 cpu1(Y)
+	 *
+	 *        dev_coredump() uevent sent to user space
+	 *        device_add()  ======================> user space process Y reads the
+	 *                                              uevents writes to devcd fd
+	 *                                              which results into writes to
+	 *
+	 *                                             devcd_data_write()
+	 *                                               mod_delayed_work()
+	 *                                                 try_to_grab_pending()
+	 *                                                   del_timer()
+	 *                                                     debug_assert_init()
+	 *       INIT_DELAYED_WORK()
+	 *       schedule_delayed_work()
+	 *
+	 *
+	 * Also, mutex alone would not be enough to avoid scheduling of
+	 * del_wk work after it get flush from a call to devcd_free()
+	 * mentioned as below.
+	 *
+	 *	disabled_store()
+	 *        devcd_free()
+	 *          mutex_lock()             devcd_data_write()
+	 *          flush_delayed_work()
+	 *          mutex_unlock()
+	 *                                   mutex_lock()
+	 *                                   mod_delayed_work()
+	 *                                   mutex_unlock()
+	 * So, delete_work flag is required.
+	 */
+	struct mutex mutex;
+	bool delete_work;
 	struct module *owner;
 	ssize_t (*read)(char *buffer, loff_t offset, size_t count,
 			void *data, size_t datalen);
@@ -88,7 +129,12 @@ static ssize_t devcd_data_write(struct file *filp, struct kobject *kobj,
 	struct device *dev = kobj_to_dev(kobj);
 	struct devcd_entry *devcd = dev_to_devcd(dev);
 
-	mod_delayed_work(system_wq, &devcd->del_wk, 0);
+	mutex_lock(&devcd->mutex);
+	if (!devcd->delete_work) {
+		devcd->delete_work = true;
+		mod_delayed_work(system_wq, &devcd->del_wk, 0);
+	}
+	mutex_unlock(&devcd->mutex);
 
 	return count;
 }
@@ -116,7 +162,12 @@ static int devcd_free(struct device *dev, void *data)
 {
 	struct devcd_entry *devcd = dev_to_devcd(dev);
 
+	mutex_lock(&devcd->mutex);
+	if (!devcd->delete_work)
+		devcd->delete_work = true;
+
 	flush_delayed_work(&devcd->del_wk);
+	mutex_unlock(&devcd->mutex);
 	return 0;
 }
 
@@ -126,6 +177,30 @@ static ssize_t disabled_show(struct class *class, struct class_attribute *attr,
 	return sysfs_emit(buf, "%d\n", devcd_disabled);
 }
 
+/*
+ *
+ *	disabled_store()                                	worker()
+ *	 class_for_each_device(&devcd_class,
+ *		NULL, NULL, devcd_free)
+ *         ...
+ *         ...
+ *	   while ((dev = class_dev_iter_next(&iter))
+ *                                                             devcd_del()
+ *                                                               device_del()
+ *                                                                 put_device() <- last reference
+ *             error = fn(dev, data)                           devcd_dev_release()
+ *             devcd_free(dev, data)                           kfree(devcd)
+ *             mutex_lock(&devcd->mutex);
+ *
+ *
+ * In the above diagram, It looks like disabled_store() would be racing with parallely
+ * running devcd_del() and result in memory abort while acquiring devcd->mutex which
+ * is called after kfree of devcd memory  after dropping its last reference with
+ * put_device(). However, this will not happens as fn(dev, data) runs
+ * with its own reference to device via klist_node so it is not its last reference.
+ * so, above situation would not occur.
+ */
+
 static ssize_t disabled_store(struct class *class, struct class_attribute *attr,
 			      const char *buf, size_t count)
 {
@@ -282,13 +357,16 @@ void dev_coredumpm(struct device *dev, struct module *owner,
 	devcd->read = read;
 	devcd->free = free;
 	devcd->failing_dev = get_device(dev);
+	devcd->delete_work = false;
 
+	mutex_init(&devcd->mutex);
 	device_initialize(&devcd->devcd_dev);
 
 	dev_set_name(&devcd->devcd_dev, "devcd%d",
 		     atomic_inc_return(&devcd_count));
 	devcd->devcd_dev.class = &devcd_class;
 
+	mutex_lock(&devcd->mutex);
 	if (device_add(&devcd->devcd_dev))
 		goto put_device;
 
@@ -302,10 +380,11 @@ void dev_coredumpm(struct device *dev, struct module *owner,
 
 	INIT_DELAYED_WORK(&devcd->del_wk, devcd_del);
 	schedule_delayed_work(&devcd->del_wk, DEVCD_TIMEOUT);
-
+	mutex_unlock(&devcd->mutex);
 	return;
  put_device:
 	put_device(&devcd->devcd_dev);
+	mutex_unlock(&devcd->mutex);
  put_module:
 	module_put(owner);
  free:

From 9e3ca02b11643e25fb3e12235b0ad9364c657c94 Mon Sep 17 00:00:00 2001
From: Mukesh Ojha <quic_mojha@quicinc.com>
Date: Fri, 17 Nov 2023 20:19:32 +0530
Subject: [PATCH 0920/1043] devcoredump: Send uevent once devcd is ready

[ Upstream commit af54d778a03853801d681c98c0c2a6c316ef9ca7 ]

dev_coredumpm() creates a devcoredump device and adds it
to the core kernel framework which eventually end up
sending uevent to the user space and later creates a
symbolic link to the failed device. An application
running in userspace may be interested in this symbolic
link to get the name of the failed device.

In a issue scenario, once uevent sent to the user space
it start reading '/sys/class/devcoredump/devcdX/failing_device'
to get the actual name of the device which might not been
created and it is in its path of creation.

To fix this, suppress sending uevent till the failing device
symbolic link gets created and send uevent once symbolic
link is created successfully.

Fixes: 833c95456a70 ("device coredump: add new device coredump class")
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1700232572-25823-1-git-send-email-quic_mojha@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/devcoredump.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/base/devcoredump.c b/drivers/base/devcoredump.c
index ef23c1c33eb2..4d725d1fd61a 100644
--- a/drivers/base/devcoredump.c
+++ b/drivers/base/devcoredump.c
@@ -367,6 +367,7 @@ void dev_coredumpm(struct device *dev, struct module *owner,
 	devcd->devcd_dev.class = &devcd_class;
 
 	mutex_lock(&devcd->mutex);
+	dev_set_uevent_suppress(&devcd->devcd_dev, true);
 	if (device_add(&devcd->devcd_dev))
 		goto put_device;
 
@@ -378,6 +379,8 @@ void dev_coredumpm(struct device *dev, struct module *owner,
 			      "devcoredump"))
 		/* nothing - symlink will be missing */;
 
+	dev_set_uevent_suppress(&devcd->devcd_dev, false);
+	kobject_uevent(&devcd->devcd_dev.kobj, KOBJ_ADD);
 	INIT_DELAYED_WORK(&devcd->del_wk, devcd_del);
 	schedule_delayed_work(&devcd->del_wk, DEVCD_TIMEOUT);
 	mutex_unlock(&devcd->mutex);

From fa49e956b7259a346377cc0290a62bdfcac17f25 Mon Sep 17 00:00:00 2001
From: ChunHao Lin <hau@realtek.com>
Date: Wed, 29 Nov 2023 23:53:50 +0800
Subject: [PATCH 0921/1043] r8169: fix rtl8125b PAUSE frames blasting when
 suspended

[ Upstream commit 4b0768b6556af56ee9b7cf4e68452a2b6289ae45 ]

When FIFO reaches near full state, device will issue pause frame.
If pause slot is enabled(set to 1), in this time, device will issue
pause frame only once. But if pause slot is disabled(set to 0), device
will keep sending pause frames until FIFO reaches near empty state.

When pause slot is disabled, if there is no one to handle receive
packets, device FIFO will reach near full state and keep sending
pause frames. That will impact entire local area network.

This issue can be reproduced in Chromebox (not Chromebook) in
developer mode running a test image (and v5.10 kernel):
1) ping -f $CHROMEBOX (from workstation on same local network)
2) run "powerd_dbus_suspend" from command line on the $CHROMEBOX
3) ping $ROUTER (wait until ping fails from workstation)

Takes about ~20-30 seconds after step 2 for the local network to
stop working.

Fix this issue by enabling pause slot to only send pause frame once
when FIFO reaches near full state.

Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125")
Reported-by: Grant Grundler <grundler@chromium.org>
Tested-by: Grant Grundler <grundler@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: ChunHao Lin <hau@realtek.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/20231129155350.5843-1-hau@realtek.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 88253cedd9d9..c72ff0fd38c4 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -205,6 +205,7 @@ enum rtl_registers {
 					/* No threshold before first PCI xfer */
 #define	RX_FIFO_THRESH			(7 << RXCFG_FIFO_SHIFT)
 #define	RX_EARLY_OFF			(1 << 11)
+#define	RX_PAUSE_SLOT_ON		(1 << 11)	/* 8125b and later */
 #define	RXCFG_DMA_SHIFT			8
 					/* Unlimited maximum PCI burst. */
 #define	RX_DMA_BURST			(7 << RXCFG_DMA_SHIFT)
@@ -2318,9 +2319,13 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
 	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_52:
 		RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
 		break;
-	case RTL_GIGA_MAC_VER_60 ... RTL_GIGA_MAC_VER_63:
+	case RTL_GIGA_MAC_VER_61:
 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST);
 		break;
+	case RTL_GIGA_MAC_VER_63:
+		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST |
+			RX_PAUSE_SLOT_ON);
+		break;
 	default:
 		RTL_W32(tp, RxConfig, RX128_INT_EN | RX_DMA_BURST);
 		break;

From b50306f77190155d2c14a72be5d2e02254d17dbd Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 13 Dec 2023 18:27:07 +0100
Subject: [PATCH 0922/1043] Linux 5.10.204

Link: https://lore.kernel.org/r/20231211182019.802717483@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 4cbeb198196b..87886018d774 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 203
+SUBLEVEL = 204
 EXTRAVERSION =
 NAME = Dare mighty things
 

From e710feda7ed9b849fb9bede0d5e03621c526b9c9 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 18 Dec 2023 19:17:03 +0000
Subject: [PATCH 0923/1043] Revert "hrtimers: Push pending hrtimers away from
 outgoing CPU earlier"

This reverts commit 7f4c89400d2997939f6971c7981cc780a219e36b which is
commit 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ifdc5474de6e7488eb24959df1697b61b2e3e7880
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/linux/cpuhotplug.h |  1 -
 include/linux/hrtimer.h    |  4 ++--
 kernel/cpu.c               |  8 +-------
 kernel/time/hrtimer.c      | 33 +++++++++++++++++++++------------
 4 files changed, 24 insertions(+), 22 deletions(-)

diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index d1e086d6a4d7..843bb056b8c6 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -148,7 +148,6 @@ enum cpuhp_state {
 	CPUHP_AP_ARM_CORESIGHT_CTI_STARTING,
 	CPUHP_AP_ARM64_ISNDEP_STARTING,
 	CPUHP_AP_SMPCFD_DYING,
-	CPUHP_AP_HRTIMERS_DYING,
 	CPUHP_AP_X86_TBOOT_DYING,
 	CPUHP_AP_ARM_CACHE_B15_RAC_DYING,
 	CPUHP_AP_ONLINE,
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 42f4af2fc864..9874d37cd8e4 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -529,9 +529,9 @@ extern void sysrq_timer_list_show(void);
 
 int hrtimers_prepare_cpu(unsigned int cpu);
 #ifdef CONFIG_HOTPLUG_CPU
-int hrtimers_cpu_dying(unsigned int cpu);
+int hrtimers_dead_cpu(unsigned int cpu);
 #else
-#define hrtimers_cpu_dying	NULL
+#define hrtimers_dead_cpu	NULL
 #endif
 
 #endif
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 3dbfbeae3150..c44e1b705bea 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1906,7 +1906,7 @@ static struct cpuhp_step cpuhp_hp_states[] = {
 	[CPUHP_HRTIMERS_PREPARE] = {
 		.name			= "hrtimers:prepare",
 		.startup.single		= hrtimers_prepare_cpu,
-		.teardown.single	= NULL,
+		.teardown.single	= hrtimers_dead_cpu,
 	},
 	[CPUHP_SMPCFD_PREPARE] = {
 		.name			= "smpcfd:prepare",
@@ -1973,12 +1973,6 @@ static struct cpuhp_step cpuhp_hp_states[] = {
 		.startup.single		= NULL,
 		.teardown.single	= smpcfd_dying_cpu,
 	},
-	[CPUHP_AP_HRTIMERS_DYING] = {
-		.name			= "hrtimers:dying",
-		.startup.single		= NULL,
-		.teardown.single	= hrtimers_cpu_dying,
-	},
-
 	/* Entry state on starting. Interrupts enabled from here on. Transient
 	 * state for synchronsization */
 	[CPUHP_AP_ONLINE] = {
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index ede09dda36e9..70deb2f01e97 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -2114,22 +2114,29 @@ static void migrate_hrtimer_list(struct hrtimer_clock_base *old_base,
 	}
 }
 
-int hrtimers_cpu_dying(unsigned int dying_cpu)
+int hrtimers_dead_cpu(unsigned int scpu)
 {
 	struct hrtimer_cpu_base *old_base, *new_base;
-	int i, ncpu = cpumask_first(cpu_active_mask);
+	int i;
 
-	tick_cancel_sched_timer(dying_cpu);
-
-	old_base = this_cpu_ptr(&hrtimer_bases);
-	new_base = &per_cpu(hrtimer_bases, ncpu);
+	BUG_ON(cpu_online(scpu));
+	tick_cancel_sched_timer(scpu);
 
+	/*
+	 * this BH disable ensures that raise_softirq_irqoff() does
+	 * not wakeup ksoftirqd (and acquire the pi-lock) while
+	 * holding the cpu_base lock
+	 */
+	local_bh_disable();
+	local_irq_disable();
+	old_base = &per_cpu(hrtimer_bases, scpu);
+	new_base = this_cpu_ptr(&hrtimer_bases);
 	/*
 	 * The caller is globally serialized and nobody else
 	 * takes two locks at once, deadlock is not possible.
 	 */
-	raw_spin_lock(&old_base->lock);
-	raw_spin_lock_nested(&new_base->lock, SINGLE_DEPTH_NESTING);
+	raw_spin_lock(&new_base->lock);
+	raw_spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING);
 
 	for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
 		migrate_hrtimer_list(&old_base->clock_base[i],
@@ -2140,13 +2147,15 @@ int hrtimers_cpu_dying(unsigned int dying_cpu)
 	 * The migration might have changed the first expiring softirq
 	 * timer on this CPU. Update it.
 	 */
-	__hrtimer_get_next_event(new_base, HRTIMER_ACTIVE_SOFT);
-	/* Tell the other CPU to retrigger the next event */
-	smp_call_function_single(ncpu, retrigger_next_event, NULL, 0);
+	hrtimer_update_softirq_timer(new_base, false);
 
-	raw_spin_unlock(&new_base->lock);
 	raw_spin_unlock(&old_base->lock);
+	raw_spin_unlock(&new_base->lock);
 
+	/* Check, if we got expired work to do */
+	__hrtimer_peek_ahead_timers();
+	local_irq_enable();
+	local_bh_enable();
 	return 0;
 }
 

From 86a3866fec5b69f2ee48a194291566c55942212c Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 18 Dec 2023 19:00:55 +0000
Subject: [PATCH 0924/1043] Revert "perf: Fix perf_event_validate_size()"

This reverts commit 208dd116f96ea19e5d38d7b80fce49bc5ce1bbe8 which is
commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I7db90bfbe74a408b807480c811382e38731f0c53
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 kernel/events/core.c | 61 +++++++++++++++++---------------------------
 1 file changed, 23 insertions(+), 38 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index e0aad8aaf50b..b9034e9d8869 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1845,34 +1845,31 @@ static inline void perf_event__state_init(struct perf_event *event)
 					      PERF_EVENT_STATE_INACTIVE;
 }
 
-static int __perf_event_read_size(u64 read_format, int nr_siblings)
+static void __perf_event_read_size(struct perf_event *event, int nr_siblings)
 {
 	int entry = sizeof(u64); /* value */
 	int size = 0;
 	int nr = 1;
 
-	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
+	if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
 		size += sizeof(u64);
 
-	if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
+	if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
 		size += sizeof(u64);
 
-	if (read_format & PERF_FORMAT_ID)
+	if (event->attr.read_format & PERF_FORMAT_ID)
 		entry += sizeof(u64);
 
-	if (read_format & PERF_FORMAT_LOST)
+	if (event->attr.read_format & PERF_FORMAT_LOST)
 		entry += sizeof(u64);
 
-	if (read_format & PERF_FORMAT_GROUP) {
+	if (event->attr.read_format & PERF_FORMAT_GROUP) {
 		nr += nr_siblings;
 		size += sizeof(u64);
 	}
 
-	/*
-	 * Since perf_event_validate_size() limits this to 16k and inhibits
-	 * adding more siblings, this will never overflow.
-	 */
-	return size + nr * entry;
+	size += entry * nr;
+	event->read_size = size;
 }
 
 static void __perf_event_header_size(struct perf_event *event, u64 sample_type)
@@ -1916,9 +1913,8 @@ static void __perf_event_header_size(struct perf_event *event, u64 sample_type)
  */
 static void perf_event__header_size(struct perf_event *event)
 {
-	event->read_size =
-		__perf_event_read_size(event->attr.read_format,
-				       event->group_leader->nr_siblings);
+	__perf_event_read_size(event,
+			       event->group_leader->nr_siblings);
 	__perf_event_header_size(event, event->attr.sample_type);
 }
 
@@ -1949,35 +1945,24 @@ static void perf_event__id_header_size(struct perf_event *event)
 	event->id_header_size = size;
 }
 
-/*
- * Check that adding an event to the group does not result in anybody
- * overflowing the 64k event limit imposed by the output buffer.
- *
- * Specifically, check that the read_size for the event does not exceed 16k,
- * read_size being the one term that grows with groups size. Since read_size
- * depends on per-event read_format, also (re)check the existing events.
- *
- * This leaves 48k for the constant size fields and things like callchains,
- * branch stacks and register sets.
- */
 static bool perf_event_validate_size(struct perf_event *event)
 {
-	struct perf_event *sibling, *group_leader = event->group_leader;
+	/*
+	 * The values computed here will be over-written when we actually
+	 * attach the event.
+	 */
+	__perf_event_read_size(event, event->group_leader->nr_siblings + 1);
+	__perf_event_header_size(event, event->attr.sample_type & ~PERF_SAMPLE_READ);
+	perf_event__id_header_size(event);
 
-	if (__perf_event_read_size(event->attr.read_format,
-				   group_leader->nr_siblings + 1) > 16*1024)
+	/*
+	 * Sum the lot; should not exceed the 64k limit we have on records.
+	 * Conservative limit to allow for callchains and other variable fields.
+	 */
+	if (event->read_size + event->header_size +
+	    event->id_header_size + sizeof(struct perf_event_header) >= 16*1024)
 		return false;
 
-	if (__perf_event_read_size(group_leader->attr.read_format,
-				   group_leader->nr_siblings + 1) > 16*1024)
-		return false;
-
-	for_each_sibling_event(sibling, group_leader) {
-		if (__perf_event_read_size(sibling->attr.read_format,
-					   group_leader->nr_siblings + 1) > 16*1024)
-			return false;
-	}
-
 	return true;
 }
 

From e4dd66fb0276856c241541061291c339b10de0a5 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 18 Dec 2023 19:01:15 +0000
Subject: [PATCH 0925/1043] Revert "perf/core: Add a new read format to get a
 number of lost samples"

This reverts commit 8bd3d61624d503ebe8b8469021a03bef359f89de which is
commit 119a784c81270eb88e573174ed2209225d646656 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I9f973774a99437a3dcfecf32eff8e7ddcfd418ed
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/linux/perf_event.h      |  2 --
 include/uapi/linux/perf_event.h |  5 +----
 kernel/events/core.c            | 21 +++------------------
 kernel/events/ring_buffer.c     |  5 +----
 4 files changed, 5 insertions(+), 28 deletions(-)

diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index b5d3aa067779..346d24a1469a 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -755,8 +755,6 @@ struct perf_event {
 	struct pid_namespace		*ns;
 	u64				id;
 
-	atomic64_t			lost_samples;
-
 	u64				(*clock)(void);
 	perf_overflow_handler_t		overflow_handler;
 	void				*overflow_handler_context;
diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
index 81348c2ad116..33bdc13b81cb 100644
--- a/include/uapi/linux/perf_event.h
+++ b/include/uapi/linux/perf_event.h
@@ -279,7 +279,6 @@ enum {
  *	  { u64		time_enabled; } && PERF_FORMAT_TOTAL_TIME_ENABLED
  *	  { u64		time_running; } && PERF_FORMAT_TOTAL_TIME_RUNNING
  *	  { u64		id;           } && PERF_FORMAT_ID
- *	  { u64		lost;         } && PERF_FORMAT_LOST
  *	} && !PERF_FORMAT_GROUP
  *
  *	{ u64		nr;
@@ -287,7 +286,6 @@ enum {
  *	  { u64		time_running; } && PERF_FORMAT_TOTAL_TIME_RUNNING
  *	  { u64		value;
  *	    { u64	id;           } && PERF_FORMAT_ID
- *	    { u64	lost;         } && PERF_FORMAT_LOST
  *	  }		cntr[nr];
  *	} && PERF_FORMAT_GROUP
  * };
@@ -297,9 +295,8 @@ enum perf_event_read_format {
 	PERF_FORMAT_TOTAL_TIME_RUNNING		= 1U << 1,
 	PERF_FORMAT_ID				= 1U << 2,
 	PERF_FORMAT_GROUP			= 1U << 3,
-	PERF_FORMAT_LOST			= 1U << 4,
 
-	PERF_FORMAT_MAX = 1U << 5,		/* non-ABI */
+	PERF_FORMAT_MAX = 1U << 4,		/* non-ABI */
 };
 
 #define PERF_ATTR_SIZE_VER0	64	/* sizeof first published struct */
diff --git a/kernel/events/core.c b/kernel/events/core.c
index b9034e9d8869..80ab33aa3a18 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1860,9 +1860,6 @@ static void __perf_event_read_size(struct perf_event *event, int nr_siblings)
 	if (event->attr.read_format & PERF_FORMAT_ID)
 		entry += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_LOST)
-		entry += sizeof(u64);
-
 	if (event->attr.read_format & PERF_FORMAT_GROUP) {
 		nr += nr_siblings;
 		size += sizeof(u64);
@@ -5199,15 +5196,11 @@ static int __perf_read_group_add(struct perf_event *leader,
 	values[n++] += perf_event_count(leader);
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(leader);
-	if (read_format & PERF_FORMAT_LOST)
-		values[n++] = atomic64_read(&leader->lost_samples);
 
 	for_each_sibling_event(sub, leader) {
 		values[n++] += perf_event_count(sub);
 		if (read_format & PERF_FORMAT_ID)
 			values[n++] = primary_event_id(sub);
-		if (read_format & PERF_FORMAT_LOST)
-			values[n++] = atomic64_read(&sub->lost_samples);
 	}
 
 	raw_spin_unlock_irqrestore(&ctx->lock, flags);
@@ -5264,7 +5257,7 @@ static int perf_read_one(struct perf_event *event,
 				 u64 read_format, char __user *buf)
 {
 	u64 enabled, running;
-	u64 values[5];
+	u64 values[4];
 	int n = 0;
 
 	values[n++] = __perf_event_read_value(event, &enabled, &running);
@@ -5274,8 +5267,6 @@ static int perf_read_one(struct perf_event *event,
 		values[n++] = running;
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(event);
-	if (read_format & PERF_FORMAT_LOST)
-		values[n++] = atomic64_read(&event->lost_samples);
 
 	if (copy_to_user(buf, values, n * sizeof(u64)))
 		return -EFAULT;
@@ -6768,7 +6759,7 @@ static void perf_output_read_one(struct perf_output_handle *handle,
 				 u64 enabled, u64 running)
 {
 	u64 read_format = event->attr.read_format;
-	u64 values[5];
+	u64 values[4];
 	int n = 0;
 
 	values[n++] = perf_event_count(event);
@@ -6782,8 +6773,6 @@ static void perf_output_read_one(struct perf_output_handle *handle,
 	}
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(event);
-	if (read_format & PERF_FORMAT_LOST)
-		values[n++] = atomic64_read(&event->lost_samples);
 
 	__output_copy(handle, values, n * sizeof(u64));
 }
@@ -6794,7 +6783,7 @@ static void perf_output_read_group(struct perf_output_handle *handle,
 {
 	struct perf_event *leader = event->group_leader, *sub;
 	u64 read_format = event->attr.read_format;
-	u64 values[6];
+	u64 values[5];
 	int n = 0;
 
 	values[n++] = 1 + leader->nr_siblings;
@@ -6812,8 +6801,6 @@ static void perf_output_read_group(struct perf_output_handle *handle,
 	values[n++] = perf_event_count(leader);
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(leader);
-	if (read_format & PERF_FORMAT_LOST)
-		values[n++] = atomic64_read(&leader->lost_samples);
 
 	__output_copy(handle, values, n * sizeof(u64));
 
@@ -6827,8 +6814,6 @@ static void perf_output_read_group(struct perf_output_handle *handle,
 		values[n++] = perf_event_count(sub);
 		if (read_format & PERF_FORMAT_ID)
 			values[n++] = primary_event_id(sub);
-		if (read_format & PERF_FORMAT_LOST)
-			values[n++] = atomic64_read(&sub->lost_samples);
 
 		__output_copy(handle, values, n * sizeof(u64));
 	}
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index ca27946fdaaf..01351e7e2543 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -172,10 +172,8 @@ __perf_output_begin(struct perf_output_handle *handle,
 		goto out;
 
 	if (unlikely(rb->paused)) {
-		if (rb->nr_pages) {
+		if (rb->nr_pages)
 			local_inc(&rb->lost);
-			atomic64_inc(&event->lost_samples);
-		}
 		goto out;
 	}
 
@@ -256,7 +254,6 @@ __perf_output_begin(struct perf_output_handle *handle,
 
 fail:
 	local_inc(&rb->lost);
-	atomic64_inc(&event->lost_samples);
 	perf_output_put_handle(handle);
 out:
 	rcu_read_unlock();

From ae04f2701b69b4f4ed3fed27d632226c82b66acc Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 18 Dec 2023 19:07:26 +0000
Subject: [PATCH 0926/1043] Revert "drop_monitor: Require 'CAP_SYS_ADMIN' when
 joining "events" group"

This reverts commit e844a9309f517c2b4c2a8a4a5ebfc31f0d6648c6 which is
commit e03781879a0d524ce3126678d50a80484a513c4b upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Iecbd6b6537bd4cd2d178d0afbdc7557e521429c5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/net/genetlink.h | 2 --
 net/core/drop_monitor.c | 4 +---
 net/netlink/genetlink.c | 3 ---
 3 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index df9a829bb447..a48feee47b2b 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -12,12 +12,10 @@
 /**
  * struct genl_multicast_group - generic netlink multicast group
  * @name: name of the multicast group, names are per-family
- * @cap_sys_admin: whether %CAP_SYS_ADMIN is required for binding
  */
 struct genl_multicast_group {
 	char			name[GENL_NAMSIZ];
 	u8			flags;
-	u8			cap_sys_admin:1;
 };
 
 struct genl_ops;
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 7742ee689141..ed9dd17f9348 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -183,7 +183,7 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
 }
 
 static const struct genl_multicast_group dropmon_mcgrps[] = {
-	{ .name = "events", .cap_sys_admin = 1 },
+	{ .name = "events", },
 };
 
 static void send_dm_alert(struct work_struct *work)
@@ -1616,13 +1616,11 @@ static const struct genl_small_ops dropmon_ops[] = {
 		.cmd = NET_DM_CMD_START,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 		.doit = net_dm_cmd_trace,
-		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NET_DM_CMD_STOP,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 		.doit = net_dm_cmd_trace,
-		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NET_DM_CMD_CONFIG_GET,
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index e9035de65546..4dce39013d75 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1387,9 +1387,6 @@ static int genl_bind(struct net *net, int group)
 		if ((grp->flags & GENL_UNS_ADMIN_PERM) &&
 		    !ns_capable(net->user_ns, CAP_NET_ADMIN))
 			ret = -EPERM;
-		if (grp->cap_sys_admin &&
-		    !ns_capable(net->user_ns, CAP_SYS_ADMIN))
-			ret = -EPERM;
 
 		break;
 	}

From 36f0b85aff197d34fcc3a53b16882d932a76a29b Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 18 Dec 2023 19:07:47 +0000
Subject: [PATCH 0927/1043] Revert "genetlink: add CAP_NET_ADMIN test for
 multicast bind"

This reverts commit 015870c10c45902882d2d4adad17f162df144104 which does
not have a direct relation to an upstream commit.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I8ddc8a86b47a9560115ccb83fc50d522436d0b3b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/net/genetlink.h |  1 -
 net/netlink/genetlink.c | 32 --------------------------------
 2 files changed, 33 deletions(-)

diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index a48feee47b2b..d66f0f397f2e 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -15,7 +15,6 @@
  */
 struct genl_multicast_group {
 	char			name[GENL_NAMSIZ];
-	u8			flags;
 };
 
 struct genl_ops;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 4dce39013d75..9fd7ba01b9f8 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1364,43 +1364,11 @@ static struct genl_family genl_ctrl __ro_after_init = {
 	.netnsok = true,
 };
 
-static int genl_bind(struct net *net, int group)
-{
-	const struct genl_family *family;
-	unsigned int id;
-	int ret = 0;
-
-	genl_lock_all();
-
-	idr_for_each_entry(&genl_fam_idr, family, id) {
-		const struct genl_multicast_group *grp;
-		int i;
-
-		if (family->n_mcgrps == 0)
-			continue;
-
-		i = group - family->mcgrp_offset;
-		if (i < 0 || i >= family->n_mcgrps)
-			continue;
-
-		grp = &family->mcgrps[i];
-		if ((grp->flags & GENL_UNS_ADMIN_PERM) &&
-		    !ns_capable(net->user_ns, CAP_NET_ADMIN))
-			ret = -EPERM;
-
-		break;
-	}
-
-	genl_unlock_all();
-	return ret;
-}
-
 static int __net_init genl_pernet_init(struct net *net)
 {
 	struct netlink_kernel_cfg cfg = {
 		.input		= genl_rcv,
 		.flags		= NL_CFG_F_NONROOT_RECV,
-		.bind		= genl_bind,
 	};
 
 	/* we'll bump the group number right afterwards */

From 63d180012d78b520c5e8713e7cfa4bfdb18d2547 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Tue, 19 Dec 2023 10:36:54 +0000
Subject: [PATCH 0928/1043] Revert "psample: Require 'CAP_NET_ADMIN' when
 joining "packets" group"

This reverts commit ad2223a16925c20155294fdec7ae67127d8e16e1 which is
commit 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I7235543b47283c02435320bf1a1c39139d68a5b6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 net/psample/psample.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/psample/psample.c b/net/psample/psample.c
index 5913da77c71d..482c07f2766b 100644
--- a/net/psample/psample.c
+++ b/net/psample/psample.c
@@ -30,8 +30,7 @@ enum psample_nl_multicast_groups {
 
 static const struct genl_multicast_group psample_nl_mcgrps[] = {
 	[PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME },
-	[PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME,
-				      .flags = GENL_UNS_ADMIN_PERM },
+	[PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME },
 };
 
 static struct genl_family psample_nl_family __ro_after_init;

From 8ee7b2c46594a804c02ee44402e0b04f1acc68e4 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Mon, 4 Dec 2023 12:29:54 +0100
Subject: [PATCH 0929/1043] netfilter: nf_tables: fix 'exist' matching on
 bigendian arches
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 63331e37fb227e796894b31d713697612c8dee7f ]

Maze reports "tcp option fastopen exists" fails to match on
OpenWrt 22.03.5, r20134-5f15225c1e (5.10.176) router.

"tcp option fastopen exists" translates to:
inet
  [ exthdr load tcpopt 1b @ 34 + 0 present => reg 1 ]
  [ cmp eq reg 1 0x00000001 ]

.. but existing nft userspace generates a 1-byte compare.

On LSB (x86), "*reg32 = 1" is identical to nft_reg_store8(reg32, 1), but
not on MSB, which will place the 1 last. IOW, on bigendian aches the cmp8
is awalys false.

Make sure we store this in a consistent fashion, so existing userspace
will also work on MSB (bigendian).

Regardless of this patch we can also change nft userspace to generate
'reg32 == 0' and 'reg32 != 0' instead of u8 == 0 // u8 == 1 when
adding 'option x missing/exists' expressions as well.

Fixes: 3c1fece8819e ("netfilter: nft_exthdr: Allow checking TCP option presence, too")
Fixes: b9f9a485fb0e ("netfilter: nft_exthdr: add boolean DCCP option matching")
Fixes: 055c4b34b94f ("netfilter: nft_fib: Support existence check")
Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com>
Closes: https://lore.kernel.org/netfilter-devel/CAHo-OozyEqHUjL2-ntATzeZOiuftLWZ_HU6TOM_js4qLfDEAJg@mail.gmail.com/
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_exthdr.c | 2 +-
 net/netfilter/nft_fib.c    | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index cb69a299f10c..c9f89f035ccf 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -214,7 +214,7 @@ static void nft_exthdr_tcp_eval(const struct nft_expr *expr,
 
 		offset = i + priv->offset;
 		if (priv->flags & NFT_EXTHDR_F_PRESENT) {
-			*dest = 1;
+			nft_reg_store8(dest, 1);
 		} else {
 			if (priv->len % NFT_REG32_SIZE)
 				dest[priv->len / NFT_REG32_SIZE] = 0;
diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c
index b10ce732b337..1fd4b2054e8f 100644
--- a/net/netfilter/nft_fib.c
+++ b/net/netfilter/nft_fib.c
@@ -140,11 +140,15 @@ void nft_fib_store_result(void *reg, const struct nft_fib *priv,
 	switch (priv->result) {
 	case NFT_FIB_RESULT_OIF:
 		index = dev ? dev->ifindex : 0;
-		*dreg = (priv->flags & NFTA_FIB_F_PRESENT) ? !!index : index;
+		if (priv->flags & NFTA_FIB_F_PRESENT)
+			nft_reg_store8(dreg, !!index);
+		else
+			*dreg = index;
+
 		break;
 	case NFT_FIB_RESULT_OIFNAME:
 		if (priv->flags & NFTA_FIB_F_PRESENT)
-			*dreg = !!dev;
+			nft_reg_store8(dreg, !!dev);
 		else
 			strncpy(reg, dev ? dev->name : "", IFNAMSIZ);
 		break;

From 84eed654ff333b6f2d07258feccb98e97f688ccf Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Mon, 11 Dec 2023 21:43:52 +0000
Subject: [PATCH 0930/1043] afs: Fix refcount underflow from error handling
 race

[ Upstream commit 52bf9f6c09fca8c74388cd41cc24e5d1bff812a9 ]

If an AFS cell that has an unreachable (eg. ENETUNREACH) server listed (VL
server or fileserver), an asynchronous probe to one of its addresses may
fail immediately because sendmsg() returns an error.  When this happens, a
refcount underflow can happen if certain events hit a very small window.

The way this occurs is:

 (1) There are two levels of "call" object, the afs_call and the
     rxrpc_call.  Each of them can be transitioned to a "completed" state
     in the event of success or failure.

 (2) Asynchronous afs_calls are self-referential whilst they are active to
     prevent them from evaporating when they're not being processed.  This
     reference is disposed of when the afs_call is completed.

     Note that an afs_call may only be completed once; once completed
     completing it again will do nothing.

 (3) When a call transmission is made, the app-side rxrpc code queues a Tx
     buffer for the rxrpc I/O thread to transmit.  The I/O thread invokes
     sendmsg() to transmit it - and in the case of failure, it transitions
     the rxrpc_call to the completed state.

 (4) When an rxrpc_call is completed, the app layer is notified.  In this
     case, the app is kafs and it schedules a work item to process events
     pertaining to an afs_call.

 (5) When the afs_call event processor is run, it goes down through the
     RPC-specific handler to afs_extract_data() to retrieve data from rxrpc
     - and, in this case, it picks up the error from the rxrpc_call and
     returns it.

     The error is then propagated to the afs_call and that is completed
     too.  At this point the self-reference is released.

 (6) If the rxrpc I/O thread manages to complete the rxrpc_call within the
     window between rxrpc_send_data() queuing the request packet and
     checking for call completion on the way out, then
     rxrpc_kernel_send_data() will return the error from sendmsg() to the
     app.

 (7) Then afs_make_call() will see an error and will jump to the error
     handling path which will attempt to clean up the afs_call.

 (8) The problem comes when the error handling path in afs_make_call()
     tries to unconditionally drop an async afs_call's self-reference.
     This self-reference, however, may already have been dropped by
     afs_extract_data() completing the afs_call

 (9) The refcount underflows when we return to afs_do_probe_vlserver() and
     that tries to drop its reference on the afs_call.

Fix this by making afs_make_call() attempt to complete the afs_call rather
than unconditionally putting it.  That way, if afs_extract_data() manages
to complete the call first, afs_make_call() won't do anything.

The bug can be forced by making do_udp_sendmsg() return -ENETUNREACH and
sticking an msleep() in rxrpc_send_data() after the 'success:' label to
widen the race window.

The error message looks something like:

    refcount_t: underflow; use-after-free.
    WARNING: CPU: 3 PID: 720 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110
    ...
    RIP: 0010:refcount_warn_saturate+0xba/0x110
    ...
    afs_put_call+0x1dc/0x1f0 [kafs]
    afs_fs_get_capabilities+0x8b/0xe0 [kafs]
    afs_fs_probe_fileserver+0x188/0x1e0 [kafs]
    afs_lookup_server+0x3bf/0x3f0 [kafs]
    afs_alloc_server_list+0x130/0x2e0 [kafs]
    afs_create_volume+0x162/0x400 [kafs]
    afs_get_tree+0x266/0x410 [kafs]
    vfs_get_tree+0x25/0xc0
    fc_mount+0xe/0x40
    afs_d_automount+0x1b3/0x390 [kafs]
    __traverse_mounts+0x8f/0x210
    step_into+0x340/0x760
    path_openat+0x13a/0x1260
    do_filp_open+0xaf/0x160
    do_sys_openat2+0xaf/0x170

or something like:

    refcount_t: underflow; use-after-free.
    ...
    RIP: 0010:refcount_warn_saturate+0x99/0xda
    ...
    afs_put_call+0x4a/0x175
    afs_send_vl_probes+0x108/0x172
    afs_select_vlserver+0xd6/0x311
    afs_do_cell_detect_alias+0x5e/0x1e9
    afs_cell_detect_alias+0x44/0x92
    afs_validate_fc+0x9d/0x134
    afs_get_tree+0x20/0x2e6
    vfs_get_tree+0x1d/0xc9
    fc_mount+0xe/0x33
    afs_d_automount+0x48/0x9d
    __traverse_mounts+0xe0/0x166
    step_into+0x140/0x274
    open_last_lookups+0x1c1/0x1df
    path_openat+0x138/0x1c3
    do_filp_open+0x55/0xb4
    do_sys_openat2+0x6c/0xb6

Fixes: 34fa47612bfe ("afs: Fix race in async call refcounting")
Reported-by: Bill MacAllister <bill@ca-zephyr.org>
Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1052304
Suggested-by: Jeffrey E Altman <jaltman@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Link: https://lore.kernel.org/r/2633992.1702073229@warthog.procyon.org.uk/ # v1
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/rxrpc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 535d28b44bca..1820b53657a6 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -491,7 +491,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp)
 	if (call->async) {
 		if (cancel_work_sync(&call->async_work))
 			afs_put_call(call);
-		afs_put_call(call);
+		afs_set_call_complete(call, ret, 0);
 	}
 
 	ac->error = ret;

From b30fbeb390d066e7686ce1b9035ebf7c61848ad9 Mon Sep 17 00:00:00 2001
From: Mikhail Khvainitski <me@khvoinitsky.org>
Date: Tue, 12 Dec 2023 15:31:48 +0200
Subject: [PATCH 0931/1043] HID: lenovo: Restrict detection of patched firmware
 only to USB cptkbd

[ Upstream commit 43527a0094c10dfbf0d5a2e7979395a38de3ff65 ]

Commit 46a0a2c96f0f ("HID: lenovo: Detect quirk-free fw on cptkbd and
stop applying workaround") introduced a regression for ThinkPad
TrackPoint Keyboard II which has similar quirks to cptkbd (so it uses
the same workarounds) but slightly different so that there are
false-positives during detecting well-behaving firmware. This commit
restricts detecting well-behaving firmware to the only model which
known to have one and have stable enough quirks to not cause
false-positives.

Fixes: 46a0a2c96f0f ("HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround")
Link: https://lore.kernel.org/linux-input/ZXRiiPsBKNasioqH@jekhomev/
Link: https://bbs.archlinux.org/viewtopic.php?pid=2135468#p2135468
Signed-off-by: Mikhail Khvainitski <me@khvoinitsky.org>
Tested-by: Yauhen Kharuzhy <jekhor@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-lenovo.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
index 71f7b0d539df..249af8d26fe7 100644
--- a/drivers/hid/hid-lenovo.c
+++ b/drivers/hid/hid-lenovo.c
@@ -489,7 +489,8 @@ static int lenovo_event_cptkbd(struct hid_device *hdev,
 		 * so set middlebutton_state to 3
 		 * to never apply workaround anymore
 		 */
-		if (cptkbd_data->middlebutton_state == 1 &&
+		if (hdev->product == USB_DEVICE_ID_LENOVO_CUSBKBD &&
+				cptkbd_data->middlebutton_state == 1 &&
 				usage->type == EV_REL &&
 				(usage->code == REL_X || usage->code == REL_Y)) {
 			cptkbd_data->middlebutton_state = 3;

From 97275e470c2a6d19916b47b631d6ec3bd4427566 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Wed, 6 Dec 2023 09:36:12 -0800
Subject: [PATCH 0932/1043] net: ipv6: support reporting otherwise unknown
 prefix flags in RTM_NEWPREFIX
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit bd4a816752bab609dd6d65ae021387beb9e2ddbd ]

Lorenzo points out that we effectively clear all unknown
flags from PIO when copying them to userspace in the netlink
RTM_NEWPREFIX notification.

We could fix this one at a time as new flags are defined,
or in one fell swoop - I choose the latter.

We could either define 6 new reserved flags (reserved1..6) and handle
them individually (and rename them as new flags are defined), or we
could simply copy the entire unmodified byte over - I choose the latter.

This unfortunately requires some anonymous union/struct magic,
so we add a static assert on the struct size for a little extra safety.

Cc: David Ahern <dsahern@kernel.org>
Cc: Lorenzo Colitti <lorenzo@google.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/addrconf.h | 12 ++++++++++--
 include/net/if_inet6.h |  4 ----
 net/ipv6/addrconf.c    |  6 +-----
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index edba74a53683..4d0c4cf1d4c8 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -31,17 +31,22 @@ struct prefix_info {
 	__u8			length;
 	__u8			prefix_len;
 
+	union __packed {
+		__u8		flags;
+		struct __packed {
 #if defined(__BIG_ENDIAN_BITFIELD)
-	__u8			onlink : 1,
+			__u8	onlink : 1,
 			 	autoconf : 1,
 				reserved : 6;
 #elif defined(__LITTLE_ENDIAN_BITFIELD)
-	__u8			reserved : 6,
+			__u8	reserved : 6,
 				autoconf : 1,
 				onlink : 1;
 #else
 #error "Please fix <asm/byteorder.h>"
 #endif
+		};
+	};
 	__be32			valid;
 	__be32			prefered;
 	__be32			reserved2;
@@ -49,6 +54,9 @@ struct prefix_info {
 	struct in6_addr		prefix;
 };
 
+/* rfc4861 4.6.2: IPv6 PIO is 32 bytes in size */
+static_assert(sizeof(struct prefix_info) == 32);
+
 #include <linux/ipv6.h>
 #include <linux/netdevice.h>
 #include <net/if_inet6.h>
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index e03ba8e80781..d4d7f4d52b15 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -22,10 +22,6 @@
 #define IF_RS_SENT	0x10
 #define IF_READY	0x80000000
 
-/* prefix flags */
-#define IF_PREFIX_ONLINK	0x01
-#define IF_PREFIX_AUTOCONF	0x02
-
 enum {
 	INET6_IFADDR_STATE_PREDAD,
 	INET6_IFADDR_STATE_DAD,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 193e5f275733..79787a1f5ab3 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -6034,11 +6034,7 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
 	pmsg->prefix_len = pinfo->prefix_len;
 	pmsg->prefix_type = pinfo->type;
 	pmsg->prefix_pad3 = 0;
-	pmsg->prefix_flags = 0;
-	if (pinfo->onlink)
-		pmsg->prefix_flags |= IF_PREFIX_ONLINK;
-	if (pinfo->autoconf)
-		pmsg->prefix_flags |= IF_PREFIX_AUTOCONF;
+	pmsg->prefix_flags = pinfo->flags;
 
 	if (nla_put(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix))
 		goto nla_put_failure;

From a07e5568d95f879127793ac4eb825885ab6cdcf9 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Wed, 6 Dec 2023 15:12:20 +0100
Subject: [PATCH 0933/1043] qca_debug: Prevent crash on TX ring changes

[ Upstream commit f4e6064c97c050bd9904925ff7d53d0c9954fc7b ]

The qca_spi driver stop and restart the SPI kernel thread
(via ndo_stop & ndo_open) in case of TX ring changes. This is
a big issue because it allows userspace to prevent restart of
the SPI kernel thread (via signals). A subsequent change of
TX ring wrongly assume a valid spi_thread pointer which result
in a crash.

So prevent this by stopping the network traffic handling and
temporary park the SPI thread.

Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Link: https://lore.kernel.org/r/20231206141222.52029-2-wahrenst@gmx.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qualcomm/qca_debug.c |  9 ++++-----
 drivers/net/ethernet/qualcomm/qca_spi.c   | 12 ++++++++++++
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/qca_debug.c b/drivers/net/ethernet/qualcomm/qca_debug.c
index 702aa217a27a..4c6c1792fdc7 100644
--- a/drivers/net/ethernet/qualcomm/qca_debug.c
+++ b/drivers/net/ethernet/qualcomm/qca_debug.c
@@ -258,7 +258,6 @@ qcaspi_get_ringparam(struct net_device *dev, struct ethtool_ringparam *ring)
 static int
 qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring)
 {
-	const struct net_device_ops *ops = dev->netdev_ops;
 	struct qcaspi *qca = netdev_priv(dev);
 
 	if ((ring->rx_pending) ||
@@ -266,14 +265,14 @@ qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring)
 	    (ring->rx_jumbo_pending))
 		return -EINVAL;
 
-	if (netif_running(dev))
-		ops->ndo_stop(dev);
+	if (qca->spi_thread)
+		kthread_park(qca->spi_thread);
 
 	qca->txr.count = max_t(u32, ring->tx_pending, TX_RING_MIN_LEN);
 	qca->txr.count = min_t(u16, qca->txr.count, TX_RING_MAX_LEN);
 
-	if (netif_running(dev))
-		ops->ndo_open(dev);
+	if (qca->spi_thread)
+		kthread_unpark(qca->spi_thread);
 
 	return 0;
 }
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 44fa959ebcaa..b08a4b2a6a99 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -573,6 +573,18 @@ qcaspi_spi_thread(void *data)
 	netdev_info(qca->net_dev, "SPI thread created\n");
 	while (!kthread_should_stop()) {
 		set_current_state(TASK_INTERRUPTIBLE);
+		if (kthread_should_park()) {
+			netif_tx_disable(qca->net_dev);
+			netif_carrier_off(qca->net_dev);
+			qcaspi_flush_tx_ring(qca);
+			kthread_parkme();
+			if (qca->sync == QCASPI_SYNC_READY) {
+				netif_carrier_on(qca->net_dev);
+				netif_wake_queue(qca->net_dev);
+			}
+			continue;
+		}
+
 		if ((qca->intr_req == qca->intr_svc) &&
 		    !qca->txr.skb[qca->txr.head])
 			schedule();

From 347d10877bde00cd9f998f7dbaa82b87b524a3cf Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Wed, 6 Dec 2023 15:12:21 +0100
Subject: [PATCH 0934/1043] qca_debug: Fix ethtool -G iface tx behavior

[ Upstream commit 96a7e861d9e04d07febd3011c30cd84cd141d81f ]

After calling ethtool -g it was not possible to adjust the TX ring
size again:

  # ethtool -g eth1
  Ring parameters for eth1:
  Pre-set maximums:
  RX:		4
  RX Mini:	n/a
  RX Jumbo:	n/a
  TX:		10
  Current hardware settings:
  RX:		4
  RX Mini:	n/a
  RX Jumbo:	n/a
  TX:		10
  # ethtool -G eth1 tx 8
  netlink error: Invalid argument

The reason for this is that the readonly setting rx_pending get
initialized and after that the range check in qcaspi_set_ringparam()
fails regardless of the provided parameter. So fix this by accepting
the exposed RX defaults. Instead of adding another magic number
better use a new define here.

Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Link: https://lore.kernel.org/r/20231206141222.52029-3-wahrenst@gmx.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qualcomm/qca_debug.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/qca_debug.c b/drivers/net/ethernet/qualcomm/qca_debug.c
index 4c6c1792fdc7..66229b300c5a 100644
--- a/drivers/net/ethernet/qualcomm/qca_debug.c
+++ b/drivers/net/ethernet/qualcomm/qca_debug.c
@@ -30,6 +30,8 @@
 
 #define QCASPI_MAX_REGS 0x20
 
+#define QCASPI_RX_MAX_FRAMES 4
+
 static const u16 qcaspi_spi_regs[] = {
 	SPI_REG_BFR_SIZE,
 	SPI_REG_WRBUF_SPC_AVA,
@@ -249,9 +251,9 @@ qcaspi_get_ringparam(struct net_device *dev, struct ethtool_ringparam *ring)
 {
 	struct qcaspi *qca = netdev_priv(dev);
 
-	ring->rx_max_pending = 4;
+	ring->rx_max_pending = QCASPI_RX_MAX_FRAMES;
 	ring->tx_max_pending = TX_RING_MAX_LEN;
-	ring->rx_pending = 4;
+	ring->rx_pending = QCASPI_RX_MAX_FRAMES;
 	ring->tx_pending = qca->txr.count;
 }
 
@@ -260,7 +262,7 @@ qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring)
 {
 	struct qcaspi *qca = netdev_priv(dev);
 
-	if ((ring->rx_pending) ||
+	if (ring->rx_pending != QCASPI_RX_MAX_FRAMES ||
 	    (ring->rx_mini_pending) ||
 	    (ring->rx_jumbo_pending))
 		return -EINVAL;

From 6a7b673e6ec7d1a5a86d4ff8c430e0a205a6af2b Mon Sep 17 00:00:00 2001
From: Stefan Wahren <wahrenst@gmx.net>
Date: Wed, 6 Dec 2023 15:12:22 +0100
Subject: [PATCH 0935/1043] qca_spi: Fix reset behavior

[ Upstream commit 1057812d146dd658c9a9a96d869c2551150207b5 ]

In case of a reset triggered by the QCA7000 itself, the behavior of the
qca_spi driver was not quite correct:
- in case of a pending RX frame decoding the drop counter must be
  incremented and decoding state machine reseted
- also the reset counter must always be incremented regardless of sync
  state

Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Link: https://lore.kernel.org/r/20231206141222.52029-4-wahrenst@gmx.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qualcomm/qca_spi.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index b08a4b2a6a99..ffa1846f5b4c 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -613,11 +613,17 @@ qcaspi_spi_thread(void *data)
 			if (intr_cause & SPI_INT_CPU_ON) {
 				qcaspi_qca7k_sync(qca, QCASPI_EVENT_CPUON);
 
+				/* Frame decoding in progress */
+				if (qca->frm_handle.state != qca->frm_handle.init)
+					qca->net_dev->stats.rx_dropped++;
+
+				qcafrm_fsm_init_spi(&qca->frm_handle);
+				qca->stats.device_reset++;
+
 				/* not synced. */
 				if (qca->sync != QCASPI_SYNC_READY)
 					continue;
 
-				qca->stats.device_reset++;
 				netif_wake_queue(qca->net_dev);
 				netif_carrier_on(qca->net_dev);
 			}

From df5c24df63c4d289ca62bb654212bc9507c0d617 Mon Sep 17 00:00:00 2001
From: Chengfeng Ye <dg573847474@gmail.com>
Date: Thu, 7 Dec 2023 12:34:37 +0000
Subject: [PATCH 0936/1043] atm: solos-pci: Fix potential deadlock on
 &cli_queue_lock

[ Upstream commit d5dba32b8f6cb39be708b726044ba30dbc088b30 ]

As &card->cli_queue_lock is acquired under softirq context along the
following call chain from solos_bh(), other acquisition of the same
lock inside process context should disable at least bh to avoid double
lock.

<deadlock #1>
console_show()
--> spin_lock(&card->cli_queue_lock)
<interrupt>
   --> solos_bh()
   --> spin_lock(&card->cli_queue_lock)

This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.

To prevent the potential deadlock, the patch uses spin_lock_bh()
on the card->cli_queue_lock under process context code consistently
to prevent the possible deadlock scenario.

Fixes: 9c54004ea717 ("atm: Driver for Solos PCI ADSL2+ card.")
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/solos-pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 94fbc3abe60e..95f768b28a5e 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -449,9 +449,9 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
 	struct sk_buff *skb;
 	unsigned int len;
 
-	spin_lock(&card->cli_queue_lock);
+	spin_lock_bh(&card->cli_queue_lock);
 	skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]);
-	spin_unlock(&card->cli_queue_lock);
+	spin_unlock_bh(&card->cli_queue_lock);
 	if(skb == NULL)
 		return sprintf(buf, "No data.\n");
 

From bc0860a3c49c2b13a1c7992239d7e7a034ee34a9 Mon Sep 17 00:00:00 2001
From: Chengfeng Ye <dg573847474@gmail.com>
Date: Thu, 7 Dec 2023 12:34:53 +0000
Subject: [PATCH 0937/1043] atm: solos-pci: Fix potential deadlock on
 &tx_queue_lock

[ Upstream commit 15319a4e8ee4b098118591c6ccbd17237f841613 ]

As &card->tx_queue_lock is acquired under softirq context along the
following call chain from solos_bh(), other acquisition of the same
lock inside process context should disable at least bh to avoid double
lock.

<deadlock #2>
pclose()
--> spin_lock(&card->tx_queue_lock)
<interrupt>
   --> solos_bh()
   --> fpga_tx()
   --> spin_lock(&card->tx_queue_lock)

This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.

To prevent the potential deadlock, the patch uses spin_lock_bh()
on &card->tx_queue_lock under process context code consistently to
prevent the possible deadlock scenario.

Fixes: 213e85d38912 ("solos-pci: clean up pclose() function")
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/solos-pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 95f768b28a5e..d3c30a28c410 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -956,14 +956,14 @@ static void pclose(struct atm_vcc *vcc)
 	struct pkt_hdr *header;
 
 	/* Remove any yet-to-be-transmitted packets from the pending queue */
-	spin_lock(&card->tx_queue_lock);
+	spin_lock_bh(&card->tx_queue_lock);
 	skb_queue_walk_safe(&card->tx_queue[port], skb, tmpskb) {
 		if (SKB_CB(skb)->vcc == vcc) {
 			skb_unlink(skb, &card->tx_queue[port]);
 			solos_pop(vcc, skb);
 		}
 	}
-	spin_unlock(&card->tx_queue_lock);
+	spin_unlock_bh(&card->tx_queue_lock);
 
 	skb = alloc_skb(sizeof(*header), GFP_KERNEL);
 	if (!skb) {

From d15e4b825dc0b0ad24a54d493be2f17bd8eb7f0b Mon Sep 17 00:00:00 2001
From: Vladimir Oltean <vladimir.oltean@nxp.com>
Date: Fri, 21 Apr 2023 01:55:54 +0300
Subject: [PATCH 0938/1043] net: vlan: introduce skb_vlan_eth_hdr()

[ Upstream commit 1f5020acb33f926030f62563c86dffca35c7b701 ]

Similar to skb_eth_hdr() introduced in commit 96cc4b69581d ("macvlan: do
not assume mac_header is set in macvlan_broadcast()"), let's introduce a
skb_vlan_eth_hdr() helper which can be used in TX-only code paths to get
to the VLAN header based on skb->data rather than based on the
skb_mac_header(skb).

We also consolidate the drivers that dereference skb->data to go through
this helper.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 9fc95fe95c3e ("net: fec: correct queue selection")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c      |  3 +--
 drivers/net/ethernet/emulex/benet/be_main.c          |  2 +-
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c      |  2 +-
 drivers/net/ethernet/intel/i40e/i40e_txrx.c          |  2 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c        |  2 +-
 drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c |  2 +-
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c       |  4 ++--
 drivers/net/ethernet/sfc/tx_tso.c                    |  2 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c    |  7 ++-----
 drivers/staging/gdm724x/gdm_lte.c                    |  4 ++--
 include/linux/if_vlan.h                              | 12 ++++++++++--
 net/batman-adv/soft-interface.c                      |  2 +-
 12 files changed, 24 insertions(+), 20 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 4f669e7c7558..4509a29ff73f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1924,8 +1924,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
 
 		/* Skip VLAN tag if present */
 		if (ether_type == ETH_P_8021Q) {
-			struct vlan_ethhdr *vhdr =
-				(struct vlan_ethhdr *)skb->data;
+			struct vlan_ethhdr *vhdr = skb_vlan_eth_hdr(skb);
 
 			ether_type = ntohs(vhdr->h_vlan_encapsulated_proto);
 		}
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 52b399aa3213..edd4dd73b3e3 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1125,7 +1125,7 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter,
 						  struct be_wrb_params
 						  *wrb_params)
 {
-	struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+	struct vlan_ethhdr *veh = skb_vlan_eth_hdr(skb);
 	unsigned int eth_hdr_len;
 	struct iphdr *ip;
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 4df5e91e86ce..a4ab3e7efa5e 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -1002,7 +1002,7 @@ static int hns3_handle_vtags(struct hns3_enet_ring *tx_ring,
 	if (unlikely(rc < 0))
 		return rc;
 
-	vhdr = (struct vlan_ethhdr *)skb->data;
+	vhdr = skb_vlan_eth_hdr(skb);
 	vhdr->h_vlan_TCI |= cpu_to_be16((skb->priority << VLAN_PRIO_SHIFT)
 					 & VLAN_PRIO_MASK);
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 88d8f17cefd8..57667ccc28f5 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -2879,7 +2879,7 @@ static inline int i40e_tx_prepare_vlan_flags(struct sk_buff *skb,
 			rc = skb_cow_head(skb, 0);
 			if (rc < 0)
 				return rc;
-			vhdr = (struct vlan_ethhdr *)skb->data;
+			vhdr = skb_vlan_eth_hdr(skb);
 			vhdr->h_vlan_TCI = htons(tx_flags >>
 						 I40E_TX_FLAGS_VLAN_SHIFT);
 		} else {
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 2b100b7b325a..5829d81f2cb1 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -8707,7 +8707,7 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
 
 			if (skb_cow_head(skb, 0))
 				goto out_drop;
-			vhdr = (struct vlan_ethhdr *)skb->data;
+			vhdr = skb_vlan_eth_hdr(skb);
 			vhdr->h_vlan_TCI = htons(tx_flags >>
 						 IXGBE_TX_FLAGS_VLAN_SHIFT);
 		} else {
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index e2046b6d65a3..2c5460083564 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -1861,7 +1861,7 @@ netxen_tso_check(struct net_device *netdev,
 
 	if (protocol == cpu_to_be16(ETH_P_8021Q)) {
 
-		vh = (struct vlan_ethhdr *)skb->data;
+		vh = skb_vlan_eth_hdr(skb);
 		protocol = vh->h_vlan_encapsulated_proto;
 		flags = FLAGS_VLAN_TAGGED;
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index bdf15d2a6431..7260e57d79f2 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -317,7 +317,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter,
 
 	if (adapter->flags & QLCNIC_VLAN_FILTERING) {
 		if (protocol == ETH_P_8021Q) {
-			vh = (struct vlan_ethhdr *)skb->data;
+			vh = skb_vlan_eth_hdr(skb);
 			vlan_id = ntohs(vh->h_vlan_TCI);
 		} else if (skb_vlan_tag_present(skb)) {
 			vlan_id = skb_vlan_tag_get(skb);
@@ -467,7 +467,7 @@ static int qlcnic_tx_pkt(struct qlcnic_adapter *adapter,
 	u32 producer = tx_ring->producer;
 
 	if (protocol == ETH_P_8021Q) {
-		vh = (struct vlan_ethhdr *)skb->data;
+		vh = skb_vlan_eth_hdr(skb);
 		flags = QLCNIC_FLAGS_VLAN_TAGGED;
 		vlan_tci = ntohs(vh->h_vlan_TCI);
 		protocol = ntohs(vh->h_vlan_encapsulated_proto);
diff --git a/drivers/net/ethernet/sfc/tx_tso.c b/drivers/net/ethernet/sfc/tx_tso.c
index 898e5c61d908..d381d8164f07 100644
--- a/drivers/net/ethernet/sfc/tx_tso.c
+++ b/drivers/net/ethernet/sfc/tx_tso.c
@@ -147,7 +147,7 @@ static __be16 efx_tso_check_protocol(struct sk_buff *skb)
 	EFX_WARN_ON_ONCE_PARANOID(((struct ethhdr *)skb->data)->h_proto !=
 				  protocol);
 	if (protocol == htons(ETH_P_8021Q)) {
-		struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+		struct vlan_ethhdr *veh = skb_vlan_eth_hdr(skb);
 
 		protocol = veh->h_vlan_encapsulated_proto;
 	}
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 59a07a01e80c..709bd81fde2a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3660,13 +3660,10 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
 static void stmmac_rx_vlan(struct net_device *dev, struct sk_buff *skb)
 {
-	struct vlan_ethhdr *veth;
-	__be16 vlan_proto;
+	struct vlan_ethhdr *veth = skb_vlan_eth_hdr(skb);
+	__be16 vlan_proto = veth->h_vlan_proto;
 	u16 vlanid;
 
-	veth = (struct vlan_ethhdr *)skb->data;
-	vlan_proto = veth->h_vlan_proto;
-
 	if ((vlan_proto == htons(ETH_P_8021Q) &&
 	     dev->features & NETIF_F_HW_VLAN_CTAG_RX) ||
 	    (vlan_proto == htons(ETH_P_8021AD) &&
diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c
index de30262c3fae..e0787647093d 100644
--- a/drivers/staging/gdm724x/gdm_lte.c
+++ b/drivers/staging/gdm724x/gdm_lte.c
@@ -350,7 +350,7 @@ static s32 gdm_lte_tx_nic_type(struct net_device *dev, struct sk_buff *skb)
 	/* Get ethernet protocol */
 	eth = (struct ethhdr *)skb->data;
 	if (ntohs(eth->h_proto) == ETH_P_8021Q) {
-		vlan_eth = (struct vlan_ethhdr *)skb->data;
+		vlan_eth = skb_vlan_eth_hdr(skb);
 		mac_proto = ntohs(vlan_eth->h_vlan_encapsulated_proto);
 		network_data = skb->data + VLAN_ETH_HLEN;
 		nic_type |= NIC_TYPE_F_VLAN;
@@ -436,7 +436,7 @@ static netdev_tx_t gdm_lte_tx(struct sk_buff *skb, struct net_device *dev)
 	 * driver based on the NIC mac
 	 */
 	if (nic_type & NIC_TYPE_F_VLAN) {
-		struct vlan_ethhdr *vlan_eth = (struct vlan_ethhdr *)skb->data;
+		struct vlan_ethhdr *vlan_eth = skb_vlan_eth_hdr(skb);
 
 		nic->vlan_id = ntohs(vlan_eth->h_vlan_TCI) & VLAN_VID_MASK;
 		data_buf = skb->data + (VLAN_ETH_HLEN - ETH_HLEN);
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 4e7e72f3da5b..ce6714bec65f 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -60,6 +60,14 @@ static inline struct vlan_ethhdr *vlan_eth_hdr(const struct sk_buff *skb)
 	return (struct vlan_ethhdr *)skb_mac_header(skb);
 }
 
+/* Prefer this version in TX path, instead of
+ * skb_reset_mac_header() + vlan_eth_hdr()
+ */
+static inline struct vlan_ethhdr *skb_vlan_eth_hdr(const struct sk_buff *skb)
+{
+	return (struct vlan_ethhdr *)skb->data;
+}
+
 #define VLAN_PRIO_MASK		0xe000 /* Priority Code Point */
 #define VLAN_PRIO_SHIFT		13
 #define VLAN_CFI_MASK		0x1000 /* Canonical Format Indicator / Drop Eligible Indicator */
@@ -526,7 +534,7 @@ static inline void __vlan_hwaccel_put_tag(struct sk_buff *skb,
  */
 static inline int __vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)
 {
-	struct vlan_ethhdr *veth = (struct vlan_ethhdr *)skb->data;
+	struct vlan_ethhdr *veth = skb_vlan_eth_hdr(skb);
 
 	if (!eth_type_vlan(veth->h_vlan_proto))
 		return -EINVAL;
@@ -727,7 +735,7 @@ static inline bool skb_vlan_tagged_multi(struct sk_buff *skb)
 		if (unlikely(!pskb_may_pull(skb, VLAN_ETH_HLEN)))
 			return false;
 
-		veh = (struct vlan_ethhdr *)skb->data;
+		veh = skb_vlan_eth_hdr(skb);
 		protocol = veh->h_vlan_encapsulated_proto;
 	}
 
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 7ac16d7b94a2..0e6d0a5e6841 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -454,7 +454,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
 		if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
 			goto dropped;
 
-		vhdr = (struct vlan_ethhdr *)skb->data;
+		vhdr = skb_vlan_eth_hdr(skb);
 
 		/* drop batman-in-batman packets to prevent loops */
 		if (vhdr->h_vlan_encapsulated_proto != htons(ETH_P_BATMAN))

From c20f425e0692815ed5406a2d11f32d1ea9f6bf14 Mon Sep 17 00:00:00 2001
From: Radu Bulie <radu-andrei.bulie@nxp.com>
Date: Thu, 7 Dec 2023 16:38:01 +0800
Subject: [PATCH 0939/1043] net: fec: correct queue selection

[ Upstream commit 9fc95fe95c3e2a63ced8eeca4b256518ab204b63 ]

The old implementation extracted VLAN TCI info from the payload
before the VLAN tag has been pushed in the payload.

Another problem was that the VLAN TCI was extracted even if the
packet did not have VLAN protocol header.

This resulted in invalid VLAN TCI and as a consequence a random
queue was computed.

This patch fixes the above issues and use the VLAN TCI from the
skb if it is present or VLAN TCI from payload if present. If no
VLAN header is present queue 0 is selected.

Fixes: 52c4a1a85f4b ("net: fec: add ndo_select_queue to fix TX bandwidth fluctuations")
Signed-off-by: Radu Bulie <radu-andrei.bulie@nxp.com>
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/fec_main.c | 27 +++++++++--------------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index e18b3b72fc0d..4ce913559c91 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3266,31 +3266,26 @@ static int fec_set_features(struct net_device *netdev,
 	return 0;
 }
 
-static u16 fec_enet_get_raw_vlan_tci(struct sk_buff *skb)
-{
-	struct vlan_ethhdr *vhdr;
-	unsigned short vlan_TCI = 0;
-
-	if (skb->protocol == htons(ETH_P_ALL)) {
-		vhdr = (struct vlan_ethhdr *)(skb->data);
-		vlan_TCI = ntohs(vhdr->h_vlan_TCI);
-	}
-
-	return vlan_TCI;
-}
-
 static u16 fec_enet_select_queue(struct net_device *ndev, struct sk_buff *skb,
 				 struct net_device *sb_dev)
 {
 	struct fec_enet_private *fep = netdev_priv(ndev);
-	u16 vlan_tag;
+	u16 vlan_tag = 0;
 
 	if (!(fep->quirks & FEC_QUIRK_HAS_AVB))
 		return netdev_pick_tx(ndev, skb, NULL);
 
-	vlan_tag = fec_enet_get_raw_vlan_tci(skb);
-	if (!vlan_tag)
+	/* VLAN is present in the payload.*/
+	if (eth_type_vlan(skb->protocol)) {
+		struct vlan_ethhdr *vhdr = skb_vlan_eth_hdr(skb);
+
+		vlan_tag = ntohs(vhdr->h_vlan_TCI);
+	/*  VLAN is present in the skb but not yet pushed in the payload.*/
+	} else if (skb_vlan_tag_present(skb)) {
+		vlan_tag = skb->vlan_tci;
+	} else {
 		return vlan_tag;
+	}
 
 	return fec_enet_vlan_pri_to_queue[vlan_tag >> 13];
 }

From 64a032015c336ca1795b3e1b1d1f94085ada3553 Mon Sep 17 00:00:00 2001
From: Hyunwoo Kim <v4bel@theori.io>
Date: Sat, 9 Dec 2023 04:42:10 -0500
Subject: [PATCH 0940/1043] atm: Fix Use-After-Free in do_vcc_ioctl

[ Upstream commit 24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3 ]

Because do_vcc_ioctl() accesses sk->sk_receive_queue
without holding a sk->sk_receive_queue.lock, it can
cause a race with vcc_recvmsg().
A use-after-free for skb occurs with the following flow.
```
do_vcc_ioctl() -> skb_peek()
vcc_recvmsg() -> skb_recv_datagram() -> skb_free_datagram()
```
Add sk->sk_receive_queue.lock to do_vcc_ioctl() to fix this issue.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Link: https://lore.kernel.org/r/20231209094210.GA403126@v4bel-B760M-AORUS-ELITE-AX
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/atm/ioctl.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c
index 838ebf0cabbf..f81f8d56f5c0 100644
--- a/net/atm/ioctl.c
+++ b/net/atm/ioctl.c
@@ -73,14 +73,17 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd,
 	case SIOCINQ:
 	{
 		struct sk_buff *skb;
+		int amount;
 
 		if (sock->state != SS_CONNECTED) {
 			error = -EINVAL;
 			goto done;
 		}
+		spin_lock_irq(&sk->sk_receive_queue.lock);
 		skb = skb_peek(&sk->sk_receive_queue);
-		error = put_user(skb ? skb->len : 0,
-				 (int __user *)argp) ? -EFAULT : 0;
+		amount = skb ? skb->len : 0;
+		spin_unlock_irq(&sk->sk_receive_queue.lock);
+		error = put_user(amount, (int __user *)argp) ? -EFAULT : 0;
 		goto done;
 	}
 	case ATM_SETSC:

From 7eda5960a5332654b10d951e735750ed60d7f0a9 Mon Sep 17 00:00:00 2001
From: Hyunwoo Kim <v4bel@theori.io>
Date: Sat, 9 Dec 2023 05:05:38 -0500
Subject: [PATCH 0941/1043] net/rose: Fix Use-After-Free in rose_ioctl

[ Upstream commit 810c38a369a0a0ce625b5c12169abce1dd9ccd53 ]

Because rose_ioctl() accesses sk->sk_receive_queue
without holding a sk->sk_receive_queue.lock, it can
cause a race with rose_accept().
A use-after-free for skb occurs with the following flow.
```
rose_ioctl() -> skb_peek()
rose_accept() -> skb_dequeue() -> kfree_skb()
```
Add sk->sk_receive_queue.lock to rose_ioctl() to fix this issue.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Link: https://lore.kernel.org/r/20231209100538.GA407321@v4bel-B760M-AORUS-ELITE-AX
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rose/af_rose.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 86c93cf1744b..b3e7a92f1ec1 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1307,9 +1307,11 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 	case TIOCINQ: {
 		struct sk_buff *skb;
 		long amount = 0L;
-		/* These two are safe on a single CPU system as only user tasks fiddle here */
+
+		spin_lock_irq(&sk->sk_receive_queue.lock);
 		if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
 			amount = skb->len;
+		spin_unlock_irq(&sk->sk_receive_queue.lock);
 		return put_user(amount, (unsigned int __user *) argp);
 	}
 

From 10760f4234f752d5752aa5fc7717aedbd4076efc Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Sun, 10 Dec 2023 12:52:55 +0800
Subject: [PATCH 0942/1043] qed: Fix a potential use-after-free in
 qed_cxt_tables_alloc

[ Upstream commit b65d52ac9c085c0c52dee012a210d4e2f352611b ]

qed_ilt_shadow_alloc() will call qed_ilt_shadow_free() to
free p_hwfn->p_cxt_mngr->ilt_shadow on error. However,
qed_cxt_tables_alloc() accesses the freed pointer on failure
of qed_ilt_shadow_alloc() through calling qed_cxt_mngr_free(),
which may lead to use-after-free. Fix this issue by setting
p_mngr->ilt_shadow to NULL in qed_ilt_shadow_free().

Fixes: fe56b9e6a8d9 ("qed: Add module with basic common support")
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Link: https://lore.kernel.org/r/20231210045255.21383-1-dinghao.liu@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qed/qed_cxt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
index 0a22f8ce9a2c..1c3737921b6c 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
@@ -933,6 +933,7 @@ static void qed_ilt_shadow_free(struct qed_hwfn *p_hwfn)
 		p_dma->virt_addr = NULL;
 	}
 	kfree(p_mngr->ilt_shadow);
+	p_mngr->ilt_shadow = NULL;
 }
 
 static int qed_ilt_blk_alloc(struct qed_hwfn *p_hwfn,

From 7ed59c4027a8f1badc7a4bf43568603279c41781 Mon Sep 17 00:00:00 2001
From: Dong Chenchen <dongchenchen2@huawei.com>
Date: Sun, 10 Dec 2023 10:02:00 +0800
Subject: [PATCH 0943/1043] net: Remove acked SYN flag from packet in the
 transmit queue correctly

[ Upstream commit f99cd56230f56c8b6b33713c5be4da5d6766be1f ]

syzkaller report:

 kernel BUG at net/core/skbuff.c:3452!
 invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.7.0-rc4-00009-gbee0e7762ad2-dirty #135
 RIP: 0010:skb_copy_and_csum_bits (net/core/skbuff.c:3452)
 Call Trace:
 icmp_glue_bits (net/ipv4/icmp.c:357)
 __ip_append_data.isra.0 (net/ipv4/ip_output.c:1165)
 ip_append_data (net/ipv4/ip_output.c:1362 net/ipv4/ip_output.c:1341)
 icmp_push_reply (net/ipv4/icmp.c:370)
 __icmp_send (./include/net/route.h:252 net/ipv4/icmp.c:772)
 ip_fragment.constprop.0 (./include/linux/skbuff.h:1234 net/ipv4/ip_output.c:592 net/ipv4/ip_output.c:577)
 __ip_finish_output (net/ipv4/ip_output.c:311 net/ipv4/ip_output.c:295)
 ip_output (net/ipv4/ip_output.c:427)
 __ip_queue_xmit (net/ipv4/ip_output.c:535)
 __tcp_transmit_skb (net/ipv4/tcp_output.c:1462)
 __tcp_retransmit_skb (net/ipv4/tcp_output.c:3387)
 tcp_retransmit_skb (net/ipv4/tcp_output.c:3404)
 tcp_retransmit_timer (net/ipv4/tcp_timer.c:604)
 tcp_write_timer (./include/linux/spinlock.h:391 net/ipv4/tcp_timer.c:716)

The panic issue was trigered by tcp simultaneous initiation.
The initiation process is as follows:

      TCP A                                            TCP B

  1.  CLOSED                                           CLOSED

  2.  SYN-SENT     --> <SEQ=100><CTL=SYN>              ...

  3.  SYN-RECEIVED <-- <SEQ=300><CTL=SYN>              <-- SYN-SENT

  4.               ... <SEQ=100><CTL=SYN>              --> SYN-RECEIVED

  5.  SYN-RECEIVED --> <SEQ=100><ACK=301><CTL=SYN,ACK> ...

  // TCP B: not send challenge ack for ack limit or packet loss
  // TCP A: close
	tcp_close
	   tcp_send_fin
              if (!tskb && tcp_under_memory_pressure(sk))
                  tskb = skb_rb_last(&sk->tcp_rtx_queue); //pick SYN_ACK packet
           TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN;  // set FIN flag

  6.  FIN_WAIT_1  --> <SEQ=100><ACK=301><END_SEQ=102><CTL=SYN,FIN,ACK> ...

  // TCP B: send challenge ack to SYN_FIN_ACK

  7.               ... <SEQ=301><ACK=101><CTL=ACK>   <-- SYN-RECEIVED //challenge ack

  // TCP A:  <SND.UNA=101>

  8.  FIN_WAIT_1 --> <SEQ=101><ACK=301><END_SEQ=102><CTL=SYN,FIN,ACK> ... // retransmit panic

	__tcp_retransmit_skb  //skb->len=0
	    tcp_trim_head
		len = tp->snd_una - TCP_SKB_CB(skb)->seq // len=101-100
		    __pskb_trim_head
			skb->data_len -= len // skb->len=-1, wrap around
	    ... ...
	    ip_fragment
		icmp_glue_bits //BUG_ON

If we use tcp_trim_head() to remove acked SYN from packet that contains data
or other flags, skb->len will be incorrectly decremented. We can remove SYN
flag that has been acked from rtx_queue earlier than tcp_trim_head(), which
can fix the problem mentioned above.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Co-developed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com>
Link: https://lore.kernel.org/r/20231210020200.1539875-1-dongchenchen2@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_output.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index f8ad8465f76c..f0df14782ee0 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3171,7 +3171,13 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
 	if (skb_still_in_host_queue(sk, skb))
 		return -EBUSY;
 
+start:
 	if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) {
+		if (unlikely(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) {
+			TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_SYN;
+			TCP_SKB_CB(skb)->seq++;
+			goto start;
+		}
 		if (unlikely(before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))) {
 			WARN_ON_ONCE(1);
 			return -EINVAL;

From c83544b70cc8c0219e17058c395383a03e098ed5 Mon Sep 17 00:00:00 2001
From: David Arinzon <darinzon@amazon.com>
Date: Mon, 11 Dec 2023 06:27:58 +0000
Subject: [PATCH 0944/1043] net: ena: Destroy correct number of xdp queues upon
 failure

[ Upstream commit 41db6f99b5489a0d2ef26afe816ef0c6118d1d47 ]

The ena_setup_and_create_all_xdp_queues() function freed all the
resources upon failure, after creating only xdp_num_queues queues,
instead of freeing just the created ones.

In this patch, the only resources that are freed, are the ones
allocated right before the failure occurs.

Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action")
Signed-off-by: Shahar Itzko <itzko@amazon.com>
Signed-off-by: David Arinzon <darinzon@amazon.com>
Link: https://lore.kernel.org/r/20231211062801.27891-2-darinzon@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_netdev.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 1722d4091ea3..e13ae04d2f0f 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -77,6 +77,8 @@ static void ena_unmap_tx_buff(struct ena_ring *tx_ring,
 			      struct ena_tx_buffer *tx_info);
 static int ena_create_io_tx_queues_in_range(struct ena_adapter *adapter,
 					    int first_index, int count);
+static void ena_free_all_io_tx_resources_in_range(struct ena_adapter *adapter,
+						  int first_index, int count);
 
 static void ena_tx_timeout(struct net_device *dev, unsigned int txqueue)
 {
@@ -388,23 +390,22 @@ static void ena_init_all_xdp_queues(struct ena_adapter *adapter)
 
 static int ena_setup_and_create_all_xdp_queues(struct ena_adapter *adapter)
 {
+	u32 xdp_first_ring = adapter->xdp_first_ring;
+	u32 xdp_num_queues = adapter->xdp_num_queues;
 	int rc = 0;
 
-	rc = ena_setup_tx_resources_in_range(adapter, adapter->xdp_first_ring,
-					     adapter->xdp_num_queues);
+	rc = ena_setup_tx_resources_in_range(adapter, xdp_first_ring, xdp_num_queues);
 	if (rc)
 		goto setup_err;
 
-	rc = ena_create_io_tx_queues_in_range(adapter,
-					      adapter->xdp_first_ring,
-					      adapter->xdp_num_queues);
+	rc = ena_create_io_tx_queues_in_range(adapter, xdp_first_ring, xdp_num_queues);
 	if (rc)
 		goto create_err;
 
 	return 0;
 
 create_err:
-	ena_free_all_io_tx_resources(adapter);
+	ena_free_all_io_tx_resources_in_range(adapter, xdp_first_ring, xdp_num_queues);
 setup_err:
 	return rc;
 }

From 25bfae19b84a72517320ae7c21eaf6e4d683d261 Mon Sep 17 00:00:00 2001
From: David Arinzon <darinzon@amazon.com>
Date: Mon, 11 Dec 2023 06:28:01 +0000
Subject: [PATCH 0945/1043] net: ena: Fix XDP redirection error

[ Upstream commit 4ab138ca0a340e6d6e7a6a9bd5004bd8f83127ca ]

When sending TX packets, the meta descriptor can be all zeroes
as no meta information is required (as in XDP).

This patch removes the validity check, as when
`disable_meta_caching` is enabled, such TX packets will be
dropped otherwise.

Fixes: 0e3a3f6dacf0 ("net: ena: support new LLQ acceleration mode")
Signed-off-by: Shay Agroskin <shayagr@amazon.com>
Signed-off-by: David Arinzon <darinzon@amazon.com>
Link: https://lore.kernel.org/r/20231211062801.27891-5-darinzon@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amazon/ena/ena_eth_com.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.c b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
index 032ab9f20438..3af9dbf245f2 100644
--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
@@ -316,9 +316,6 @@ static int ena_com_create_and_store_tx_meta_desc(struct ena_com_io_sq *io_sq,
 	 * compare it to the stored version, just create the meta
 	 */
 	if (io_sq->disable_meta_caching) {
-		if (unlikely(!ena_tx_ctx->meta_valid))
-			return -EINVAL;
-
 		*have_meta = true;
 		return ena_com_create_meta(io_sq, ena_meta);
 	}

From 4c0d7e8261608e5ffa95ba1ba14eff6b429aae09 Mon Sep 17 00:00:00 2001
From: Yusong Gao <a869920004@gmail.com>
Date: Wed, 13 Dec 2023 10:31:10 +0000
Subject: [PATCH 0946/1043] sign-file: Fix incorrect return values check

[ Upstream commit 829649443e78d85db0cff0c37cadb28fbb1a5f6f ]

There are some wrong return values check in sign-file when call OpenSSL
API. The ERR() check cond is wrong because of the program only check the
return value is < 0 which ignored the return val is 0. For example:
1. CMS_final() return 1 for success or 0 for failure.
2. i2d_CMS_bio_stream() returns 1 for success or 0 for failure.
3. i2d_TYPEbio() return 1 for success and 0 for failure.
4. BIO_free() return 1 for success and 0 for failure.

Link: https://www.openssl.org/docs/manmaster/man3/
Fixes: e5a2e3c84782 ("scripts/sign-file.c: Add support for signing with a raw signature")
Signed-off-by: Yusong Gao <a869920004@gmail.com>
Reviewed-by: Juerg Haefliger <juerg.haefliger@canonical.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/r/20231213024405.624692-1-a869920004@gmail.com/ # v5
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/sign-file.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index 7434e9ea926e..12acc70e5a7a 100644
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -322,7 +322,7 @@ int main(int argc, char **argv)
 				     CMS_NOSMIMECAP | use_keyid |
 				     use_signed_attrs),
 		    "CMS_add1_signer");
-		ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) < 0,
+		ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) != 1,
 		    "CMS_final");
 
 #else
@@ -341,10 +341,10 @@ int main(int argc, char **argv)
 			b = BIO_new_file(sig_file_name, "wb");
 			ERR(!b, "%s", sig_file_name);
 #ifndef USE_PKCS7
-			ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) < 0,
+			ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) != 1,
 			    "%s", sig_file_name);
 #else
-			ERR(i2d_PKCS7_bio(b, pkcs7) < 0,
+			ERR(i2d_PKCS7_bio(b, pkcs7) != 1,
 			    "%s", sig_file_name);
 #endif
 			BIO_free(b);
@@ -374,9 +374,9 @@ int main(int argc, char **argv)
 
 	if (!raw_sig) {
 #ifndef USE_PKCS7
-		ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) < 0, "%s", dest_name);
+		ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) != 1, "%s", dest_name);
 #else
-		ERR(i2d_PKCS7_bio(bd, pkcs7) < 0, "%s", dest_name);
+		ERR(i2d_PKCS7_bio(bd, pkcs7) != 1, "%s", dest_name);
 #endif
 	} else {
 		BIO *b;
@@ -396,7 +396,7 @@ int main(int argc, char **argv)
 	ERR(BIO_write(bd, &sig_info, sizeof(sig_info)) < 0, "%s", dest_name);
 	ERR(BIO_write(bd, magic_number, sizeof(magic_number) - 1) < 0, "%s", dest_name);
 
-	ERR(BIO_free(bd) < 0, "%s", dest_name);
+	ERR(BIO_free(bd) != 1, "%s", dest_name);
 
 	/* Finally, if we're signing in place, replace the original. */
 	if (replace_orig)

From 52a4c0e82a24b7c7aeb5851917f5501a7ebae99b Mon Sep 17 00:00:00 2001
From: Nikolay Kuratov <kniv@yandex-team.ru>
Date: Mon, 11 Dec 2023 19:23:17 +0300
Subject: [PATCH 0947/1043] vsock/virtio: Fix unsigned integer wrap around in
 virtio_transport_has_space()

[ Upstream commit 60316d7f10b17a7ebb1ead0642fee8710e1560e0 ]

We need to do signed arithmetic if we expect condition
`if (bytes < 0)` to be possible

Found by Linux Verification Center (linuxtesting.org) with SVACE

Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko")
Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/20231211162317.4116625-1-kniv@yandex-team.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/vmw_vsock/virtio_transport_common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index c9ee9259af48..080e8f2bf985 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -436,7 +436,7 @@ static s64 virtio_transport_has_space(struct vsock_sock *vsk)
 	struct virtio_vsock_sock *vvs = vsk->trans;
 	s64 bytes;
 
-	bytes = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);
+	bytes = (s64)vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);
 	if (bytes < 0)
 		bytes = 0;
 

From 5470533a7d7ea375d0da9e24616952737903fcc0 Mon Sep 17 00:00:00 2001
From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Date: Thu, 2 Jun 2022 09:48:40 +0200
Subject: [PATCH 0948/1043] net: stmmac: use dev_err_probe() for reporting mdio
 bus registration failure

[ Upstream commit 839612d23ffd933174db911ce56dc3f3ca883ec5 ]

I have a board where these two lines are always printed during boot:

   imx-dwmac 30bf0000.ethernet: Cannot register the MDIO bus
   imx-dwmac 30bf0000.ethernet: stmmac_dvr_probe: MDIO bus (id: 1) registration failed

It's perfectly fine, and the device is successfully (and silently, as
far as the console goes) probed later.

Use dev_err_probe() instead, which will demote these messages to debug
level (thus removing the alarming messages from the console) when the
error is -EPROBE_DEFER, and also has the advantage of including the
error code if/when it happens to be something other than -EPROBE_DEFER.

While here, add the missing \n to one of the format strings.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Link: https://lore.kernel.org/r/20220602074840.1143360-1-linux@rasmusvillemoes.dk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: e23c0d21ce92 ("net: stmmac: Handle disabled MDIO busses from devicetree")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +++---
 drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 709bd81fde2a..8416a186cd7f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5187,9 +5187,9 @@ int stmmac_dvr_probe(struct device *device,
 		/* MDIO bus Registration */
 		ret = stmmac_mdio_register(ndev);
 		if (ret < 0) {
-			dev_err(priv->device,
-				"%s: MDIO bus (id: %d) registration failed",
-				__func__, priv->plat->bus_id);
+			dev_err_probe(priv->device, ret,
+				      "%s: MDIO bus (id: %d) registration failed\n",
+				      __func__, priv->plat->bus_id);
 			goto error_mdio_register;
 		}
 	}
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index 7c1a14b256da..ecc7f4842f84 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -460,7 +460,7 @@ int stmmac_mdio_register(struct net_device *ndev)
 
 	err = of_mdiobus_register(new_bus, mdio_node);
 	if (err != 0) {
-		dev_err(dev, "Cannot register the MDIO bus\n");
+		dev_err_probe(dev, err, "Cannot register the MDIO bus\n");
 		goto bus_register_fail;
 	}
 

From 9deccfbaed4b8cc4902ae6f803e2261ff0ad888b Mon Sep 17 00:00:00 2001
From: Andrew Halaney <ahalaney@redhat.com>
Date: Tue, 12 Dec 2023 16:18:33 -0600
Subject: [PATCH 0949/1043] net: stmmac: Handle disabled MDIO busses from
 devicetree

[ Upstream commit e23c0d21ce9234fbc31ece35663ababbb83f9347 ]

Many hardware configurations have the MDIO bus disabled, and are instead
using some other MDIO bus to talk to the MAC's phy.

of_mdiobus_register() returns -ENODEV in this case. Let's handle it
gracefully instead of failing to probe the MAC.

Fixes: 47dd7a540b8a ("net: add support for STMicroelectronics Ethernet controllers.")
Signed-off-by: Andrew Halaney <ahalaney@redhat.com>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Link: https://lore.kernel.org/r/20231212-b4-stmmac-handle-mdio-enodev-v2-1-600171acf79f@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index ecc7f4842f84..d9b76e1e0949 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -459,7 +459,11 @@ int stmmac_mdio_register(struct net_device *ndev)
 	new_bus->parent = priv->device;
 
 	err = of_mdiobus_register(new_bus, mdio_node);
-	if (err != 0) {
+	if (err == -ENODEV) {
+		err = 0;
+		dev_info(dev, "MDIO bus is disabled\n");
+		goto bus_register_fail;
+	} else if (err) {
 		dev_err_probe(dev, err, "Cannot register the MDIO bus\n");
 		goto bus_register_fail;
 	}

From a232eb81c7cb5d4dbd325d4611ed029b7fa07596 Mon Sep 17 00:00:00 2001
From: Hyunwoo Kim <v4bel@theori.io>
Date: Tue, 12 Dec 2023 23:10:56 -0500
Subject: [PATCH 0950/1043] appletalk: Fix Use-After-Free in atalk_ioctl

[ Upstream commit 189ff16722ee36ced4d2a2469d4ab65a8fee4198 ]

Because atalk_ioctl() accesses sk->sk_receive_queue
without holding a sk->sk_receive_queue.lock, it can
cause a race with atalk_recvmsg().
A use-after-free for skb occurs with the following flow.
```
atalk_ioctl() -> skb_peek()
atalk_recvmsg() -> skb_recv_datagram() -> skb_free_datagram()
```
Add sk->sk_receive_queue.lock to atalk_ioctl() to fix this issue.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Link: https://lore.kernel.org/r/20231213041056.GA519680@v4bel-B760M-AORUS-ELITE-AX
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/appletalk/ddp.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index c94b212d8e7c..46adb8cefccf 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1811,15 +1811,14 @@ static int atalk_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 		break;
 	}
 	case TIOCINQ: {
-		/*
-		 * These two are safe on a single CPU system as only
-		 * user tasks fiddle here
-		 */
-		struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
+		struct sk_buff *skb;
 		long amount = 0;
 
+		spin_lock_irq(&sk->sk_receive_queue.lock);
+		skb = skb_peek(&sk->sk_receive_queue);
 		if (skb)
 			amount = skb->len - sizeof(struct ddpehdr);
+		spin_unlock_irq(&sk->sk_receive_queue.lock);
 		rc = put_user(amount, (int __user *)argp);
 		break;
 	}

From 03b50868ae5325bfe3251920c56e29b19e5ec24b Mon Sep 17 00:00:00 2001
From: Igor Russkikh <irusskikh@marvell.com>
Date: Wed, 13 Dec 2023 10:40:44 +0100
Subject: [PATCH 0951/1043] net: atlantic: fix double free in ring reinit logic

[ Upstream commit 7bb26ea74aa86fdf894b7dbd8c5712c5b4187da7 ]

Driver has a logic leak in ring data allocation/free,
where double free may happen in aq_ring_free if system is under
stress and driver init/deinit is happening.

The probability is higher to get this during suspend/resume cycle.

Verification was done simulating same conditions with

    stress -m 2000 --vm-bytes 20M --vm-hang 10 --backoff 1000
    while true; do sudo ifconfig enp1s0 down; sudo ifconfig enp1s0 up; done

Fixed by explicitly clearing pointers to NULL on deallocation

Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code")
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Closes: https://lore.kernel.org/netdev/CAHk-=wiZZi7FcvqVSUirHBjx0bBUZ4dFrMDVLc3+3HCrtq0rBA@mail.gmail.com/
Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
Link: https://lore.kernel.org/r/20231213094044.22988-1-irusskikh@marvell.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index e9c6f1fa0b1a..98e8997f8036 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -577,11 +577,14 @@ void aq_ring_free(struct aq_ring_s *self)
 		return;
 
 	kfree(self->buff_ring);
+	self->buff_ring = NULL;
 
-	if (self->dx_ring)
+	if (self->dx_ring) {
 		dma_free_coherent(aq_nic_get_dev(self->aq_nic),
 				  self->size * self->dx_size, self->dx_ring,
 				  self->dx_ring_pa);
+		self->dx_ring = NULL;
+	}
 }
 
 unsigned int aq_ring_fill_stats_data(struct aq_ring_s *self, u64 *data)

From 2623cf1fe825e5f706a5f00e6ac552e9d1852ec8 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Fri, 15 Dec 2023 13:24:10 -0700
Subject: [PATCH 0952/1043] cred: switch to using atomic_long_t

commit f8fa5d76925991976b3e7076f9d1052515ec1fca upstream.

There are multiple ways to grab references to credentials, and the only
protection we have against overflowing it is the memory required to do
so.

With memory sizes only moving in one direction, let's bump the reference
count to 64-bit and move it outside the realm of feasibly overflowing.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/cred.h |  8 +++---
 kernel/cred.c        | 64 ++++++++++++++++++++++----------------------
 2 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/include/linux/cred.h b/include/linux/cred.h
index 18639c069263..d35e4867d5cc 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -109,7 +109,7 @@ static inline int groups_search(const struct group_info *group_info, kgid_t grp)
  * same context as task->real_cred.
  */
 struct cred {
-	atomic_t	usage;
+	atomic_long_t	usage;
 #ifdef CONFIG_DEBUG_CREDENTIALS
 	atomic_t	subscribers;	/* number of processes subscribed */
 	void		*put_addr;
@@ -227,7 +227,7 @@ static inline bool cap_ambient_invariant_ok(const struct cred *cred)
  */
 static inline struct cred *get_new_cred(struct cred *cred)
 {
-	atomic_inc(&cred->usage);
+	atomic_long_inc(&cred->usage);
 	return cred;
 }
 
@@ -259,7 +259,7 @@ static inline const struct cred *get_cred_rcu(const struct cred *cred)
 	struct cred *nonconst_cred = (struct cred *) cred;
 	if (!cred)
 		return NULL;
-	if (!atomic_inc_not_zero(&nonconst_cred->usage))
+	if (!atomic_long_inc_not_zero(&nonconst_cred->usage))
 		return NULL;
 	validate_creds(cred);
 	nonconst_cred->non_rcu = 0;
@@ -283,7 +283,7 @@ static inline void put_cred(const struct cred *_cred)
 
 	if (cred) {
 		validate_creds(cred);
-		if (atomic_dec_and_test(&(cred)->usage))
+		if (atomic_long_dec_and_test(&(cred)->usage))
 			__put_cred(cred);
 	}
 }
diff --git a/kernel/cred.c b/kernel/cred.c
index 421b1149c651..54042ebed5d2 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -98,17 +98,17 @@ static void put_cred_rcu(struct rcu_head *rcu)
 
 #ifdef CONFIG_DEBUG_CREDENTIALS
 	if (cred->magic != CRED_MAGIC_DEAD ||
-	    atomic_read(&cred->usage) != 0 ||
+	    atomic_long_read(&cred->usage) != 0 ||
 	    read_cred_subscribers(cred) != 0)
 		panic("CRED: put_cred_rcu() sees %p with"
-		      " mag %x, put %p, usage %d, subscr %d\n",
+		      " mag %x, put %p, usage %ld, subscr %d\n",
 		      cred, cred->magic, cred->put_addr,
-		      atomic_read(&cred->usage),
+		      atomic_long_read(&cred->usage),
 		      read_cred_subscribers(cred));
 #else
-	if (atomic_read(&cred->usage) != 0)
-		panic("CRED: put_cred_rcu() sees %p with usage %d\n",
-		      cred, atomic_read(&cred->usage));
+	if (atomic_long_read(&cred->usage) != 0)
+		panic("CRED: put_cred_rcu() sees %p with usage %ld\n",
+		      cred, atomic_long_read(&cred->usage));
 #endif
 
 	security_cred_free(cred);
@@ -131,11 +131,11 @@ static void put_cred_rcu(struct rcu_head *rcu)
  */
 void __put_cred(struct cred *cred)
 {
-	kdebug("__put_cred(%p{%d,%d})", cred,
-	       atomic_read(&cred->usage),
+	kdebug("__put_cred(%p{%ld,%d})", cred,
+	       atomic_long_read(&cred->usage),
 	       read_cred_subscribers(cred));
 
-	BUG_ON(atomic_read(&cred->usage) != 0);
+	BUG_ON(atomic_long_read(&cred->usage) != 0);
 #ifdef CONFIG_DEBUG_CREDENTIALS
 	BUG_ON(read_cred_subscribers(cred) != 0);
 	cred->magic = CRED_MAGIC_DEAD;
@@ -158,8 +158,8 @@ void exit_creds(struct task_struct *tsk)
 {
 	struct cred *cred;
 
-	kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
-	       atomic_read(&tsk->cred->usage),
+	kdebug("exit_creds(%u,%p,%p,{%ld,%d})", tsk->pid, tsk->real_cred, tsk->cred,
+	       atomic_long_read(&tsk->cred->usage),
 	       read_cred_subscribers(tsk->cred));
 
 	cred = (struct cred *) tsk->real_cred;
@@ -218,7 +218,7 @@ struct cred *cred_alloc_blank(void)
 	if (!new)
 		return NULL;
 
-	atomic_set(&new->usage, 1);
+	atomic_long_set(&new->usage, 1);
 #ifdef CONFIG_DEBUG_CREDENTIALS
 	new->magic = CRED_MAGIC;
 #endif
@@ -265,7 +265,7 @@ struct cred *prepare_creds(void)
 	memcpy(new, old, sizeof(struct cred));
 
 	new->non_rcu = 0;
-	atomic_set(&new->usage, 1);
+	atomic_long_set(&new->usage, 1);
 	set_cred_subscribers(new, 0);
 	get_group_info(new->group_info);
 	get_uid(new->user);
@@ -348,8 +348,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
 		p->real_cred = get_cred(p->cred);
 		get_cred(p->cred);
 		alter_cred_subscribers(p->cred, 2);
-		kdebug("share_creds(%p{%d,%d})",
-		       p->cred, atomic_read(&p->cred->usage),
+		kdebug("share_creds(%p{%ld,%d})",
+		       p->cred, atomic_long_read(&p->cred->usage),
 		       read_cred_subscribers(p->cred));
 		atomic_inc(&p->cred->user->processes);
 		return 0;
@@ -439,8 +439,8 @@ int commit_creds(struct cred *new)
 	struct task_struct *task = current;
 	const struct cred *old = task->real_cred;
 
-	kdebug("commit_creds(%p{%d,%d})", new,
-	       atomic_read(&new->usage),
+	kdebug("commit_creds(%p{%ld,%d})", new,
+	       atomic_long_read(&new->usage),
 	       read_cred_subscribers(new));
 
 	BUG_ON(task->cred != old);
@@ -449,7 +449,7 @@ int commit_creds(struct cred *new)
 	validate_creds(old);
 	validate_creds(new);
 #endif
-	BUG_ON(atomic_read(&new->usage) < 1);
+	BUG_ON(atomic_long_read(&new->usage) < 1);
 
 	get_cred(new); /* we will require a ref for the subj creds too */
 
@@ -522,14 +522,14 @@ EXPORT_SYMBOL(commit_creds);
  */
 void abort_creds(struct cred *new)
 {
-	kdebug("abort_creds(%p{%d,%d})", new,
-	       atomic_read(&new->usage),
+	kdebug("abort_creds(%p{%ld,%d})", new,
+	       atomic_long_read(&new->usage),
 	       read_cred_subscribers(new));
 
 #ifdef CONFIG_DEBUG_CREDENTIALS
 	BUG_ON(read_cred_subscribers(new) != 0);
 #endif
-	BUG_ON(atomic_read(&new->usage) < 1);
+	BUG_ON(atomic_long_read(&new->usage) < 1);
 	put_cred(new);
 }
 EXPORT_SYMBOL(abort_creds);
@@ -545,8 +545,8 @@ const struct cred *override_creds(const struct cred *new)
 {
 	const struct cred *old = current->cred;
 
-	kdebug("override_creds(%p{%d,%d})", new,
-	       atomic_read(&new->usage),
+	kdebug("override_creds(%p{%ld,%d})", new,
+	       atomic_long_read(&new->usage),
 	       read_cred_subscribers(new));
 
 	validate_creds(old);
@@ -568,8 +568,8 @@ const struct cred *override_creds(const struct cred *new)
 	rcu_assign_pointer(current->cred, new);
 	alter_cred_subscribers(old, -1);
 
-	kdebug("override_creds() = %p{%d,%d}", old,
-	       atomic_read(&old->usage),
+	kdebug("override_creds() = %p{%ld,%d}", old,
+	       atomic_long_read(&old->usage),
 	       read_cred_subscribers(old));
 	return old;
 }
@@ -586,8 +586,8 @@ void revert_creds(const struct cred *old)
 {
 	const struct cred *override = current->cred;
 
-	kdebug("revert_creds(%p{%d,%d})", old,
-	       atomic_read(&old->usage),
+	kdebug("revert_creds(%p{%ld,%d})", old,
+	       atomic_long_read(&old->usage),
 	       read_cred_subscribers(old));
 
 	validate_creds(old);
@@ -699,7 +699,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
 
 	*new = *old;
 	new->non_rcu = 0;
-	atomic_set(&new->usage, 1);
+	atomic_long_set(&new->usage, 1);
 	set_cred_subscribers(new, 0);
 	get_uid(new->user);
 	get_user_ns(new->user_ns);
@@ -809,8 +809,8 @@ static void dump_invalid_creds(const struct cred *cred, const char *label,
 	       cred == tsk->cred ? "[eff]" : "");
 	printk(KERN_ERR "CRED: ->magic=%x, put_addr=%p\n",
 	       cred->magic, cred->put_addr);
-	printk(KERN_ERR "CRED: ->usage=%d, subscr=%d\n",
-	       atomic_read(&cred->usage),
+	printk(KERN_ERR "CRED: ->usage=%ld, subscr=%d\n",
+	       atomic_long_read(&cred->usage),
 	       read_cred_subscribers(cred));
 	printk(KERN_ERR "CRED: ->*uid = { %d,%d,%d,%d }\n",
 		from_kuid_munged(&init_user_ns, cred->uid),
@@ -882,9 +882,9 @@ EXPORT_SYMBOL(__validate_process_creds);
  */
 void validate_creds_for_do_exit(struct task_struct *tsk)
 {
-	kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})",
+	kdebug("validate_creds_for_do_exit(%p,%p{%ld,%d})",
 	       tsk->real_cred, tsk->cred,
-	       atomic_read(&tsk->cred->usage),
+	       atomic_long_read(&tsk->cred->usage),
 	       read_cred_subscribers(tsk->cred));
 
 	__validate_process_creds(tsk, __FILE__, __LINE__);

From 851783a0c4ffb87a8d8065f9bf286c2aa546a542 Mon Sep 17 00:00:00 2001
From: Hangyu Hua <hbh25y@gmail.com>
Date: Thu, 16 Nov 2023 15:57:26 +0800
Subject: [PATCH 0953/1043] fuse: dax: set fc->dax to NULL in
 fuse_dax_conn_free()

commit 7f8ed28d1401320bcb02dda81b3c23ab2dc5a6d8 upstream.

fuse_dax_conn_free() will be called when fuse_fill_super_common() fails
after fuse_dax_conn_alloc(). Then deactivate_locked_super() in
virtio_fs_get_tree() will call virtio_kill_sb() to release the discarded
superblock. This will call fuse_dax_conn_free() again in fuse_conn_put(),
resulting in a possible double free.

Fixes: 1dd539577c42 ("virtiofs: add a mount option to enable dax")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Acked-by: Vivek Goyal <vgoyal@redhat.com>
Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Cc: <stable@vger.kernel.org> # v5.10
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fuse/dax.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/fuse/dax.c b/fs/fuse/dax.c
index ff99ab2a3c43..2739e218df64 100644
--- a/fs/fuse/dax.c
+++ b/fs/fuse/dax.c
@@ -1228,6 +1228,7 @@ void fuse_dax_conn_free(struct fuse_conn *fc)
 	if (fc->dax) {
 		fuse_free_dax_mem_ranges(&fc->dax->free_ranges);
 		kfree(fc->dax);
+		fc->dax = NULL;
 	}
 }
 

From 063302851147024f427144641122eb9df4cdb548 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Fri, 8 Dec 2023 15:21:27 +0200
Subject: [PATCH 0954/1043] ALSA: hda/hdmi: add force-connect quirks for
 ASUSTeK Z170 variants
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 924f5ca2975b2993ee81a7ecc3c809943a70f334 upstream.

On ASUSTeK Z170M PLUS and Z170 PRO GAMING systems, the display codec
pins are not registered properly without the force-connect quirk. The
codec will report only one pin as having external connectivity, but i915
finds all three connectors on the system, so the two drivers are not
in sync.

Issue found with DRM igt-gpu-tools test kms_hdmi_inject@inject-audio.

Link: https://gitlab.freedesktop.org/drm/intel/-/issues/9801
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Jani Saarinen <jani.saarinen@intel.com>
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20231208132127.2438067-3-kai.vehmanen@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_hdmi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index c19afe486194..86a43b955db9 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1967,6 +1967,8 @@ static const struct snd_pci_quirk force_connect_list[] = {
 	SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1),
 	SND_PCI_QUIRK(0x103c, 0x8711, "HP", 1),
 	SND_PCI_QUIRK(0x103c, 0x8715, "HP", 1),
+	SND_PCI_QUIRK(0x1043, 0x86ae, "ASUS", 1),  /* Z170 PRO */
+	SND_PCI_QUIRK(0x1043, 0x86c7, "ASUS", 1),  /* Z170M PLUS */
 	SND_PCI_QUIRK(0x1462, 0xec94, "MS-7C94", 1),
 	{}
 };

From 7e2afd08850628908c344f1375b0ebba85a1af5c Mon Sep 17 00:00:00 2001
From: Hartmut Knaack <knaack.h@gmx.de>
Date: Sat, 9 Dec 2023 15:47:07 +0100
Subject: [PATCH 0955/1043] ALSA: hda/realtek: Apply mute LED quirk for HP15-db

commit 9b726bf6ae11add6a7a52883a21f90ff9cbca916 upstream.

The HP laptop 15-db0403ng uses the ALC236 codec and controls the mute
LED using COEF 0x07 index 1.
Sound card subsystem: Hewlett-Packard Company Device [103c:84ae]

Use the existing quirk for this model.

Signed-off-by: Hartmut Knaack <knaack.h@gmx.de>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/e61815d0-f1c7-b164-e49d-6ca84771476a@gmx.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index d9140630cf3d..0743fcd74707 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8986,6 +8986,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
 	SND_PCI_QUIRK(0x103c, 0x841c, "HP Pavilion 15-CK0xx", ALC269_FIXUP_HP_MUTE_LED_MIC3),
 	SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+	SND_PCI_QUIRK(0x103c, 0x84ae, "HP 15-db0403ng", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN),
 	SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
 	SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360),

From 791bca1b099696646c5174a5ad92b8a4d9f05b41 Mon Sep 17 00:00:00 2001
From: Bjorn Helgaas <bhelgaas@google.com>
Date: Thu, 14 Dec 2023 09:08:56 -0600
Subject: [PATCH 0956/1043] Revert "PCI: acpiphp: Reassign resources on bridge
 if necessary"

commit 5df12742b7e3aae2594a30a9d14d5d6e9e7699f4 upstream.

This reverts commit 40613da52b13fb21c5566f10b287e0ca8c12c4e9 and the
subsequent fix to it:

  cc22522fd55e ("PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus")

40613da52b13 fixed a problem where hot-adding a device with large BARs
failed if the bridge windows programmed by firmware were not large enough.

cc22522fd55e ("PCI: acpiphp: Use pci_assign_unassigned_bridge_resources()
only for non-root bus") fixed a problem with 40613da52b13: an ACPI hot-add
of a device on a PCI root bus (common in the virt world) or firmware
sending ACPI Bus Check to non-existent Root Ports (e.g., on Dell Inspiron
7352/0W6WV0) caused a NULL pointer dereference and suspend/resume hangs.

Unfortunately the combination of 40613da52b13 and cc22522fd55e caused other
problems:

  - Fiona reported that hot-add of SCSI disks in QEMU virtual machine fails
    sometimes.

  - Dongli reported a similar problem with hot-add of SCSI disks.

  - Jonathan reported a console freeze during boot on bare metal due to an
    error in radeon GPU initialization.

Revert both patches to avoid adding these problems.  This means we will
again see the problems with hot-adding devices with large BARs and the NULL
pointer dereferences and suspend/resume issues that 40613da52b13 and
cc22522fd55e were intended to fix.

Fixes: 40613da52b13 ("PCI: acpiphp: Reassign resources on bridge if necessary")
Fixes: cc22522fd55e ("PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus")
Reported-by: Fiona Ebner <f.ebner@proxmox.com>
Closes: https://lore.kernel.org/r/9eb669c0-d8f2-431d-a700-6da13053ae54@proxmox.com
Reported-by: Dongli Zhang <dongli.zhang@oracle.com>
Closes: https://lore.kernel.org/r/3c4a446a-b167-11b8-f36f-d3c1b49b42e9@oracle.com
Reported-by: Jonathan Woithe <jwoithe@just42.net>
Closes: https://lore.kernel.org/r/ZXpaNCLiDM+Kv38H@marvin.atrad.com.au
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/hotplug/acpiphp_glue.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 0a37967b0a93..f031302ad401 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -503,15 +503,12 @@ static void enable_slot(struct acpiphp_slot *slot, bool bridge)
 				if (pass && dev->subordinate) {
 					check_hotplug_bridge(slot, dev);
 					pcibios_resource_survey_bus(dev->subordinate);
-					if (pci_is_root_bus(bus))
-						__pci_bus_size_bridges(dev->subordinate, &add_list);
+					__pci_bus_size_bridges(dev->subordinate,
+							       &add_list);
 				}
 			}
 		}
-		if (pci_is_root_bus(bus))
-			__pci_bus_assign_resources(bus, &add_list, NULL);
-		else
-			pci_assign_unassigned_bridge_resources(bus->self);
+		__pci_bus_assign_resources(bus, &add_list, NULL);
 	}
 
 	acpiphp_sanitize_bus(bus);

From 022b82336a620c12f77a6047aee2287d74d00fd4 Mon Sep 17 00:00:00 2001
From: Jiaxun Yang <jiaxun.yang@flygoat.com>
Date: Fri, 1 Dec 2023 11:50:28 +0000
Subject: [PATCH 0957/1043] PCI: loongson: Limit MRRS to 256

commit ef61a0405742a9f7f6051bc6fd2f017d87d07911 upstream.

This is a partial revert of 8b3517f88ff2 ("PCI: loongson: Prevent LS7A MRRS
increases") for MIPS-based Loongson.

Some MIPS Loongson systems don't support arbitrary Max_Read_Request_Size
(MRRS) settings.  8b3517f88ff2 ("PCI: loongson: Prevent LS7A MRRS
increases") worked around that by (1) assuming that firmware configured
MRRS to the maximum supported value and (2) preventing the PCI core from
increasing MRRS.

Unfortunately, some firmware doesn't set that maximum MRRS correctly, which
results in devices not being initialized correctly.  One symptom, from the
Debian report below, is this:

  ata4.00: exception Emask 0x0 SAct 0x20000000 SErr 0x0 action 0x6 frozen
  ata4.00: failed command: WRITE FPDMA QUEUED
  ata4.00: cmd 61/20:e8:00:f0:e1/00:00:00:00:00/40 tag 29 ncq dma 16384 out
           res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
  ata4.00: status: { DRDY }
  ata4: hard resetting link

Limit MRRS to 256 because MIPS Loongson with higher MRRS support is
considered rare.

This must be done at device enablement stage because the MRRS setting may
get lost if PCI_COMMAND_MASTER on the parent bridge is cleared, and we are
only sure parent bridge is enabled at this point.

Fixes: 8b3517f88ff2 ("PCI: loongson: Prevent LS7A MRRS increases")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217680
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1035587
Link: https://lore.kernel.org/r/20231201115028.84351-1-jiaxun.yang@flygoat.com
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Huacai Chen <chenhuacai@loongson.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-loongson.c | 46 ++++++++++++++++++++++++---
 1 file changed, 41 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/controller/pci-loongson.c b/drivers/pci/controller/pci-loongson.c
index e73e18a73833..8b40b45590a0 100644
--- a/drivers/pci/controller/pci-loongson.c
+++ b/drivers/pci/controller/pci-loongson.c
@@ -65,13 +65,49 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LOONGSON,
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LOONGSON,
 			DEV_LS7A_LPC, system_bus_quirk);
 
+/*
+ * Some Loongson PCIe ports have hardware limitations on their Maximum Read
+ * Request Size. They can't handle anything larger than this.  Sane
+ * firmware will set proper MRRS at boot, so we only need no_inc_mrrs for
+ * bridges. However, some MIPS Loongson firmware doesn't set MRRS properly,
+ * so we have to enforce maximum safe MRRS, which is 256 bytes.
+ */
+#ifdef CONFIG_MIPS
+static void loongson_set_min_mrrs_quirk(struct pci_dev *pdev)
+{
+	struct pci_bus *bus = pdev->bus;
+	struct pci_dev *bridge;
+	static const struct pci_device_id bridge_devids[] = {
+		{ PCI_VDEVICE(LOONGSON, DEV_LS2K_PCIE_PORT0) },
+		{ PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT0) },
+		{ PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT1) },
+		{ PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT2) },
+		{ PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT3) },
+		{ PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT4) },
+		{ PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT5) },
+		{ PCI_VDEVICE(LOONGSON, DEV_LS7A_PCIE_PORT6) },
+		{ 0, },
+	};
+
+	/* look for the matching bridge */
+	while (!pci_is_root_bus(bus)) {
+		bridge = bus->self;
+		bus = bus->parent;
+
+		if (pci_match_id(bridge_devids, bridge)) {
+			if (pcie_get_readrq(pdev) > 256) {
+				pci_info(pdev, "limiting MRRS to 256\n");
+				pcie_set_readrq(pdev, 256);
+			}
+			break;
+		}
+	}
+}
+DECLARE_PCI_FIXUP_ENABLE(PCI_ANY_ID, PCI_ANY_ID, loongson_set_min_mrrs_quirk);
+#endif
+
 static void loongson_mrrs_quirk(struct pci_dev *pdev)
 {
-	/*
-	 * Some Loongson PCIe ports have h/w limitations of maximum read
-	 * request size. They can't handle anything larger than this. So
-	 * force this limit on any devices attached under these ports.
-	 */
 	struct pci_host_bridge *bridge = pci_find_host_bridge(pdev->bus);
 
 	bridge->no_inc_mrrs = 1;

From 1e3ea8d2bad845e512ee3430323206d4f8ec9cc2 Mon Sep 17 00:00:00 2001
From: "Jason-JH.Lin" <jason-jh.lin@mediatek.com>
Date: Wed, 20 Sep 2023 17:06:58 +0800
Subject: [PATCH 0958/1043] drm/mediatek: Add spinlock for setting vblank event
 in atomic_begin

[ Upstream commit fe4c5f662097978b6c91c23a13c24ed92339a180 ]

Add spinlock protection to avoid race condition on vblank event
between mtk_drm_crtc_atomic_begin() and mtk_drm_finish_page_flip().

Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com>
Suggested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
Reviewed-by: Fei Shao <fshao@chromium.org>
Tested-by: Fei Shao <fshao@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: CK Hu <ck.hu@mediatek.com>
Link: https://patchwork.kernel.org/project/dri-devel/patch/20230920090658.31181-1-jason-jh.lin@mediatek.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index cc3cb5b63d44..1eaf513166a1 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
@@ -582,6 +582,7 @@ static void mtk_drm_crtc_atomic_begin(struct drm_crtc *crtc,
 {
 	struct mtk_crtc_state *state = to_mtk_crtc_state(crtc->state);
 	struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
+	unsigned long flags;
 
 	if (mtk_crtc->event && state->base.event)
 		DRM_ERROR("new event while there is still a pending event\n");
@@ -589,7 +590,11 @@ static void mtk_drm_crtc_atomic_begin(struct drm_crtc *crtc,
 	if (state->base.event) {
 		state->base.event->pipe = drm_crtc_index(crtc);
 		WARN_ON(drm_crtc_vblank_get(crtc) != 0);
+
+		spin_lock_irqsave(&crtc->dev->event_lock, flags);
 		mtk_crtc->event = state->base.event;
+		spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+
 		state->base.event = NULL;
 	}
 }

From d69581c17608d81824dd497d9a54b6a5b6139975 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Wed, 15 Nov 2023 11:08:57 +0100
Subject: [PATCH 0959/1043] usb: aqc111: check packet for fixup for true limit

[ Upstream commit ccab434e674ca95d483788b1895a70c21b7f016a ]

If a device sends a packet that is inbetween 0
and sizeof(u64) the value passed to skb_trim()
as length will wrap around ending up as some very
large value.

The driver will then proceed to parse the header
located at that position, which will either oops or
process some random value.

The fix is to check against sizeof(u64) rather than
0, which the driver currently does. The issue exists
since the introduction of the driver.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/aqc111.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c
index c9c409518174..4ea02116be18 100644
--- a/drivers/net/usb/aqc111.c
+++ b/drivers/net/usb/aqc111.c
@@ -1079,17 +1079,17 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 	u16 pkt_count = 0;
 	u64 desc_hdr = 0;
 	u16 vlan_tag = 0;
-	u32 skb_len = 0;
+	u32 skb_len;
 
 	if (!skb)
 		goto err;
 
-	if (skb->len == 0)
+	skb_len = skb->len;
+	if (skb_len < sizeof(desc_hdr))
 		goto err;
 
-	skb_len = skb->len;
 	/* RX Descriptor Header */
-	skb_trim(skb, skb->len - sizeof(desc_hdr));
+	skb_trim(skb, skb_len - sizeof(desc_hdr));
 	desc_hdr = le64_to_cpup((u64 *)skb_tail_pointer(skb));
 
 	/* Check these packets */

From dbf0cdacdb4ebd68bf60dcd1a8b0d20dcdab1fbd Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Fri, 17 Nov 2023 10:35:22 +0800
Subject: [PATCH 0960/1043] blk-throttle: fix lockdep warning of "cgroup_mutex
 or RCU read lock required!"

[ Upstream commit 27b13e209ddca5979847a1b57890e0372c1edcee ]

Inside blkg_for_each_descendant_pre(), both
css_for_each_descendant_pre() and blkg_lookup() requires RCU read lock,
and either cgroup_assert_mutex_or_rcu_locked() or rcu_read_lock_held()
is called.

Fix the warning by adding rcu read lock.

Reported-by: Changhui Zhong <czhong@redhat.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20231117023527.3188627-2-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-throttle.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index c526fdd0a7b9..4bf514a7bd82 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1409,6 +1409,7 @@ static void tg_conf_updated(struct throtl_grp *tg, bool global)
 		   tg_bps_limit(tg, READ), tg_bps_limit(tg, WRITE),
 		   tg_iops_limit(tg, READ), tg_iops_limit(tg, WRITE));
 
+	rcu_read_lock();
 	/*
 	 * Update has_rules[] flags for the updated tg's subtree.  A tg is
 	 * considered to have rules if either the tg itself or any of its
@@ -1436,6 +1437,7 @@ static void tg_conf_updated(struct throtl_grp *tg, bool global)
 		this_tg->latency_target = max(this_tg->latency_target,
 				parent_tg->latency_target);
 	}
+	rcu_read_unlock();
 
 	/*
 	 * We're already holding queue_lock and know @tg is valid.  Let's

From ea2341d08255fae1dd9886f477312c86d3d95840 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Mon, 20 Nov 2023 13:24:54 +0800
Subject: [PATCH 0961/1043] bcache: avoid oversize memory allocation by small
 stripe_size

[ Upstream commit baf8fb7e0e5ec54ea0839f0c534f2cdcd79bea9c ]

Arraies bcache->stripe_sectors_dirty and bcache->full_dirty_stripes are
used for dirty data writeback, their sizes are decided by backing device
capacity and stripe size. Larger backing device capacity or smaller
stripe size make these two arraies occupies more dynamic memory space.

Currently bcache->stripe_size is directly inherited from
queue->limits.io_opt of underlying storage device. For normal hard
drives, its limits.io_opt is 0, and bcache sets the corresponding
stripe_size to 1TB (1<<31 sectors), it works fine 10+ years. But for
devices do declare value for queue->limits.io_opt, small stripe_size
(comparing to 1TB) becomes an issue for oversize memory allocations of
bcache->stripe_sectors_dirty and bcache->full_dirty_stripes, while the
capacity of hard drives gets much larger in recent decade.

For example a raid5 array assembled by three 20TB hardrives, the raid
device capacity is 40TB with typical 512KB limits.io_opt. After the math
calculation in bcache code, these two arraies will occupy 400MB dynamic
memory. Even worse Andrea Tomassetti reports that a 4KB limits.io_opt is
declared on a new 2TB hard drive, then these two arraies request 2GB and
512MB dynamic memory from kzalloc(). The result is that bcache device
always fails to initialize on his system.

To avoid the oversize memory allocation, bcache->stripe_size should not
directly inherited by queue->limits.io_opt from the underlying device.
This patch defines BCH_MIN_STRIPE_SZ (4MB) as minimal bcache stripe size
and set bcache device's stripe size against the declared limits.io_opt
value from the underlying storage device,
- If the declared limits.io_opt > BCH_MIN_STRIPE_SZ, bcache device will
  set its stripe size directly by this limits.io_opt value.
- If the declared limits.io_opt < BCH_MIN_STRIPE_SZ, bcache device will
  set its stripe size by a value multiplying limits.io_opt and euqal or
  large than BCH_MIN_STRIPE_SZ.

Then the minimal stripe size of a bcache device will always be >= 4MB.
For a 40TB raid5 device with 512KB limits.io_opt, memory occupied by
bcache->stripe_sectors_dirty and bcache->full_dirty_stripes will be 50MB
in total. For a 2TB hard drive with 4KB limits.io_opt, memory occupied
by these two arraies will be 2.5MB in total.

Such mount of memory allocated for bcache->stripe_sectors_dirty and
bcache->full_dirty_stripes is reasonable for most of storage devices.

Reported-by: Andrea Tomassetti <andrea.tomassetti-opensource@devo.com>
Signed-off-by: Coly Li <colyli@suse.de>
Reviewed-by: Eric Wheeler <bcache@lists.ewheeler.net>
Link: https://lore.kernel.org/r/20231120052503.6122-2-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/bcache.h | 1 +
 drivers/md/bcache/super.c  | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index e8bf4f752e8b..5804a8e6e215 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -265,6 +265,7 @@ struct bcache_device {
 #define BCACHE_DEV_WB_RUNNING		3
 #define BCACHE_DEV_RATE_DW_RUNNING	4
 	int			nr_stripes;
+#define BCH_MIN_STRIPE_SZ		((4 << 20) >> SECTOR_SHIFT)
 	unsigned int		stripe_size;
 	atomic_t		*stripe_sectors_dirty;
 	unsigned long		*full_dirty_stripes;
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index e8c8077667f9..9c3e1632568c 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -917,6 +917,8 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size,
 
 	if (!d->stripe_size)
 		d->stripe_size = 1 << 31;
+	else if (d->stripe_size < BCH_MIN_STRIPE_SZ)
+		d->stripe_size = roundup(BCH_MIN_STRIPE_SZ, d->stripe_size);
 
 	n = DIV_ROUND_UP_ULL(sectors, d->stripe_size);
 	if (!n || n > max_stripes) {

From 3b48e1c0485ada191e7a24822aa03842f3f6414a Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.i.king@gmail.com>
Date: Mon, 20 Nov 2023 13:24:56 +0800
Subject: [PATCH 0962/1043] bcache: remove redundant assignment to variable
 cur_idx

[ Upstream commit be93825f0e6428c2d3f03a6e4d447dc48d33d7ff ]

Variable cur_idx is being initialized with a value that is never read,
it is being re-assigned later in a while-loop. Remove the redundant
assignment. Cleans up clang scan build warning:

drivers/md/bcache/writeback.c:916:2: warning: Value stored to 'cur_idx'
is never read [deadcode.DeadStores]

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Reviewed-by: Coly Li <colyli@suse.de>
Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20231120052503.6122-4-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/writeback.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 94e899ce3855..8e3f5f004c39 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -857,7 +857,7 @@ static int bch_dirty_init_thread(void *arg)
 	int cur_idx, prev_idx, skip_nr;
 
 	k = p = NULL;
-	cur_idx = prev_idx = 0;
+	prev_idx = 0;
 
 	bch_btree_iter_init(&c->root->keys, &iter, NULL);
 	k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad);

From a7555524e32520c35d2a3450c57e3418cd907955 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Mon, 20 Nov 2023 13:25:02 +0800
Subject: [PATCH 0963/1043] bcache: add code comments for bch_btree_node_get()
 and __bch_btree_node_alloc()

[ Upstream commit 31f5b956a197d4ec25c8a07cb3a2ab69d0c0b82f ]

This patch adds code comments to bch_btree_node_get() and
__bch_btree_node_alloc() that NULL pointer will not be returned and it
is unnecessary to check NULL pointer by the callers of these routines.

Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20231120052503.6122-10-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/btree.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 3d6a7fbcbb15..1a1a9554474a 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -974,6 +974,9 @@ static struct btree *mca_alloc(struct cache_set *c, struct btree_op *op,
  *
  * The btree node will have either a read or a write lock held, depending on
  * level and op->lock.
+ *
+ * Note: Only error code or btree pointer will be returned, it is unncessary
+ *       for callers to check NULL pointer.
  */
 struct btree *bch_btree_node_get(struct cache_set *c, struct btree_op *op,
 				 struct bkey *k, int level, bool write,
@@ -1085,6 +1088,10 @@ static void btree_node_free(struct btree *b)
 	mutex_unlock(&b->c->bucket_lock);
 }
 
+/*
+ * Only error code or btree pointer will be returned, it is unncessary for
+ * callers to check NULL pointer.
+ */
 struct btree *__bch_btree_node_alloc(struct cache_set *c, struct btree_op *op,
 				     int level, bool wait,
 				     struct btree *parent)

From e01135763b9bff27c8e84820a9ddda6062647322 Mon Sep 17 00:00:00 2001
From: Coly Li <colyli@suse.de>
Date: Mon, 20 Nov 2023 13:25:03 +0800
Subject: [PATCH 0964/1043] bcache: avoid NULL checking to c->root in
 run_cache_set()

[ Upstream commit 3eba5e0b2422aec3c9e79822029599961fdcab97 ]

In run_cache_set() after c->root returned from bch_btree_node_get(), it
is checked by IS_ERR_OR_NULL(). Indeed it is unncessary to check NULL
because bch_btree_node_get() will not return NULL pointer to caller.

This patch replaces IS_ERR_OR_NULL() by IS_ERR() for the above reason.

Signed-off-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20231120052503.6122-11-colyli@suse.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 9c3e1632568c..04ddaa4bbd77 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -2043,7 +2043,7 @@ static int run_cache_set(struct cache_set *c)
 		c->root = bch_btree_node_get(c, NULL, k,
 					     j->btree_level,
 					     true, NULL);
-		if (IS_ERR_OR_NULL(c->root))
+		if (IS_ERR(c->root))
 			goto err;
 
 		list_del_init(&c->root->list);

From 6026a862f351a67605e650c587e7b64e53173a54 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Mon, 20 Nov 2023 17:07:56 +0200
Subject: [PATCH 0965/1043] platform/x86: intel_telemetry: Fix kernel doc
 descriptions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit a6584711e64d9d12ab79a450ec3628fd35e4f476 ]

LKP found issues with a kernel doc in the driver:

core.c:116: warning: Function parameter or member 'ioss_evtconfig' not described in 'telemetry_update_events'
core.c:188: warning: Function parameter or member 'ioss_evtconfig' not described in 'telemetry_get_eventconfig'

It looks like it were copy'n'paste typos when these descriptions
had been introduced. Fix the typos.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310070743.WALmRGSY-lkp@intel.com/
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20231120150756.1661425-1-andriy.shevchenko@linux.intel.com
Reviewed-by: Rajneesh Bhardwaj <irenic.rajneesh@gmail.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel_telemetry_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/x86/intel_telemetry_core.c b/drivers/platform/x86/intel_telemetry_core.c
index fdf55b5d6948..e4be40f73eeb 100644
--- a/drivers/platform/x86/intel_telemetry_core.c
+++ b/drivers/platform/x86/intel_telemetry_core.c
@@ -102,7 +102,7 @@ static const struct telemetry_core_ops telm_defpltops = {
 /**
  * telemetry_update_events() - Update telemetry Configuration
  * @pss_evtconfig: PSS related config. No change if num_evts = 0.
- * @pss_evtconfig: IOSS related config. No change if num_evts = 0.
+ * @ioss_evtconfig: IOSS related config. No change if num_evts = 0.
  *
  * This API updates the IOSS & PSS Telemetry configuration. Old config
  * is overwritten. Call telemetry_reset_events when logging is over
@@ -176,7 +176,7 @@ EXPORT_SYMBOL_GPL(telemetry_reset_events);
 /**
  * telemetry_get_eventconfig() - Returns the pss and ioss events enabled
  * @pss_evtconfig: Pointer to PSS related configuration.
- * @pss_evtconfig: Pointer to IOSS related configuration.
+ * @ioss_evtconfig: Pointer to IOSS related configuration.
  * @pss_len:	   Number of u32 elements allocated for pss_evtconfig array
  * @ioss_len:	   Number of u32 elements allocated for ioss_evtconfig array
  *

From a64a9f38ae3e401487ba60c6efb48f65fbc79271 Mon Sep 17 00:00:00 2001
From: Brett Raye <braye@fastmail.com>
Date: Thu, 2 Nov 2023 18:10:38 -0700
Subject: [PATCH 0966/1043] HID: glorious: fix Glorious Model I HID report

[ Upstream commit a5e913c25b6b2b6ae02acef6d9400645ac03dfdf ]

The Glorious Model I mouse has a buggy HID report descriptor for its
keyboard endpoint (used for programmable buttons). For report ID 2, there
is a mismatch between Logical Minimum and Usage Minimum in the array that
reports keycodes.

The offending portion of the descriptor: (from hid-decode)

0x95, 0x05,                    //  Report Count (5)                   30
0x75, 0x08,                    //  Report Size (8)                    32
0x15, 0x00,                    //  Logical Minimum (0)                34
0x25, 0x65,                    //  Logical Maximum (101)              36
0x05, 0x07,                    //  Usage Page (Keyboard)              38
0x19, 0x01,                    //  Usage Minimum (1)                  40
0x29, 0x65,                    //  Usage Maximum (101)                42
0x81, 0x00,                    //  Input (Data,Arr,Abs)               44

This bug shifts all programmed keycodes up by 1. Importantly, this causes
"empty" array indexes of 0x00 to be interpreted as 0x01, ErrorRollOver.
The presence of ErrorRollOver causes the system to ignore all keypresses
from the endpoint and breaks the ability to use the programmable buttons.

Setting byte 41 to 0x00 fixes this, and causes keycodes to be interpreted
correctly.

Also, USB_VENDOR_ID_GLORIOUS is changed to USB_VENDOR_ID_SINOWEALTH,
and a new ID for Laview Technology is added. Glorious seems to be
white-labeling controller boards or mice from these vendors. There isn't a
single canonical vendor ID for Glorious products.

Signed-off-by: Brett Raye <braye@fastmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-glorious.c | 16 ++++++++++++++--
 drivers/hid/hid-ids.h      | 11 +++++++----
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/drivers/hid/hid-glorious.c b/drivers/hid/hid-glorious.c
index 558eb08c19ef..281b3a7187ce 100644
--- a/drivers/hid/hid-glorious.c
+++ b/drivers/hid/hid-glorious.c
@@ -21,6 +21,10 @@ MODULE_DESCRIPTION("HID driver for Glorious PC Gaming Race mice");
  * Glorious Model O and O- specify the const flag in the consumer input
  * report descriptor, which leads to inputs being ignored. Fix this
  * by patching the descriptor.
+ *
+ * Glorious Model I incorrectly specifes the Usage Minimum for its
+ * keyboard HID report, causing keycodes to be misinterpreted.
+ * Fix this by setting Usage Minimum to 0 in that report.
  */
 static __u8 *glorious_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 		unsigned int *rsize)
@@ -32,6 +36,10 @@ static __u8 *glorious_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 		rdesc[85] = rdesc[113] = rdesc[141] = \
 			HID_MAIN_ITEM_VARIABLE | HID_MAIN_ITEM_RELATIVE;
 	}
+	if (*rsize == 156 && rdesc[41] == 1) {
+		hid_info(hdev, "patching Glorious Model I keyboard report descriptor\n");
+		rdesc[41] = 0;
+	}
 	return rdesc;
 }
 
@@ -44,6 +52,8 @@ static void glorious_update_name(struct hid_device *hdev)
 		model = "Model O"; break;
 	case USB_DEVICE_ID_GLORIOUS_MODEL_D:
 		model = "Model D"; break;
+	case USB_DEVICE_ID_GLORIOUS_MODEL_I:
+		model = "Model I"; break;
 	}
 
 	snprintf(hdev->name, sizeof(hdev->name), "%s %s", "Glorious", model);
@@ -66,10 +76,12 @@ static int glorious_probe(struct hid_device *hdev,
 }
 
 static const struct hid_device_id glorious_devices[] = {
-	{ HID_USB_DEVICE(USB_VENDOR_ID_GLORIOUS,
+	{ HID_USB_DEVICE(USB_VENDOR_ID_SINOWEALTH,
 		USB_DEVICE_ID_GLORIOUS_MODEL_O) },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_GLORIOUS,
+	{ HID_USB_DEVICE(USB_VENDOR_ID_SINOWEALTH,
 		USB_DEVICE_ID_GLORIOUS_MODEL_D) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_LAVIEW,
+		USB_DEVICE_ID_GLORIOUS_MODEL_I) },
 	{ }
 };
 MODULE_DEVICE_TABLE(hid, glorious_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 7c688d7f8ccf..6273ab615af8 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -471,10 +471,6 @@
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A 0x010a
 #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100
 
-#define USB_VENDOR_ID_GLORIOUS  0x258a
-#define USB_DEVICE_ID_GLORIOUS_MODEL_D 0x0033
-#define USB_DEVICE_ID_GLORIOUS_MODEL_O 0x0036
-
 #define I2C_VENDOR_ID_GOODIX		0x27c6
 #define I2C_DEVICE_ID_GOODIX_01F0	0x01f0
 
@@ -697,6 +693,9 @@
 #define USB_VENDOR_ID_LABTEC		0x1020
 #define USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD	0x0006
 
+#define USB_VENDOR_ID_LAVIEW		0x22D4
+#define USB_DEVICE_ID_GLORIOUS_MODEL_I	0x1503
+
 #define USB_VENDOR_ID_LCPOWER		0x1241
 #define USB_DEVICE_ID_LCPOWER_LC1000	0xf767
 
@@ -1068,6 +1067,10 @@
 #define USB_VENDOR_ID_SIGMATEL		0x066F
 #define USB_DEVICE_ID_SIGMATEL_STMP3780	0x3780
 
+#define USB_VENDOR_ID_SINOWEALTH  0x258a
+#define USB_DEVICE_ID_GLORIOUS_MODEL_D 0x0033
+#define USB_DEVICE_ID_GLORIOUS_MODEL_O 0x0036
+
 #define USB_VENDOR_ID_SIS_TOUCH		0x0457
 #define USB_DEVICE_ID_SIS9200_TOUCH	0x9200
 #define USB_DEVICE_ID_SIS817_TOUCH	0x0817

From 1ac7379d2e186c007ef6f84b6234f6a7a9e2402c Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 14 Nov 2023 15:54:30 +0100
Subject: [PATCH 0967/1043] HID: add ALWAYS_POLL quirk for Apple kb

[ Upstream commit c55092187d9ad7b2f8f5a8645286fa03997d442f ]

These devices disconnect if suspended without remote wakeup. They can operate
with the standard driver.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 787349f2de01..1b3a83fa7616 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -33,6 +33,7 @@ static const struct hid_device_id hid_quirks[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2), HID_QUIRK_NO_INIT_REPORTS },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ALPS, USB_DEVICE_ID_IBM_GAMEPAD), HID_QUIRK_BADPAD },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_AMI, USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE), HID_QUIRK_ALWAYS_POLL },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_REVB_ANSI), HID_QUIRK_ALWAYS_POLL },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM), HID_QUIRK_NOGET },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC), HID_QUIRK_NOGET },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM), HID_QUIRK_NOGET },

From 744027bb8ee0ef5be9a49f4f9c2f22c5f9d49abe Mon Sep 17 00:00:00 2001
From: Denis Benato <benato.denis96@gmail.com>
Date: Fri, 17 Nov 2023 14:15:56 +1300
Subject: [PATCH 0968/1043] HID: hid-asus: reset the backlight brightness level
 on resume

[ Upstream commit 546edbd26cff7ae990e480a59150e801a06f77b1 ]

Some devices managed by this driver automatically set brightness to 0
before entering a suspended state and reset it back to a default
brightness level after the resume:
this has the effect of having the kernel report wrong brightness
status after a sleep, and on some devices (like the Asus RC71L) that
brightness is the intensity of LEDs directly facing the user.

Fix the above issue by setting back brightness to the level it had
before entering a sleep state.

Signed-off-by: Denis Benato <benato.denis96@gmail.com>
Signed-off-by: Luke D. Jones <luke@ljones.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-asus.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 6865cab33cf8..52b0ef99bc95 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -901,6 +901,24 @@ static int asus_start_multitouch(struct hid_device *hdev)
 	return 0;
 }
 
+static int __maybe_unused asus_resume(struct hid_device *hdev) {
+	struct asus_drvdata *drvdata = hid_get_drvdata(hdev);
+	int ret = 0;
+
+	if (drvdata->kbd_backlight) {
+		const u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4,
+				drvdata->kbd_backlight->cdev.brightness };
+		ret = asus_kbd_set_report(hdev, buf, sizeof(buf));
+		if (ret < 0) {
+			hid_err(hdev, "Asus failed to set keyboard backlight: %d\n", ret);
+			goto asus_resume_err;
+		}
+	}
+
+asus_resume_err:
+	return ret;
+}
+
 static int __maybe_unused asus_reset_resume(struct hid_device *hdev)
 {
 	struct asus_drvdata *drvdata = hid_get_drvdata(hdev);
@@ -1177,6 +1195,7 @@ static struct hid_driver asus_driver = {
 	.input_configured       = asus_input_configured,
 #ifdef CONFIG_PM
 	.reset_resume           = asus_reset_resume,
+	.resume					= asus_resume,
 #endif
 	.event			= asus_event,
 	.raw_event		= asus_raw_event

From f6a1bf42997853812461249ed2ca9f424b759d11 Mon Sep 17 00:00:00 2001
From: Aoba K <nexp_0x17@outlook.com>
Date: Tue, 21 Nov 2023 20:23:11 +0800
Subject: [PATCH 0969/1043] HID: multitouch: Add quirk for HONOR GLO-GXXX
 touchpad

[ Upstream commit 9ffccb691adb854e7b7f3ee57fbbda12ff70533f ]

Honor MagicBook 13 2023 has a touchpad which do not switch to the multitouch
mode until the input mode feature is written by the host.  The touchpad do
report the input mode at touchpad(3), while itself working under mouse mode. As
a workaround, it is possible to call MT_QUIRE_FORCE_GET_FEATURE to force set
feature in mt_set_input_mode for such device.

The touchpad reports as BLTP7853, which cannot retrive any useful manufacture
information on the internel by this string at present.  As the serial number of
the laptop is GLO-G52, while DMI info reports the laptop serial number as
GLO-GXXX, this workaround should applied to all models which has the GLO-GXXX.

Signed-off-by: Aoba K <nexp_0x17@outlook.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-multitouch.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 84b12599eaf6..7d43d62df240 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1962,6 +1962,11 @@ static const struct hid_device_id mt_devices[] = {
 		MT_USB_DEVICE(USB_VENDOR_ID_HANVON_ALT,
 			USB_DEVICE_ID_HANVON_ALT_MULTITOUCH) },
 
+	/* HONOR GLO-GXXX panel */
+	{ .driver_data = MT_CLS_VTL,
+		HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+			0x347d, 0x7853) },
+
 	/* Ilitek dual touch panel */
 	{  .driver_data = MT_CLS_NSMU,
 		MT_USB_DEVICE(USB_VENDOR_ID_ILITEK,

From 09c8ee5f9bb36aea2c5d90576fb7b38e33ddec06 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Thu, 9 Nov 2023 22:22:13 -0800
Subject: [PATCH 0970/1043] asm-generic: qspinlock: fix
 queued_spin_value_unlocked() implementation

[ Upstream commit 125b0bb95dd6bec81b806b997a4ccb026eeecf8f ]

We really don't want to do atomic_read() or anything like that, since we
already have the value, not the lock.  The whole point of this is that
we've loaded the lock from memory, and we want to check whether the
value we loaded was a locked one or not.

The main use of this is the lockref code, which loads both the lock and
the reference count in one atomic operation, and then works on that
combined value.  With the atomic_read(), the compiler would pointlessly
spill the value to the stack, in order to then be able to read it back
"atomically".

This is the qspinlock version of commit c6f4a9002252 ("asm-generic:
ticket-lock: Optimize arch_spin_value_unlocked()") which fixed this same
bug for ticket locks.

Cc: Guo Ren <guoren@kernel.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Waiman Long <longman@redhat.com>
Link: https://lore.kernel.org/all/CAHk-=whNRv0v6kQiV5QO6DJhjH4KEL36vWQ6Re8Csrnh4zbRkQ@mail.gmail.com/
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/asm-generic/qspinlock.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/asm-generic/qspinlock.h b/include/asm-generic/qspinlock.h
index 4fe7fd0fe834..d1ddbcf71791 100644
--- a/include/asm-generic/qspinlock.h
+++ b/include/asm-generic/qspinlock.h
@@ -41,7 +41,7 @@ static __always_inline int queued_spin_is_locked(struct qspinlock *lock)
  */
 static __always_inline int queued_spin_value_unlocked(struct qspinlock lock)
 {
-	return !atomic_read(&lock.val);
+	return !lock.val.counter;
 }
 
 /**

From e9709a88a8ee67f383ee64d29e5c7be5e29e882a Mon Sep 17 00:00:00 2001
From: Lech Perczak <lech.perczak@gmail.com>
Date: Sat, 18 Nov 2023 00:19:18 +0100
Subject: [PATCH 0971/1043] net: usb: qmi_wwan: claim interface 4 for ZTE MF290
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 99360d9620f09fb8bc15548d855011bbb198c680 ]

Interface 4 is used by for QMI interface in stock firmware of MF28D, the
router which uses MF290 modem. Rebind it to qmi_wwan after freeing it up
from option driver.
The proper configuration is:

Interface mapping is:
0: QCDM, 1: (unknown), 2: AT (PCUI), 2: AT (Modem), 4: QMI

T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  4 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=19d2 ProdID=0189 Rev= 0.00
S:  Manufacturer=ZTE, Incorporated
S:  Product=ZTE LTE Technologies MSM
C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=84(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E:  Ad=86(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms

Cc: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://lore.kernel.org/r/20231117231918.100278-3-lech.perczak@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/qmi_wwan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 5cf7f389bf4e..3d342908f57a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1225,6 +1225,7 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x19d2, 0x0168, 4)},
 	{QMI_FIXED_INTF(0x19d2, 0x0176, 3)},
 	{QMI_FIXED_INTF(0x19d2, 0x0178, 3)},
+	{QMI_FIXED_INTF(0x19d2, 0x0189, 4)},    /* ZTE MF290 */
 	{QMI_FIXED_INTF(0x19d2, 0x0191, 4)},	/* ZTE EuFi890 */
 	{QMI_FIXED_INTF(0x19d2, 0x0199, 1)},	/* ZTE MF820S */
 	{QMI_FIXED_INTF(0x19d2, 0x0200, 1)},

From 5984306f6ce7b1f872df1c6d24fe227dbb584361 Mon Sep 17 00:00:00 2001
From: Denis Benato <benato.denis96@gmail.com>
Date: Fri, 17 Nov 2023 14:15:55 +1300
Subject: [PATCH 0972/1043] HID: hid-asus: add const to read-only outgoing usb
 buffer

[ Upstream commit 06ae5afce8cc1f7621cc5c7751e449ce20d68af7 ]

In the function asus_kbd_set_report the parameter buf is read-only
as it gets copied in a memory portion suitable for USB transfer,
but the parameter is not marked as const: add the missing const and mark
const immutable buffers passed to that function.

Signed-off-by: Denis Benato <benato.denis96@gmail.com>
Signed-off-by: Luke D. Jones <luke@ljones.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-asus.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 52b0ef99bc95..b46fb92d28e5 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -336,7 +336,7 @@ static int asus_raw_event(struct hid_device *hdev,
 	return 0;
 }
 
-static int asus_kbd_set_report(struct hid_device *hdev, u8 *buf, size_t buf_size)
+static int asus_kbd_set_report(struct hid_device *hdev, const u8 *buf, size_t buf_size)
 {
 	unsigned char *dmabuf;
 	int ret;
@@ -355,7 +355,7 @@ static int asus_kbd_set_report(struct hid_device *hdev, u8 *buf, size_t buf_size
 
 static int asus_kbd_init(struct hid_device *hdev)
 {
-	u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x41, 0x53, 0x55, 0x53, 0x20, 0x54,
+	const u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x41, 0x53, 0x55, 0x53, 0x20, 0x54,
 		     0x65, 0x63, 0x68, 0x2e, 0x49, 0x6e, 0x63, 0x2e, 0x00 };
 	int ret;
 
@@ -369,7 +369,7 @@ static int asus_kbd_init(struct hid_device *hdev)
 static int asus_kbd_get_functions(struct hid_device *hdev,
 				  unsigned char *kbd_func)
 {
-	u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x05, 0x20, 0x31, 0x00, 0x08 };
+	const u8 buf[] = { FEATURE_KBD_REPORT_ID, 0x05, 0x20, 0x31, 0x00, 0x08 };
 	u8 *readbuf;
 	int ret;
 

From 7ccfc078cd475d11b233288c3ae3d639f7c4ce1c Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Fri, 15 Dec 2023 11:24:50 +0000
Subject: [PATCH 0973/1043] perf: Fix perf_event_validate_size() lockdep splat

commit 7e2c1e4b34f07d9aa8937fab88359d4a0fce468e upstream.

When lockdep is enabled, the for_each_sibling_event(sibling, event)
macro checks that event->ctx->mutex is held. When creating a new group
leader event, we call perf_event_validate_size() on a partially
initialized event where event->ctx is NULL, and so when
for_each_sibling_event() attempts to check event->ctx->mutex, we get a
splat, as reported by Lucas De Marchi:

  WARNING: CPU: 8 PID: 1471 at kernel/events/core.c:1950 __do_sys_perf_event_open+0xf37/0x1080

This only happens for a new event which is its own group_leader, and in
this case there cannot be any sibling events. Thus it's safe to skip the
check for siblings, which avoids having to make invasive and ugly
changes to for_each_sibling_event().

Avoid the splat by bailing out early when the new event is its own
group_leader.

Fixes: 382c27f4ed28f803 ("perf: Fix perf_event_validate_size()")
Closes: https://lore.kernel.org/lkml/20231214000620.3081018-1-lucas.demarchi@intel.com/
Closes: https://lore.kernel.org/lkml/ZXpm6gQ%2Fd59jGsuW@xpf.sh.intel.com/
Reported-by: Lucas De Marchi <lucas.demarchi@intel.com>
Reported-by: Pengfei Xu <pengfei.xu@intel.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20231215112450.3972309-1-mark.rutland@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/events/core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 0a6855d64803..afedd008e0af 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2039,6 +2039,16 @@ static bool perf_event_validate_size(struct perf_event *event)
 				   group_leader->nr_siblings + 1) > 16*1024)
 		return false;
 
+	/*
+	 * When creating a new group leader, group_leader->ctx is initialized
+	 * after the size has been validated, but we cannot safely use
+	 * for_each_sibling_event() until group_leader->ctx is set. A new group
+	 * leader cannot have any siblings yet, so we can safely skip checking
+	 * the non-existent siblings.
+	 */
+	if (event == group_leader)
+		return true;
+
 	for_each_sibling_event(sibling, group_leader) {
 		if (__perf_event_read_size(sibling->attr.read_format,
 					   group_leader->nr_siblings + 1) > 16*1024)

From 6e2628dfade502b5917e338cce87de728d221587 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date: Fri, 24 Nov 2023 19:01:36 +0100
Subject: [PATCH 0974/1043] soundwire: stream: fix NULL pointer dereference for
 multi_link

commit e199bf52ffda8f98f129728d57244a9cd9ad5623 upstream.

If bus is marked as multi_link, but number of masters in the stream is
not higher than bus->hw_sync_min_links (bus->multi_link && m_rt_count >=
bus->hw_sync_min_links), bank switching should not happen.  The first
part of do_bank_switch() code properly takes these conditions into
account, but second part (sdw_ml_sync_bank_switch()) relies purely on
bus->multi_link property.  This is not balanced and leads to NULL
pointer dereference:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
  ...
  Call trace:
   wait_for_completion_timeout+0x124/0x1f0
   do_bank_switch+0x370/0x6f8
   sdw_prepare_stream+0x2d0/0x438
   qcom_snd_sdw_prepare+0xa0/0x118
   sm8450_snd_prepare+0x128/0x148
   snd_soc_link_prepare+0x5c/0xe8
   __soc_pcm_prepare+0x28/0x1ec
   dpcm_be_dai_prepare+0x1e0/0x2c0
   dpcm_fe_dai_prepare+0x108/0x28c
   snd_pcm_do_prepare+0x44/0x68
   snd_pcm_action_single+0x54/0xc0
   snd_pcm_action_nonatomic+0xe4/0xec
   snd_pcm_prepare+0xc4/0x114
   snd_pcm_common_ioctl+0x1154/0x1cc0
   snd_pcm_ioctl+0x54/0x74

Fixes: ce6e74d008ff ("soundwire: Add support for multi link bank switch")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20231124180136.390621-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soundwire/stream.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
index 79554d28f08a..a377c3d02c55 100644
--- a/drivers/soundwire/stream.c
+++ b/drivers/soundwire/stream.c
@@ -724,14 +724,15 @@ static int sdw_bank_switch(struct sdw_bus *bus, int m_rt_count)
  * sdw_ml_sync_bank_switch: Multilink register bank switch
  *
  * @bus: SDW bus instance
+ * @multi_link: whether this is a multi-link stream with hardware-based sync
  *
  * Caller function should free the buffers on error
  */
-static int sdw_ml_sync_bank_switch(struct sdw_bus *bus)
+static int sdw_ml_sync_bank_switch(struct sdw_bus *bus, bool multi_link)
 {
 	unsigned long time_left;
 
-	if (!bus->multi_link)
+	if (!multi_link)
 		return 0;
 
 	/* Wait for completion of transfer */
@@ -827,7 +828,7 @@ static int do_bank_switch(struct sdw_stream_runtime *stream)
 			bus->bank_switch_timeout = DEFAULT_BANK_SWITCH_TIMEOUT;
 
 		/* Check if bank switch was successful */
-		ret = sdw_ml_sync_bank_switch(bus);
+		ret = sdw_ml_sync_bank_switch(bus, multi_link);
 		if (ret < 0) {
 			dev_err(bus->dev,
 				"multi link bank switch failed: %d\n", ret);

From 26eeec522acaad86ed05da97db5ea7c72da96fb6 Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Mon, 27 Nov 2023 14:33:13 +0800
Subject: [PATCH 0975/1043] ext4: prevent the normalized size from exceeding
 EXT_MAX_BLOCKS

commit 2dcf5fde6dffb312a4bfb8ef940cea2d1f402e32 upstream.

For files with logical blocks close to EXT_MAX_BLOCKS, the file size
predicted in ext4_mb_normalize_request() may exceed EXT_MAX_BLOCKS.
This can cause some blocks to be preallocated that will not be used.
And after [Fixes], the following issue may be triggered:

=========================================================
 kernel BUG at fs/ext4/mballoc.c:4653!
 Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
 CPU: 1 PID: 2357 Comm: xfs_io 6.7.0-rc2-00195-g0f5cc96c367f
 Hardware name: linux,dummy-virt (DT)
 pc : ext4_mb_use_inode_pa+0x148/0x208
 lr : ext4_mb_use_inode_pa+0x98/0x208
 Call trace:
  ext4_mb_use_inode_pa+0x148/0x208
  ext4_mb_new_inode_pa+0x240/0x4a8
  ext4_mb_use_best_found+0x1d4/0x208
  ext4_mb_try_best_found+0xc8/0x110
  ext4_mb_regular_allocator+0x11c/0xf48
  ext4_mb_new_blocks+0x790/0xaa8
  ext4_ext_map_blocks+0x7cc/0xd20
  ext4_map_blocks+0x170/0x600
  ext4_iomap_begin+0x1c0/0x348
=========================================================

Here is a calculation when adjusting ac_b_ex in ext4_mb_new_inode_pa():

	ex.fe_logical = orig_goal_end - EXT4_C2B(sbi, ex.fe_len);
	if (ac->ac_o_ex.fe_logical >= ex.fe_logical)
		goto adjust_bex;

The problem is that when orig_goal_end is subtracted from ac_b_ex.fe_len
it is still greater than EXT_MAX_BLOCKS, which causes ex.fe_logical to
overflow to a very small value, which ultimately triggers a BUG_ON in
ext4_mb_new_inode_pa() because pa->pa_free < len.

The last logical block of an actual write request does not exceed
EXT_MAX_BLOCKS, so in ext4_mb_normalize_request() also avoids normalizing
the last logical block to exceed EXT_MAX_BLOCKS to avoid the above issue.

The test case in [Link] can reproduce the above issue with 64k block size.

Link: https://patchwork.kernel.org/project/fstests/list/?series=804003
Cc:  <stable@kernel.org> # 6.4
Fixes: 93cdf49f6eca ("ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()")
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20231127063313.3734294-1-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/mballoc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index c9ac43f40746..3babc07ae613 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3603,6 +3603,10 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
 	start = max(start, rounddown(ac->ac_o_ex.fe_logical,
 			(ext4_lblk_t)EXT4_BLOCKS_PER_GROUP(ac->ac_sb)));
 
+	/* avoid unnecessary preallocation that may trigger assertions */
+	if (start + size > EXT_MAX_BLOCKS)
+		size = EXT_MAX_BLOCKS - start;
+
 	/* don't cover already allocated blocks in selected range */
 	if (ar->pleft && start <= ar->lleft) {
 		size -= ar->lleft + 1 - start;

From 33fb8ac30c3ee1f14a9d95503ccb07d67e15d088 Mon Sep 17 00:00:00 2001
From: James Houghton <jthoughton@google.com>
Date: Mon, 4 Dec 2023 17:26:46 +0000
Subject: [PATCH 0976/1043] arm64: mm: Always make sw-dirty PTEs hw-dirty in
 pte_modify

commit 3c0696076aad60a2f04c019761921954579e1b0e upstream.

It is currently possible for a userspace application to enter an
infinite page fault loop when using HugeTLB pages implemented with
contiguous PTEs when HAFDBS is not available. This happens because:

1. The kernel may sometimes write PTEs that are sw-dirty but hw-clean
   (PTE_DIRTY | PTE_RDONLY | PTE_WRITE).

2. If, during a write, the CPU uses a sw-dirty, hw-clean PTE in handling
   the memory access on a system without HAFDBS, we will get a page
   fault.

3. HugeTLB will check if it needs to update the dirty bits on the PTE.
   For contiguous PTEs, it will check to see if the pgprot bits need
   updating. In this case, HugeTLB wants to write a sequence of
   sw-dirty, hw-dirty PTEs, but it finds that all the PTEs it is about
   to overwrite are all pte_dirty() (pte_sw_dirty() => pte_dirty()),
   so it thinks no update is necessary.

We can get the kernel to write a sw-dirty, hw-clean PTE with the
following steps (showing the relevant VMA flags and pgprot bits):

i.   Create a valid, writable contiguous PTE.
       VMA vmflags:     VM_SHARED | VM_READ | VM_WRITE
       VMA pgprot bits: PTE_RDONLY | PTE_WRITE
       PTE pgprot bits: PTE_DIRTY | PTE_WRITE

ii.  mprotect the VMA to PROT_NONE.
       VMA vmflags:     VM_SHARED
       VMA pgprot bits: PTE_RDONLY
       PTE pgprot bits: PTE_DIRTY | PTE_RDONLY

iii. mprotect the VMA back to PROT_READ | PROT_WRITE.
       VMA vmflags:     VM_SHARED | VM_READ | VM_WRITE
       VMA pgprot bits: PTE_RDONLY | PTE_WRITE
       PTE pgprot bits: PTE_DIRTY | PTE_WRITE | PTE_RDONLY

Make it impossible to create a writeable sw-dirty, hw-clean PTE with
pte_modify(). Such a PTE should be impossible to create, and there may
be places that assume that pte_dirty() implies pte_hw_dirty().

Signed-off-by: James Houghton <jthoughton@google.com>
Fixes: 031e6e6b4e12 ("arm64: hugetlb: Avoid unnecessary clearing in huge_ptep_set_access_flags")
Cc: <stable@vger.kernel.org>
Acked-by: Will Deacon <will@kernel.org>
Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
Link: https://lore.kernel.org/r/20231204172646.2541916-3-jthoughton@google.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/pgtable.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 4eedfd784cf6..7756a365d4c4 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -744,6 +744,12 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 	if (pte_hw_dirty(pte))
 		pte = pte_mkdirty(pte);
 	pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask);
+	/*
+	 * If we end up clearing hw dirtiness for a sw-dirty PTE, set hardware
+	 * dirtiness again.
+	 */
+	if (pte_sw_dirty(pte))
+		pte = pte_mkdirty(pte);
 	return pte;
 }
 

From 5ffda6998be51a8abb11b911087ebdd83ddfe7c5 Mon Sep 17 00:00:00 2001
From: Florent Revest <revest@chromium.org>
Date: Wed, 6 Dec 2023 13:37:18 +0100
Subject: [PATCH 0977/1043] team: Fix use-after-free when an option instance
 allocation fails

commit c12296bbecc488623b7d1932080e394d08f3226b upstream.

In __team_options_register, team_options are allocated and appended to
the team's option_list.
If one option instance allocation fails, the "inst_rollback" cleanup
path frees the previously allocated options but doesn't remove them from
the team's option_list.
This leaves dangling pointers that can be dereferenced later by other
parts of the team driver that iterate over options.

This patch fixes the cleanup path to remove the dangling pointers from
the list.

As far as I can tell, this uaf doesn't have much security implications
since it would be fairly hard to exploit (an attacker would need to make
the allocation of that specific small object fail) but it's still nice
to fix.

Cc: stable@vger.kernel.org
Fixes: 80f7c6683fe0 ("team: add support for per-port options")
Signed-off-by: Florent Revest <revest@chromium.org>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://lore.kernel.org/r/20231206123719.1963153-1-revest@chromium.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/team/team.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 97a77dabed64..49d7030ddc1b 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -284,8 +284,10 @@ static int __team_options_register(struct team *team,
 	return 0;
 
 inst_rollback:
-	for (i--; i >= 0; i--)
+	for (i--; i >= 0; i--) {
 		__team_option_inst_del_option(team, dst_opts[i]);
+		list_del(&dst_opts[i]->list);
+	}
 
 	i = option_count;
 alloc_rollback:

From a3580b2bfe909dd3e56cc9db29de85f100f0e83a Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Date: Sun, 10 Dec 2023 22:12:50 -0500
Subject: [PATCH 0978/1043] ring-buffer: Fix memory leak of free page

commit 17d801758157bec93f26faaf5ff1a8b9a552d67a upstream.

Reading the ring buffer does a swap of a sub-buffer within the ring buffer
with a empty sub-buffer. This allows the reader to have full access to the
content of the sub-buffer that was swapped out without having to worry
about contention with the writer.

The readers call ring_buffer_alloc_read_page() to allocate a page that
will be used to swap with the ring buffer. When the code is finished with
the reader page, it calls ring_buffer_free_read_page(). Instead of freeing
the page, it stores it as a spare. Then next call to
ring_buffer_alloc_read_page() will return this spare instead of calling
into the memory management system to allocate a new page.

Unfortunately, on freeing of the ring buffer, this spare page is not
freed, and causes a memory leak.

Link: https://lore.kernel.org/linux-trace-kernel/20231210221250.7b9cc83c@rorschach.local.home

Cc: stable@vger.kernel.org
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Fixes: 73a757e63114d ("ring-buffer: Return reader page back into existing ring buffer")
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ring_buffer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 7e1148aafd28..acb9e5a0f5ef 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1667,6 +1667,8 @@ static void rb_free_cpu_buffer(struct ring_buffer_per_cpu *cpu_buffer)
 		free_buffer_page(bpage);
 	}
 
+	free_page((unsigned long)cpu_buffer->free_page);
+
 	kfree(cpu_buffer);
 }
 

From d7a2939814277efe81aa39cf0b9516e3a4d12032 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Date: Sun, 10 Dec 2023 22:54:47 -0500
Subject: [PATCH 0979/1043] tracing: Update snapshot buffer on resize if it is
 allocated

commit d06aff1cb13d2a0d52b48e605462518149c98c81 upstream.

The snapshot buffer is to mimic the main buffer so that when a snapshot is
needed, the snapshot and main buffer are swapped. When the snapshot buffer
is allocated, it is set to the minimal size that the ring buffer may be at
and still functional. When it is allocated it becomes the same size as the
main ring buffer, and when the main ring buffer changes in size, it should
do.

Currently, the resize only updates the snapshot buffer if it's used by the
current tracer (ie. the preemptirqsoff tracer). But it needs to be updated
anytime it is allocated.

When changing the size of the main buffer, instead of looking to see if
the current tracer is utilizing the snapshot buffer, just check if it is
allocated to know if it should be updated or not.

Also fix typo in comment just above the code change.

Link: https://lore.kernel.org/linux-trace-kernel/20231210225447.48476a6a@rorschach.local.home

Cc: stable@vger.kernel.org
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Fixes: ad909e21bbe69 ("tracing: Add internal tracing_snapshot() functions")
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/trace.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 4e0411b19ef9..b2527624481d 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -5905,7 +5905,7 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
 	if (!tr->array_buffer.buffer)
 		return 0;
 
-	/* Do not allow tracing while resizng ring buffer */
+	/* Do not allow tracing while resizing ring buffer */
 	tracing_stop_tr(tr);
 
 	ret = ring_buffer_resize(tr->array_buffer.buffer, size, cpu);
@@ -5913,7 +5913,7 @@ static int __tracing_resize_ring_buffer(struct trace_array *tr,
 		goto out_start;
 
 #ifdef CONFIG_TRACER_MAX_TRACE
-	if (!tr->current_trace->use_max_tr)
+	if (!tr->allocated_snapshot)
 		goto out;
 
 	ret = ring_buffer_resize(tr->max_buffer.buffer, size, cpu);

From 3e8055fc3b2193e59739da88393de6f43ec2f84d Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Date: Tue, 12 Dec 2023 07:25:58 -0500
Subject: [PATCH 0980/1043] ring-buffer: Have saved event hold the entire event

commit b049525855fdd0024881c9b14b8fbec61c3f53d3 upstream.

For the ring buffer iterator (non-consuming read), the event needs to be
copied into the iterator buffer to make sure that a writer does not
overwrite it while the user is reading it. If a write happens during the
copy, the buffer is simply discarded.

But the temp buffer itself was not big enough. The allocation of the
buffer was only BUF_MAX_DATA_SIZE, which is the maximum data size that can
be passed into the ring buffer and saved. But the temp buffer needs to
hold the meta data as well. That would be BUF_PAGE_SIZE and not
BUF_MAX_DATA_SIZE.

Link: https://lore.kernel.org/linux-trace-kernel/20231212072558.61f76493@gandalf.local.home

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Fixes: 785888c544e04 ("ring-buffer: Have rb_iter_head_event() handle concurrent writer")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ring_buffer.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index acb9e5a0f5ef..e37a8e0352f3 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2275,7 +2275,7 @@ rb_iter_head_event(struct ring_buffer_iter *iter)
 	 */
 	barrier();
 
-	if ((iter->head + length) > commit || length > BUF_MAX_DATA_SIZE)
+	if ((iter->head + length) > commit || length > BUF_PAGE_SIZE)
 		/* Writer corrupted the read? */
 		goto reset;
 
@@ -4836,7 +4836,8 @@ ring_buffer_read_prepare(struct trace_buffer *buffer, int cpu, gfp_t flags)
 	if (!iter)
 		return NULL;
 
-	iter->event = kmalloc(BUF_MAX_DATA_SIZE, flags);
+	/* Holds the entire event: data and meta data */
+	iter->event = kmalloc(BUF_PAGE_SIZE, flags);
 	if (!iter->event) {
 		kfree(iter);
 		return NULL;

From 9f5bf009f77deb59159cc39f9fbdfa334fc0a193 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Date: Tue, 12 Dec 2023 11:16:17 -0500
Subject: [PATCH 0981/1043] ring-buffer: Fix writing to the buffer with
 max_data_size

commit b3ae7b67b87fed771fa5bf95389df06b0433603e upstream.

The maximum ring buffer data size is the maximum size of data that can be
recorded on the ring buffer. Events must be smaller than the sub buffer
data size minus any meta data. This size is checked before trying to
allocate from the ring buffer because the allocation assumes that the size
will fit on the sub buffer.

The maximum size was calculated as the size of a sub buffer page (which is
currently PAGE_SIZE minus the sub buffer header) minus the size of the
meta data of an individual event. But it missed the possible adding of a
time stamp for events that are added long enough apart that the event meta
data can't hold the time delta.

When an event is added that is greater than the current BUF_MAX_DATA_SIZE
minus the size of a time stamp, but still less than or equal to
BUF_MAX_DATA_SIZE, the ring buffer would go into an infinite loop, looking
for a page that can hold the event. Luckily, there's a check for this loop
and after 1000 iterations and a warning is emitted and the ring buffer is
disabled. But this should never happen.

This can happen when a large event is added first, or after a long period
where an absolute timestamp is prefixed to the event, increasing its size
by 8 bytes. This passes the check and then goes into the algorithm that
causes the infinite loop.

For events that are the first event on the sub-buffer, it does not need to
add a timestamp, because the sub-buffer itself contains an absolute
timestamp, and adding one is redundant.

The fix is to check if the event is to be the first event on the
sub-buffer, and if it is, then do not add a timestamp.

This also fixes 32 bit adding a timestamp when a read of before_stamp or
write_stamp is interrupted. There's still no need to add that timestamp if
the event is going to be the first event on the sub buffer.

Also, if the buffer has "time_stamp_abs" set, then also check if the
length plus the timestamp is greater than the BUF_MAX_DATA_SIZE.

Link: https://lore.kernel.org/all/20231212104549.58863438@gandalf.local.home/
Link: https://lore.kernel.org/linux-trace-kernel/20231212071837.5fdd6c13@gandalf.local.home
Link: https://lore.kernel.org/linux-trace-kernel/20231212111617.39e02849@gandalf.local.home

Cc: stable@vger.kernel.org
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Fixes: a4543a2fa9ef3 ("ring-buffer: Get timestamp after event is allocated")
Fixes: 58fbc3c63275c ("ring-buffer: Consolidate add_timestamp to remove some branches")
Reported-by: Kent Overstreet <kent.overstreet@linux.dev> # (on IRC)
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ring_buffer.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index e37a8e0352f3..190d0ae08247 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3301,7 +3301,10 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
 		 * absolute timestamp.
 		 * Don't bother if this is the start of a new page (w == 0).
 		 */
-		if (unlikely(!a_ok || !b_ok || (info->before != info->after && w))) {
+		if (!w) {
+			/* Use the sub-buffer timestamp */
+			info->delta = 0;
+		} else if (unlikely(!a_ok || !b_ok || info->before != info->after)) {
 			info->add_timestamp |= RB_ADD_STAMP_FORCE | RB_ADD_STAMP_EXTEND;
 			info->length += RB_LEN_TIME_EXTEND;
 		} else {
@@ -3456,6 +3459,8 @@ rb_reserve_next_event(struct trace_buffer *buffer,
 	if (ring_buffer_time_stamp_abs(cpu_buffer->buffer)) {
 		add_ts_default = RB_ADD_STAMP_ABSOLUTE;
 		info.length += RB_LEN_TIME_EXTEND;
+		if (info.length > BUF_MAX_DATA_SIZE)
+			goto out_fail;
 	} else {
 		add_ts_default = RB_ADD_STAMP_NONE;
 	}

From 20c2cb79a38c9470e855ce74a9c0ce4d09a98d14 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Date: Tue, 12 Dec 2023 11:53:01 -0500
Subject: [PATCH 0982/1043] ring-buffer: Fix a race in rb_time_cmpxchg() for 32
 bit archs

commit fff88fa0fbc7067ba46dde570912d63da42c59a9 upstream.

Mathieu Desnoyers pointed out an issue in the rb_time_cmpxchg() for 32 bit
architectures. That is:

 static bool rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set)
 {
	unsigned long cnt, top, bottom, msb;
	unsigned long cnt2, top2, bottom2, msb2;
	u64 val;

	/* The cmpxchg always fails if it interrupted an update */
	 if (!__rb_time_read(t, &val, &cnt2))
		 return false;

	 if (val != expect)
		 return false;

<<<< interrupted here!

	 cnt = local_read(&t->cnt);

The problem is that the synchronization counter in the rb_time_t is read
*after* the value of the timestamp is read. That means if an interrupt
were to come in between the value being read and the counter being read,
it can change the value and the counter and the interrupted process would
be clueless about it!

The counter needs to be read first and then the value. That way it is easy
to tell if the value is stale or not. If the counter hasn't been updated,
then the value is still good.

Link: https://lore.kernel.org/linux-trace-kernel/20231211201324.652870-1-mathieu.desnoyers@efficios.com/
Link: https://lore.kernel.org/linux-trace-kernel/20231212115301.7a9c9a64@gandalf.local.home

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Fixes: 10464b4aa605e ("ring-buffer: Add rb_time_t 64 bit operations for speeding up 32 bit")
Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ring_buffer.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 190d0ae08247..364fa91ab33e 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -703,6 +703,9 @@ static int rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set)
 	unsigned long cnt2, top2, bottom2;
 	u64 val;
 
+	/* Any interruptions in this function should cause a failure */
+	cnt = local_read(&t->cnt);
+
 	/* The cmpxchg always fails if it interrupted an update */
 	 if (!__rb_time_read(t, &val, &cnt2))
 		 return false;
@@ -710,7 +713,6 @@ static int rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set)
 	 if (val != expect)
 		 return false;
 
-	 cnt = local_read(&t->cnt);
 	 if ((cnt & 3) != cnt2)
 		 return false;
 

From 918ba07224e9e9a8bd8d375132be9a72e4cadc86 Mon Sep 17 00:00:00 2001
From: Roy Luo <royluo@google.com>
Date: Tue, 28 Nov 2023 22:17:56 +0000
Subject: [PATCH 0983/1043] USB: gadget: core: adjust uevent timing on gadget
 unbind

commit 73ea73affe8622bdf292de898da869d441da6a9d upstream.

The KOBJ_CHANGE uevent is sent before gadget unbind is actually
executed, resulting in inaccurate uevent emitted at incorrect timing
(the uevent would have USB_UDC_DRIVER variable set while it would
soon be removed).
Move the KOBJ_CHANGE uevent to the end of the unbind function so that
uevent is sent only after the change has been made.

Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class")
Cc: stable@vger.kernel.org
Signed-off-by: Roy Luo <royluo@google.com>
Link: https://lore.kernel.org/r/20231128221756.2591158-1-royluo@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 14d9d1ee16fc..7b3c0787d5a4 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1353,8 +1353,6 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
 	dev_dbg(&udc->dev, "unregistering UDC driver [%s]\n",
 			udc->driver->function);
 
-	kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
-
 	usb_gadget_disconnect(udc->gadget);
 	if (udc->gadget->irq)
 		synchronize_irq(udc->gadget->irq);
@@ -1363,6 +1361,8 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
 
 	udc->driver = NULL;
 	udc->gadget->dev.driver = NULL;
+
+	kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
 }
 
 /**

From b8faa754b523a845facdc83120b2ecd290d7fa6d Mon Sep 17 00:00:00 2001
From: Daniel Starke <daniel.starke@siemens.com>
Date: Tue, 12 Dec 2023 11:17:21 +0000
Subject: [PATCH 0984/1043] tty: n_gsm: fix tty registration before control
 channel open

commit 01aecd917114577c423f07cec0d186ad007d76fc upstream.

The current implementation registers/deregisters the user ttys at mux
attach/detach. That means that the user devices are available before any
control channel is open. However, user channel initialization requires an
open control channel. Furthermore, the user is not informed if the mux
restarts due to configuration changes.
Put the registration/deregistration procedure into separate function to
improve readability.
Move registration to mux activation and deregistration to mux cleanup to
keep the user devices only open as long as a control channel exists. The
user will be informed via the device driver if the mux was reconfigured in
a way that required a mux re-activation.
This makes it necessary to add T2 initialization to gsmld_open() for the
ldisc open code path (not the reconfiguration code path) to avoid deletion
of an uninitialized T2 at mux cleanup.

Fixes: d50f6dcaf22a ("tty: n_gsm: expose gsmtty device nodes at ldisc open time")
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220701061652.39604-2-daniel.starke@siemens.com
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/n_gsm.c | 117 ++++++++++++++++++++++++++++++--------------
 1 file changed, 79 insertions(+), 38 deletions(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 3693ad9f4521..7a883a2c0c50 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -235,6 +235,7 @@ struct gsm_mux {
 	struct gsm_dlci *dlci[NUM_DLCI];
 	int old_c_iflag;		/* termios c_iflag value before attach */
 	bool constipated;		/* Asked by remote to shut up */
+	bool has_devices;		/* Devices were registered */
 
 	spinlock_t tx_lock;
 	unsigned int tx_bytes;		/* TX data outstanding */
@@ -464,6 +465,68 @@ static u8 gsm_encode_modem(const struct gsm_dlci *dlci)
 	return modembits;
 }
 
+/**
+ *	gsm_register_devices	-	register all tty devices for a given mux index
+ *
+ *	@driver: the tty driver that describes the tty devices
+ *	@index:  the mux number is used to calculate the minor numbers of the
+ *	         ttys for this mux and may differ from the position in the
+ *	         mux array.
+ */
+static int gsm_register_devices(struct tty_driver *driver, unsigned int index)
+{
+	struct device *dev;
+	int i;
+	unsigned int base;
+
+	if (!driver || index >= MAX_MUX)
+		return -EINVAL;
+
+	base = index * NUM_DLCI; /* first minor for this index */
+	for (i = 1; i < NUM_DLCI; i++) {
+		/* Don't register device 0 - this is the control channel
+		 * and not a usable tty interface
+		 */
+		dev = tty_register_device(gsm_tty_driver, base + i, NULL);
+		if (IS_ERR(dev)) {
+			if (debug & 8)
+				pr_info("%s failed to register device minor %u",
+					__func__, base + i);
+			for (i--; i >= 1; i--)
+				tty_unregister_device(gsm_tty_driver, base + i);
+			return PTR_ERR(dev);
+		}
+	}
+
+	return 0;
+}
+
+/**
+ *	gsm_unregister_devices	-	unregister all tty devices for a given mux index
+ *
+ *	@driver: the tty driver that describes the tty devices
+ *	@index:  the mux number is used to calculate the minor numbers of the
+ *	         ttys for this mux and may differ from the position in the
+ *	         mux array.
+ */
+static void gsm_unregister_devices(struct tty_driver *driver,
+				   unsigned int index)
+{
+	int i;
+	unsigned int base;
+
+	if (!driver || index >= MAX_MUX)
+		return;
+
+	base = index * NUM_DLCI; /* first minor for this index */
+	for (i = 1; i < NUM_DLCI; i++) {
+		/* Don't unregister device 0 - this is the control
+		 * channel and not a usable tty interface
+		 */
+		tty_unregister_device(gsm_tty_driver, base + i);
+	}
+}
+
 /**
  *	gsm_print_packet	-	display a frame for debug
  *	@hdr: header to print before decode
@@ -2178,6 +2241,10 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
 	del_timer_sync(&gsm->t2_timer);
 
 	/* Free up any link layer users and finally the control channel */
+	if (gsm->has_devices) {
+		gsm_unregister_devices(gsm_tty_driver, gsm->num);
+		gsm->has_devices = false;
+	}
 	for (i = NUM_DLCI - 1; i >= 0; i--)
 		if (gsm->dlci[i])
 			gsm_dlci_release(gsm->dlci[i]);
@@ -2201,15 +2268,21 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
 static int gsm_activate_mux(struct gsm_mux *gsm)
 {
 	struct gsm_dlci *dlci;
+	int ret;
 
 	if (gsm->encoding == 0)
 		gsm->receive = gsm0_receive;
 	else
 		gsm->receive = gsm1_receive;
 
+	ret = gsm_register_devices(gsm_tty_driver, gsm->num);
+	if (ret)
+		return ret;
+
 	dlci = gsm_dlci_alloc(gsm, 0);
 	if (dlci == NULL)
 		return -ENOMEM;
+	gsm->has_devices = true;
 	gsm->dead = false;		/* Tty opens are now permissible */
 	return 0;
 }
@@ -2475,39 +2548,14 @@ static int gsmld_output(struct gsm_mux *gsm, u8 *data, int len)
  *	will need moving to an ioctl path.
  */
 
-static int gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
+static void gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
 {
-	unsigned int base;
-	int ret, i;
-
 	gsm->tty = tty_kref_get(tty);
 	/* Turn off tty XON/XOFF handling to handle it explicitly. */
 	gsm->old_c_iflag = tty->termios.c_iflag;
 	tty->termios.c_iflag &= (IXON | IXOFF);
-	ret =  gsm_activate_mux(gsm);
-	if (ret != 0)
-		tty_kref_put(gsm->tty);
-	else {
-		/* Don't register device 0 - this is the control channel and not
-		   a usable tty interface */
-		base = mux_num_to_base(gsm); /* Base for this MUX */
-		for (i = 1; i < NUM_DLCI; i++) {
-			struct device *dev;
-
-			dev = tty_register_device(gsm_tty_driver,
-							base + i, NULL);
-			if (IS_ERR(dev)) {
-				for (i--; i >= 1; i--)
-					tty_unregister_device(gsm_tty_driver,
-								base + i);
-				return PTR_ERR(dev);
-			}
-		}
-	}
-	return ret;
 }
 
-
 /**
  *	gsmld_detach_gsm	-	stop doing 0710 mux
  *	@tty: tty attached to the mux
@@ -2518,12 +2566,7 @@ static int gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
 
 static void gsmld_detach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
 {
-	unsigned int base = mux_num_to_base(gsm); /* Base for this MUX */
-	int i;
-
 	WARN_ON(tty != gsm->tty);
-	for (i = 1; i < NUM_DLCI; i++)
-		tty_unregister_device(gsm_tty_driver, base + i);
 	/* Restore tty XON/XOFF handling. */
 	gsm->tty->termios.c_iflag = gsm->old_c_iflag;
 	tty_kref_put(gsm->tty);
@@ -2619,7 +2662,6 @@ static void gsmld_close(struct tty_struct *tty)
 static int gsmld_open(struct tty_struct *tty)
 {
 	struct gsm_mux *gsm;
-	int ret;
 
 	if (tty->ops->write == NULL)
 		return -EINVAL;
@@ -2635,12 +2677,11 @@ static int gsmld_open(struct tty_struct *tty)
 	/* Attach the initial passive connection */
 	gsm->encoding = 1;
 
-	ret = gsmld_attach_gsm(tty, gsm);
-	if (ret != 0) {
-		gsm_cleanup_mux(gsm, false);
-		mux_put(gsm);
-	}
-	return ret;
+	gsmld_attach_gsm(tty, gsm);
+
+	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
+
+	return 0;
 }
 
 /**

From a11ea2c08f517798e0af9ebd2b7318bf7be9f609 Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Tue, 12 Dec 2023 11:17:21 +0000
Subject: [PATCH 0985/1043] tty: n_gsm, remove duplicates of parameters

commit b93db97e1ca08e500305bc46b08c72e2232c4be1 upstream.

dp, f, and i are only duplicates of gsmld_receive_buf's parameters. Use
the parameters directly (cp, fp, and count) and delete these local
variables.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20210302062214.29627-41-jslaby@suse.cz
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/n_gsm.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 7a883a2c0c50..2455f952e0aa 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2577,27 +2577,24 @@ static void gsmld_receive_buf(struct tty_struct *tty, const unsigned char *cp,
 			      char *fp, int count)
 {
 	struct gsm_mux *gsm = tty->disc_data;
-	const unsigned char *dp;
-	char *f;
-	int i;
 	char flags = TTY_NORMAL;
 
 	if (debug & 4)
 		print_hex_dump_bytes("gsmld_receive: ", DUMP_PREFIX_OFFSET,
 				     cp, count);
 
-	for (i = count, dp = cp, f = fp; i; i--, dp++) {
-		if (f)
-			flags = *f++;
+	for (; count; count--, cp++) {
+		if (fp)
+			flags = *fp++;
 		switch (flags) {
 		case TTY_NORMAL:
-			gsm->receive(gsm, *dp);
+			gsm->receive(gsm, *cp);
 			break;
 		case TTY_OVERRUN:
 		case TTY_BREAK:
 		case TTY_PARITY:
 		case TTY_FRAME:
-			gsm_error(gsm, *dp, flags);
+			gsm_error(gsm, *cp, flags);
 			break;
 		default:
 			WARN_ONCE(1, "%s: unknown flag %d\n",

From 5a82cf64f8ad63caf6bf115642ce44ddbc64311e Mon Sep 17 00:00:00 2001
From: Mazin Al Haddad <mazinalhaddad05@gmail.com>
Date: Tue, 12 Dec 2023 11:17:21 +0000
Subject: [PATCH 0986/1043] tty: n_gsm: add sanity check for gsm->receive in
 gsm_receive_buf()

commit f16c6d2e58a4c2b972efcf9eb12390ee0ba3befb upstream

A null pointer dereference can happen when attempting to access the
"gsm->receive()" function in gsmld_receive_buf(). Currently, the code
assumes that gsm->receive is only called after MUX activation.
Since the gsmld_receive_buf() function can be accessed without the need to
initialize the MUX, the gsm->receive() function will not be set and a
NULL pointer dereference will occur.

Fix this by avoiding the call to "gsm->receive()" in case the function is
not initialized by adding a sanity check.

Call Trace:
 <TASK>
 gsmld_receive_buf+0x1c2/0x2f0 drivers/tty/n_gsm.c:2861
 tiocsti drivers/tty/tty_io.c:2293 [inline]
 tty_ioctl+0xa75/0x15d0 drivers/tty/tty_io.c:2692
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl fs/ioctl.c:856 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Link: https://syzkaller.appspot.com/bug?id=bdf035c61447f8c6e0e6920315d577cb5cc35ac5
Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+e3563f0c94e188366dbb@syzkaller.appspotmail.com
Signed-off-by: Mazin Al Haddad <mazinalhaddad05@gmail.com>
Link: https://lore.kernel.org/r/20220814015211.84180-1-mazinalhaddad05@gmail.com
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/n_gsm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 2455f952e0aa..fa49529682ce 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2588,7 +2588,8 @@ static void gsmld_receive_buf(struct tty_struct *tty, const unsigned char *cp,
 			flags = *fp++;
 		switch (flags) {
 		case TTY_NORMAL:
-			gsm->receive(gsm, *cp);
+			if (gsm->receive)
+				gsm->receive(gsm, *cp);
 			break;
 		case TTY_OVERRUN:
 		case TTY_BREAK:

From e30e62f0e17884b5723f64ba93e58a7efbda2cf4 Mon Sep 17 00:00:00 2001
From: Naveen N Rao <naveen@kernel.org>
Date: Fri, 15 Dec 2023 16:44:32 +0530
Subject: [PATCH 0987/1043] powerpc/ftrace: Create a dummy stackframe to fix
 stack unwind

commit 41a506ef71eb38d94fe133f565c87c3e06ccc072 upstream.

With ppc64 -mprofile-kernel and ppc32 -pg, profiling instructions to
call into ftrace are emitted right at function entry. The instruction
sequence used is minimal to reduce overhead. Crucially, a stackframe is
not created for the function being traced. This breaks stack unwinding
since the function being traced does not have a stackframe for itself.
As such, it never shows up in the backtrace:

/sys/kernel/debug/tracing # echo 1 > /proc/sys/kernel/stack_tracer_enabled
/sys/kernel/debug/tracing # cat stack_trace
        Depth    Size   Location    (17 entries)
        -----    ----   --------
  0)     4144      32   ftrace_call+0x4/0x44
  1)     4112     432   get_page_from_freelist+0x26c/0x1ad0
  2)     3680     496   __alloc_pages+0x290/0x1280
  3)     3184     336   __folio_alloc+0x34/0x90
  4)     2848     176   vma_alloc_folio+0xd8/0x540
  5)     2672     272   __handle_mm_fault+0x700/0x1cc0
  6)     2400     208   handle_mm_fault+0xf0/0x3f0
  7)     2192      80   ___do_page_fault+0x3e4/0xbe0
  8)     2112     160   do_page_fault+0x30/0xc0
  9)     1952     256   data_access_common_virt+0x210/0x220
 10)     1696     400   0xc00000000f16b100
 11)     1296     384   load_elf_binary+0x804/0x1b80
 12)      912     208   bprm_execve+0x2d8/0x7e0
 13)      704      64   do_execveat_common+0x1d0/0x2f0
 14)      640     160   sys_execve+0x54/0x70
 15)      480      64   system_call_exception+0x138/0x350
 16)      416     416   system_call_common+0x160/0x2c4

Fix this by having ftrace create a dummy stackframe for the function
being traced. With this, backtraces now capture the function being
traced:

/sys/kernel/debug/tracing # cat stack_trace
        Depth    Size   Location    (17 entries)
        -----    ----   --------
  0)     3888      32   _raw_spin_trylock+0x8/0x70
  1)     3856     576   get_page_from_freelist+0x26c/0x1ad0
  2)     3280      64   __alloc_pages+0x290/0x1280
  3)     3216     336   __folio_alloc+0x34/0x90
  4)     2880     176   vma_alloc_folio+0xd8/0x540
  5)     2704     416   __handle_mm_fault+0x700/0x1cc0
  6)     2288      96   handle_mm_fault+0xf0/0x3f0
  7)     2192      48   ___do_page_fault+0x3e4/0xbe0
  8)     2144     192   do_page_fault+0x30/0xc0
  9)     1952     608   data_access_common_virt+0x210/0x220
 10)     1344      16   0xc0000000334bbb50
 11)     1328     416   load_elf_binary+0x804/0x1b80
 12)      912      64   bprm_execve+0x2d8/0x7e0
 13)      848     176   do_execveat_common+0x1d0/0x2f0
 14)      672     192   sys_execve+0x54/0x70
 15)      480      64   system_call_exception+0x138/0x350
 16)      416     416   system_call_common+0x160/0x2c4

This results in two additional stores in the ftrace entry code, but
produces reliable backtraces.

Fixes: 153086644fd1 ("powerpc/ftrace: Add support for -mprofile-kernel ftrace ABI")
Cc: stable@vger.kernel.org
Signed-off-by: Naveen N Rao <naveen@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230621051349.759567-1-naveen@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
index f9fd5f743eba..da2ca0c6c2c4 100644
--- a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
+++ b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
@@ -36,6 +36,9 @@ _GLOBAL(ftrace_regs_caller)
 	/* Save the original return address in A's stack frame */
 	std	r0,LRSAVE(r1)
 
+	/* Create a minimal stack frame for representing B */
+	stdu	r1, -STACK_FRAME_MIN_SIZE(r1)
+
 	/* Create our stack frame + pt_regs */
 	stdu	r1,-SWITCH_FRAME_SIZE(r1)
 
@@ -65,6 +68,8 @@ _GLOBAL(ftrace_regs_caller)
 	mflr	r7
 	/* Save it as pt_regs->nip */
 	std     r7, _NIP(r1)
+	/* Also save it in B's stackframe header for proper unwind */
+	std	r7, LRSAVE+SWITCH_FRAME_SIZE(r1)
 	/* Save the read LR in pt_regs->link */
 	std     r0, _LINK(r1)
 
@@ -121,7 +126,7 @@ ftrace_regs_call:
 	ld	r2, 24(r1)
 
 	/* Pop our stack frame */
-	addi r1, r1, SWITCH_FRAME_SIZE
+	addi r1, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE
 
 #ifdef CONFIG_LIVEPATCH
         /* Based on the cmpd above, if the NIP was altered handle livepatch */
@@ -153,6 +158,9 @@ _GLOBAL(ftrace_caller)
 	/* Save the original return address in A's stack frame */
 	std	r0, LRSAVE(r1)
 
+	/* Create a minimal stack frame for representing B */
+	stdu	r1, -STACK_FRAME_MIN_SIZE(r1)
+
 	/* Create our stack frame + pt_regs */
 	stdu	r1, -SWITCH_FRAME_SIZE(r1)
 
@@ -166,6 +174,7 @@ _GLOBAL(ftrace_caller)
 	/* Get the _mcount() call site out of LR */
 	mflr	r7
 	std     r7, _NIP(r1)
+	std	r7, LRSAVE+SWITCH_FRAME_SIZE(r1)
 
 	/* Save callee's TOC in the ABI compliant location */
 	std	r2, 24(r1)
@@ -200,7 +209,7 @@ ftrace_call:
 	ld	r2, 24(r1)
 
 	/* Pop our stack frame */
-	addi	r1, r1, SWITCH_FRAME_SIZE
+	addi	r1, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE
 
 	/* Reload original LR */
 	ld	r0, LRSAVE(r1)

From 05c547e8427af1a7b2919a38a54c673e697cd44f Mon Sep 17 00:00:00 2001
From: Naveen N Rao <naveen@kernel.org>
Date: Fri, 15 Dec 2023 16:44:33 +0530
Subject: [PATCH 0988/1043] powerpc/ftrace: Fix stack teardown in
 ftrace_no_trace

commit 4b3338aaa74d7d4ec5b6734dc298f0db94ec83d2 upstream.

Commit 41a506ef71eb ("powerpc/ftrace: Create a dummy stackframe to fix
stack unwind") added use of a new stack frame on ftrace entry to fix
stack unwind. However, the commit missed updating the offset used while
tearing down the ftrace stack when ftrace is disabled. Fix the same.

In addition, the commit missed saving the correct stack pointer in
pt_regs. Update the same.

Fixes: 41a506ef71eb ("powerpc/ftrace: Create a dummy stackframe to fix stack unwind")
Cc: stable@vger.kernel.org # v6.5+
Signed-off-by: Naveen N Rao <naveen@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231130065947.2188860-1-naveen@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
index da2ca0c6c2c4..0bc39ff53233 100644
--- a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
+++ b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
@@ -55,7 +55,7 @@ _GLOBAL(ftrace_regs_caller)
 	SAVE_10GPRS(22, r1)
 
 	/* Save previous stack pointer (r1) */
-	addi	r8, r1, SWITCH_FRAME_SIZE
+	addi	r8, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE
 	std	r8, GPR1(r1)
 
 	/* Load special regs for save below */
@@ -150,7 +150,7 @@ ftrace_no_trace:
 	mflr	r3
 	mtctr	r3
 	REST_GPR(3, r1)
-	addi	r1, r1, SWITCH_FRAME_SIZE
+	addi	r1, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE
 	mtlr	r0
 	bctr
 

From ca4427ebc6269ed2c255db88dc6e7bd2036c3103 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 20 Dec 2023 15:44:42 +0100
Subject: [PATCH 0989/1043] Linux 5.10.205

Link: https://lore.kernel.org/r/20231218135046.178317233@linuxfoundation.org
Link: https://lore.kernel.org/r/20231219074407.947984749@linuxfoundation.org
Tested-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
Tested-by: kernelci.org bot <bot@kernelci.org>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 87886018d774..5ba86be42e7c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 204
+SUBLEVEL = 205
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 4a8f190c2a5621e002d62c778d203657c4af0ea8 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Wed, 3 Jan 2024 17:05:22 +0000
Subject: [PATCH 0990/1043] Revert "cred: switch to using atomic_long_t"

This reverts commit 2623cf1fe825e5f706a5f00e6ac552e9d1852ec8 which is
commit f8fa5d76925991976b3e7076f9d1052515ec1fca upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way.

Bug: 161946584
Bug: 317347552
Change-Id: I9eb52866bc3b2a9f02e3f7fbee0bacbcc06b0849
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/linux/cred.h |  8 +++---
 kernel/cred.c        | 64 ++++++++++++++++++++++----------------------
 2 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/include/linux/cred.h b/include/linux/cred.h
index d35e4867d5cc..18639c069263 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -109,7 +109,7 @@ static inline int groups_search(const struct group_info *group_info, kgid_t grp)
  * same context as task->real_cred.
  */
 struct cred {
-	atomic_long_t	usage;
+	atomic_t	usage;
 #ifdef CONFIG_DEBUG_CREDENTIALS
 	atomic_t	subscribers;	/* number of processes subscribed */
 	void		*put_addr;
@@ -227,7 +227,7 @@ static inline bool cap_ambient_invariant_ok(const struct cred *cred)
  */
 static inline struct cred *get_new_cred(struct cred *cred)
 {
-	atomic_long_inc(&cred->usage);
+	atomic_inc(&cred->usage);
 	return cred;
 }
 
@@ -259,7 +259,7 @@ static inline const struct cred *get_cred_rcu(const struct cred *cred)
 	struct cred *nonconst_cred = (struct cred *) cred;
 	if (!cred)
 		return NULL;
-	if (!atomic_long_inc_not_zero(&nonconst_cred->usage))
+	if (!atomic_inc_not_zero(&nonconst_cred->usage))
 		return NULL;
 	validate_creds(cred);
 	nonconst_cred->non_rcu = 0;
@@ -283,7 +283,7 @@ static inline void put_cred(const struct cred *_cred)
 
 	if (cred) {
 		validate_creds(cred);
-		if (atomic_long_dec_and_test(&(cred)->usage))
+		if (atomic_dec_and_test(&(cred)->usage))
 			__put_cred(cred);
 	}
 }
diff --git a/kernel/cred.c b/kernel/cred.c
index 11cbec7bb3e1..64bd9efa1c27 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -100,17 +100,17 @@ static void put_cred_rcu(struct rcu_head *rcu)
 
 #ifdef CONFIG_DEBUG_CREDENTIALS
 	if (cred->magic != CRED_MAGIC_DEAD ||
-	    atomic_long_read(&cred->usage) != 0 ||
+	    atomic_read(&cred->usage) != 0 ||
 	    read_cred_subscribers(cred) != 0)
 		panic("CRED: put_cred_rcu() sees %p with"
-		      " mag %x, put %p, usage %ld, subscr %d\n",
+		      " mag %x, put %p, usage %d, subscr %d\n",
 		      cred, cred->magic, cred->put_addr,
-		      atomic_long_read(&cred->usage),
+		      atomic_read(&cred->usage),
 		      read_cred_subscribers(cred));
 #else
-	if (atomic_long_read(&cred->usage) != 0)
-		panic("CRED: put_cred_rcu() sees %p with usage %ld\n",
-		      cred, atomic_long_read(&cred->usage));
+	if (atomic_read(&cred->usage) != 0)
+		panic("CRED: put_cred_rcu() sees %p with usage %d\n",
+		      cred, atomic_read(&cred->usage));
 #endif
 
 	security_cred_free(cred);
@@ -133,11 +133,11 @@ static void put_cred_rcu(struct rcu_head *rcu)
  */
 void __put_cred(struct cred *cred)
 {
-	kdebug("__put_cred(%p{%ld,%d})", cred,
-	       atomic_long_read(&cred->usage),
+	kdebug("__put_cred(%p{%d,%d})", cred,
+	       atomic_read(&cred->usage),
 	       read_cred_subscribers(cred));
 
-	BUG_ON(atomic_long_read(&cred->usage) != 0);
+	BUG_ON(atomic_read(&cred->usage) != 0);
 #ifdef CONFIG_DEBUG_CREDENTIALS
 	BUG_ON(read_cred_subscribers(cred) != 0);
 	cred->magic = CRED_MAGIC_DEAD;
@@ -160,8 +160,8 @@ void exit_creds(struct task_struct *tsk)
 {
 	struct cred *cred;
 
-	kdebug("exit_creds(%u,%p,%p,{%ld,%d})", tsk->pid, tsk->real_cred, tsk->cred,
-	       atomic_long_read(&tsk->cred->usage),
+	kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
+	       atomic_read(&tsk->cred->usage),
 	       read_cred_subscribers(tsk->cred));
 
 	cred = (struct cred *) tsk->real_cred;
@@ -221,7 +221,7 @@ struct cred *cred_alloc_blank(void)
 	if (!new)
 		return NULL;
 
-	atomic_long_set(&new->usage, 1);
+	atomic_set(&new->usage, 1);
 #ifdef CONFIG_DEBUG_CREDENTIALS
 	new->magic = CRED_MAGIC;
 #endif
@@ -268,7 +268,7 @@ struct cred *prepare_creds(void)
 	memcpy(new, old, sizeof(struct cred));
 
 	new->non_rcu = 0;
-	atomic_long_set(&new->usage, 1);
+	atomic_set(&new->usage, 1);
 	set_cred_subscribers(new, 0);
 	get_group_info(new->group_info);
 	get_uid(new->user);
@@ -351,8 +351,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
 		p->real_cred = get_cred(p->cred);
 		get_cred(p->cred);
 		alter_cred_subscribers(p->cred, 2);
-		kdebug("share_creds(%p{%ld,%d})",
-		       p->cred, atomic_long_read(&p->cred->usage),
+		kdebug("share_creds(%p{%d,%d})",
+		       p->cred, atomic_read(&p->cred->usage),
 		       read_cred_subscribers(p->cred));
 		atomic_inc(&p->cred->user->processes);
 		return 0;
@@ -442,8 +442,8 @@ int commit_creds(struct cred *new)
 	struct task_struct *task = current;
 	const struct cred *old = task->real_cred;
 
-	kdebug("commit_creds(%p{%ld,%d})", new,
-	       atomic_long_read(&new->usage),
+	kdebug("commit_creds(%p{%d,%d})", new,
+	       atomic_read(&new->usage),
 	       read_cred_subscribers(new));
 
 	BUG_ON(task->cred != old);
@@ -452,7 +452,7 @@ int commit_creds(struct cred *new)
 	validate_creds(old);
 	validate_creds(new);
 #endif
-	BUG_ON(atomic_long_read(&new->usage) < 1);
+	BUG_ON(atomic_read(&new->usage) < 1);
 
 	get_cred(new); /* we will require a ref for the subj creds too */
 
@@ -526,14 +526,14 @@ EXPORT_SYMBOL(commit_creds);
  */
 void abort_creds(struct cred *new)
 {
-	kdebug("abort_creds(%p{%ld,%d})", new,
-	       atomic_long_read(&new->usage),
+	kdebug("abort_creds(%p{%d,%d})", new,
+	       atomic_read(&new->usage),
 	       read_cred_subscribers(new));
 
 #ifdef CONFIG_DEBUG_CREDENTIALS
 	BUG_ON(read_cred_subscribers(new) != 0);
 #endif
-	BUG_ON(atomic_long_read(&new->usage) < 1);
+	BUG_ON(atomic_read(&new->usage) < 1);
 	put_cred(new);
 }
 EXPORT_SYMBOL(abort_creds);
@@ -549,8 +549,8 @@ const struct cred *override_creds(const struct cred *new)
 {
 	const struct cred *old = current->cred;
 
-	kdebug("override_creds(%p{%ld,%d})", new,
-	       atomic_long_read(&new->usage),
+	kdebug("override_creds(%p{%d,%d})", new,
+	       atomic_read(&new->usage),
 	       read_cred_subscribers(new));
 
 	validate_creds(old);
@@ -573,8 +573,8 @@ const struct cred *override_creds(const struct cred *new)
 	trace_android_vh_override_creds(current, new);
 	alter_cred_subscribers(old, -1);
 
-	kdebug("override_creds() = %p{%ld,%d}", old,
-	       atomic_long_read(&old->usage),
+	kdebug("override_creds() = %p{%d,%d}", old,
+	       atomic_read(&old->usage),
 	       read_cred_subscribers(old));
 	return old;
 }
@@ -591,8 +591,8 @@ void revert_creds(const struct cred *old)
 {
 	const struct cred *override = current->cred;
 
-	kdebug("revert_creds(%p{%ld,%d})", old,
-	       atomic_long_read(&old->usage),
+	kdebug("revert_creds(%p{%d,%d})", old,
+	       atomic_read(&old->usage),
 	       read_cred_subscribers(old));
 
 	validate_creds(old);
@@ -705,7 +705,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
 
 	*new = *old;
 	new->non_rcu = 0;
-	atomic_long_set(&new->usage, 1);
+	atomic_set(&new->usage, 1);
 	set_cred_subscribers(new, 0);
 	get_uid(new->user);
 	get_user_ns(new->user_ns);
@@ -815,8 +815,8 @@ static void dump_invalid_creds(const struct cred *cred, const char *label,
 	       cred == tsk->cred ? "[eff]" : "");
 	printk(KERN_ERR "CRED: ->magic=%x, put_addr=%p\n",
 	       cred->magic, cred->put_addr);
-	printk(KERN_ERR "CRED: ->usage=%ld, subscr=%d\n",
-	       atomic_long_read(&cred->usage),
+	printk(KERN_ERR "CRED: ->usage=%d, subscr=%d\n",
+	       atomic_read(&cred->usage),
 	       read_cred_subscribers(cred));
 	printk(KERN_ERR "CRED: ->*uid = { %d,%d,%d,%d }\n",
 		from_kuid_munged(&init_user_ns, cred->uid),
@@ -888,9 +888,9 @@ EXPORT_SYMBOL(__validate_process_creds);
  */
 void validate_creds_for_do_exit(struct task_struct *tsk)
 {
-	kdebug("validate_creds_for_do_exit(%p,%p{%ld,%d})",
+	kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})",
 	       tsk->real_cred, tsk->cred,
-	       atomic_long_read(&tsk->cred->usage),
+	       atomic_read(&tsk->cred->usage),
 	       read_cred_subscribers(tsk->cred));
 
 	__validate_process_creds(tsk, __FILE__, __LINE__);

From 068af29e247a0f01dedddc55488c2179bfceac54 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Thu, 4 Jan 2024 12:09:05 +0000
Subject: [PATCH 0991/1043] ANDROID: GKI: fix crc issue in
 include/net/addrconf.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit 97275e470c2a ("net: ipv6: support reporting otherwise unknown
prefix flags in RTM_NEWPREFIX") a union is added to fix some issues, but
that messes with the crc of a number of networking symbols for obvious
reasons.  As this does not actually change the abi at all, use some
GENKSYMS magic #define logic to preserve the crc so that all is well.

Bug: 161946584
Fixes: 97275e470c2a ("net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX")
Cc: Maciej Żenczykowski <maze@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Change-Id: I9d2df74e8f3ae60425534f1b33d50b2bc444f7f5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 include/net/addrconf.h | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 3abbc600003f..4caa95bee8c4 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -31,9 +31,15 @@ struct prefix_info {
 	__u8			length;
 	__u8			prefix_len;
 
+/*
+ * ANDROID: crc fix for commit 9354e0acdb74 ("net: ipv6: support
+ * reporting otherwise unknown prefix * flags in RTM_NEWPREFIX")
+ */
+#ifndef __GENKSYMS__
 	union __packed {
 		__u8		flags;
 		struct __packed {
+#endif
 #if defined(__BIG_ENDIAN_BITFIELD)
 			__u8	onlink : 1,
 			 	autoconf : 1,
@@ -45,8 +51,10 @@ struct prefix_info {
 #else
 #error "Please fix <asm/byteorder.h>"
 #endif
+#ifndef __GENKSYMS__
 		};
 	};
+#endif
 	__be32			valid;
 	__be32			prefered;
 	__be32			reserved2;

From a5ea932a75e357ec49f3c5d2507875d907a581c1 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 19 Dec 2023 19:44:49 +0100
Subject: [PATCH 0992/1043] UPSTREAM: netfilter: nf_tables: skip set commit for
 deleted/destroyed sets

commit 7315dc1e122c85ffdfc8defffbb8f8b616c2eb1a upstream.

NFT_MSG_DELSET deactivates all elements in the set, skip
set->ops->commit() to avoid the unnecessary clone (for the pipapo case)
as well as the sync GC cycle, which could deactivate again expired
elements in such set.

Bug: 318548348
Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Reported-by: Kevin Rich <kevinrich1337@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 0105571f80edb96f81bb4bbdd5233a9130dc345b)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ie733688e27d9568d797fc1bc477261883b7dc8c1
---
 net/netfilter/nf_tables_api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 78b268bd7f01..1bfdf34ef778 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8360,7 +8360,7 @@ static void nft_set_commit_update(struct list_head *set_update_list)
 	list_for_each_entry_safe(set, next, set_update_list, pending_update) {
 		list_del_init(&set->pending_update);
 
-		if (!set->ops->commit)
+		if (!set->ops->commit || set->dead)
 			continue;
 
 		set->ops->commit(set);

From 3e4106c3c95ad8f5ce55d810ecdf3e07600f07f6 Mon Sep 17 00:00:00 2001
From: liujinbao1 <liujinbao1@xiaomi.com>
Date: Fri, 8 Jul 2022 15:01:25 +0800
Subject: [PATCH 0993/1043] BACKPORT: exfat: reduce block requests when zeroing
 a cluster

If 'dirsync' is enabled, when zeroing a cluster, submitting
sector by sector will generate many block requests, will
cause the block device to not fully perform its performance.

This commit makes the sectors in a cluster to be submitted in
once, it will reduce the number of block requests. This will
make the block device to give full play to its performance.

Test create 1000 directories on SD card with:

$ time (for ((i=0;i<1000;i++)); do mkdir dir${i}; done)

Performance has been improved by more than 73% on imx6q-sabrelite.

Cluster size       Before         After       Improvement
64  KBytes         3m34.036s      0m56.052s   73.8%
128 KBytes         6m2.644s       1m13.354s   79.8%
256 KBytes         11m22.202s     1m39.451s   85.4%

imx6q-sabrelite:
  - CPU: 792 MHz x4
  - Memory: 1GB DDR3
  - SD Card: SanDisk 8GB Class 4

Bug: 239500767
Bug: 319538772

Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Andy Wu <Andy.Wu@sony.com>
Reviewed-by: Aoyama Wataru <wataru.aoyama@sony.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Sungjong Seo <sj1557.seo@samsung.com>
(cherry picked from commit 1b6138385499507147e8f654840f4c39afe6adbf)
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

Signed-off-by: liujinbao1 <liujinbao1@xiaomi.com>
Change-Id: Ie9ed20fb90caed2fce2692f7fb81272cf647faa7
(cherry picked from commit 1f44e4411f9e914fac45dd1a232ccabcc05811b3)
---
 fs/exfat/fatent.c | 41 +++++++++++++++++------------------------
 1 file changed, 17 insertions(+), 24 deletions(-)

diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
index 78aa02e2d2c1..3c2daa0bc271 100644
--- a/fs/exfat/fatent.c
+++ b/fs/exfat/fatent.c
@@ -6,6 +6,7 @@
 #include <linux/slab.h>
 #include <asm/unaligned.h>
 #include <linux/buffer_head.h>
+#include <linux/blk_types.h>
 
 #include "exfat_raw.h"
 #include "exfat_fs.h"
@@ -258,10 +259,10 @@ int exfat_zeroed_cluster(struct inode *dir, unsigned int clu)
 {
 	struct super_block *sb = dir->i_sb;
 	struct exfat_sb_info *sbi = EXFAT_SB(sb);
-	struct buffer_head *bhs[MAX_BUF_PER_PAGE];
-	int nr_bhs = MAX_BUF_PER_PAGE;
+	struct buffer_head *bh;
+	struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping;
 	sector_t blknr, last_blknr;
-	int err, i, n;
+	int i;
 
 	blknr = exfat_cluster_to_sector(sbi, clu);
 	last_blknr = blknr + sbi->sect_per_clus;
@@ -275,30 +276,22 @@ int exfat_zeroed_cluster(struct inode *dir, unsigned int clu)
 	}
 
 	/* Zeroing the unused blocks on this cluster */
-	while (blknr < last_blknr) {
-		for (n = 0; n < nr_bhs && blknr < last_blknr; n++, blknr++) {
-			bhs[n] = sb_getblk(sb, blknr);
-			if (!bhs[n]) {
-				err = -ENOMEM;
-				goto release_bhs;
-			}
-			memset(bhs[n]->b_data, 0, sb->s_blocksize);
-		}
+	for (i = blknr; i < last_blknr; i++) {
+		bh = sb_getblk(sb, i);
+		if (!bh)
+			return -ENOMEM;
 
-		err = exfat_update_bhs(bhs, n, IS_DIRSYNC(dir));
-		if (err)
-			goto release_bhs;
-
-		for (i = 0; i < n; i++)
-			brelse(bhs[i]);
+		memset(bh->b_data, 0, sb->s_blocksize);
+		set_buffer_uptodate(bh);
+		mark_buffer_dirty(bh);
+		brelse(bh);
 	}
-	return 0;
+	if (IS_DIRSYNC(dir))
+		return filemap_write_and_wait_range(mapping,
+				EXFAT_BLK_TO_B(blknr, sb),
+				EXFAT_BLK_TO_B(last_blknr, sb) - 1);
 
-release_bhs:
-	exfat_err(sb, "failed zeroed sect %llu\n", (unsigned long long)blknr);
-	for (i = 0; i < n; i++)
-		bforget(bhs[i]);
-	return err;
+	return 0;
 }
 
 int exfat_alloc_cluster(struct inode *inode, unsigned int num_alloc,

From 7efc668a498e17d09ea134e2d8cf7153de183db3 Mon Sep 17 00:00:00 2001
From: "cd.jeong" <cd.jeong@samsung.com>
Date: Fri, 12 Jan 2024 11:25:08 +0900
Subject: [PATCH 0994/1043] ANDROID: ABI: update allowed list for galaxy

Leaf changes summary: 1 artifact changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

1 Added function:

  [A] 'function snd_card* snd_card_ref(int)

 Updating expected ABI definition (android/abi_gki_aarch64.xml)

Bug: 320570312
Change-Id: I22db7080405372037291dd0f321c0cabe9e298b4
Signed-off-by: cd.jeong <cd.jeong@samsung.com>
---
 android/abi_gki_aarch64.xml    | 172 +++++++++++++--------------------
 android/abi_gki_aarch64_galaxy |   1 +
 2 files changed, 70 insertions(+), 103 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index ddb9a85a5a8d..4aaf6c631d6e 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -5115,6 +5115,7 @@
       <elf-symbol name='snd_card_disconnect' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe26c968c'/>
       <elf-symbol name='snd_card_free' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9348463f'/>
       <elf-symbol name='snd_card_new' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5d885b0f'/>
+      <elf-symbol name='snd_card_ref' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x743fda48'/>
       <elf-symbol name='snd_card_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1f80a2eb'/>
       <elf-symbol name='snd_card_rw_proc_new' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8805aaf7'/>
       <elf-symbol name='snd_component_add' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x14e43f0d'/>
@@ -44709,23 +44710,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='538b7809' size-in-bits='64' id='5f0d472d'/>
-      <class-decl name='fsverity_operations' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/linux/fsverity.h' line='18' column='1' id='5f0d764c'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='begin_enable_verity' type-id='4da4101d' visibility='default' filepath='include/linux/fsverity.h' line='33' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='end_enable_verity' type-id='f3a5c46a' visibility='default' filepath='include/linux/fsverity.h' line='55' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='get_verity_descriptor' type-id='c60354f3' visibility='default' filepath='include/linux/fsverity.h' line='72' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='read_merkle_tree_page' type-id='68b31938' visibility='default' filepath='include/linux/fsverity.h' line='93' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='write_merkle_tree_block' type-id='c748f227' visibility='default' filepath='include/linux/fsverity.h' line='110' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='fsverity_operations' is-struct='yes' visibility='default' is-declaration-only='yes' id='5f0d764c'/>
       <pointer-type-def type-id='0caa7082' size-in-bits='64' id='5f29549c'/>
       <class-decl name='configfs_attribute' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/linux/configfs.h' line='117' column='1' id='5f2e9b8f'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -49065,7 +49050,6 @@
         <parameter type-id='5d6479ae'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <pointer-type-def type-id='e151e1f6' size-in-bits='64' id='68b31938'/>
       <class-decl name='module_layout' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/module.h' line='327' column='1' id='68b3d9a8'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='base' type-id='eaa32e2f' visibility='default' filepath='include/linux/module.h' line='329' column='1'/>
@@ -54023,13 +54007,6 @@
         <parameter type-id='4db02c58'/>
         <return type-id='c91d1bf1'/>
       </function-type>
-      <function-type size-in-bits='64' id='74fec388'>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='b59d7dce'/>
-        <parameter type-id='91ce1af9'/>
-        <return type-id='95e97e5e'/>
-      </function-type>
       <function-type size-in-bits='64' id='7506f11b'>
         <parameter type-id='b7c1d7d5'/>
         <parameter type-id='99baf115'/>
@@ -66695,13 +66672,6 @@
       <typedef-decl name='u64' type-id='d3130597' filepath='include/asm-generic/int-ll64.h' line='23' column='1' id='91ce1af9'/>
       <pointer-type-def type-id='d7c60ba9' size-in-bits='64' id='91d0de51'/>
       <pointer-type-def type-id='d0fea0bb' size-in-bits='64' id='91d6c443'/>
-      <function-type size-in-bits='64' id='91dc7ea3'>
-        <parameter type-id='7e666abe'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='91ce1af9'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='95e97e5e'/>
-      </function-type>
       <function-type size-in-bits='64' id='91de15a8'>
         <parameter type-id='7e666abe'/>
         <parameter type-id='cd1b45ab'/>
@@ -91494,7 +91464,6 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='e9ec35ef' size-in-bits='64' id='c7432356'/>
-      <pointer-type-def type-id='91dc7ea3' size-in-bits='64' id='c748f227'/>
       <union-decl name='__anonymous_union__' size-in-bits='4096' is-anonymous='yes' visibility='default' filepath='include/uapi/sound/asound.h' line='1054' column='1' id='c74bfd7b'>
         <data-member access='public'>
           <var-decl name='value' type-id='1fd26250' visibility='default' filepath='include/uapi/sound/asound.h' line='1055' column='1'/>
@@ -103266,12 +103235,6 @@
           <var-decl name='first' type-id='08cbad52' visibility='default' filepath='include/linux/types.h' line='183' column='1'/>
         </data-member>
       </class-decl>
-      <function-type size-in-bits='64' id='e151e1f6'>
-        <parameter type-id='7e666abe'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='02f11ed4'/>
-      </function-type>
       <pointer-type-def type-id='20b17040' size-in-bits='64' id='e153f6de'/>
       <pointer-type-def type-id='4d94804e' size-in-bits='64' id='e15671b8'/>
       <pointer-type-def type-id='59aa7dba' size-in-bits='64' id='e15aece4'/>
@@ -111518,7 +111481,6 @@
           <var-decl name='memsw' type-id='635c3685' visibility='default' filepath='include/linux/memcontrol.h' line='222' column='1'/>
         </data-member>
       </union-decl>
-      <pointer-type-def type-id='74fec388' size-in-bits='64' id='f3a5c46a'/>
       <class-decl name='rc_scancode_filter' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/media/rc-core.h' line='38' column='1' id='f3a6417e'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='data' type-id='19c2251e' visibility='default' filepath='include/media/rc-core.h' line='39' column='1'/>
@@ -126598,15 +126560,15 @@
         <parameter type-id='2aee9912' name='args' filepath='drivers/base/core.c' line='4434' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_add_device' mangled-name='devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_device'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='747' column='1'/>
-        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='748' column='1'/>
-        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='749' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='750' column='1'/>
+      <function-decl name='devfreq_add_device' mangled-name='devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='767' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='767' column='1'/>
+        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='768' column='1'/>
+        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='769' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='770' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
-      <function-decl name='devfreq_add_governor' mangled-name='devfreq_add_governor' filepath='drivers/devfreq/devfreq.c' line='1194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_governor'>
-        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1194' column='1'/>
+      <function-decl name='devfreq_add_governor' mangled-name='devfreq_add_governor' filepath='drivers/devfreq/devfreq.c' line='1214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_governor'>
+        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1214' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devfreq_cooling_unregister' mangled-name='devfreq_cooling_unregister' filepath='drivers/thermal/devfreq_cooling.c' line='557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_cooling_unregister'>
@@ -126637,67 +126599,67 @@
         <parameter type-id='d6184118' name='edata' filepath='drivers/devfreq/devfreq-event.c' line='161' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_get_devfreq_by_node' mangled-name='devfreq_get_devfreq_by_node' filepath='drivers/devfreq/devfreq.c' line='995' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_node'>
-        <parameter type-id='9a537bbe' name='node' filepath='drivers/devfreq/devfreq.c' line='995' column='1'/>
+      <function-decl name='devfreq_get_devfreq_by_node' mangled-name='devfreq_get_devfreq_by_node' filepath='drivers/devfreq/devfreq.c' line='1015' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_node'>
+        <parameter type-id='9a537bbe' name='node' filepath='drivers/devfreq/devfreq.c' line='1015' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
-      <function-decl name='devfreq_get_devfreq_by_phandle' mangled-name='devfreq_get_devfreq_by_phandle' filepath='drivers/devfreq/devfreq.c' line='1023' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_phandle'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1023' column='1'/>
-        <parameter type-id='80f4b756' name='phandle_name' filepath='drivers/devfreq/devfreq.c' line='1024' column='1'/>
-        <parameter type-id='95e97e5e' name='index' filepath='drivers/devfreq/devfreq.c' line='1024' column='1'/>
+      <function-decl name='devfreq_get_devfreq_by_phandle' mangled-name='devfreq_get_devfreq_by_phandle' filepath='drivers/devfreq/devfreq.c' line='1043' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_phandle'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1043' column='1'/>
+        <parameter type-id='80f4b756' name='phandle_name' filepath='drivers/devfreq/devfreq.c' line='1044' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/devfreq/devfreq.c' line='1044' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
-      <function-decl name='devfreq_monitor_resume' mangled-name='devfreq_monitor_resume' filepath='drivers/devfreq/devfreq.c' line='535' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_resume'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='535' column='1'/>
+      <function-decl name='devfreq_monitor_resume' mangled-name='devfreq_monitor_resume' filepath='drivers/devfreq/devfreq.c' line='555' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_resume'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='555' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devfreq_monitor_start' mangled-name='devfreq_monitor_start' filepath='drivers/devfreq/devfreq.c' line='457' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_start'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='457' column='1'/>
+      <function-decl name='devfreq_monitor_start' mangled-name='devfreq_monitor_start' filepath='drivers/devfreq/devfreq.c' line='461' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_start'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='461' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devfreq_monitor_stop' mangled-name='devfreq_monitor_stop' filepath='drivers/devfreq/devfreq.c' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_stop'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='487' column='1'/>
+      <function-decl name='devfreq_monitor_stop' mangled-name='devfreq_monitor_stop' filepath='drivers/devfreq/devfreq.c' line='499' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_stop'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='499' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devfreq_monitor_suspend' mangled-name='devfreq_monitor_suspend' filepath='drivers/devfreq/devfreq.c' line='508' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_suspend'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='508' column='1'/>
+      <function-decl name='devfreq_monitor_suspend' mangled-name='devfreq_monitor_suspend' filepath='drivers/devfreq/devfreq.c' line='528' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_suspend'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='528' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devfreq_recommended_opp' mangled-name='devfreq_recommended_opp' filepath='drivers/devfreq/devfreq.c' line='1900' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_recommended_opp'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1900' column='1'/>
-        <parameter type-id='1d2c2b85' name='freq' filepath='drivers/devfreq/devfreq.c' line='1901' column='1'/>
-        <parameter type-id='19c2251e' name='flags' filepath='drivers/devfreq/devfreq.c' line='1902' column='1'/>
+      <function-decl name='devfreq_recommended_opp' mangled-name='devfreq_recommended_opp' filepath='drivers/devfreq/devfreq.c' line='1920' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_recommended_opp'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1920' column='1'/>
+        <parameter type-id='1d2c2b85' name='freq' filepath='drivers/devfreq/devfreq.c' line='1921' column='1'/>
+        <parameter type-id='19c2251e' name='flags' filepath='drivers/devfreq/devfreq.c' line='1922' column='1'/>
         <return type-id='02e48bc6'/>
       </function-decl>
-      <function-decl name='devfreq_register_opp_notifier' mangled-name='devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1933' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_register_opp_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1933' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1933' column='1'/>
+      <function-decl name='devfreq_register_opp_notifier' mangled-name='devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1953' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_register_opp_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1953' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1953' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_remove_device' mangled-name='devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='923' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_device'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='923' column='1'/>
+      <function-decl name='devfreq_remove_device' mangled-name='devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='943' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='943' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_remove_governor' mangled-name='devfreq_remove_governor' filepath='drivers/devfreq/devfreq.c' line='1259' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_governor'>
-        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1259' column='1'/>
+      <function-decl name='devfreq_remove_governor' mangled-name='devfreq_remove_governor' filepath='drivers/devfreq/devfreq.c' line='1279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_governor'>
+        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1279' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_resume_device' mangled-name='devfreq_resume_device' filepath='drivers/devfreq/devfreq.c' line='1117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_resume_device'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1117' column='1'/>
+      <function-decl name='devfreq_resume_device' mangled-name='devfreq_resume_device' filepath='drivers/devfreq/devfreq.c' line='1137' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_resume_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1137' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_suspend_device' mangled-name='devfreq_suspend_device' filepath='drivers/devfreq/devfreq.c' line='1080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_suspend_device'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1080' column='1'/>
+      <function-decl name='devfreq_suspend_device' mangled-name='devfreq_suspend_device' filepath='drivers/devfreq/devfreq.c' line='1100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_suspend_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1100' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_unregister_opp_notifier' mangled-name='devfreq_unregister_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1949' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_unregister_opp_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1949' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1949' column='1'/>
+      <function-decl name='devfreq_unregister_opp_notifier' mangled-name='devfreq_unregister_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1969' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_unregister_opp_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1969' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1969' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_update_interval' mangled-name='devfreq_update_interval' filepath='drivers/devfreq/devfreq.c' line='572' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_update_interval'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='572' column='1'/>
-        <parameter type-id='807869d3' name='delay' filepath='drivers/devfreq/devfreq.c' line='572' column='1'/>
+      <function-decl name='devfreq_update_interval' mangled-name='devfreq_update_interval' filepath='drivers/devfreq/devfreq.c' line='592' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_update_interval'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='592' column='1'/>
+        <parameter type-id='807869d3' name='delay' filepath='drivers/devfreq/devfreq.c' line='592' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='device_add' mangled-name='device_add' filepath='drivers/base/core.c' line='3127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_add'>
@@ -127055,11 +127017,11 @@
         <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4267' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='devm_devfreq_add_device' mangled-name='devm_devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='964' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_add_device'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='964' column='1'/>
-        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='965' column='1'/>
-        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='966' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='967' column='1'/>
+      <function-decl name='devm_devfreq_add_device' mangled-name='devm_devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='984' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_add_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='984' column='1'/>
+        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='985' column='1'/>
+        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='986' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='987' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
       <function-decl name='devm_devfreq_event_add_edev' mangled-name='devm_devfreq_event_add_edev' filepath='drivers/devfreq/devfreq-event.c' line='397' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_event_add_edev'>
@@ -127067,28 +127029,28 @@
         <parameter type-id='72742e5b' name='desc' filepath='drivers/devfreq/devfreq-event.c' line='398' column='1'/>
         <return type-id='88146159'/>
       </function-decl>
-      <function-decl name='devm_devfreq_register_notifier' mangled-name='devm_devfreq_register_notifier' filepath='drivers/devfreq/devfreq.c' line='2080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2080' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2081' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2082' column='1'/>
-        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2083' column='1'/>
+      <function-decl name='devm_devfreq_register_notifier' mangled-name='devm_devfreq_register_notifier' filepath='drivers/devfreq/devfreq.c' line='2100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2100' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2101' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2102' column='1'/>
+        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2103' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_devfreq_register_opp_notifier' mangled-name='devm_devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1966' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_opp_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1966' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1967' column='1'/>
+      <function-decl name='devm_devfreq_register_opp_notifier' mangled-name='devm_devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1986' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_opp_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1986' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1987' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_devfreq_remove_device' mangled-name='devm_devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='1065' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_remove_device'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1065' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1065' column='1'/>
+      <function-decl name='devm_devfreq_remove_device' mangled-name='devm_devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='1085' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_remove_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1085' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1085' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devm_devfreq_unregister_notifier' mangled-name='devm_devfreq_unregister_notifier' filepath='drivers/devfreq/devfreq.c' line='2116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_unregister_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2116' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2117' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2118' column='1'/>
-        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2119' column='1'/>
+      <function-decl name='devm_devfreq_unregister_notifier' mangled-name='devm_devfreq_unregister_notifier' filepath='drivers/devfreq/devfreq.c' line='2136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_unregister_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2136' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2137' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2138' column='1'/>
+        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2139' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='devm_device_add_group' mangled-name='devm_device_add_group' filepath='drivers/base/core.c' line='2392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_device_add_group'>
@@ -144437,6 +144399,10 @@
         <parameter type-id='63cbc127' name='card_ret' filepath='sound/core/init.c' line='163' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='snd_card_ref' mangled-name='snd_card_ref' filepath='sound/core/init.c' line='268' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_ref'>
+        <parameter type-id='95e97e5e' name='idx' filepath='sound/core/init.c' line='268' column='1'/>
+        <return type-id='52704eb7'/>
+      </function-decl>
       <function-decl name='snd_card_register' mangled-name='snd_card_register' filepath='sound/core/init.c' line='746' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_register'>
         <parameter type-id='52704eb7' name='card' filepath='sound/core/init.c' line='746' column='1'/>
         <return type-id='95e97e5e'/>
diff --git a/android/abi_gki_aarch64_galaxy b/android/abi_gki_aarch64_galaxy
index db5abff44b22..4b398f0a91bf 100644
--- a/android/abi_gki_aarch64_galaxy
+++ b/android/abi_gki_aarch64_galaxy
@@ -3316,6 +3316,7 @@
   snd_card_disconnect
   snd_card_free
   snd_card_new
+  snd_card_ref
   snd_card_register
   snd_card_rw_proc_new
   snd_component_add

From e93f80f363fc94c441d8237d8e39cc91d0579043 Mon Sep 17 00:00:00 2001
From: "cd.jeong" <cd.jeong@samsung.com>
Date: Fri, 12 Jan 2024 11:25:08 +0900
Subject: [PATCH 0995/1043] ANDROID: ABI: update allowed list for galaxy

Leaf changes summary: 1 artifact changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

1 Added function:

  [A] 'function snd_card* snd_card_ref(int)

 Updating expected ABI definition (android/abi_gki_aarch64.xml)

Bug: 320570312
Bug: 320781398
Change-Id: I22db7080405372037291dd0f321c0cabe9e298b4
Signed-off-by: cd.jeong <cd.jeong@samsung.com>
(cherry picked from commit 7efc668a498e17d09ea134e2d8cf7153de183db3)
---
 android/abi_gki_aarch64.xml    | 172 +++++++++++++--------------------
 android/abi_gki_aarch64_galaxy |   1 +
 2 files changed, 70 insertions(+), 103 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index ddb9a85a5a8d..4aaf6c631d6e 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -5115,6 +5115,7 @@
       <elf-symbol name='snd_card_disconnect' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe26c968c'/>
       <elf-symbol name='snd_card_free' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9348463f'/>
       <elf-symbol name='snd_card_new' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5d885b0f'/>
+      <elf-symbol name='snd_card_ref' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x743fda48'/>
       <elf-symbol name='snd_card_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1f80a2eb'/>
       <elf-symbol name='snd_card_rw_proc_new' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8805aaf7'/>
       <elf-symbol name='snd_component_add' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x14e43f0d'/>
@@ -44709,23 +44710,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='538b7809' size-in-bits='64' id='5f0d472d'/>
-      <class-decl name='fsverity_operations' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/linux/fsverity.h' line='18' column='1' id='5f0d764c'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='begin_enable_verity' type-id='4da4101d' visibility='default' filepath='include/linux/fsverity.h' line='33' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='end_enable_verity' type-id='f3a5c46a' visibility='default' filepath='include/linux/fsverity.h' line='55' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='get_verity_descriptor' type-id='c60354f3' visibility='default' filepath='include/linux/fsverity.h' line='72' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='read_merkle_tree_page' type-id='68b31938' visibility='default' filepath='include/linux/fsverity.h' line='93' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='write_merkle_tree_block' type-id='c748f227' visibility='default' filepath='include/linux/fsverity.h' line='110' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='fsverity_operations' is-struct='yes' visibility='default' is-declaration-only='yes' id='5f0d764c'/>
       <pointer-type-def type-id='0caa7082' size-in-bits='64' id='5f29549c'/>
       <class-decl name='configfs_attribute' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/linux/configfs.h' line='117' column='1' id='5f2e9b8f'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -49065,7 +49050,6 @@
         <parameter type-id='5d6479ae'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <pointer-type-def type-id='e151e1f6' size-in-bits='64' id='68b31938'/>
       <class-decl name='module_layout' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/module.h' line='327' column='1' id='68b3d9a8'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='base' type-id='eaa32e2f' visibility='default' filepath='include/linux/module.h' line='329' column='1'/>
@@ -54023,13 +54007,6 @@
         <parameter type-id='4db02c58'/>
         <return type-id='c91d1bf1'/>
       </function-type>
-      <function-type size-in-bits='64' id='74fec388'>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='b59d7dce'/>
-        <parameter type-id='91ce1af9'/>
-        <return type-id='95e97e5e'/>
-      </function-type>
       <function-type size-in-bits='64' id='7506f11b'>
         <parameter type-id='b7c1d7d5'/>
         <parameter type-id='99baf115'/>
@@ -66695,13 +66672,6 @@
       <typedef-decl name='u64' type-id='d3130597' filepath='include/asm-generic/int-ll64.h' line='23' column='1' id='91ce1af9'/>
       <pointer-type-def type-id='d7c60ba9' size-in-bits='64' id='91d0de51'/>
       <pointer-type-def type-id='d0fea0bb' size-in-bits='64' id='91d6c443'/>
-      <function-type size-in-bits='64' id='91dc7ea3'>
-        <parameter type-id='7e666abe'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='91ce1af9'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='95e97e5e'/>
-      </function-type>
       <function-type size-in-bits='64' id='91de15a8'>
         <parameter type-id='7e666abe'/>
         <parameter type-id='cd1b45ab'/>
@@ -91494,7 +91464,6 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='e9ec35ef' size-in-bits='64' id='c7432356'/>
-      <pointer-type-def type-id='91dc7ea3' size-in-bits='64' id='c748f227'/>
       <union-decl name='__anonymous_union__' size-in-bits='4096' is-anonymous='yes' visibility='default' filepath='include/uapi/sound/asound.h' line='1054' column='1' id='c74bfd7b'>
         <data-member access='public'>
           <var-decl name='value' type-id='1fd26250' visibility='default' filepath='include/uapi/sound/asound.h' line='1055' column='1'/>
@@ -103266,12 +103235,6 @@
           <var-decl name='first' type-id='08cbad52' visibility='default' filepath='include/linux/types.h' line='183' column='1'/>
         </data-member>
       </class-decl>
-      <function-type size-in-bits='64' id='e151e1f6'>
-        <parameter type-id='7e666abe'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='02f11ed4'/>
-      </function-type>
       <pointer-type-def type-id='20b17040' size-in-bits='64' id='e153f6de'/>
       <pointer-type-def type-id='4d94804e' size-in-bits='64' id='e15671b8'/>
       <pointer-type-def type-id='59aa7dba' size-in-bits='64' id='e15aece4'/>
@@ -111518,7 +111481,6 @@
           <var-decl name='memsw' type-id='635c3685' visibility='default' filepath='include/linux/memcontrol.h' line='222' column='1'/>
         </data-member>
       </union-decl>
-      <pointer-type-def type-id='74fec388' size-in-bits='64' id='f3a5c46a'/>
       <class-decl name='rc_scancode_filter' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/media/rc-core.h' line='38' column='1' id='f3a6417e'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='data' type-id='19c2251e' visibility='default' filepath='include/media/rc-core.h' line='39' column='1'/>
@@ -126598,15 +126560,15 @@
         <parameter type-id='2aee9912' name='args' filepath='drivers/base/core.c' line='4434' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_add_device' mangled-name='devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_device'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='747' column='1'/>
-        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='748' column='1'/>
-        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='749' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='750' column='1'/>
+      <function-decl name='devfreq_add_device' mangled-name='devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='767' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='767' column='1'/>
+        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='768' column='1'/>
+        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='769' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='770' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
-      <function-decl name='devfreq_add_governor' mangled-name='devfreq_add_governor' filepath='drivers/devfreq/devfreq.c' line='1194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_governor'>
-        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1194' column='1'/>
+      <function-decl name='devfreq_add_governor' mangled-name='devfreq_add_governor' filepath='drivers/devfreq/devfreq.c' line='1214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_governor'>
+        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1214' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devfreq_cooling_unregister' mangled-name='devfreq_cooling_unregister' filepath='drivers/thermal/devfreq_cooling.c' line='557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_cooling_unregister'>
@@ -126637,67 +126599,67 @@
         <parameter type-id='d6184118' name='edata' filepath='drivers/devfreq/devfreq-event.c' line='161' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_get_devfreq_by_node' mangled-name='devfreq_get_devfreq_by_node' filepath='drivers/devfreq/devfreq.c' line='995' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_node'>
-        <parameter type-id='9a537bbe' name='node' filepath='drivers/devfreq/devfreq.c' line='995' column='1'/>
+      <function-decl name='devfreq_get_devfreq_by_node' mangled-name='devfreq_get_devfreq_by_node' filepath='drivers/devfreq/devfreq.c' line='1015' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_node'>
+        <parameter type-id='9a537bbe' name='node' filepath='drivers/devfreq/devfreq.c' line='1015' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
-      <function-decl name='devfreq_get_devfreq_by_phandle' mangled-name='devfreq_get_devfreq_by_phandle' filepath='drivers/devfreq/devfreq.c' line='1023' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_phandle'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1023' column='1'/>
-        <parameter type-id='80f4b756' name='phandle_name' filepath='drivers/devfreq/devfreq.c' line='1024' column='1'/>
-        <parameter type-id='95e97e5e' name='index' filepath='drivers/devfreq/devfreq.c' line='1024' column='1'/>
+      <function-decl name='devfreq_get_devfreq_by_phandle' mangled-name='devfreq_get_devfreq_by_phandle' filepath='drivers/devfreq/devfreq.c' line='1043' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_phandle'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1043' column='1'/>
+        <parameter type-id='80f4b756' name='phandle_name' filepath='drivers/devfreq/devfreq.c' line='1044' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/devfreq/devfreq.c' line='1044' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
-      <function-decl name='devfreq_monitor_resume' mangled-name='devfreq_monitor_resume' filepath='drivers/devfreq/devfreq.c' line='535' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_resume'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='535' column='1'/>
+      <function-decl name='devfreq_monitor_resume' mangled-name='devfreq_monitor_resume' filepath='drivers/devfreq/devfreq.c' line='555' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_resume'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='555' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devfreq_monitor_start' mangled-name='devfreq_monitor_start' filepath='drivers/devfreq/devfreq.c' line='457' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_start'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='457' column='1'/>
+      <function-decl name='devfreq_monitor_start' mangled-name='devfreq_monitor_start' filepath='drivers/devfreq/devfreq.c' line='461' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_start'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='461' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devfreq_monitor_stop' mangled-name='devfreq_monitor_stop' filepath='drivers/devfreq/devfreq.c' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_stop'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='487' column='1'/>
+      <function-decl name='devfreq_monitor_stop' mangled-name='devfreq_monitor_stop' filepath='drivers/devfreq/devfreq.c' line='499' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_stop'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='499' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devfreq_monitor_suspend' mangled-name='devfreq_monitor_suspend' filepath='drivers/devfreq/devfreq.c' line='508' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_suspend'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='508' column='1'/>
+      <function-decl name='devfreq_monitor_suspend' mangled-name='devfreq_monitor_suspend' filepath='drivers/devfreq/devfreq.c' line='528' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_monitor_suspend'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='528' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devfreq_recommended_opp' mangled-name='devfreq_recommended_opp' filepath='drivers/devfreq/devfreq.c' line='1900' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_recommended_opp'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1900' column='1'/>
-        <parameter type-id='1d2c2b85' name='freq' filepath='drivers/devfreq/devfreq.c' line='1901' column='1'/>
-        <parameter type-id='19c2251e' name='flags' filepath='drivers/devfreq/devfreq.c' line='1902' column='1'/>
+      <function-decl name='devfreq_recommended_opp' mangled-name='devfreq_recommended_opp' filepath='drivers/devfreq/devfreq.c' line='1920' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_recommended_opp'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1920' column='1'/>
+        <parameter type-id='1d2c2b85' name='freq' filepath='drivers/devfreq/devfreq.c' line='1921' column='1'/>
+        <parameter type-id='19c2251e' name='flags' filepath='drivers/devfreq/devfreq.c' line='1922' column='1'/>
         <return type-id='02e48bc6'/>
       </function-decl>
-      <function-decl name='devfreq_register_opp_notifier' mangled-name='devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1933' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_register_opp_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1933' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1933' column='1'/>
+      <function-decl name='devfreq_register_opp_notifier' mangled-name='devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1953' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_register_opp_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1953' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1953' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_remove_device' mangled-name='devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='923' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_device'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='923' column='1'/>
+      <function-decl name='devfreq_remove_device' mangled-name='devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='943' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='943' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_remove_governor' mangled-name='devfreq_remove_governor' filepath='drivers/devfreq/devfreq.c' line='1259' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_governor'>
-        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1259' column='1'/>
+      <function-decl name='devfreq_remove_governor' mangled-name='devfreq_remove_governor' filepath='drivers/devfreq/devfreq.c' line='1279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_governor'>
+        <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1279' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_resume_device' mangled-name='devfreq_resume_device' filepath='drivers/devfreq/devfreq.c' line='1117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_resume_device'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1117' column='1'/>
+      <function-decl name='devfreq_resume_device' mangled-name='devfreq_resume_device' filepath='drivers/devfreq/devfreq.c' line='1137' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_resume_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1137' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_suspend_device' mangled-name='devfreq_suspend_device' filepath='drivers/devfreq/devfreq.c' line='1080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_suspend_device'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1080' column='1'/>
+      <function-decl name='devfreq_suspend_device' mangled-name='devfreq_suspend_device' filepath='drivers/devfreq/devfreq.c' line='1100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_suspend_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1100' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_unregister_opp_notifier' mangled-name='devfreq_unregister_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1949' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_unregister_opp_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1949' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1949' column='1'/>
+      <function-decl name='devfreq_unregister_opp_notifier' mangled-name='devfreq_unregister_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1969' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_unregister_opp_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1969' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1969' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_update_interval' mangled-name='devfreq_update_interval' filepath='drivers/devfreq/devfreq.c' line='572' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_update_interval'>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='572' column='1'/>
-        <parameter type-id='807869d3' name='delay' filepath='drivers/devfreq/devfreq.c' line='572' column='1'/>
+      <function-decl name='devfreq_update_interval' mangled-name='devfreq_update_interval' filepath='drivers/devfreq/devfreq.c' line='592' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_update_interval'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='592' column='1'/>
+        <parameter type-id='807869d3' name='delay' filepath='drivers/devfreq/devfreq.c' line='592' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='device_add' mangled-name='device_add' filepath='drivers/base/core.c' line='3127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_add'>
@@ -127055,11 +127017,11 @@
         <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4267' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='devm_devfreq_add_device' mangled-name='devm_devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='964' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_add_device'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='964' column='1'/>
-        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='965' column='1'/>
-        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='966' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='967' column='1'/>
+      <function-decl name='devm_devfreq_add_device' mangled-name='devm_devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='984' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_add_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='984' column='1'/>
+        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='985' column='1'/>
+        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='986' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='987' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
       <function-decl name='devm_devfreq_event_add_edev' mangled-name='devm_devfreq_event_add_edev' filepath='drivers/devfreq/devfreq-event.c' line='397' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_event_add_edev'>
@@ -127067,28 +127029,28 @@
         <parameter type-id='72742e5b' name='desc' filepath='drivers/devfreq/devfreq-event.c' line='398' column='1'/>
         <return type-id='88146159'/>
       </function-decl>
-      <function-decl name='devm_devfreq_register_notifier' mangled-name='devm_devfreq_register_notifier' filepath='drivers/devfreq/devfreq.c' line='2080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2080' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2081' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2082' column='1'/>
-        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2083' column='1'/>
+      <function-decl name='devm_devfreq_register_notifier' mangled-name='devm_devfreq_register_notifier' filepath='drivers/devfreq/devfreq.c' line='2100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2100' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2101' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2102' column='1'/>
+        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2103' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_devfreq_register_opp_notifier' mangled-name='devm_devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1966' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_opp_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1966' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1967' column='1'/>
+      <function-decl name='devm_devfreq_register_opp_notifier' mangled-name='devm_devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1986' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_opp_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1986' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1987' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_devfreq_remove_device' mangled-name='devm_devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='1065' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_remove_device'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1065' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1065' column='1'/>
+      <function-decl name='devm_devfreq_remove_device' mangled-name='devm_devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='1085' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_remove_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1085' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1085' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devm_devfreq_unregister_notifier' mangled-name='devm_devfreq_unregister_notifier' filepath='drivers/devfreq/devfreq.c' line='2116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_unregister_notifier'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2116' column='1'/>
-        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2117' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2118' column='1'/>
-        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2119' column='1'/>
+      <function-decl name='devm_devfreq_unregister_notifier' mangled-name='devm_devfreq_unregister_notifier' filepath='drivers/devfreq/devfreq.c' line='2136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_unregister_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2136' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2137' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/devfreq/devfreq.c' line='2138' column='1'/>
+        <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2139' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='devm_device_add_group' mangled-name='devm_device_add_group' filepath='drivers/base/core.c' line='2392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_device_add_group'>
@@ -144437,6 +144399,10 @@
         <parameter type-id='63cbc127' name='card_ret' filepath='sound/core/init.c' line='163' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='snd_card_ref' mangled-name='snd_card_ref' filepath='sound/core/init.c' line='268' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_ref'>
+        <parameter type-id='95e97e5e' name='idx' filepath='sound/core/init.c' line='268' column='1'/>
+        <return type-id='52704eb7'/>
+      </function-decl>
       <function-decl name='snd_card_register' mangled-name='snd_card_register' filepath='sound/core/init.c' line='746' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_register'>
         <parameter type-id='52704eb7' name='card' filepath='sound/core/init.c' line='746' column='1'/>
         <return type-id='95e97e5e'/>
diff --git a/android/abi_gki_aarch64_galaxy b/android/abi_gki_aarch64_galaxy
index db5abff44b22..4b398f0a91bf 100644
--- a/android/abi_gki_aarch64_galaxy
+++ b/android/abi_gki_aarch64_galaxy
@@ -3316,6 +3316,7 @@
   snd_card_disconnect
   snd_card_free
   snd_card_new
+  snd_card_ref
   snd_card_register
   snd_card_rw_proc_new
   snd_component_add

From 050c668fefb2a9724ad4f3efd58bd04c6fd308c5 Mon Sep 17 00:00:00 2001
From: Carlos Galo <carlosgalo@google.com>
Date: Thu, 11 Jan 2024 21:05:30 +0000
Subject: [PATCH 0996/1043] FROMGIT: BACKPORT: mm: update mark_victim
 tracepoints fields

The current implementation of the mark_victim tracepoint provides only the
process ID (pid) of the victim process.  This limitation poses challenges
for userspace tools that need additional information about the OOM victim.
The association between pid and the additional data may be lost after the
kill, making it difficult for userspace to correlate the OOM event with
the specific process.

In order to mitigate this limitation, add the following fields:

- UID
   In Android each installed application has a unique UID. Including
   the `uid` assists in correlating OOM events with specific apps.

- Process Name (comm)
   Enables identification of the affected process.

- OOM Score
   Allows userspace to get additional insights of the relative kill
   priority of the OOM victim.

Link: https://lkml.kernel.org/r/20240111210539.636607-1-carlosgalo@google.com
Change-Id: Icc3ed013a9dfff9bb09f1d7588757e6028c17069
Signed-off-by: Carlos Galo <carlosgalo@google.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 649ffb4cbb90a7f60f17dd74e57d814e762ea01d mm-unstable)
[ carlosgalo: Manually added struct cred change in mark_oom_victim function ]

Bug: 315560026
Change-Id: I81fb6f3447f432100ad4cd25e22db23768003388
Signed-off-by: Carlos Galo <carlosgalo@google.com>
---
 include/trace/events/oom.h | 19 +++++++++++++++----
 mm/oom_kill.c              |  7 ++++++-
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/include/trace/events/oom.h b/include/trace/events/oom.h
index 26a11e4a2c36..3c5941da8075 100644
--- a/include/trace/events/oom.h
+++ b/include/trace/events/oom.h
@@ -72,19 +72,30 @@ TRACE_EVENT(reclaim_retry_zone,
 );
 
 TRACE_EVENT(mark_victim,
-	TP_PROTO(int pid),
+	TP_PROTO(struct task_struct *task, uid_t uid),
 
-	TP_ARGS(pid),
+	TP_ARGS(task, uid),
 
 	TP_STRUCT__entry(
 		__field(int, pid)
+		__field(uid_t, uid)
+		__string(comm, task->comm)
+		__field(short, oom_score_adj)
 	),
 
 	TP_fast_assign(
-		__entry->pid = pid;
+		__entry->pid = task->pid;
+		__entry->uid = uid;
+		__assign_str(comm, task->comm);
+		__entry->oom_score_adj = task->signal->oom_score_adj;
 	),
 
-	TP_printk("pid=%d", __entry->pid)
+	TP_printk("pid=%d uid=%u comm=%s oom_score_adj=%hd",
+		__entry->pid,
+		__entry->uid,
+		__get_str(comm),
+		__entry->oom_score_adj
+	)
 );
 
 TRACE_EVENT(wake_reaper,
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index e722c6877faf..f335ffb793e5 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -44,6 +44,7 @@
 #include <linux/kthread.h>
 #include <linux/init.h>
 #include <linux/mmu_notifier.h>
+#include <linux/cred.h>
 
 #include <asm/tlb.h>
 #include "internal.h"
@@ -751,6 +752,8 @@ static void __mark_oom_victim(struct task_struct *tsk)
  */
 static void mark_oom_victim(struct task_struct *tsk)
 {
+	const struct cred *cred;
+
 	WARN_ON(oom_killer_disabled);
 	/* OOM killer might race with memcg OOM */
 	if (test_and_set_tsk_thread_flag(tsk, TIF_MEMDIE))
@@ -767,7 +770,9 @@ static void mark_oom_victim(struct task_struct *tsk)
 	 */
 	__thaw_task(tsk);
 	atomic_inc(&oom_victims);
-	trace_mark_victim(tsk->pid);
+	cred = get_task_cred(tsk);
+	trace_mark_victim(tsk, cred->uid.val);
+	put_cred(cred);
 }
 
 /**

From cbfcf517dc42cd4dbcd69cada971e0f3002dab88 Mon Sep 17 00:00:00 2001
From: Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com>
Date: Fri, 22 Dec 2023 15:17:04 +0530
Subject: [PATCH 0997/1043] FROMGIT: usb: dwc: ep0: Update request status in
 dwc3_ep0_stall_restart

Current implementation blocks the running operations when Plug-out and
Plug-In is performed continuously, process gets stuck in
dwc3_thread_interrupt().

Code Flow:

	CPU1

	->Gadget_start
	->dwc3_interrupt
	->dwc3_thread_interrupt
	->dwc3_process_event_buf
	->dwc3_process_event_entry
	->dwc3_endpoint_interrupt
	->dwc3_ep0_interrupt
	->dwc3_ep0_inspect_setup
	->dwc3_ep0_stall_and_restart

By this time if pending_list is not empty, it will get the next request
on the given list and calls dwc3_gadget_giveback which will unmap request
and call its complete() callback to notify upper layers that it has
completed. Currently dwc3_gadget_giveback status is set to -ECONNRESET,
whereas it should be -ESHUTDOWN based on condition if not dwc->connected
is true.

Cc:  <stable@vger.kernel.org>
Fixes: d742220b3577 ("usb: dwc3: ep0: giveback requests on stall_and_restart")
Signed-off-by: Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com>
Link: https://lore.kernel.org/r/20231222094704.20276-1-quic_uaggarwa@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 320608609
(cherry picked from commit e9d40b215e38480fd94c66b06d79045717a59e9c
https: //git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-next)

Change-Id: Ie1cb993fc9e24e6c2f6d6120bca409a6f2664c18
Signed-off-by: Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com>
---
 drivers/usb/dwc3/ep0.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index fbb7d38ede7d..b1acdea8eecb 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -236,7 +236,10 @@ void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
 		struct dwc3_request	*req;
 
 		req = next_request(&dep->pending_list);
-		dwc3_gadget_giveback(dep, req, -ECONNRESET);
+		if (!dwc->connected)
+			dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
+		else
+			dwc3_gadget_giveback(dep, req, -ECONNRESET);
 	}
 
 	dwc->eps[0]->trb_enqueue = 0;

From 75c057fe65b2fa75a936ef4ef201a26a9b506b54 Mon Sep 17 00:00:00 2001
From: Sanjeev Yadav <sanjeev.y@mediatek.com>
Date: Wed, 24 Jan 2024 23:32:32 +0530
Subject: [PATCH 0998/1043] ANDROID: GKI: Update symbol list for mtk

It's require to integrate vendor specific err handling mechanism where below symbols will be used.

  [A] 'function void ufshcd_complete_requests(ufs_hba*)'
  [A] 'function void ufshcd_err_handling_prepare(ufs_hba*)'
  [A] 'function void ufshcd_err_handling_unprepare(ufs_hba*)'

Above mentioned 3 symbols will be used in UFS vendor hooks implementation exported with previous submitted topic - "ufs_perf_heuristic" (URL mentioned in Link:)

Bug: 322142524
Link: https://android-review.googlesource.com/q/topic:%22ufs_perf_heuristic%22
Change-Id: I05a8db36c6c8f7d1cb37c122420fb3d3110dc2a5
Signed-off-by: Sanjeev Yadav <sanjeev.y@mediatek.com>
---
 android/abi_gki_aarch64.xml | 23 +++++++++++++++++++----
 android/abi_gki_aarch64_mtk |  3 +++
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 4aaf6c631d6e..226ceb691807 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -5739,12 +5739,15 @@
       <elf-symbol name='ufshcd_alloc_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x57f9b97'/>
       <elf-symbol name='ufshcd_auto_hibern8_update' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc16cbeff'/>
       <elf-symbol name='ufshcd_bkops_ctrl' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9da76035'/>
+      <elf-symbol name='ufshcd_complete_requests' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdac8b246'/>
       <elf-symbol name='ufshcd_config_pwr_mode' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb40401db'/>
       <elf-symbol name='ufshcd_dealloc_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x26267833'/>
       <elf-symbol name='ufshcd_delay_us' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x723b1abf'/>
       <elf-symbol name='ufshcd_dme_get_attr' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1108b959'/>
       <elf-symbol name='ufshcd_dme_set_attr' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc1ba1599'/>
       <elf-symbol name='ufshcd_dump_regs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6605adad'/>
+      <elf-symbol name='ufshcd_err_handling_prepare' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8a859165'/>
+      <elf-symbol name='ufshcd_err_handling_unprepare' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe41cd645'/>
       <elf-symbol name='ufshcd_fixup_dev_quirks' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc4e74b30'/>
       <elf-symbol name='ufshcd_get_local_unipro_ver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa59b3f84'/>
       <elf-symbol name='ufshcd_get_pwr_dev_param' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xff85cd6b'/>
@@ -141599,8 +141602,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='net/core/netevent.c' line='28' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_oom_notifier' mangled-name='register_oom_notifier' filepath='mm/oom_kill.c' line='1075' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_oom_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1075' column='1'/>
+      <function-decl name='register_oom_notifier' mangled-name='register_oom_notifier' filepath='mm/oom_kill.c' line='1080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_oom_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1080' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='register_pernet_device' mangled-name='register_pernet_device' filepath='net/core/net_namespace.c' line='1316' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_pernet_device'>
@@ -147666,6 +147669,10 @@
         <parameter type-id='462d2624' name='status' filepath='drivers/scsi/ufs/ufshcd.c' line='5496' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='ufshcd_complete_requests' mangled-name='ufshcd_complete_requests' filepath='drivers/scsi/ufs/ufshcd.c' line='5806' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_complete_requests'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='5806' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='ufshcd_config_pwr_mode' mangled-name='ufshcd_config_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4366' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_config_pwr_mode'>
         <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4366' column='1'/>
         <parameter type-id='35f4156d' name='desired_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4367' column='1'/>
@@ -147702,6 +147709,14 @@
         <parameter type-id='80f4b756' name='prefix' filepath='drivers/scsi/ufs/ufshcd.c' line='104' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='ufshcd_err_handling_prepare' mangled-name='ufshcd_err_handling_prepare' filepath='drivers/scsi/ufs/ufshcd.c' line='5926' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_err_handling_prepare'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='5926' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='ufshcd_err_handling_unprepare' mangled-name='ufshcd_err_handling_unprepare' filepath='drivers/scsi/ufs/ufshcd.c' line='5963' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_err_handling_unprepare'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='5963' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='ufshcd_fixup_dev_quirks' mangled-name='ufshcd_fixup_dev_quirks' filepath='drivers/scsi/ufs/ufshcd.c' line='7472' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_fixup_dev_quirks'>
         <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='7472' column='1'/>
         <parameter type-id='c5251c27' name='fixups' filepath='drivers/scsi/ufs/ufshcd.c' line='7472' column='1'/>
@@ -147975,8 +147990,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='net/core/netevent.c' line='44' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='unregister_oom_notifier' mangled-name='unregister_oom_notifier' filepath='mm/oom_kill.c' line='1081' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_oom_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1081' column='1'/>
+      <function-decl name='unregister_oom_notifier' mangled-name='unregister_oom_notifier' filepath='mm/oom_kill.c' line='1086' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_oom_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1086' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='unregister_pernet_device' mangled-name='unregister_pernet_device' filepath='net/core/net_namespace.c' line='1337' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_pernet_device'>
diff --git a/android/abi_gki_aarch64_mtk b/android/abi_gki_aarch64_mtk
index 21fb3b2771a6..4accdf1c433f 100644
--- a/android/abi_gki_aarch64_mtk
+++ b/android/abi_gki_aarch64_mtk
@@ -2381,10 +2381,13 @@
   uart_update_timeout
   uclamp_eff_value
   __udelay
+  ufshcd_complete_requests
   ufshcd_delay_us
   ufshcd_dme_get_attr
   ufshcd_dme_set_attr
   ufshcd_dump_regs
+  ufshcd_err_handling_prepare
+  ufshcd_err_handling_unprepare
   ufshcd_fixup_dev_quirks
   ufshcd_get_pwr_dev_param
   ufshcd_hba_enable

From 789c68e980a2ef99afeb13056862b5586cf0e955 Mon Sep 17 00:00:00 2001
From: Sanjeev Yadav <sanjeev.y@mediatek.com>
Date: Thu, 11 Jan 2024 15:25:04 +0530
Subject: [PATCH 0999/1043] ANDROID: scsi: ufs: UFS HPB feature not working

UFS HPB feature not working/disabled for some UFS storage device in Android12-5.10
There was below error trigger in the UFS init flow at kernel bootup time.

[name:ufshcd_core&]ufshpb_get_dev_info: HPB 103 version is not supported.
[name:ufshcd_core&]ufshcd_query_flag: Sending flag query for idn 18 failed, err = 253
[name:ufshcd_core&]ufshcd_query_flag: Sending flag query for idn 18 failed, err = 253
[name:ufshcd_core&]ufshcd_query_flag: Sending flag query for idn 18 failed, err = 253
[name:ufshcd_core&]ufshcd_query_flag_retry: query attribute, opcode 5, idn 18, failed with error 253 after 3 retires

It observed that the 0x103 version have some extension of legacy UFS HPB.
We have to consider all the extension of legacy
(after 0x100 in the code for legacy support).
Similar for Advanced version(0x200) also.
Added mask for the major version so that it can be picked for legacy
or advance HPB version accordingly and support HPB thereafter.

UFS HPB feature has been integrated in Linux stable branch from linux-5.15. So it is not there in Linux-5.10.y stable branch and recently from Linux-6.6, this HPB feature removed from the mainline.
i.e. submitted this bug here in Android12-5.10 as this is Android specific.

Bug: 320628430
Change-Id: I171255de991f19d5d662447939f35e6595d1c4e2
Fixes: 756ecd96f649 ("scsi: ufs: Add HPB 2.0 support")
Signed-off-by: Sanjeev Yadav <sanjeev.y@mediatek.com>
---
 drivers/scsi/ufs/ufshpb.c | 2 +-
 drivers/scsi/ufs/ufshpb.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/ufs/ufshpb.c b/drivers/scsi/ufs/ufshpb.c
index a869668f3061..93e27eea89b0 100644
--- a/drivers/scsi/ufs/ufshpb.c
+++ b/drivers/scsi/ufs/ufshpb.c
@@ -2873,7 +2873,7 @@ void ufshpb_get_dev_info(struct ufs_hba *hba, u8 *desc_buf)
 
 	hpb_dev_info->control_mode = desc_buf[DEVICE_DESC_PARAM_HPB_CONTROL];
 
-	version = get_unaligned_be16(desc_buf + DEVICE_DESC_PARAM_HPB_VER);
+	version = get_unaligned_be16(desc_buf + DEVICE_DESC_PARAM_HPB_VER) & HPB_MAJOR_VERSION_MASK;
 	if ((version != HPB_SUPPORT_VERSION) &&
 	    (version != HPB_SUPPORT_LEGACY_VERSION)) {
 		dev_err(hba->dev, "%s: HPB %x version is not supported.\n",
diff --git a/drivers/scsi/ufs/ufshpb.h b/drivers/scsi/ufs/ufshpb.h
index a79e07398970..6371ece513d5 100644
--- a/drivers/scsi/ufs/ufshpb.h
+++ b/drivers/scsi/ufs/ufshpb.h
@@ -53,6 +53,7 @@
 
 #define HPB_SUPPORT_VERSION			0x200
 #define HPB_SUPPORT_LEGACY_VERSION		0x100
+#define HPB_MAJOR_VERSION_MASK			0xFF00
 
 enum UFSHPB_MODE {
 	HPB_HOST_CONTROL,

From 40c0aa9ee12929094a8243042fb3eb254bf08ccf Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Thu, 2 Nov 2023 15:49:38 +0000
Subject: [PATCH 1000/1043] Reapply "perf: Disallow mis-matched inherited group
 reads"

This reverts commit b78ecc11eaf11ffd2ad67bab53186e6180ed2dcf.

Keeps the ABI stable by taking advantage of a hole in the structure!

Bug: 307236803
Change-Id: Ic5f7ebeb3a9b13afdb3bfff7e54c4a93b863dab6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 android/abi_gki_aarch64.xml | 379 ++++++++++++++++++------------------
 include/linux/perf_event.h  |   3 +
 kernel/events/core.c        |  39 +++-
 3 files changed, 227 insertions(+), 194 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 226ceb691807..5296e056669e 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -12126,12 +12126,12 @@
       <pointer-type-def type-id='d81ac7f6' size-in-bits='64' id='0e289f54'/>
       <pointer-type-def type-id='897bd6f1' size-in-bits='64' id='0e291009'/>
       <pointer-type-def type-id='b50ce591' size-in-bits='64' id='0e3f80d9'/>
-      <class-decl name='__anonymous_struct__' size-in-bits='64' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/perf_event.h' line='1015' column='1' id='0e48f9a5'>
+      <class-decl name='__anonymous_struct__' size-in-bits='64' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/perf_event.h' line='1018' column='1' id='0e48f9a5'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='pid' type-id='19c2251e' visibility='default' filepath='include/linux/perf_event.h' line='1016' column='1'/>
+          <var-decl name='pid' type-id='19c2251e' visibility='default' filepath='include/linux/perf_event.h' line='1019' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='tid' type-id='19c2251e' visibility='default' filepath='include/linux/perf_event.h' line='1017' column='1'/>
+          <var-decl name='tid' type-id='19c2251e' visibility='default' filepath='include/linux/perf_event.h' line='1020' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='1119a98f' size-in-bits='64' id='0e587527'/>
@@ -24110,69 +24110,69 @@
           <var-decl name='vaddr' type-id='7359adad' visibility='default' filepath='include/linux/uprobes.h' line='67' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='perf_sample_data' size-in-bits='1536' is-struct='yes' visibility='default' filepath='include/linux/perf_event.h' line='996' column='1' id='2b3d4ba2'>
+      <class-decl name='perf_sample_data' size-in-bits='1536' is-struct='yes' visibility='default' filepath='include/linux/perf_event.h' line='999' column='1' id='2b3d4ba2'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='addr' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1001' column='1'/>
+          <var-decl name='addr' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1004' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='raw' type-id='f4a67529' visibility='default' filepath='include/linux/perf_event.h' line='1002' column='1'/>
+          <var-decl name='raw' type-id='f4a67529' visibility='default' filepath='include/linux/perf_event.h' line='1005' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='br_stack' type-id='070ae8d2' visibility='default' filepath='include/linux/perf_event.h' line='1003' column='1'/>
+          <var-decl name='br_stack' type-id='070ae8d2' visibility='default' filepath='include/linux/perf_event.h' line='1006' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='period' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1004' column='1'/>
+          <var-decl name='period' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1007' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='weight' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1005' column='1'/>
+          <var-decl name='weight' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1008' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='txn' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1006' column='1'/>
+          <var-decl name='txn' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1009' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='data_src' type-id='2be3cc53' visibility='default' filepath='include/linux/perf_event.h' line='1007' column='1'/>
+          <var-decl name='data_src' type-id='2be3cc53' visibility='default' filepath='include/linux/perf_event.h' line='1010' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='type' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1013' column='1'/>
+          <var-decl name='type' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1016' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='ip' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1014' column='1'/>
+          <var-decl name='ip' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1017' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='tid_entry' type-id='0e48f9a5' visibility='default' filepath='include/linux/perf_event.h' line='1018' column='1'/>
+          <var-decl name='tid_entry' type-id='0e48f9a5' visibility='default' filepath='include/linux/perf_event.h' line='1021' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='time' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1019' column='1'/>
+          <var-decl name='time' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1022' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='id' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1020' column='1'/>
+          <var-decl name='id' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1023' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='stream_id' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1021' column='1'/>
+          <var-decl name='stream_id' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1024' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='cpu_entry' type-id='3851c7bb' visibility='default' filepath='include/linux/perf_event.h' line='1025' column='1'/>
+          <var-decl name='cpu_entry' type-id='3851c7bb' visibility='default' filepath='include/linux/perf_event.h' line='1028' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='callchain' type-id='cd3a82e3' visibility='default' filepath='include/linux/perf_event.h' line='1026' column='1'/>
+          <var-decl name='callchain' type-id='cd3a82e3' visibility='default' filepath='include/linux/perf_event.h' line='1029' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='aux_size' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1027' column='1'/>
+          <var-decl name='aux_size' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1030' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='regs_user' type-id='85b37ab4' visibility='default' filepath='include/linux/perf_event.h' line='1029' column='1'/>
+          <var-decl name='regs_user' type-id='85b37ab4' visibility='default' filepath='include/linux/perf_event.h' line='1032' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='regs_intr' type-id='85b37ab4' visibility='default' filepath='include/linux/perf_event.h' line='1030' column='1'/>
+          <var-decl name='regs_intr' type-id='85b37ab4' visibility='default' filepath='include/linux/perf_event.h' line='1033' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='stack_user_size' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1031' column='1'/>
+          <var-decl name='stack_user_size' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1034' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='phys_addr' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1033' column='1'/>
+          <var-decl name='phys_addr' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1036' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='cgroup' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1034' column='1'/>
+          <var-decl name='cgroup' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='1037' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='f8f2633f' size-in-bits='64' id='2b3f1c33'/>
@@ -27727,12 +27727,12 @@
         <parameter type-id='19c2251e'/>
         <return type-id='f0981eeb'/>
       </function-type>
-      <class-decl name='perf_event_groups' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/perf_event.h' line='786' column='1' id='3643bc2a'>
+      <class-decl name='perf_event_groups' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/perf_event.h' line='789' column='1' id='3643bc2a'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='tree' type-id='dec44472' visibility='default' filepath='include/linux/perf_event.h' line='787' column='1'/>
+          <var-decl name='tree' type-id='dec44472' visibility='default' filepath='include/linux/perf_event.h' line='790' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='index' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='788' column='1'/>
+          <var-decl name='index' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='791' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='e07298c6' size-in-bits='64' id='364779d0'/>
@@ -28259,12 +28259,12 @@
           <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/ip6_fib.h' line='230' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='__anonymous_struct__' size-in-bits='64' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/perf_event.h' line='1022' column='1' id='3851c7bb'>
+      <class-decl name='__anonymous_struct__' size-in-bits='64' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/perf_event.h' line='1025' column='1' id='3851c7bb'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='cpu' type-id='19c2251e' visibility='default' filepath='include/linux/perf_event.h' line='1023' column='1'/>
+          <var-decl name='cpu' type-id='19c2251e' visibility='default' filepath='include/linux/perf_event.h' line='1026' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='reserved' type-id='19c2251e' visibility='default' filepath='include/linux/perf_event.h' line='1024' column='1'/>
+          <var-decl name='reserved' type-id='19c2251e' visibility='default' filepath='include/linux/perf_event.h' line='1027' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='d49e6088' size-in-bits='64' id='38527a92'/>
@@ -33225,48 +33225,48 @@
       <pointer-type-def type-id='a6d8bab7' size-in-bits='64' id='442dc527'/>
       <pointer-type-def type-id='fbc017ef' size-in-bits='64' id='44372936'/>
       <qualified-type-def type-id='43795fda' const='yes' id='4443d9d9'/>
-      <class-decl name='perf_cpu_context' size-in-bits='3520' is-struct='yes' visibility='default' filepath='include/linux/perf_event.h' line='862' column='1' id='4448fdd3'>
+      <class-decl name='perf_cpu_context' size-in-bits='3520' is-struct='yes' visibility='default' filepath='include/linux/perf_event.h' line='865' column='1' id='4448fdd3'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='ctx' type-id='9d67acd5' visibility='default' filepath='include/linux/perf_event.h' line='863' column='1'/>
+          <var-decl name='ctx' type-id='9d67acd5' visibility='default' filepath='include/linux/perf_event.h' line='866' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2176'>
-          <var-decl name='task_ctx' type-id='b9419dc5' visibility='default' filepath='include/linux/perf_event.h' line='864' column='1'/>
+          <var-decl name='task_ctx' type-id='b9419dc5' visibility='default' filepath='include/linux/perf_event.h' line='867' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2240'>
-          <var-decl name='active_oncpu' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='865' column='1'/>
+          <var-decl name='active_oncpu' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='868' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2272'>
-          <var-decl name='exclusive' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='866' column='1'/>
+          <var-decl name='exclusive' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='869' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2304'>
-          <var-decl name='hrtimer_lock' type-id='f5c90b3f' visibility='default' filepath='include/linux/perf_event.h' line='868' column='1'/>
+          <var-decl name='hrtimer_lock' type-id='f5c90b3f' visibility='default' filepath='include/linux/perf_event.h' line='871' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2368'>
-          <var-decl name='hrtimer' type-id='b6993efc' visibility='default' filepath='include/linux/perf_event.h' line='869' column='1'/>
+          <var-decl name='hrtimer' type-id='b6993efc' visibility='default' filepath='include/linux/perf_event.h' line='872' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2944'>
-          <var-decl name='hrtimer_interval' type-id='fbc017ef' visibility='default' filepath='include/linux/perf_event.h' line='870' column='1'/>
+          <var-decl name='hrtimer_interval' type-id='fbc017ef' visibility='default' filepath='include/linux/perf_event.h' line='873' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3008'>
-          <var-decl name='hrtimer_active' type-id='f0981eeb' visibility='default' filepath='include/linux/perf_event.h' line='871' column='1'/>
+          <var-decl name='hrtimer_active' type-id='f0981eeb' visibility='default' filepath='include/linux/perf_event.h' line='874' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3072'>
-          <var-decl name='sched_cb_entry' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='878' column='1'/>
+          <var-decl name='sched_cb_entry' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='881' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3200'>
-          <var-decl name='sched_cb_usage' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='879' column='1'/>
+          <var-decl name='sched_cb_usage' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='882' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3232'>
-          <var-decl name='online' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='881' column='1'/>
+          <var-decl name='online' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='884' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3264'>
-          <var-decl name='heap_size' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='886' column='1'/>
+          <var-decl name='heap_size' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='889' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3328'>
-          <var-decl name='heap' type-id='a0127209' visibility='default' filepath='include/linux/perf_event.h' line='887' column='1'/>
+          <var-decl name='heap' type-id='a0127209' visibility='default' filepath='include/linux/perf_event.h' line='890' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3392'>
-          <var-decl name='heap_default' type-id='e0f8c0f3' visibility='default' filepath='include/linux/perf_event.h' line='888' column='1'/>
+          <var-decl name='heap_default' type-id='e0f8c0f3' visibility='default' filepath='include/linux/perf_event.h' line='891' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='ee15d052' size-in-bits='64' id='44572ce8'/>
@@ -37006,12 +37006,12 @@
       <qualified-type-def type-id='2ba71bf0' const='yes' id='4e267e15'/>
       <pointer-type-def type-id='9a165a97' size-in-bits='64' id='4e30d787'/>
       <pointer-type-def type-id='b992836c' size-in-bits='64' id='4e326e06'/>
-      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/linux/perf_event.h' line='897' column='1' id='4e335919'>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/linux/perf_event.h' line='900' column='1' id='4e335919'>
         <data-member access='public'>
-          <var-decl name='addr' type-id='eaa32e2f' visibility='default' filepath='include/linux/perf_event.h' line='898' column='1'/>
+          <var-decl name='addr' type-id='eaa32e2f' visibility='default' filepath='include/linux/perf_event.h' line='901' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='head' type-id='7359adad' visibility='default' filepath='include/linux/perf_event.h' line='899' column='1'/>
+          <var-decl name='head' type-id='7359adad' visibility='default' filepath='include/linux/perf_event.h' line='902' column='1'/>
         </data-member>
       </union-decl>
       <function-type size-in-bits='64' id='4e3458ca'>
@@ -52706,176 +52706,179 @@
         <data-member access='public' layout-offset-in-bits='1088'>
           <var-decl name='group_caps' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='660' column='1'/>
         </data-member>
+        <data-member access='public' layout-offset-in-bits='1120'>
+          <var-decl name='group_generation' type-id='f0981eeb' visibility='default' filepath='include/linux/perf_event.h' line='663' column='1'/>
+        </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='group_leader' type-id='2bf16f59' visibility='default' filepath='include/linux/perf_event.h' line='662' column='1'/>
+          <var-decl name='group_leader' type-id='2bf16f59' visibility='default' filepath='include/linux/perf_event.h' line='665' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='pmu' type-id='0906f5b9' visibility='default' filepath='include/linux/perf_event.h' line='663' column='1'/>
+          <var-decl name='pmu' type-id='0906f5b9' visibility='default' filepath='include/linux/perf_event.h' line='666' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='pmu_private' type-id='eaa32e2f' visibility='default' filepath='include/linux/perf_event.h' line='664' column='1'/>
+          <var-decl name='pmu_private' type-id='eaa32e2f' visibility='default' filepath='include/linux/perf_event.h' line='667' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='state' type-id='31fdb95a' visibility='default' filepath='include/linux/perf_event.h' line='666' column='1'/>
+          <var-decl name='state' type-id='31fdb95a' visibility='default' filepath='include/linux/perf_event.h' line='669' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1376'>
-          <var-decl name='attach_state' type-id='f0981eeb' visibility='default' filepath='include/linux/perf_event.h' line='667' column='1'/>
+          <var-decl name='attach_state' type-id='f0981eeb' visibility='default' filepath='include/linux/perf_event.h' line='670' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='count' type-id='7da7300e' visibility='default' filepath='include/linux/perf_event.h' line='668' column='1'/>
+          <var-decl name='count' type-id='7da7300e' visibility='default' filepath='include/linux/perf_event.h' line='671' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='child_count' type-id='28ee064c' visibility='default' filepath='include/linux/perf_event.h' line='669' column='1'/>
+          <var-decl name='child_count' type-id='28ee064c' visibility='default' filepath='include/linux/perf_event.h' line='672' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='total_time_enabled' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='677' column='1'/>
+          <var-decl name='total_time_enabled' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='680' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='total_time_running' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='678' column='1'/>
+          <var-decl name='total_time_running' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='681' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='tstamp' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='679' column='1'/>
+          <var-decl name='tstamp' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='682' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1728'>
-          <var-decl name='shadow_ctx_time' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='691' column='1'/>
+          <var-decl name='shadow_ctx_time' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='694' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1792'>
-          <var-decl name='attr' type-id='e57536d9' visibility='default' filepath='include/linux/perf_event.h' line='693' column='1'/>
+          <var-decl name='attr' type-id='e57536d9' visibility='default' filepath='include/linux/perf_event.h' line='696' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2752'>
-          <var-decl name='header_size' type-id='1dc6a898' visibility='default' filepath='include/linux/perf_event.h' line='694' column='1'/>
+          <var-decl name='header_size' type-id='1dc6a898' visibility='default' filepath='include/linux/perf_event.h' line='697' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2768'>
-          <var-decl name='id_header_size' type-id='1dc6a898' visibility='default' filepath='include/linux/perf_event.h' line='695' column='1'/>
+          <var-decl name='id_header_size' type-id='1dc6a898' visibility='default' filepath='include/linux/perf_event.h' line='698' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2784'>
-          <var-decl name='read_size' type-id='1dc6a898' visibility='default' filepath='include/linux/perf_event.h' line='696' column='1'/>
+          <var-decl name='read_size' type-id='1dc6a898' visibility='default' filepath='include/linux/perf_event.h' line='699' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2816'>
-          <var-decl name='hw' type-id='b594b0c9' visibility='default' filepath='include/linux/perf_event.h' line='697' column='1'/>
+          <var-decl name='hw' type-id='b594b0c9' visibility='default' filepath='include/linux/perf_event.h' line='700' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4352'>
-          <var-decl name='ctx' type-id='b9419dc5' visibility='default' filepath='include/linux/perf_event.h' line='699' column='1'/>
+          <var-decl name='ctx' type-id='b9419dc5' visibility='default' filepath='include/linux/perf_event.h' line='702' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4416'>
-          <var-decl name='refcount' type-id='f22a8abb' visibility='default' filepath='include/linux/perf_event.h' line='700' column='1'/>
+          <var-decl name='refcount' type-id='f22a8abb' visibility='default' filepath='include/linux/perf_event.h' line='703' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4480'>
-          <var-decl name='child_total_time_enabled' type-id='28ee064c' visibility='default' filepath='include/linux/perf_event.h' line='706' column='1'/>
+          <var-decl name='child_total_time_enabled' type-id='28ee064c' visibility='default' filepath='include/linux/perf_event.h' line='709' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4544'>
-          <var-decl name='child_total_time_running' type-id='28ee064c' visibility='default' filepath='include/linux/perf_event.h' line='707' column='1'/>
+          <var-decl name='child_total_time_running' type-id='28ee064c' visibility='default' filepath='include/linux/perf_event.h' line='710' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4608'>
-          <var-decl name='child_mutex' type-id='925167dc' visibility='default' filepath='include/linux/perf_event.h' line='712' column='1'/>
+          <var-decl name='child_mutex' type-id='925167dc' visibility='default' filepath='include/linux/perf_event.h' line='715' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4992'>
-          <var-decl name='child_list' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='713' column='1'/>
+          <var-decl name='child_list' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='716' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5120'>
-          <var-decl name='parent' type-id='2bf16f59' visibility='default' filepath='include/linux/perf_event.h' line='714' column='1'/>
+          <var-decl name='parent' type-id='2bf16f59' visibility='default' filepath='include/linux/perf_event.h' line='717' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5184'>
-          <var-decl name='oncpu' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='716' column='1'/>
+          <var-decl name='oncpu' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='719' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5216'>
-          <var-decl name='cpu' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='717' column='1'/>
+          <var-decl name='cpu' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='720' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5248'>
-          <var-decl name='owner_entry' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='719' column='1'/>
+          <var-decl name='owner_entry' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='722' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5376'>
-          <var-decl name='owner' type-id='f23e2572' visibility='default' filepath='include/linux/perf_event.h' line='720' column='1'/>
+          <var-decl name='owner' type-id='f23e2572' visibility='default' filepath='include/linux/perf_event.h' line='723' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5440'>
-          <var-decl name='mmap_mutex' type-id='925167dc' visibility='default' filepath='include/linux/perf_event.h' line='723' column='1'/>
+          <var-decl name='mmap_mutex' type-id='925167dc' visibility='default' filepath='include/linux/perf_event.h' line='726' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5824'>
-          <var-decl name='mmap_count' type-id='49178f86' visibility='default' filepath='include/linux/perf_event.h' line='724' column='1'/>
+          <var-decl name='mmap_count' type-id='49178f86' visibility='default' filepath='include/linux/perf_event.h' line='727' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5888'>
-          <var-decl name='rb' type-id='35b814e1' visibility='default' filepath='include/linux/perf_event.h' line='726' column='1'/>
+          <var-decl name='rb' type-id='35b814e1' visibility='default' filepath='include/linux/perf_event.h' line='729' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5952'>
-          <var-decl name='rb_entry' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='727' column='1'/>
+          <var-decl name='rb_entry' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='730' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6080'>
-          <var-decl name='rcu_batches' type-id='7359adad' visibility='default' filepath='include/linux/perf_event.h' line='728' column='1'/>
+          <var-decl name='rcu_batches' type-id='7359adad' visibility='default' filepath='include/linux/perf_event.h' line='731' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6144'>
-          <var-decl name='rcu_pending' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='729' column='1'/>
+          <var-decl name='rcu_pending' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='732' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6208'>
-          <var-decl name='waitq' type-id='b5ab048f' visibility='default' filepath='include/linux/perf_event.h' line='732' column='1'/>
+          <var-decl name='waitq' type-id='b5ab048f' visibility='default' filepath='include/linux/perf_event.h' line='735' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6400'>
-          <var-decl name='fasync' type-id='5bb9c75d' visibility='default' filepath='include/linux/perf_event.h' line='733' column='1'/>
+          <var-decl name='fasync' type-id='5bb9c75d' visibility='default' filepath='include/linux/perf_event.h' line='736' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6464'>
-          <var-decl name='pending_wakeup' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='736' column='1'/>
+          <var-decl name='pending_wakeup' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='739' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6496'>
-          <var-decl name='pending_kill' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='737' column='1'/>
+          <var-decl name='pending_kill' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='740' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6528'>
-          <var-decl name='pending_disable' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='738' column='1'/>
+          <var-decl name='pending_disable' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='741' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6592'>
-          <var-decl name='pending' type-id='9281c70f' visibility='default' filepath='include/linux/perf_event.h' line='739' column='1'/>
+          <var-decl name='pending' type-id='9281c70f' visibility='default' filepath='include/linux/perf_event.h' line='742' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6784'>
-          <var-decl name='event_limit' type-id='49178f86' visibility='default' filepath='include/linux/perf_event.h' line='741' column='1'/>
+          <var-decl name='event_limit' type-id='49178f86' visibility='default' filepath='include/linux/perf_event.h' line='744' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6848'>
-          <var-decl name='addr_filters' type-id='54885433' visibility='default' filepath='include/linux/perf_event.h' line='744' column='1'/>
+          <var-decl name='addr_filters' type-id='54885433' visibility='default' filepath='include/linux/perf_event.h' line='747' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7040'>
-          <var-decl name='addr_filter_ranges' type-id='200ffa89' visibility='default' filepath='include/linux/perf_event.h' line='746' column='1'/>
+          <var-decl name='addr_filter_ranges' type-id='200ffa89' visibility='default' filepath='include/linux/perf_event.h' line='749' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7104'>
-          <var-decl name='addr_filters_gen' type-id='7359adad' visibility='default' filepath='include/linux/perf_event.h' line='747' column='1'/>
+          <var-decl name='addr_filters_gen' type-id='7359adad' visibility='default' filepath='include/linux/perf_event.h' line='750' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7168'>
-          <var-decl name='aux_event' type-id='2bf16f59' visibility='default' filepath='include/linux/perf_event.h' line='750' column='1'/>
+          <var-decl name='aux_event' type-id='2bf16f59' visibility='default' filepath='include/linux/perf_event.h' line='753' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7232'>
-          <var-decl name='destroy' type-id='aed2baa8' visibility='default' filepath='include/linux/perf_event.h' line='752' column='1'/>
+          <var-decl name='destroy' type-id='aed2baa8' visibility='default' filepath='include/linux/perf_event.h' line='755' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7296'>
-          <var-decl name='callback_head' type-id='e3d8ce29' visibility='default' filepath='include/linux/perf_event.h' line='753' column='1'/>
+          <var-decl name='callback_head' type-id='e3d8ce29' visibility='default' filepath='include/linux/perf_event.h' line='756' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7424'>
-          <var-decl name='ns' type-id='b816e1d0' visibility='default' filepath='include/linux/perf_event.h' line='755' column='1'/>
+          <var-decl name='ns' type-id='b816e1d0' visibility='default' filepath='include/linux/perf_event.h' line='758' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7488'>
-          <var-decl name='id' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='756' column='1'/>
+          <var-decl name='id' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='759' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7552'>
-          <var-decl name='clock' type-id='0e70db3e' visibility='default' filepath='include/linux/perf_event.h' line='758' column='1'/>
+          <var-decl name='clock' type-id='0e70db3e' visibility='default' filepath='include/linux/perf_event.h' line='761' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7616'>
-          <var-decl name='overflow_handler' type-id='20a2e4e6' visibility='default' filepath='include/linux/perf_event.h' line='759' column='1'/>
+          <var-decl name='overflow_handler' type-id='20a2e4e6' visibility='default' filepath='include/linux/perf_event.h' line='762' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7680'>
-          <var-decl name='overflow_handler_context' type-id='eaa32e2f' visibility='default' filepath='include/linux/perf_event.h' line='760' column='1'/>
+          <var-decl name='overflow_handler_context' type-id='eaa32e2f' visibility='default' filepath='include/linux/perf_event.h' line='763' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7744'>
-          <var-decl name='orig_overflow_handler' type-id='20a2e4e6' visibility='default' filepath='include/linux/perf_event.h' line='762' column='1'/>
+          <var-decl name='orig_overflow_handler' type-id='20a2e4e6' visibility='default' filepath='include/linux/perf_event.h' line='765' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7808'>
-          <var-decl name='prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/perf_event.h' line='763' column='1'/>
+          <var-decl name='prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/perf_event.h' line='766' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7872'>
-          <var-decl name='tp_event' type-id='23d6768c' visibility='default' filepath='include/linux/perf_event.h' line='767' column='1'/>
+          <var-decl name='tp_event' type-id='23d6768c' visibility='default' filepath='include/linux/perf_event.h' line='770' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7936'>
-          <var-decl name='filter' type-id='26461068' visibility='default' filepath='include/linux/perf_event.h' line='768' column='1'/>
+          <var-decl name='filter' type-id='26461068' visibility='default' filepath='include/linux/perf_event.h' line='771' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8000'>
-          <var-decl name='security' type-id='eaa32e2f' visibility='default' filepath='include/linux/perf_event.h' line='779' column='1'/>
+          <var-decl name='security' type-id='eaa32e2f' visibility='default' filepath='include/linux/perf_event.h' line='782' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8064'>
-          <var-decl name='sb_list' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='781' column='1'/>
+          <var-decl name='sb_list' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='784' column='1'/>
         </data-member>
       </class-decl>
       <typedef-decl name='work_func_t' type-id='939280af' filepath='include/linux/workqueue.h' line='22' column='1' id='72666d3f'/>
@@ -69239,27 +69242,27 @@
         <parameter type-id='acada613'/>
         <return type-id='f0981eeb'/>
       </function-type>
-      <class-decl name='perf_output_handle' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/perf_event.h' line='891' column='1' id='98bc2b95'>
+      <class-decl name='perf_output_handle' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/perf_event.h' line='894' column='1' id='98bc2b95'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='event' type-id='2bf16f59' visibility='default' filepath='include/linux/perf_event.h' line='892' column='1'/>
+          <var-decl name='event' type-id='2bf16f59' visibility='default' filepath='include/linux/perf_event.h' line='895' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='rb' type-id='35b814e1' visibility='default' filepath='include/linux/perf_event.h' line='893' column='1'/>
+          <var-decl name='rb' type-id='35b814e1' visibility='default' filepath='include/linux/perf_event.h' line='896' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='wakeup' type-id='7359adad' visibility='default' filepath='include/linux/perf_event.h' line='894' column='1'/>
+          <var-decl name='wakeup' type-id='7359adad' visibility='default' filepath='include/linux/perf_event.h' line='897' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='size' type-id='7359adad' visibility='default' filepath='include/linux/perf_event.h' line='895' column='1'/>
+          <var-decl name='size' type-id='7359adad' visibility='default' filepath='include/linux/perf_event.h' line='898' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='aux_flags' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='896' column='1'/>
+          <var-decl name='aux_flags' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='899' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='' type-id='4e335919' visibility='default' filepath='include/linux/perf_event.h' line='897' column='1'/>
+          <var-decl name='' type-id='4e335919' visibility='default' filepath='include/linux/perf_event.h' line='900' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='page' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='901' column='1'/>
+          <var-decl name='page' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='904' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='__anonymous_struct__' size-in-bits='256' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/restart_block.h' line='48' column='1' id='98bfe848'>
@@ -71362,84 +71365,84 @@
       </function-type>
       <pointer-type-def type-id='053f72e5' size-in-bits='64' id='9d632ac5'/>
       <pointer-type-def type-id='ca7f7878' size-in-bits='64' id='9d640202'/>
-      <class-decl name='perf_event_context' size-in-bits='2176' is-struct='yes' visibility='default' filepath='include/linux/perf_event.h' line='796' column='1' id='9d67acd5'>
+      <class-decl name='perf_event_context' size-in-bits='2176' is-struct='yes' visibility='default' filepath='include/linux/perf_event.h' line='799' column='1' id='9d67acd5'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='pmu' type-id='0906f5b9' visibility='default' filepath='include/linux/perf_event.h' line='797' column='1'/>
+          <var-decl name='pmu' type-id='0906f5b9' visibility='default' filepath='include/linux/perf_event.h' line='800' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='lock' type-id='f5c90b3f' visibility='default' filepath='include/linux/perf_event.h' line='802' column='1'/>
+          <var-decl name='lock' type-id='f5c90b3f' visibility='default' filepath='include/linux/perf_event.h' line='805' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='mutex' type-id='925167dc' visibility='default' filepath='include/linux/perf_event.h' line='808' column='1'/>
+          <var-decl name='mutex' type-id='925167dc' visibility='default' filepath='include/linux/perf_event.h' line='811' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='active_ctx_list' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='810' column='1'/>
+          <var-decl name='active_ctx_list' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='813' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='pinned_groups' type-id='3643bc2a' visibility='default' filepath='include/linux/perf_event.h' line='811' column='1'/>
+          <var-decl name='pinned_groups' type-id='3643bc2a' visibility='default' filepath='include/linux/perf_event.h' line='814' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='flexible_groups' type-id='3643bc2a' visibility='default' filepath='include/linux/perf_event.h' line='812' column='1'/>
+          <var-decl name='flexible_groups' type-id='3643bc2a' visibility='default' filepath='include/linux/perf_event.h' line='815' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='event_list' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='813' column='1'/>
+          <var-decl name='event_list' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='816' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='pinned_active' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='815' column='1'/>
+          <var-decl name='pinned_active' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='818' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='flexible_active' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='816' column='1'/>
+          <var-decl name='flexible_active' type-id='72f469ec' visibility='default' filepath='include/linux/perf_event.h' line='819' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='nr_events' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='818' column='1'/>
+          <var-decl name='nr_events' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='821' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1312'>
-          <var-decl name='nr_active' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='819' column='1'/>
+          <var-decl name='nr_active' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='822' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='is_active' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='820' column='1'/>
+          <var-decl name='is_active' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='823' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1376'>
-          <var-decl name='nr_stat' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='821' column='1'/>
+          <var-decl name='nr_stat' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='824' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='nr_freq' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='822' column='1'/>
+          <var-decl name='nr_freq' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='825' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1440'>
-          <var-decl name='rotate_disable' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='823' column='1'/>
+          <var-decl name='rotate_disable' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='826' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='rotate_necessary' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='828' column='1'/>
+          <var-decl name='rotate_necessary' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='831' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1504'>
-          <var-decl name='refcount' type-id='64615833' visibility='default' filepath='include/linux/perf_event.h' line='829' column='1'/>
+          <var-decl name='refcount' type-id='64615833' visibility='default' filepath='include/linux/perf_event.h' line='832' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='task' type-id='f23e2572' visibility='default' filepath='include/linux/perf_event.h' line='830' column='1'/>
+          <var-decl name='task' type-id='f23e2572' visibility='default' filepath='include/linux/perf_event.h' line='833' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='time' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='835' column='1'/>
+          <var-decl name='time' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='838' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='timestamp' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='836' column='1'/>
+          <var-decl name='timestamp' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='839' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1728'>
-          <var-decl name='parent_ctx' type-id='b9419dc5' visibility='default' filepath='include/linux/perf_event.h' line='842' column='1'/>
+          <var-decl name='parent_ctx' type-id='b9419dc5' visibility='default' filepath='include/linux/perf_event.h' line='845' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1792'>
-          <var-decl name='parent_gen' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='843' column='1'/>
+          <var-decl name='parent_gen' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='846' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1856'>
-          <var-decl name='generation' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='844' column='1'/>
+          <var-decl name='generation' type-id='91ce1af9' visibility='default' filepath='include/linux/perf_event.h' line='847' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1920'>
-          <var-decl name='pin_count' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='845' column='1'/>
+          <var-decl name='pin_count' type-id='95e97e5e' visibility='default' filepath='include/linux/perf_event.h' line='848' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1984'>
-          <var-decl name='task_ctx_data' type-id='eaa32e2f' visibility='default' filepath='include/linux/perf_event.h' line='849' column='1'/>
+          <var-decl name='task_ctx_data' type-id='eaa32e2f' visibility='default' filepath='include/linux/perf_event.h' line='852' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2048'>
-          <var-decl name='callback_head' type-id='e3d8ce29' visibility='default' filepath='include/linux/perf_event.h' line='850' column='1'/>
+          <var-decl name='callback_head' type-id='e3d8ce29' visibility='default' filepath='include/linux/perf_event.h' line='853' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='usb_cdc_mdlm_desc' size-in-bits='168' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='157' column='1' id='9d7259bb'>
@@ -139655,50 +139658,50 @@
         <parameter type-id='91ce1af9' name='flags' filepath='kernel/events/ring_buffer.c' line='334' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_addr_filters_sync' mangled-name='perf_event_addr_filters_sync' filepath='kernel/events/core.c' line='3129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_addr_filters_sync'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3129' column='1'/>
+      <function-decl name='perf_event_addr_filters_sync' mangled-name='perf_event_addr_filters_sync' filepath='kernel/events/core.c' line='3131' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_addr_filters_sync'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3131' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_create_kernel_counter' mangled-name='perf_event_create_kernel_counter' filepath='kernel/events/core.c' line='12192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_create_kernel_counter'>
-        <parameter type-id='20862e61' name='attr' filepath='kernel/events/core.c' line='12192' column='1'/>
-        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/events/core.c' line='12192' column='1'/>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='12193' column='1'/>
-        <parameter type-id='20a2e4e6' name='overflow_handler' filepath='kernel/events/core.c' line='12194' column='1'/>
-        <parameter type-id='eaa32e2f' name='context' filepath='kernel/events/core.c' line='12195' column='1'/>
+      <function-decl name='perf_event_create_kernel_counter' mangled-name='perf_event_create_kernel_counter' filepath='kernel/events/core.c' line='12218' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_create_kernel_counter'>
+        <parameter type-id='20862e61' name='attr' filepath='kernel/events/core.c' line='12218' column='1'/>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/events/core.c' line='12218' column='1'/>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='12219' column='1'/>
+        <parameter type-id='20a2e4e6' name='overflow_handler' filepath='kernel/events/core.c' line='12220' column='1'/>
+        <parameter type-id='eaa32e2f' name='context' filepath='kernel/events/core.c' line='12221' column='1'/>
         <return type-id='2bf16f59'/>
       </function-decl>
-      <function-decl name='perf_event_disable' mangled-name='perf_event_disable' filepath='kernel/events/core.c' line='2458' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_disable'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='2458' column='1'/>
+      <function-decl name='perf_event_disable' mangled-name='perf_event_disable' filepath='kernel/events/core.c' line='2460' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_disable'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='2460' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_enable' mangled-name='perf_event_enable' filepath='kernel/events/core.c' line='3029' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_enable'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3029' column='1'/>
+      <function-decl name='perf_event_enable' mangled-name='perf_event_enable' filepath='kernel/events/core.c' line='3031' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_enable'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3031' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_pause' mangled-name='perf_event_pause' filepath='kernel/events/core.c' line='5368' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_pause'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5368' column='1'/>
-        <parameter type-id='b50a4934' name='reset' filepath='kernel/events/core.c' line='5368' column='1'/>
+      <function-decl name='perf_event_pause' mangled-name='perf_event_pause' filepath='kernel/events/core.c' line='5394' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_pause'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5394' column='1'/>
+        <parameter type-id='b50a4934' name='reset' filepath='kernel/events/core.c' line='5394' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='perf_event_read_local' mangled-name='perf_event_read_local' filepath='kernel/events/core.c' line='4341' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_local'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='4341' column='1'/>
-        <parameter type-id='3df9fd28' name='value' filepath='kernel/events/core.c' line='4341' column='1'/>
-        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='4342' column='1'/>
-        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='4342' column='1'/>
+      <function-decl name='perf_event_read_local' mangled-name='perf_event_read_local' filepath='kernel/events/core.c' line='4343' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_local'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='4343' column='1'/>
+        <parameter type-id='3df9fd28' name='value' filepath='kernel/events/core.c' line='4343' column='1'/>
+        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='4344' column='1'/>
+        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='4344' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_event_read_value' mangled-name='perf_event_read_value' filepath='kernel/events/core.c' line='5150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_value'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5150' column='1'/>
-        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='5150' column='1'/>
-        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='5150' column='1'/>
+      <function-decl name='perf_event_read_value' mangled-name='perf_event_read_value' filepath='kernel/events/core.c' line='5152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_value'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5152' column='1'/>
+        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='5152' column='1'/>
+        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='5152' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='perf_event_release_kernel' mangled-name='perf_event_release_kernel' filepath='kernel/events/core.c' line='5000' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_release_kernel'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5000' column='1'/>
+      <function-decl name='perf_event_release_kernel' mangled-name='perf_event_release_kernel' filepath='kernel/events/core.c' line='5002' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_release_kernel'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5002' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_event_update_userpage' mangled-name='perf_event_update_userpage' filepath='kernel/events/core.c' line='5747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_update_userpage'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5747' column='1'/>
+      <function-decl name='perf_event_update_userpage' mangled-name='perf_event_update_userpage' filepath='kernel/events/core.c' line='5773' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_update_userpage'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5773' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='perf_get_aux' mangled-name='perf_get_aux' filepath='kernel/events/ring_buffer.c' line='557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_get_aux'>
@@ -139708,20 +139711,20 @@
       <function-decl name='perf_num_counters' mangled-name='perf_num_counters' filepath='drivers/perf/arm_pmu.c' line='598' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_num_counters'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_pmu_migrate_context' mangled-name='perf_pmu_migrate_context' filepath='kernel/events/core.c' line='12271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_migrate_context'>
-        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='12271' column='1'/>
-        <parameter type-id='95e97e5e' name='src_cpu' filepath='kernel/events/core.c' line='12271' column='1'/>
-        <parameter type-id='95e97e5e' name='dst_cpu' filepath='kernel/events/core.c' line='12271' column='1'/>
+      <function-decl name='perf_pmu_migrate_context' mangled-name='perf_pmu_migrate_context' filepath='kernel/events/core.c' line='12297' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_migrate_context'>
+        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='12297' column='1'/>
+        <parameter type-id='95e97e5e' name='src_cpu' filepath='kernel/events/core.c' line='12297' column='1'/>
+        <parameter type-id='95e97e5e' name='dst_cpu' filepath='kernel/events/core.c' line='12297' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_pmu_register' mangled-name='perf_pmu_register' filepath='kernel/events/core.c' line='10812' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_register'>
-        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10812' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='kernel/events/core.c' line='10812' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='kernel/events/core.c' line='10812' column='1'/>
+      <function-decl name='perf_pmu_register' mangled-name='perf_pmu_register' filepath='kernel/events/core.c' line='10838' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_register'>
+        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10838' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='kernel/events/core.c' line='10838' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='kernel/events/core.c' line='10838' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_pmu_unregister' mangled-name='perf_pmu_unregister' filepath='kernel/events/core.c' line='10948' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_unregister'>
-        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10948' column='1'/>
+      <function-decl name='perf_pmu_unregister' mangled-name='perf_pmu_unregister' filepath='kernel/events/core.c' line='10974' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_unregister'>
+        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10974' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='perf_trace_buf_alloc' mangled-name='perf_trace_buf_alloc' filepath='kernel/trace/trace_event_perf.c' line='395' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_buf_alloc'>
@@ -139730,15 +139733,15 @@
         <parameter type-id='7292109c' name='rctxp' filepath='kernel/trace/trace_event_perf.c' line='395' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='perf_trace_run_bpf_submit' mangled-name='perf_trace_run_bpf_submit' filepath='kernel/events/core.c' line='9443' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_run_bpf_submit'>
-        <parameter type-id='eaa32e2f' name='raw_data' filepath='kernel/events/core.c' line='9443' column='1'/>
-        <parameter type-id='95e97e5e' name='size' filepath='kernel/events/core.c' line='9443' column='1'/>
-        <parameter type-id='95e97e5e' name='rctx' filepath='kernel/events/core.c' line='9443' column='1'/>
-        <parameter type-id='23d6768c' name='call' filepath='kernel/events/core.c' line='9444' column='1'/>
-        <parameter type-id='91ce1af9' name='count' filepath='kernel/events/core.c' line='9444' column='1'/>
-        <parameter type-id='4616a179' name='regs' filepath='kernel/events/core.c' line='9445' column='1'/>
-        <parameter type-id='030d0b18' name='head' filepath='kernel/events/core.c' line='9445' column='1'/>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='9446' column='1'/>
+      <function-decl name='perf_trace_run_bpf_submit' mangled-name='perf_trace_run_bpf_submit' filepath='kernel/events/core.c' line='9469' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_run_bpf_submit'>
+        <parameter type-id='eaa32e2f' name='raw_data' filepath='kernel/events/core.c' line='9469' column='1'/>
+        <parameter type-id='95e97e5e' name='size' filepath='kernel/events/core.c' line='9469' column='1'/>
+        <parameter type-id='95e97e5e' name='rctx' filepath='kernel/events/core.c' line='9469' column='1'/>
+        <parameter type-id='23d6768c' name='call' filepath='kernel/events/core.c' line='9470' column='1'/>
+        <parameter type-id='91ce1af9' name='count' filepath='kernel/events/core.c' line='9470' column='1'/>
+        <parameter type-id='4616a179' name='regs' filepath='kernel/events/core.c' line='9471' column='1'/>
+        <parameter type-id='030d0b18' name='head' filepath='kernel/events/core.c' line='9471' column='1'/>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='9472' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pfn_valid' mangled-name='pfn_valid' filepath='arch/arm64/mm/init.c' line='263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pfn_valid'>
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 346d24a1469a..5cac2f291568 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -659,6 +659,9 @@ struct perf_event {
 	/* The cumulative AND of all event_caps for events in this group. */
 	int				group_caps;
 
+#ifndef __GENKSYMS__
+	unsigned int			group_generation;
+#endif
 	struct perf_event		*group_leader;
 	struct pmu			*pmu;
 	void				*pmu_private;
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 80ab33aa3a18..beb1685ffa36 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1986,6 +1986,7 @@ static void perf_group_attach(struct perf_event *event)
 
 	list_add_tail(&event->sibling_list, &group_leader->sibling_list);
 	group_leader->nr_siblings++;
+	group_leader->group_generation++;
 
 	perf_event__header_size(group_leader);
 
@@ -2178,6 +2179,7 @@ static void perf_group_detach(struct perf_event *event)
 	if (leader != event) {
 		list_del_init(&event->sibling_list);
 		event->group_leader->nr_siblings--;
+		event->group_leader->group_generation++;
 		goto out;
 	}
 
@@ -5164,7 +5166,7 @@ static int __perf_read_group_add(struct perf_event *leader,
 					u64 read_format, u64 *values)
 {
 	struct perf_event_context *ctx = leader->ctx;
-	struct perf_event *sub;
+	struct perf_event *sub, *parent;
 	unsigned long flags;
 	int n = 1; /* skip @nr */
 	int ret;
@@ -5174,6 +5176,33 @@ static int __perf_read_group_add(struct perf_event *leader,
 		return ret;
 
 	raw_spin_lock_irqsave(&ctx->lock, flags);
+	/*
+	 * Verify the grouping between the parent and child (inherited)
+	 * events is still in tact.
+	 *
+	 * Specifically:
+	 *  - leader->ctx->lock pins leader->sibling_list
+	 *  - parent->child_mutex pins parent->child_list
+	 *  - parent->ctx->mutex pins parent->sibling_list
+	 *
+	 * Because parent->ctx != leader->ctx (and child_list nests inside
+	 * ctx->mutex), group destruction is not atomic between children, also
+	 * see perf_event_release_kernel(). Additionally, parent can grow the
+	 * group.
+	 *
+	 * Therefore it is possible to have parent and child groups in a
+	 * different configuration and summing over such a beast makes no sense
+	 * what so ever.
+	 *
+	 * Reject this.
+	 */
+	parent = leader->parent;
+	if (parent &&
+	    (parent->group_generation != leader->group_generation ||
+	     parent->nr_siblings != leader->nr_siblings)) {
+		ret = -ECHILD;
+		goto unlock;
+	}
 
 	/*
 	 * Since we co-schedule groups, {enabled,running} times of siblings
@@ -5203,8 +5232,9 @@ static int __perf_read_group_add(struct perf_event *leader,
 			values[n++] = primary_event_id(sub);
 	}
 
+unlock:
 	raw_spin_unlock_irqrestore(&ctx->lock, flags);
-	return 0;
+	return ret;
 }
 
 static int perf_read_group(struct perf_event *event,
@@ -5223,10 +5253,6 @@ static int perf_read_group(struct perf_event *event,
 
 	values[0] = 1 + leader->nr_siblings;
 
-	/*
-	 * By locking the child_mutex of the leader we effectively
-	 * lock the child list of all siblings.. XXX explain how.
-	 */
 	mutex_lock(&leader->child_mutex);
 
 	ret = __perf_read_group_add(leader, read_format, values);
@@ -12775,6 +12801,7 @@ static int inherit_group(struct perf_event *parent_event,
 		    !perf_get_aux_event(child_ctr, leader))
 			return -EINVAL;
 	}
+	leader->group_generation = parent_event->group_generation;
 	return 0;
 }
 

From df6358ff3c5c0a7b11ce3f8a71f8fe5e56e64b89 Mon Sep 17 00:00:00 2001
From: Sanjeev Yadav <sanjeev.y@mediatek.com>
Date: Wed, 24 Jan 2024 23:32:32 +0530
Subject: [PATCH 1001/1043] ANDROID: GKI: Update symbol list for mtk

It's require to integrate vendor specific err handling mechanism where below symbols will be used.

  [A] 'function void ufshcd_complete_requests(ufs_hba*)'
  [A] 'function void ufshcd_err_handling_prepare(ufs_hba*)'
  [A] 'function void ufshcd_err_handling_unprepare(ufs_hba*)'

Above mentioned 3 symbols will be used in UFS vendor hooks implementation exported with previous submitted topic - "ufs_perf_heuristic" (URL mentioned in Link:)

Bug: 322142524
Bug: 323289797
Link: https://android-review.googlesource.com/q/topic:%22ufs_perf_heuristic%22
Change-Id: I05a8db36c6c8f7d1cb37c122420fb3d3110dc2a5
Signed-off-by: Sanjeev Yadav <sanjeev.y@mediatek.com>
(cherry picked from commit 75c057fe65b2fa75a936ef4ef201a26a9b506b54)
---
 android/abi_gki_aarch64.xml | 23 +++++++++++++++++++----
 android/abi_gki_aarch64_mtk |  3 +++
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 4aaf6c631d6e..226ceb691807 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -5739,12 +5739,15 @@
       <elf-symbol name='ufshcd_alloc_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x57f9b97'/>
       <elf-symbol name='ufshcd_auto_hibern8_update' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc16cbeff'/>
       <elf-symbol name='ufshcd_bkops_ctrl' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9da76035'/>
+      <elf-symbol name='ufshcd_complete_requests' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdac8b246'/>
       <elf-symbol name='ufshcd_config_pwr_mode' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb40401db'/>
       <elf-symbol name='ufshcd_dealloc_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x26267833'/>
       <elf-symbol name='ufshcd_delay_us' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x723b1abf'/>
       <elf-symbol name='ufshcd_dme_get_attr' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1108b959'/>
       <elf-symbol name='ufshcd_dme_set_attr' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc1ba1599'/>
       <elf-symbol name='ufshcd_dump_regs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6605adad'/>
+      <elf-symbol name='ufshcd_err_handling_prepare' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8a859165'/>
+      <elf-symbol name='ufshcd_err_handling_unprepare' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe41cd645'/>
       <elf-symbol name='ufshcd_fixup_dev_quirks' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc4e74b30'/>
       <elf-symbol name='ufshcd_get_local_unipro_ver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa59b3f84'/>
       <elf-symbol name='ufshcd_get_pwr_dev_param' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xff85cd6b'/>
@@ -141599,8 +141602,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='net/core/netevent.c' line='28' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_oom_notifier' mangled-name='register_oom_notifier' filepath='mm/oom_kill.c' line='1075' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_oom_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1075' column='1'/>
+      <function-decl name='register_oom_notifier' mangled-name='register_oom_notifier' filepath='mm/oom_kill.c' line='1080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_oom_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1080' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='register_pernet_device' mangled-name='register_pernet_device' filepath='net/core/net_namespace.c' line='1316' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_pernet_device'>
@@ -147666,6 +147669,10 @@
         <parameter type-id='462d2624' name='status' filepath='drivers/scsi/ufs/ufshcd.c' line='5496' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='ufshcd_complete_requests' mangled-name='ufshcd_complete_requests' filepath='drivers/scsi/ufs/ufshcd.c' line='5806' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_complete_requests'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='5806' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='ufshcd_config_pwr_mode' mangled-name='ufshcd_config_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4366' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_config_pwr_mode'>
         <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4366' column='1'/>
         <parameter type-id='35f4156d' name='desired_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4367' column='1'/>
@@ -147702,6 +147709,14 @@
         <parameter type-id='80f4b756' name='prefix' filepath='drivers/scsi/ufs/ufshcd.c' line='104' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='ufshcd_err_handling_prepare' mangled-name='ufshcd_err_handling_prepare' filepath='drivers/scsi/ufs/ufshcd.c' line='5926' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_err_handling_prepare'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='5926' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='ufshcd_err_handling_unprepare' mangled-name='ufshcd_err_handling_unprepare' filepath='drivers/scsi/ufs/ufshcd.c' line='5963' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_err_handling_unprepare'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='5963' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='ufshcd_fixup_dev_quirks' mangled-name='ufshcd_fixup_dev_quirks' filepath='drivers/scsi/ufs/ufshcd.c' line='7472' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_fixup_dev_quirks'>
         <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='7472' column='1'/>
         <parameter type-id='c5251c27' name='fixups' filepath='drivers/scsi/ufs/ufshcd.c' line='7472' column='1'/>
@@ -147975,8 +147990,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='net/core/netevent.c' line='44' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='unregister_oom_notifier' mangled-name='unregister_oom_notifier' filepath='mm/oom_kill.c' line='1081' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_oom_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1081' column='1'/>
+      <function-decl name='unregister_oom_notifier' mangled-name='unregister_oom_notifier' filepath='mm/oom_kill.c' line='1086' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_oom_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1086' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='unregister_pernet_device' mangled-name='unregister_pernet_device' filepath='net/core/net_namespace.c' line='1337' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_pernet_device'>
diff --git a/android/abi_gki_aarch64_mtk b/android/abi_gki_aarch64_mtk
index 21fb3b2771a6..4accdf1c433f 100644
--- a/android/abi_gki_aarch64_mtk
+++ b/android/abi_gki_aarch64_mtk
@@ -2381,10 +2381,13 @@
   uart_update_timeout
   uclamp_eff_value
   __udelay
+  ufshcd_complete_requests
   ufshcd_delay_us
   ufshcd_dme_get_attr
   ufshcd_dme_set_attr
   ufshcd_dump_regs
+  ufshcd_err_handling_prepare
+  ufshcd_err_handling_unprepare
   ufshcd_fixup_dev_quirks
   ufshcd_get_pwr_dev_param
   ufshcd_hba_enable

From 102b3d7a649da573055f569fe81aaa68fb0fddbc Mon Sep 17 00:00:00 2001
From: Hyunwoo Kim <v4bel@theori.io>
Date: Sat, 9 Dec 2023 05:05:38 -0500
Subject: [PATCH 1002/1043] UPSTREAM: net/rose: Fix Use-After-Free in
 rose_ioctl

[ Upstream commit 810c38a369a0a0ce625b5c12169abce1dd9ccd53 ]

Because rose_ioctl() accesses sk->sk_receive_queue
without holding a sk->sk_receive_queue.lock, it can
cause a race with rose_accept().
A use-after-free for skb occurs with the following flow.
```
rose_ioctl() -> skb_peek()
rose_accept() -> skb_dequeue() -> kfree_skb()
```
Add sk->sk_receive_queue.lock to rose_ioctl() to fix this issue.

Bug: 321175740
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Link: https://lore.kernel.org/r/20231209100538.GA407321@v4bel-B760M-AORUS-ELITE-AX
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 3f1f6a94d8858706863fe90da35663f6e24be274)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I94d2aae6221fb95cb285e1a6d0c6fe39a70e35d2

From fd764687e8488c3ac06eb0a315c4557345b8de21 Mon Sep 17 00:00:00 2001
From: Phil Sutter <phil@nwl.cc>
Date: Wed, 16 Feb 2022 15:55:38 +0100
Subject: [PATCH 1003/1043] UPSTREAM: netfilter: nf_tables: Reject tables of
 unsupported family

commit f1082dd31fe461d482d69da2a8eccfeb7bf07ac2 upstream.

An nftables family is merely a hollow container, its family just a
number and such not reliant on compile-time options other than nftables
support itself. Add an artificial check so attempts at using a family
the kernel can't support fail as early as possible. This helps user
space detect kernels which lack e.g. NFPROTO_INET.

Bug: 321815738
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 25d1e7be85cf0a5afca5555f90e4609c40480ece)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I45b5c6f046e9156edf4c60bf5611367fe25f8ec9
---
 net/netfilter/nf_tables_api.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index f244a4323a43..d7c9475639f2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1186,6 +1186,30 @@ static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
 	return strcmp(obj->key.name, k->name);
 }
 
+static bool nft_supported_family(u8 family)
+{
+	return false
+#ifdef CONFIG_NF_TABLES_INET
+		|| family == NFPROTO_INET
+#endif
+#ifdef CONFIG_NF_TABLES_IPV4
+		|| family == NFPROTO_IPV4
+#endif
+#ifdef CONFIG_NF_TABLES_ARP
+		|| family == NFPROTO_ARP
+#endif
+#ifdef CONFIG_NF_TABLES_NETDEV
+		|| family == NFPROTO_NETDEV
+#endif
+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
+		|| family == NFPROTO_BRIDGE
+#endif
+#ifdef CONFIG_NF_TABLES_IPV6
+		|| family == NFPROTO_IPV6
+#endif
+		;
+}
+
 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 			      struct sk_buff *skb, const struct nlmsghdr *nlh,
 			      const struct nlattr * const nla[],
@@ -1201,6 +1225,9 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 	u32 flags = 0;
 	int err;
 
+	if (!nft_supported_family(family))
+		return -EOPNOTSUPP;
+
 	lockdep_assert_held(&nft_net->commit_mutex);
 	attr = nla[NFTA_TABLE_NAME];
 	table = nft_table_lookup(net, attr, family, genmask);

From 067856b87f308121cc28942f821e3ca8f4157e02 Mon Sep 17 00:00:00 2001
From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Date: Thu, 21 Dec 2023 16:53:57 +0000
Subject: [PATCH 1004/1043] UPSTREAM: ida: Fix crash in ida_free when the
 bitmap is empty

[ Upstream commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a ]

The IDA usually detects double-frees, but that detection failed to
consider the case when there are no nearby IDs allocated and so we have a
NULL bitmap rather than simply having a clear bit.  Add some tests to the
test-suite to be sure we don't inadvertently reintroduce this problem.
Unfortunately they're quite noisy so include a message to disregard
the warnings.

Bug: 321878978
Reported-by: Zhenghan Wang <wzhmmmmm@gmail.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 5dbcdaf4dbfe074e9142991c5c28eef789c1f6c6)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I4919e5c64af12f86fe1a91e1e9224a58eedbf345
---
 lib/idr.c      |  2 +-
 lib/test_ida.c | 40 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/lib/idr.c b/lib/idr.c
index 13f2758c2377..da36054c3ca0 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -508,7 +508,7 @@ void ida_free(struct ida *ida, unsigned int id)
 			goto delete;
 		xas_store(&xas, xa_mk_value(v));
 	} else {
-		if (!test_bit(bit, bitmap->bitmap))
+		if (!bitmap || !test_bit(bit, bitmap->bitmap))
 			goto err;
 		__clear_bit(bit, bitmap->bitmap);
 		xas_set_mark(&xas, XA_FREE_MARK);
diff --git a/lib/test_ida.c b/lib/test_ida.c
index b06880625961..55105baa19da 100644
--- a/lib/test_ida.c
+++ b/lib/test_ida.c
@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida)
 	IDA_BUG_ON(ida, !ida_is_empty(ida));
 }
 
+/*
+ * Check various situations where we attempt to free an ID we don't own.
+ */
+static void ida_check_bad_free(struct ida *ida)
+{
+	unsigned long i;
+
+	printk("vvv Ignore \"not allocated\" warnings\n");
+	/* IDA is empty; all of these will fail */
+	ida_free(ida, 0);
+	for (i = 0; i < 31; i++)
+		ida_free(ida, 1 << i);
+
+	/* IDA contains a single value entry */
+	IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3);
+	ida_free(ida, 0);
+	for (i = 0; i < 31; i++)
+		ida_free(ida, 1 << i);
+
+	/* IDA contains a single bitmap */
+	IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023);
+	ida_free(ida, 0);
+	for (i = 0; i < 31; i++)
+		ida_free(ida, 1 << i);
+
+	/* IDA contains a tree */
+	IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1);
+	ida_free(ida, 0);
+	for (i = 0; i < 31; i++)
+		ida_free(ida, 1 << i);
+	printk("^^^ \"not allocated\" warnings over\n");
+
+	ida_free(ida, 3);
+	ida_free(ida, 1023);
+	ida_free(ida, (1 << 20) - 1);
+
+	IDA_BUG_ON(ida, !ida_is_empty(ida));
+}
+
 static DEFINE_IDA(ida);
 
 static int ida_checks(void)
@@ -162,6 +201,7 @@ static int ida_checks(void)
 	ida_check_leaf(&ida, 1024 * 64);
 	ida_check_max(&ida);
 	ida_check_conv(&ida);
+	ida_check_bad_free(&ida);
 
 	printk("IDA: %u of %u tests passed\n", tests_passed, tests_run);
 	return (tests_run != tests_passed) ? 0 : -EINVAL;

From 5fe6b5a1940ad2ce2a68eade1ad58b0876603d20 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Thu, 1 Feb 2024 20:18:10 +0000
Subject: [PATCH 1005/1043] Reapply "perf: Fix perf_event_validate_size()"

This reverts commit 86a3866fec5b69f2ee48a194291566c55942212c which is
commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b upstream.

Bug: 316932704
Change-Id: I69bfbf5180f57592ce285ea14f6f7b7c1b2b0f8f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 kernel/events/core.c | 59 +++++++++++++++++++++++++++-----------------
 1 file changed, 37 insertions(+), 22 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index beb1685ffa36..3fdecb5e9969 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1845,28 +1845,31 @@ static inline void perf_event__state_init(struct perf_event *event)
 					      PERF_EVENT_STATE_INACTIVE;
 }
 
-static void __perf_event_read_size(struct perf_event *event, int nr_siblings)
+static int __perf_event_read_size(u64 read_format, int nr_siblings)
 {
 	int entry = sizeof(u64); /* value */
 	int size = 0;
 	int nr = 1;
 
-	if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
+	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
 		size += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
+	if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
 		size += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_ID)
+	if (read_format & PERF_FORMAT_ID)
 		entry += sizeof(u64);
 
-	if (event->attr.read_format & PERF_FORMAT_GROUP) {
+	if (read_format & PERF_FORMAT_GROUP) {
 		nr += nr_siblings;
 		size += sizeof(u64);
 	}
 
-	size += entry * nr;
-	event->read_size = size;
+	/*
+	 * Since perf_event_validate_size() limits this to 16k and inhibits
+	 * adding more siblings, this will never overflow.
+	 */
+	return size + nr * entry;
 }
 
 static void __perf_event_header_size(struct perf_event *event, u64 sample_type)
@@ -1910,8 +1913,9 @@ static void __perf_event_header_size(struct perf_event *event, u64 sample_type)
  */
 static void perf_event__header_size(struct perf_event *event)
 {
-	__perf_event_read_size(event,
-			       event->group_leader->nr_siblings);
+	event->read_size =
+		__perf_event_read_size(event->attr.read_format,
+				       event->group_leader->nr_siblings);
 	__perf_event_header_size(event, event->attr.sample_type);
 }
 
@@ -1942,24 +1946,35 @@ static void perf_event__id_header_size(struct perf_event *event)
 	event->id_header_size = size;
 }
 
+/*
+ * Check that adding an event to the group does not result in anybody
+ * overflowing the 64k event limit imposed by the output buffer.
+ *
+ * Specifically, check that the read_size for the event does not exceed 16k,
+ * read_size being the one term that grows with groups size. Since read_size
+ * depends on per-event read_format, also (re)check the existing events.
+ *
+ * This leaves 48k for the constant size fields and things like callchains,
+ * branch stacks and register sets.
+ */
 static bool perf_event_validate_size(struct perf_event *event)
 {
-	/*
-	 * The values computed here will be over-written when we actually
-	 * attach the event.
-	 */
-	__perf_event_read_size(event, event->group_leader->nr_siblings + 1);
-	__perf_event_header_size(event, event->attr.sample_type & ~PERF_SAMPLE_READ);
-	perf_event__id_header_size(event);
+	struct perf_event *sibling, *group_leader = event->group_leader;
 
-	/*
-	 * Sum the lot; should not exceed the 64k limit we have on records.
-	 * Conservative limit to allow for callchains and other variable fields.
-	 */
-	if (event->read_size + event->header_size +
-	    event->id_header_size + sizeof(struct perf_event_header) >= 16*1024)
+	if (__perf_event_read_size(event->attr.read_format,
+				   group_leader->nr_siblings + 1) > 16*1024)
 		return false;
 
+	if (__perf_event_read_size(group_leader->attr.read_format,
+				   group_leader->nr_siblings + 1) > 16*1024)
+		return false;
+
+	for_each_sibling_event(sibling, group_leader) {
+		if (__perf_event_read_size(sibling->attr.read_format,
+					   group_leader->nr_siblings + 1) > 16*1024)
+			return false;
+	}
+
 	return true;
 }
 

From 46469e117ff8cf5bd4e3ad7bb31b7936bcf804ab Mon Sep 17 00:00:00 2001
From: liwei <liwei1234@oppo.com>
Date: Fri, 15 Sep 2023 20:03:10 +0800
Subject: [PATCH 1006/1043] ANDROID: vendor_hooks: Add hooks for adjusting
 alloc_flags

In some situations, we want to adjust the alloc_flags for better performance.

more detail explain:
the reason why we add a vendor hook adjusting alloc_flags:
1 the user only pass parameter size and gfp_flags once. if we mask the
__GFP_RECLAIM, we can't distinguish high-order and low-order, they all
will not rise reclaim behavior, it's wrong.

2 for __iommu_dma_alloc_pages, there is a loop to try to alloc pages from
high-order to low-order fallback, and we add hook callsite to only change
the high-order( > costly order) alloc behavior(which high probability will
result more overhead than benifit).
which allow low order alloc to do reclaim behavior still, otherwise may
end up with alloc fail.

3 in android ION(drivers/dma-buf/heaps/system_heap.c )
there is same logic, high-order alloc will not do reclaim behavior.

so this change add a vendor hook for adjusting alloc_flags, and add a
callsite in __iommu_dma_alloc_pages to turn the reclaim behavior.

Bug: 300857012
Change-Id: I30bd634d8ede1cc29c83d52bdd9276c8cf72ac1e
Signed-off-by: lvwenhuan <lvwenhuan@oppo.com>
Signed-off-by: liwei <liwei1234@oppo.com>
(cherry picked from commit d6c24c3a63567676de818011403abe5b9b3d38b0)
---
 drivers/android/vendor_hooks.c | 1 +
 drivers/iommu/dma-iommu.c      | 1 +
 include/trace/hooks/iommu.h    | 3 +++
 3 files changed, 5 insertions(+)

diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 21496961475e..2335b17e59b1 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -290,6 +290,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_memory_rw);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_module_permit_before_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_set_module_permit_after_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_util_est_update);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_adjust_alloc_flags);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_meminfo_proc_show);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_exit_mm);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_get_from_fragment_pool);
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 6f0ba38aaeea..9baab01c001f 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -623,6 +623,7 @@ static struct page **__iommu_dma_alloc_pages(struct device *dev,
 			order_size = 1U << order;
 			if (order_mask > order_size)
 				alloc_flags |= __GFP_NORETRY;
+			trace_android_vh_adjust_alloc_flags(order, &alloc_flags);
 			page = alloc_pages_node(nid, alloc_flags, order);
 			if (!page)
 				continue;
diff --git a/include/trace/hooks/iommu.h b/include/trace/hooks/iommu.h
index 28bd0a3929ed..eba27e3f71fe 100644
--- a/include/trace/hooks/iommu.h
+++ b/include/trace/hooks/iommu.h
@@ -43,6 +43,9 @@ DECLARE_HOOK(android_vh_iommu_iovad_free_iova,
 	TP_PROTO(struct iova_domain *iovad, dma_addr_t iova, size_t size),
 	TP_ARGS(iovad, iova, size));
 
+DECLARE_HOOK(android_vh_adjust_alloc_flags,
+	TP_PROTO(unsigned int order, gfp_t *alloc_flags),
+	TP_ARGS(order, alloc_flags));
 
 #endif /* _TRACE_HOOK_IOMMU_H */
 

From 8cbe4885a90f505bc313597f74bb455ac2986475 Mon Sep 17 00:00:00 2001
From: liwei <liwei1234@oppo.com>
Date: Tue, 30 Jan 2024 10:11:20 +0800
Subject: [PATCH 1007/1043] ANDROID: GKI: Update oplus symbol list

1 function symbol(s) added
  'int __traceiter_android_vh_adjust_alloc_flags(void *, unsigned int, gfp_t *)'

1 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_adjust_alloc_flags'

Bug: 300857012
Change-Id: I94036f439e38492063ff68446ab909cfa5a464b6
Signed-off-by: liwei <liwei1234@oppo.com>
---
 android/abi_gki_aarch64.xml   | 13 +++++++++++--
 android/abi_gki_aarch64_oplus |  2 ++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 5296e056669e..198c5d5578ac 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -422,6 +422,7 @@
       <elf-symbol name='__traceiter_android_vh_account_task_time' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5f7a1ebe'/>
       <elf-symbol name='__traceiter_android_vh_add_page_to_lrulist' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1fd92753'/>
       <elf-symbol name='__traceiter_android_vh_add_to_avail_list' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbd5bd58b'/>
+      <elf-symbol name='__traceiter_android_vh_adjust_alloc_flags' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x63961554'/>
       <elf-symbol name='__traceiter_android_vh_aes_decrypt' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb0d1574b'/>
       <elf-symbol name='__traceiter_android_vh_aes_encrypt' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6160ff0c'/>
       <elf-symbol name='__traceiter_android_vh_aes_expandkey' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdc004b58'/>
@@ -6527,6 +6528,7 @@
       <elf-symbol name='__tracepoint_android_vh_account_task_time' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf1afbf0d'/>
       <elf-symbol name='__tracepoint_android_vh_add_page_to_lrulist' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb9d54bc5'/>
       <elf-symbol name='__tracepoint_android_vh_add_to_avail_list' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8a9d0f84'/>
+      <elf-symbol name='__tracepoint_android_vh_adjust_alloc_flags' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1c10784a'/>
       <elf-symbol name='__tracepoint_android_vh_aes_decrypt' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xde5b1cc7'/>
       <elf-symbol name='__tracepoint_android_vh_aes_encrypt' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x10f648a3'/>
       <elf-symbol name='__tracepoint_android_vh_aes_expandkey' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf7274615'/>
@@ -116560,9 +116562,9 @@
       </function-type>
       <pointer-type-def type-id='46f53066' size-in-bits='64' id='fffb07a4'/>
       <qualified-type-def type-id='55efd1a3' const='yes' id='fffdaf52'/>
-      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='520' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
+      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='521' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
       <var-decl name='GKI_struct_selinux_state' type-id='4ae52763' mangled-name='GKI_struct_selinux_state' visibility='default' filepath='security/selinux/vendor_hooks.c' line='21' column='1' elf-symbol-id='GKI_struct_selinux_state'/>
-      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='525' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
+      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='526' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
       <function-decl name='PDE_DATA' mangled-name='PDE_DATA' filepath='fs/proc/generic.c' line='802' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='PDE_DATA'>
         <parameter type-id='c5a4eb7f' name='inode' filepath='fs/proc/generic.c' line='802' column='1'/>
         <return type-id='eaa32e2f'/>
@@ -119080,6 +119082,12 @@
         <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/mm.h' line='290' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_vh_adjust_alloc_flags' mangled-name='__traceiter_android_vh_adjust_alloc_flags' filepath='include/trace/hooks/iommu.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_adjust_alloc_flags'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='46' column='1'/>
+        <parameter type-id='f0981eeb' name='order' filepath='include/trace/hooks/iommu.h' line='46' column='1'/>
+        <parameter type-id='831e6e93' name='alloc_flags' filepath='include/trace/hooks/iommu.h' line='46' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_vh_aes_decrypt' mangled-name='__traceiter_android_vh_aes_decrypt' filepath='include/trace/hooks/fips140.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_aes_decrypt'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/fips140.h' line='46' column='1'/>
         <parameter type-id='825271e7' name='ctx' filepath='include/trace/hooks/fips140.h' line='46' column='1'/>
@@ -121615,6 +121623,7 @@
       <var-decl name='__tracepoint_android_vh_account_task_time' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_account_task_time' visibility='default' filepath='include/trace/hooks/sched.h' line='312' column='1' elf-symbol-id='__tracepoint_android_vh_account_task_time'/>
       <var-decl name='__tracepoint_android_vh_add_page_to_lrulist' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_add_page_to_lrulist' visibility='default' filepath='include/trace/hooks/mm.h' line='174' column='1' elf-symbol-id='__tracepoint_android_vh_add_page_to_lrulist'/>
       <var-decl name='__tracepoint_android_vh_add_to_avail_list' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_add_to_avail_list' visibility='default' filepath='include/trace/hooks/mm.h' line='290' column='1' elf-symbol-id='__tracepoint_android_vh_add_to_avail_list'/>
+      <var-decl name='__tracepoint_android_vh_adjust_alloc_flags' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_adjust_alloc_flags' visibility='default' filepath='include/trace/hooks/iommu.h' line='46' column='1' elf-symbol-id='__tracepoint_android_vh_adjust_alloc_flags'/>
       <var-decl name='__tracepoint_android_vh_aes_decrypt' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_aes_decrypt' visibility='default' filepath='include/trace/hooks/fips140.h' line='46' column='1' elf-symbol-id='__tracepoint_android_vh_aes_decrypt'/>
       <var-decl name='__tracepoint_android_vh_aes_encrypt' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_aes_encrypt' visibility='default' filepath='include/trace/hooks/fips140.h' line='39' column='1' elf-symbol-id='__tracepoint_android_vh_aes_encrypt'/>
       <var-decl name='__tracepoint_android_vh_aes_expandkey' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_aes_expandkey' visibility='default' filepath='include/trace/hooks/fips140.h' line='32' column='1' elf-symbol-id='__tracepoint_android_vh_aes_expandkey'/>
diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus
index 76c9c4c070bf..f1719845925c 100644
--- a/android/abi_gki_aarch64_oplus
+++ b/android/abi_gki_aarch64_oplus
@@ -2761,6 +2761,7 @@
   __traceiter_android_rvh_wake_up_new_task
   __traceiter_android_vh_account_task_time
   __traceiter_android_vh_add_page_to_lrulist
+  __traceiter_android_vh_adjust_alloc_flags
   __traceiter_android_vh_alloc_pages_slowpath_begin
   __traceiter_android_vh_alloc_pages_slowpath_end
   __traceiter_android_vh_allow_domain_state
@@ -3035,6 +3036,7 @@
   __tracepoint_android_rvh_wake_up_new_task
   __tracepoint_android_vh_account_task_time
   __tracepoint_android_vh_add_page_to_lrulist
+  __tracepoint_android_vh_adjust_alloc_flags
   __tracepoint_android_vh_alloc_pages_slowpath_begin
   __tracepoint_android_vh_alloc_pages_slowpath_end
   __tracepoint_android_vh_allow_domain_state

From 0a9731879a2f3c7b16da001367627fe781b25684 Mon Sep 17 00:00:00 2001
From: liwei <liwei1234@oppo.com>
Date: Mon, 25 Sep 2023 17:28:48 +0800
Subject: [PATCH 1008/1043] ANDROID: mm: Add vendor hooks for recording when
 kswapd finishing the reclaim job

To monitor the reclaiming ability of kswapd, add vendor hook recording when the kswapd finish the reclaiming job and the reclaim progress.

android_vh_vmscan_kswpad_done(int, unsigned int, unsigned int, unsigned int)

Bug: 301044280

Change-Id: Id6e0a97003f0a156cff4d0996bc38bcd89b1dc69
Signed-off-by: John Hsu <john.hsu@mediatek.com>
Signed-off-by: liwei <liwei1234@oppo.com>
(cherry picked from commit 6c3dd25d2fdeff6fc752ef74e87e22f86ae1d939)
---
 drivers/android/vendor_hooks.c | 1 +
 include/trace/hooks/vmscan.h   | 4 ++++
 mm/vmscan.c                    | 3 +++
 3 files changed, 8 insertions(+)

diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 2335b17e59b1..172a21ee008c 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -513,6 +513,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_compl_rsp_check_done);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_handler);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_check_ctrl);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_print_ctrl);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_vmscan_kswapd_done);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/vmscan.h b/include/trace/hooks/vmscan.h
index 4bdb18c36ac6..90b9400db984 100644
--- a/include/trace/hooks/vmscan.h
+++ b/include/trace/hooks/vmscan.h
@@ -53,6 +53,10 @@ DECLARE_HOOK(android_vh_snapshot_refaults,
 DECLARE_HOOK(android_vh_check_page_look_around_ref,
 	TP_PROTO(struct page *page, int *skip),
 	TP_ARGS(page, skip));
+DECLARE_HOOK(android_vh_vmscan_kswapd_done,
+	TP_PROTO(int node_id, unsigned int highest_zoneidx, unsigned int alloc_order,
+		unsigned int reclaim_order),
+	TP_ARGS(node_id, highest_zoneidx, alloc_order, reclaim_order));
 #endif /* _TRACE_HOOK_VMSCAN_H */
 /* This part must be outside protection */
 #include <trace/define_trace.h>
diff --git a/mm/vmscan.c b/mm/vmscan.c
index f94f52e98868..d3617e6c25f2 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -68,6 +68,7 @@
 
 EXPORT_TRACEPOINT_SYMBOL_GPL(mm_vmscan_direct_reclaim_begin);
 EXPORT_TRACEPOINT_SYMBOL_GPL(mm_vmscan_direct_reclaim_end);
+EXPORT_TRACEPOINT_SYMBOL_GPL(mm_vmscan_kswapd_wake);
 
 struct scan_control {
 	/* How many pages shrink_list() should reclaim */
@@ -4038,6 +4039,8 @@ static int kswapd(void *p)
 						alloc_order);
 		reclaim_order = balance_pgdat(pgdat, alloc_order,
 						highest_zoneidx);
+		trace_android_vh_vmscan_kswapd_done(pgdat->node_id, highest_zoneidx,
+						alloc_order, reclaim_order);
 		if (reclaim_order < alloc_order)
 			goto kswapd_try_sleep;
 	}

From db57c320fa5ef4a3e402444e7e652f994eeba999 Mon Sep 17 00:00:00 2001
From: liwei <liwei1234@oppo.com>
Date: Tue, 30 Jan 2024 12:11:02 +0800
Subject: [PATCH 1009/1043] ANDROID: GKI: Update oplus symbol list

2 function symbol(s) added
  'int __traceiter_android_vh_vmscan_kswapd_done(void *, int, unsigned int, unsigned int, unsigned int)'
  'int __traceiter_mm_vmscan_kswapd_wake(void *, int, int, int)'

2 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_vmscan_kswapd_done'
  'struct tracepoint __tracepoint_mm_vmscan_kswapd_wake'

1 already EXPORTED symbol added
  static_key_enable

Bug: 309352303
Change-Id: I23698c10dd3a2ceaa2c19a6df5a8417de607915e
Signed-off-by: liwei <liwei1234@oppo.com>
---
 android/abi_gki_aarch64.xml   | 62 +++++++++++++++++++++++++----------
 android/abi_gki_aarch64_oplus |  5 +++
 2 files changed, 49 insertions(+), 18 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 198c5d5578ac..564f73c13afb 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -732,6 +732,7 @@
       <elf-symbol name='__traceiter_android_vh_v4l2subdev_set_frame_interval' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x56062d28'/>
       <elf-symbol name='__traceiter_android_vh_v4l2subdev_set_selection' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x841c50e9'/>
       <elf-symbol name='__traceiter_android_vh_vmpressure' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x72bfa1b6'/>
+      <elf-symbol name='__traceiter_android_vh_vmscan_kswapd_done' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x96191a01'/>
       <elf-symbol name='__traceiter_android_vh_waiting_for_page_migration' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc398818c'/>
       <elf-symbol name='__traceiter_android_vh_wakeup_bypass' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x585c30a1'/>
       <elf-symbol name='__traceiter_android_vh_watchdog_timer_softlockup' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf7d0def4'/>
@@ -772,6 +773,7 @@
       <elf-symbol name='__traceiter_map' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x71c059d8'/>
       <elf-symbol name='__traceiter_mm_vmscan_direct_reclaim_begin' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x803bf202'/>
       <elf-symbol name='__traceiter_mm_vmscan_direct_reclaim_end' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf2520b8a'/>
+      <elf-symbol name='__traceiter_mm_vmscan_kswapd_wake' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe7825239'/>
       <elf-symbol name='__traceiter_net_dev_queue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8f43ca5f'/>
       <elf-symbol name='__traceiter_net_dev_xmit' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf3c1c53d'/>
       <elf-symbol name='__traceiter_netif_receive_skb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4881e2b3'/>
@@ -5397,6 +5399,7 @@
       <elf-symbol name='stack_trace_save_tsk' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe8d7e643'/>
       <elf-symbol name='static_key_disable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb912560d'/>
       <elf-symbol name='static_key_disable_cpuslocked' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe6b79af'/>
+      <elf-symbol name='static_key_enable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6b2b69f7'/>
       <elf-symbol name='static_key_enable_cpuslocked' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3a55981a'/>
       <elf-symbol name='static_key_slow_dec' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2f4880df'/>
       <elf-symbol name='static_key_slow_inc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8e92f7c4'/>
@@ -6838,6 +6841,7 @@
       <elf-symbol name='__tracepoint_android_vh_v4l2subdev_set_frame_interval' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x26ad531b'/>
       <elf-symbol name='__tracepoint_android_vh_v4l2subdev_set_selection' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd163b93e'/>
       <elf-symbol name='__tracepoint_android_vh_vmpressure' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf9257104'/>
+      <elf-symbol name='__tracepoint_android_vh_vmscan_kswapd_done' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5e29085b'/>
       <elf-symbol name='__tracepoint_android_vh_waiting_for_page_migration' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1c9778c8'/>
       <elf-symbol name='__tracepoint_android_vh_wakeup_bypass' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x154b88c4'/>
       <elf-symbol name='__tracepoint_android_vh_watchdog_timer_softlockup' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x74ea651e'/>
@@ -6878,6 +6882,7 @@
       <elf-symbol name='__tracepoint_map' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x82bbf30b'/>
       <elf-symbol name='__tracepoint_mm_vmscan_direct_reclaim_begin' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc8744'/>
       <elf-symbol name='__tracepoint_mm_vmscan_direct_reclaim_end' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe1130765'/>
+      <elf-symbol name='__tracepoint_mm_vmscan_kswapd_wake' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd5e35f51'/>
       <elf-symbol name='__tracepoint_net_dev_queue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf304d20'/>
       <elf-symbol name='__tracepoint_net_dev_xmit' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb1d40474'/>
       <elf-symbol name='__tracepoint_netif_receive_skb' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8ee83e85'/>
@@ -121061,6 +121066,14 @@
         <parameter type-id='d8e6b335' name='bypass' filepath='include/trace/hooks/mm.h' line='126' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_vh_vmscan_kswapd_done' mangled-name='__traceiter_android_vh_vmscan_kswapd_done' filepath='include/trace/hooks/vmscan.h' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_vmscan_kswapd_done'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/vmscan.h' line='56' column='1'/>
+        <parameter type-id='95e97e5e' name='node_id' filepath='include/trace/hooks/vmscan.h' line='56' column='1'/>
+        <parameter type-id='f0981eeb' name='highest_zoneidx' filepath='include/trace/hooks/vmscan.h' line='56' column='1'/>
+        <parameter type-id='f0981eeb' name='alloc_order' filepath='include/trace/hooks/vmscan.h' line='56' column='1'/>
+        <parameter type-id='f0981eeb' name='reclaim_order' filepath='include/trace/hooks/vmscan.h' line='56' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_vh_waiting_for_page_migration' mangled-name='__traceiter_android_vh_waiting_for_page_migration' filepath='include/trace/hooks/mm.h' line='241' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_waiting_for_page_migration'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/mm.h' line='241' column='1'/>
         <parameter type-id='02f11ed4' name='page' filepath='include/trace/hooks/mm.h' line='241' column='1'/>
@@ -121303,6 +121316,13 @@
         <parameter type-id='7359adad' name='nr_reclaimed' filepath='include/trace/events/vmscan.h' line='162' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_mm_vmscan_kswapd_wake' mangled-name='__traceiter_mm_vmscan_kswapd_wake' filepath='include/trace/events/vmscan.h' line='52' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_mm_vmscan_kswapd_wake'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/events/vmscan.h' line='52' column='1'/>
+        <parameter type-id='95e97e5e' name='nid' filepath='include/trace/events/vmscan.h' line='52' column='1'/>
+        <parameter type-id='95e97e5e' name='zid' filepath='include/trace/events/vmscan.h' line='52' column='1'/>
+        <parameter type-id='95e97e5e' name='order' filepath='include/trace/events/vmscan.h' line='52' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_net_dev_queue' mangled-name='__traceiter_net_dev_queue' filepath='include/trace/events/net.h' line='143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_net_dev_queue'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/events/net.h' line='143' column='1'/>
         <parameter type-id='0fbf3cfd' name='skb' filepath='include/trace/events/net.h' line='143' column='1'/>
@@ -121933,6 +121953,7 @@
       <var-decl name='__tracepoint_android_vh_v4l2subdev_set_frame_interval' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_v4l2subdev_set_frame_interval' visibility='default' filepath='include/trace/hooks/v4l2core.h' line='51' column='1' elf-symbol-id='__tracepoint_android_vh_v4l2subdev_set_frame_interval'/>
       <var-decl name='__tracepoint_android_vh_v4l2subdev_set_selection' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_v4l2subdev_set_selection' visibility='default' filepath='include/trace/hooks/v4l2core.h' line='41' column='1' elf-symbol-id='__tracepoint_android_vh_v4l2subdev_set_selection'/>
       <var-decl name='__tracepoint_android_vh_vmpressure' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_vmpressure' visibility='default' filepath='include/trace/hooks/mm.h' line='126' column='1' elf-symbol-id='__tracepoint_android_vh_vmpressure'/>
+      <var-decl name='__tracepoint_android_vh_vmscan_kswapd_done' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_vmscan_kswapd_done' visibility='default' filepath='include/trace/hooks/vmscan.h' line='56' column='1' elf-symbol-id='__tracepoint_android_vh_vmscan_kswapd_done'/>
       <var-decl name='__tracepoint_android_vh_waiting_for_page_migration' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_waiting_for_page_migration' visibility='default' filepath='include/trace/hooks/mm.h' line='241' column='1' elf-symbol-id='__tracepoint_android_vh_waiting_for_page_migration'/>
       <var-decl name='__tracepoint_android_vh_wakeup_bypass' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_wakeup_bypass' visibility='default' filepath='include/trace/hooks/wakeupbypass.h' line='11' column='1' elf-symbol-id='__tracepoint_android_vh_wakeup_bypass'/>
       <var-decl name='__tracepoint_android_vh_watchdog_timer_softlockup' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_watchdog_timer_softlockup' visibility='default' filepath='include/trace/hooks/softlockup.h' line='20' column='1' elf-symbol-id='__tracepoint_android_vh_watchdog_timer_softlockup'/>
@@ -121973,6 +121994,7 @@
       <var-decl name='__tracepoint_map' type-id='4ca0c298' mangled-name='__tracepoint_map' visibility='default' filepath='include/trace/events/iommu.h' line='86' column='1' elf-symbol-id='__tracepoint_map'/>
       <var-decl name='__tracepoint_mm_vmscan_direct_reclaim_begin' type-id='4ca0c298' mangled-name='__tracepoint_mm_vmscan_direct_reclaim_begin' visibility='default' filepath='include/trace/events/vmscan.h' line='122' column='1' elf-symbol-id='__tracepoint_mm_vmscan_direct_reclaim_begin'/>
       <var-decl name='__tracepoint_mm_vmscan_direct_reclaim_end' type-id='4ca0c298' mangled-name='__tracepoint_mm_vmscan_direct_reclaim_end' visibility='default' filepath='include/trace/events/vmscan.h' line='162' column='1' elf-symbol-id='__tracepoint_mm_vmscan_direct_reclaim_end'/>
+      <var-decl name='__tracepoint_mm_vmscan_kswapd_wake' type-id='4ca0c298' mangled-name='__tracepoint_mm_vmscan_kswapd_wake' visibility='default' filepath='include/trace/events/vmscan.h' line='52' column='1' elf-symbol-id='__tracepoint_mm_vmscan_kswapd_wake'/>
       <var-decl name='__tracepoint_net_dev_queue' type-id='4ca0c298' mangled-name='__tracepoint_net_dev_queue' visibility='default' filepath='include/trace/events/net.h' line='143' column='1' elf-symbol-id='__tracepoint_net_dev_queue'/>
       <var-decl name='__tracepoint_net_dev_xmit' type-id='4ca0c298' mangled-name='__tracepoint_net_dev_xmit' visibility='default' filepath='include/trace/events/net.h' line='71' column='1' elf-symbol-id='__tracepoint_net_dev_xmit'/>
       <var-decl name='__tracepoint_netif_receive_skb' type-id='4ca0c298' mangled-name='__tracepoint_netif_receive_skb' visibility='default' filepath='include/trace/events/net.h' line='150' column='1' elf-symbol-id='__tracepoint_netif_receive_skb'/>
@@ -124286,8 +124308,8 @@
       <function-decl name='check_cache_active' mangled-name='check_cache_active' filepath='mm/swap_slots.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='check_cache_active'>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='check_move_unevictable_pages' mangled-name='check_move_unevictable_pages' filepath='mm/vmscan.c' line='4426' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='check_move_unevictable_pages'>
-        <parameter type-id='f7d3421a' name='pvec' filepath='mm/vmscan.c' line='4426' column='1'/>
+      <function-decl name='check_move_unevictable_pages' mangled-name='check_move_unevictable_pages' filepath='mm/vmscan.c' line='4429' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='check_move_unevictable_pages'>
+        <parameter type-id='f7d3421a' name='pvec' filepath='mm/vmscan.c' line='4429' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='check_preempt_curr' mangled-name='check_preempt_curr' filepath='kernel/sched/core.c' line='1781' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='check_preempt_curr'>
@@ -141467,8 +141489,8 @@
         <parameter type-id='19c2251e' name='d' filepath='lib/math/reciprocal_div.c' line='14' column='1'/>
         <return type-id='80ebe7f7'/>
       </function-decl>
-      <function-decl name='reclaim_pages' mangled-name='reclaim_pages' filepath='mm/vmscan.c' line='2187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reclaim_pages'>
-        <parameter type-id='e84b031a' name='page_list' filepath='mm/vmscan.c' line='2187' column='1'/>
+      <function-decl name='reclaim_pages' mangled-name='reclaim_pages' filepath='mm/vmscan.c' line='2188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reclaim_pages'>
+        <parameter type-id='e84b031a' name='page_list' filepath='mm/vmscan.c' line='2188' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='reclaim_shmem_address_space' mangled-name='reclaim_shmem_address_space' filepath='mm/shmem.c' line='4330' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reclaim_shmem_address_space'>
@@ -141642,8 +141664,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='183' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_shrinker' mangled-name='register_shrinker' filepath='mm/vmscan.c' line='410' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_shrinker'>
-        <parameter type-id='4be14597' name='shrinker' filepath='mm/vmscan.c' line='410' column='1'/>
+      <function-decl name='register_shrinker' mangled-name='register_shrinker' filepath='mm/vmscan.c' line='411' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_shrinker'>
+        <parameter type-id='4be14597' name='shrinker' filepath='mm/vmscan.c' line='411' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='register_syscore_ops' mangled-name='register_syscore_ops' filepath='drivers/base/syscore.c' line='22' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_syscore_ops'>
@@ -143973,11 +143995,11 @@
         <parameter type-id='42c8f564' name='sb' filepath='fs/dcache.c' line='1254' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='shrink_slab' mangled-name='shrink_slab' filepath='mm/vmscan.c' line='673' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shrink_slab'>
-        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/vmscan.c' line='673' column='1'/>
-        <parameter type-id='95e97e5e' name='nid' filepath='mm/vmscan.c' line='673' column='1'/>
-        <parameter type-id='223696fb' name='memcg' filepath='mm/vmscan.c' line='674' column='1'/>
-        <parameter type-id='95e97e5e' name='priority' filepath='mm/vmscan.c' line='675' column='1'/>
+      <function-decl name='shrink_slab' mangled-name='shrink_slab' filepath='mm/vmscan.c' line='674' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shrink_slab'>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/vmscan.c' line='674' column='1'/>
+        <parameter type-id='95e97e5e' name='nid' filepath='mm/vmscan.c' line='674' column='1'/>
+        <parameter type-id='223696fb' name='memcg' filepath='mm/vmscan.c' line='675' column='1'/>
+        <parameter type-id='95e97e5e' name='priority' filepath='mm/vmscan.c' line='676' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='si_mem_available' mangled-name='si_mem_available' filepath='mm/page_alloc.c' line='5554' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='si_mem_available'>
@@ -145945,6 +145967,10 @@
         <parameter type-id='f8840c23' name='key' filepath='kernel/jump_label.c' line='195' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='static_key_enable' mangled-name='static_key_enable' filepath='kernel/jump_label.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='static_key_enable'>
+        <parameter type-id='f8840c23' name='key' filepath='kernel/jump_label.c' line='187' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='static_key_enable_cpuslocked' mangled-name='static_key_enable_cpuslocked' filepath='kernel/jump_label.c' line='164' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='static_key_enable_cpuslocked'>
         <parameter type-id='f8840c23' name='key' filepath='kernel/jump_label.c' line='164' column='1'/>
         <return type-id='48b5725f'/>
@@ -146948,11 +146974,11 @@
         <parameter type-id='9248e67f' name='timer' filepath='kernel/time/timer.c' line='1229' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='try_to_free_mem_cgroup_pages' mangled-name='try_to_free_mem_cgroup_pages' filepath='mm/vmscan.c' line='3427' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='try_to_free_mem_cgroup_pages'>
-        <parameter type-id='223696fb' name='memcg' filepath='mm/vmscan.c' line='3427' column='1'/>
-        <parameter type-id='7359adad' name='nr_pages' filepath='mm/vmscan.c' line='3428' column='1'/>
-        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/vmscan.c' line='3429' column='1'/>
-        <parameter type-id='b50a4934' name='may_swap' filepath='mm/vmscan.c' line='3430' column='1'/>
+      <function-decl name='try_to_free_mem_cgroup_pages' mangled-name='try_to_free_mem_cgroup_pages' filepath='mm/vmscan.c' line='3428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='try_to_free_mem_cgroup_pages'>
+        <parameter type-id='223696fb' name='memcg' filepath='mm/vmscan.c' line='3428' column='1'/>
+        <parameter type-id='7359adad' name='nr_pages' filepath='mm/vmscan.c' line='3429' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/vmscan.c' line='3430' column='1'/>
+        <parameter type-id='b50a4934' name='may_swap' filepath='mm/vmscan.c' line='3431' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='try_to_release_page' mangled-name='try_to_release_page' filepath='mm/filemap.c' line='3698' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='try_to_release_page'>
@@ -148034,8 +148060,8 @@
         <parameter type-id='7331a99f' name='rpdrv' filepath='drivers/rpmsg/rpmsg_core.c' line='659' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='unregister_shrinker' mangled-name='unregister_shrinker' filepath='mm/vmscan.c' line='424' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_shrinker'>
-        <parameter type-id='4be14597' name='shrinker' filepath='mm/vmscan.c' line='424' column='1'/>
+      <function-decl name='unregister_shrinker' mangled-name='unregister_shrinker' filepath='mm/vmscan.c' line='425' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_shrinker'>
+        <parameter type-id='4be14597' name='shrinker' filepath='mm/vmscan.c' line='425' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='unregister_syscore_ops' mangled-name='unregister_syscore_ops' filepath='drivers/base/syscore.c' line='34' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_syscore_ops'>
diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus
index f1719845925c..4117c5405e2b 100644
--- a/android/abi_gki_aarch64_oplus
+++ b/android/abi_gki_aarch64_oplus
@@ -2565,6 +2565,7 @@
   __stack_chk_guard
   stack_depot_fetch
   stack_trace_save
+  static_key_enable
   static_key_disable
   static_key_slow_dec
   static_key_slow_inc
@@ -2938,6 +2939,7 @@
   __traceiter_android_vh_ufs_send_tm_command
   __traceiter_android_vh_update_page_mapcount
   __traceiter_android_vh_update_topology_flags_workfn
+  __traceiter_android_vh_vmscan_kswapd_done
   __traceiter_binder_transaction_received
   __traceiter_cpu_frequency
   __traceiter_cpu_frequency_limits
@@ -2946,6 +2948,7 @@
   __traceiter_ipi_entry
   __traceiter_ipi_raise
   __traceiter_irq_handler_entry
+  __traceiter_mm_vmscan_kswapd_wake
   __traceiter_net_dev_queue
   __traceiter_net_dev_xmit
   __traceiter_netif_receive_skb
@@ -3213,6 +3216,7 @@
   __tracepoint_android_vh_ufs_send_tm_command
   __tracepoint_android_vh_update_page_mapcount
   __tracepoint_android_vh_update_topology_flags_workfn
+  __tracepoint_android_vh_vmscan_kswapd_done
   __tracepoint_binder_transaction_received
   __tracepoint_cpu_frequency
   __tracepoint_cpu_frequency_limits
@@ -3221,6 +3225,7 @@
   __tracepoint_ipi_entry
   __tracepoint_ipi_raise
   __tracepoint_irq_handler_entry
+  __tracepoint_mm_vmscan_kswapd_wake
   __tracepoint_net_dev_queue
   __tracepoint_net_dev_xmit
   __tracepoint_netif_receive_skb

From febebd3d31fa6ba048e78ece70f8cd929ac009be Mon Sep 17 00:00:00 2001
From: John Fastabend <john.fastabend@gmail.com>
Date: Wed, 6 Dec 2023 15:27:05 -0800
Subject: [PATCH 1010/1043] UPSTREAM: net: tls, update curr on splice as well

commit c5a595000e2677e865a39f249c056bc05d6e55fd upstream.

The curr pointer must also be updated on the splice similar to how
we do this for other copy types.

Bug: 322282717
Fixes: d829e9c4112b ("tls: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Reported-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20231206232706.374377-2-john.fastabend@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ba5efd8544fa62ae85daeb36077468bf2ce974ab)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If942207e6338993096c9fbc8ce4c23a6bbecaf2e
---
 net/tls/tls_sw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 50eae668578a..dd980438f201 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1215,6 +1215,8 @@ static int tls_sw_do_sendpage(struct sock *sk, struct page *page,
 		}
 
 		sk_msg_page_add(msg_pl, page, copy, offset);
+		msg_pl->sg.copybreak = 0;
+		msg_pl->sg.curr = msg_pl->sg.end;
 		sk_mem_charge(sk, copy);
 
 		offset += copy;

From d47a714fa7cee9671216da007ef562cad6e75c61 Mon Sep 17 00:00:00 2001
From: Suren Baghdasaryan <surenb@google.com>
Date: Thu, 8 Feb 2024 13:45:31 -0800
Subject: [PATCH 1011/1043] ANDROID: mm: allow limited speculative page
 faulting in do_swap_page()

Speculative page handling was disabled in do_swap_page() because it was
unsafe to call migration_entry_wait(). Another calls which are not safe
without taking mmap_lock are ksm_might_need_to_copy() because it relies
on the VMA being stable and readahead. However if we avoid these cases,
the rest seems to be safe. Relax the check to avoid only these unsafe
cases and allow speculation otherwise.

Bug: 322762567
Change-Id: Ic1fda0a5549088d5f37004dbacf3193116a5f868
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
---
 mm/memory.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/mm/memory.c b/mm/memory.c
index 857cfc90893f..85bf4ccfa15b 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3623,8 +3623,11 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
 	void *shadow = NULL;
 
 	if (vmf->flags & FAULT_FLAG_SPECULATIVE) {
+		/* ksm_might_need_to_copy() needs a stable VMA, spf can't be used */
+#ifdef CONFIG_KSM
 		pte_unmap(vmf->pte);
 		return VM_FAULT_RETRY;
+#endif
 	}
 
 	ret = pte_unmap_same(vmf);
@@ -3641,6 +3644,10 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
 
 	entry = pte_to_swp_entry(vmf->orig_pte);
 	if (unlikely(non_swap_entry(entry))) {
+		if (vmf->flags & FAULT_FLAG_SPECULATIVE) {
+			ret = VM_FAULT_RETRY;
+			goto out;
+		}
 		if (is_migration_entry(entry)) {
 			migration_entry_wait(vma->vm_mm, vmf->pmd,
 					     vmf->address);

From c9ca12bfd28b84e448bbbfc40c00671b3fd2176c Mon Sep 17 00:00:00 2001
From: Suren Baghdasaryan <surenb@google.com>
Date: Thu, 8 Feb 2024 14:19:04 -0800
Subject: [PATCH 1012/1043] ANDROID: introduce a vendor hook to allow
 speculative swap pagefaults

Since SPF is an out-of-tree feature, the risks of changing its behavior
are higher. Add a vendor hook to enable speculative swap pagefaults. By
default it's disabled and should not cause troubles for current users.

Bug: 322762567
Change-Id: I3df7c545aa27d2707ee51ea42368f785c5faa735
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
---
 drivers/android/vendor_hooks.c |  1 +
 include/trace/hooks/mm.h       |  3 +++
 mm/memory.c                    | 11 ++++++++---
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 172a21ee008c..a45a4e21c68d 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -514,6 +514,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_handler);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_check_ctrl);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_print_ctrl);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_vmscan_kswapd_done);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_swap_page_spf);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/mm.h b/include/trace/hooks/mm.h
index 2b2459b1b878..a1a7da81e113 100644
--- a/include/trace/hooks/mm.h
+++ b/include/trace/hooks/mm.h
@@ -362,6 +362,9 @@ DECLARE_HOOK(android_vh_madvise_cold_or_pageout_abort,
 DECLARE_HOOK(android_vh_skip_swapcache,
 	TP_PROTO(swp_entry_t entry, bool *skip),
 	TP_ARGS(entry, skip));
+DECLARE_HOOK(android_vh_do_swap_page_spf,
+	TP_PROTO(bool *allow_swap_spf),
+	TP_ARGS(allow_swap_spf));
 /* macro versions of hooks are no longer required */
 
 #endif /* _TRACE_HOOK_MM_H */
diff --git a/mm/memory.c b/mm/memory.c
index 85bf4ccfa15b..ee78f871469e 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3623,11 +3623,16 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
 	void *shadow = NULL;
 
 	if (vmf->flags & FAULT_FLAG_SPECULATIVE) {
+		bool allow_swap_spf = false;
+
 		/* ksm_might_need_to_copy() needs a stable VMA, spf can't be used */
-#ifdef CONFIG_KSM
-		pte_unmap(vmf->pte);
-		return VM_FAULT_RETRY;
+#ifndef CONFIG_KSM
+		trace_android_vh_do_swap_page_spf(&allow_swap_spf);
 #endif
+		if (!allow_swap_spf) {
+			pte_unmap(vmf->pte);
+			return VM_FAULT_RETRY;
+		}
 	}
 
 	ret = pte_unmap_same(vmf);

From 08538f14e5ec85d381d7526741822660902493cb Mon Sep 17 00:00:00 2001
From: Carlos Llamas <cmllamas@google.com>
Date: Thu, 8 Feb 2024 18:51:20 +0000
Subject: [PATCH 1013/1043] ANDROID: GKI: explicit include of stringify.h

The android_kabi.h header file uses the __stringify() macro without
explicitly including its definition via linux/stringify.h. This can
result in build breaking when using the ANDROID_KABI_USE macro:

  common/include/linux/ipv6.h:83:2: error: expected ')'
  ANDROID_KABI_USE(1, struct { __s32 accept_ra_min_lft; u32 padding; });
  ^
  [...]
  common/include/linux/android_kabi.h:44:24: note: expanded from macro '__ANDROID_KABI_CHECK_SIZE_ALIGN'
      __FILE__ ":" __stringify(__LINE__) ": "          \
                   ^

To fix this let android_kabi.h include stringify.h explicitly instead of
relying on includes of previous unrelated header files.

Bug: 324437514
Change-Id: I16cced44e723871b2e1a92b312e60f38e41fea70
Signed-off-by: Carlos Llamas <cmllamas@google.com>
---
 include/linux/android_kabi.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/linux/android_kabi.h b/include/linux/android_kabi.h
index f6dd7f00b386..1fa329ee4d73 100644
--- a/include/linux/android_kabi.h
+++ b/include/linux/android_kabi.h
@@ -33,6 +33,7 @@
 #define _ANDROID_KABI_H
 
 #include <linux/compiler.h>
+#include <linux/stringify.h>
 
 /*
  * Worker macros, don't use these, use the ones without a leading '_'

From d4c4255fb45398d2980352ea16850d7664398037 Mon Sep 17 00:00:00 2001
From: Carlos Llamas <cmllamas@google.com>
Date: Tue, 13 Feb 2024 00:07:05 +0000
Subject: [PATCH 1014/1043] Reapply "net: add sysctl accept_ra_min_rtr_lft"

This reverts commit 7957cd8ab1a07ced5c55c6bb09e98b409e01186c.

Bug: 320243175
Change-Id: Ia31692230f2f5cbd2ac349edcb2be320497c52f3
Signed-off-by: Carlos Llamas <cmllamas@google.com>
---
 Documentation/networking/ip-sysctl.rst |  8 ++++++++
 include/linux/ipv6.h                   |  1 +
 include/uapi/linux/ipv6.h              |  7 +++++++
 net/ipv6/addrconf.c                    | 10 ++++++++++
 net/ipv6/ndisc.c                       | 18 ++++++++++++++++--
 5 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index eedce7474ad3..8e6b2c031f40 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1902,6 +1902,14 @@ accept_ra_min_hop_limit - INTEGER
 
 	Default: 1
 
+accept_ra_min_rtr_lft - INTEGER
+	Minimum acceptable router lifetime in Router Advertisement.
+
+	RAs with a router lifetime less than this value shall be
+	ignored. RAs with a router lifetime of 0 are unaffected.
+
+	Default: 0
+
 accept_ra_pinfo - BOOLEAN
 	Learn Prefix Information in Router Advertisement.
 
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 9a6832eb8b0c..7471874b482f 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -33,6 +33,7 @@ struct ipv6_devconf {
 	__s32		max_addresses;
 	__s32		accept_ra_defrtr;
 	__s32		accept_ra_min_hop_limit;
+	__s32		accept_ra_min_rtr_lft;
 	__s32		accept_ra_pinfo;
 	__s32		ignore_routes_with_linkdown;
 #ifdef CONFIG_IPV6_ROUTER_PREF
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index 2aadbba4e428..6a00ee39803b 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -196,6 +196,13 @@ enum {
 	DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN,
 	DEVCONF_NDISC_TCLASS,
 	DEVCONF_RPL_SEG_ENABLED,
+	DEVCONF_RA_DEFRTR_METRIC,
+	DEVCONF_IOAM6_ENABLED,
+	DEVCONF_IOAM6_ID,
+	DEVCONF_IOAM6_ID_WIDE,
+	DEVCONF_NDISC_EVICT_NOCARRIER,
+	DEVCONF_ACCEPT_UNTRACKED_NA,
+	DEVCONF_ACCEPT_RA_MIN_RTR_LFT,
 	DEVCONF_MAX
 };
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index cfad33eda6cc..92ba58e38799 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -209,6 +209,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
+	.accept_ra_min_rtr_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -265,6 +266,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
+	.accept_ra_min_rtr_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -5588,6 +5590,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 	array[DEVCONF_DISABLE_POLICY] = cnf->disable_policy;
 	array[DEVCONF_NDISC_TCLASS] = cnf->ndisc_tclass;
 	array[DEVCONF_RPL_SEG_ENABLED] = cnf->rpl_seg_enabled;
+	array[DEVCONF_ACCEPT_RA_MIN_RTR_LFT] = cnf->accept_ra_min_rtr_lft;
 }
 
 static inline size_t inet6_ifla6_size(void)
@@ -6741,6 +6744,13 @@ static const struct ctl_table addrconf_sysctl[] = {
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
 	},
+	{
+		.procname	= "accept_ra_min_rtr_lft",
+		.data		= &ipv6_devconf.accept_ra_min_rtr_lft,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec,
+	},
 	{
 		.procname	= "accept_ra_pinfo",
 		.data		= &ipv6_devconf.accept_ra_pinfo,
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index ac1e51087b1d..215ea5dbc5f0 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1222,6 +1222,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		return;
 	}
 
+	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
+
 	if (!ipv6_accept_ra(in6_dev)) {
 		ND_PRINTK(2, info,
 			  "RA: %s, did not accept ra for dev: %s\n",
@@ -1229,6 +1231,13 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_linkparms;
 	}
 
+	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
+		ND_PRINTK(2, info,
+			  "RA: router lifetime (%ds) is too short: %s\n",
+			  lifetime, skb->dev->name);
+		goto skip_linkparms;
+	}
+
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
 	/* skip link-specific parameters from interior routers */
 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
@@ -1281,8 +1290,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_defrtr;
 	}
 
-	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
-
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	pref = ra_msg->icmph.icmp6_router_pref;
 	/* 10b is handled as if it were 00b (medium) */
@@ -1429,6 +1436,13 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto out;
 	}
 
+	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
+		ND_PRINTK(2, info,
+			  "RA: router lifetime (%ds) is too short: %s\n",
+			  lifetime, skb->dev->name);
+		goto out;
+	}
+
 #ifdef CONFIG_IPV6_ROUTE_INFO
 	if (!in6_dev->cnf.accept_ra_from_local &&
 	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,

From a4508eb5526a65eb5f5ff6db7c0edf679a9f43b0 Mon Sep 17 00:00:00 2001
From: Carlos Llamas <cmllamas@google.com>
Date: Tue, 13 Feb 2024 00:07:39 +0000
Subject: [PATCH 1015/1043] Reapply "net: change accept_ra_min_rtr_lft to
 affect all RA lifetimes"

This reverts commit 935ac73a69cf8bffc2c168360de66ed464e1e4ca.

Bug: 320243175
Change-Id: If51722d74fe9b326d69c96c0cdfca43db6e33b93
Signed-off-by: Carlos Llamas <cmllamas@google.com>
---
 Documentation/networking/ip-sysctl.rst |  8 ++++----
 include/linux/ipv6.h                   |  2 +-
 include/uapi/linux/ipv6.h              |  2 +-
 net/ipv6/addrconf.c                    | 13 ++++++++-----
 net/ipv6/ndisc.c                       | 27 +++++++++++---------------
 5 files changed, 25 insertions(+), 27 deletions(-)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index 8e6b2c031f40..dffda1277d88 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1902,11 +1902,11 @@ accept_ra_min_hop_limit - INTEGER
 
 	Default: 1
 
-accept_ra_min_rtr_lft - INTEGER
-	Minimum acceptable router lifetime in Router Advertisement.
+accept_ra_min_lft - INTEGER
+	Minimum acceptable lifetime value in Router Advertisement.
 
-	RAs with a router lifetime less than this value shall be
-	ignored. RAs with a router lifetime of 0 are unaffected.
+	RA sections with a lifetime less than this value shall be
+	ignored. Zero lifetimes stay unaffected.
 
 	Default: 0
 
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 7471874b482f..5a049f604a24 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -33,7 +33,7 @@ struct ipv6_devconf {
 	__s32		max_addresses;
 	__s32		accept_ra_defrtr;
 	__s32		accept_ra_min_hop_limit;
-	__s32		accept_ra_min_rtr_lft;
+	__s32		accept_ra_min_lft;
 	__s32		accept_ra_pinfo;
 	__s32		ignore_routes_with_linkdown;
 #ifdef CONFIG_IPV6_ROUTER_PREF
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index 6a00ee39803b..456a8c74b28d 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -202,7 +202,7 @@ enum {
 	DEVCONF_IOAM6_ID_WIDE,
 	DEVCONF_NDISC_EVICT_NOCARRIER,
 	DEVCONF_ACCEPT_UNTRACKED_NA,
-	DEVCONF_ACCEPT_RA_MIN_RTR_LFT,
+	DEVCONF_ACCEPT_RA_MIN_LFT,
 	DEVCONF_MAX
 };
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 92ba58e38799..26eaa9d4d6b3 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -209,7 +209,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
-	.accept_ra_min_rtr_lft	= 0,
+	.accept_ra_min_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -266,7 +266,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 	.accept_ra_defrtr	= 1,
 	.accept_ra_from_local	= 0,
 	.accept_ra_min_hop_limit= 1,
-	.accept_ra_min_rtr_lft	= 0,
+	.accept_ra_min_lft	= 0,
 	.accept_ra_pinfo	= 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
 	.accept_ra_rtr_pref	= 1,
@@ -2750,6 +2750,9 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
 		return;
 	}
 
+	if (valid_lft != 0 && valid_lft < in6_dev->cnf.accept_ra_min_lft)
+		return;
+
 	/*
 	 *	Two things going on here:
 	 *	1) Add routes for on-link prefixes
@@ -5590,7 +5593,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 	array[DEVCONF_DISABLE_POLICY] = cnf->disable_policy;
 	array[DEVCONF_NDISC_TCLASS] = cnf->ndisc_tclass;
 	array[DEVCONF_RPL_SEG_ENABLED] = cnf->rpl_seg_enabled;
-	array[DEVCONF_ACCEPT_RA_MIN_RTR_LFT] = cnf->accept_ra_min_rtr_lft;
+	array[DEVCONF_ACCEPT_RA_MIN_LFT] = cnf->accept_ra_min_lft;
 }
 
 static inline size_t inet6_ifla6_size(void)
@@ -6745,8 +6748,8 @@ static const struct ctl_table addrconf_sysctl[] = {
 		.proc_handler	= proc_dointvec,
 	},
 	{
-		.procname	= "accept_ra_min_rtr_lft",
-		.data		= &ipv6_devconf.accept_ra_min_rtr_lft,
+		.procname	= "accept_ra_min_lft",
+		.data		= &ipv6_devconf.accept_ra_min_lft,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 215ea5dbc5f0..14251347c4a5 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1222,8 +1222,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		return;
 	}
 
-	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
-
 	if (!ipv6_accept_ra(in6_dev)) {
 		ND_PRINTK(2, info,
 			  "RA: %s, did not accept ra for dev: %s\n",
@@ -1231,13 +1229,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_linkparms;
 	}
 
-	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
-		ND_PRINTK(2, info,
-			  "RA: router lifetime (%ds) is too short: %s\n",
-			  lifetime, skb->dev->name);
-		goto skip_linkparms;
-	}
-
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
 	/* skip link-specific parameters from interior routers */
 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
@@ -1278,6 +1269,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto skip_defrtr;
 	}
 
+	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
+	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_lft) {
+		ND_PRINTK(2, info,
+			  "RA: router lifetime (%ds) is too short: %s\n",
+			  lifetime, skb->dev->name);
+		goto skip_defrtr;
+	}
+
 	/* Do not accept RA with source-addr found on local machine unless
 	 * accept_ra_from_local is set to true.
 	 */
@@ -1436,13 +1435,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 		goto out;
 	}
 
-	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
-		ND_PRINTK(2, info,
-			  "RA: router lifetime (%ds) is too short: %s\n",
-			  lifetime, skb->dev->name);
-		goto out;
-	}
-
 #ifdef CONFIG_IPV6_ROUTE_INFO
 	if (!in6_dev->cnf.accept_ra_from_local &&
 	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
@@ -1467,6 +1459,9 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 			if (ri->prefix_len == 0 &&
 			    !in6_dev->cnf.accept_ra_defrtr)
 				continue;
+			if (ri->lifetime != 0 &&
+			    ntohl(ri->lifetime) < in6_dev->cnf.accept_ra_min_lft)
+				continue;
 			if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
 				continue;
 			if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)

From be6ad5e4395a73f1212e34ac2b16c0e909598b6d Mon Sep 17 00:00:00 2001
From: Carlos Llamas <cmllamas@google.com>
Date: Tue, 13 Feb 2024 00:07:54 +0000
Subject: [PATCH 1016/1043] Reapply "net: release reference to inet6_dev
 pointer"

This reverts commit ea0ddd540d92f3180abff1edf58c51b1e70bc2a1.

Bug: 320243175
Change-Id: I4627e1097dddbb697597cbb51e4ba9f4f1af61da
Signed-off-by: Carlos Llamas <cmllamas@google.com>
---
 net/ipv6/addrconf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 26eaa9d4d6b3..5d97522211dc 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2751,7 +2751,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
 	}
 
 	if (valid_lft != 0 && valid_lft < in6_dev->cnf.accept_ra_min_lft)
-		return;
+		goto put;
 
 	/*
 	 *	Two things going on here:

From 13fdad03e6ea0044b4ede45eb68693a39cb3fcd1 Mon Sep 17 00:00:00 2001
From: Carlos Llamas <cmllamas@google.com>
Date: Wed, 7 Feb 2024 22:17:44 +0000
Subject: [PATCH 1017/1043] ANDROID: GKI: fix ABI breakage in struct
 ipv6_devconf

The following list of commits, which are in the 5.10.199 release, add a
new field in struct ipv6_devconf and this breaks the abi. Fix this by
using one of the reserved slots for upstream changes and update the xml
file to preserve the build.

  014cab5329d1 ("net: release reference to inet6_dev pointer")
  d491ac7aa12a ("net: change accept_ra_min_rtr_lft to affect all RA lifetimes")
  354a96770d94 ("net: add sysctl accept_ra_min_rtr_lft")

type 'struct ipv6_devconf' changed
  member 'union { struct { __s32 accept_ra_min_lft; u32 padding; }; struct { u64 android_kabi_reserved1; }; union { }; }' was added
  member 'u64 android_kabi_reserved1' was removed

Bug: 320243175
Change-Id: Icddcad574f3c29f6d3e63b10f8c7e51bdf46fe7f
Signed-off-by: Carlos Llamas <cmllamas@google.com>
---
 android/abi_gki_aarch64.xml | 2725 ++++++++++++++++++-----------------
 include/linux/ipv6.h        |    4 +-
 2 files changed, 1374 insertions(+), 1355 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 564f73c13afb..d67a4b4231c3 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -8725,45 +8725,45 @@
         <parameter type-id='b59d7dce'/>
         <return type-id='79a0948f'/>
       </function-type>
-      <class-decl name='dquot_operations' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='325' column='1' id='0584e65d'>
+      <class-decl name='dquot_operations' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='327' column='1' id='0584e65d'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='write_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='326' column='1'/>
+          <var-decl name='write_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='328' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='alloc_dquot' type-id='324070f9' visibility='default' filepath='include/linux/quota.h' line='327' column='1'/>
+          <var-decl name='alloc_dquot' type-id='324070f9' visibility='default' filepath='include/linux/quota.h' line='329' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='destroy_dquot' type-id='dbc22931' visibility='default' filepath='include/linux/quota.h' line='328' column='1'/>
+          <var-decl name='destroy_dquot' type-id='dbc22931' visibility='default' filepath='include/linux/quota.h' line='330' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='acquire_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='329' column='1'/>
+          <var-decl name='acquire_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='331' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='release_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='330' column='1'/>
+          <var-decl name='release_dquot' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='332' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='mark_dirty' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='331' column='1'/>
+          <var-decl name='mark_dirty' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='333' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='write_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='332' column='1'/>
+          <var-decl name='write_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='334' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='get_reserved_space' type-id='15543b10' visibility='default' filepath='include/linux/quota.h' line='335' column='1'/>
+          <var-decl name='get_reserved_space' type-id='15543b10' visibility='default' filepath='include/linux/quota.h' line='337' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='get_projid' type-id='c23b3cbc' visibility='default' filepath='include/linux/quota.h' line='336' column='1'/>
+          <var-decl name='get_projid' type-id='c23b3cbc' visibility='default' filepath='include/linux/quota.h' line='338' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='get_inode_usage' type-id='6b7539fb' visibility='default' filepath='include/linux/quota.h' line='338' column='1'/>
+          <var-decl name='get_inode_usage' type-id='6b7539fb' visibility='default' filepath='include/linux/quota.h' line='340' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='get_next_id' type-id='70b08f83' visibility='default' filepath='include/linux/quota.h' line='340' column='1'/>
+          <var-decl name='get_next_id' type-id='70b08f83' visibility='default' filepath='include/linux/quota.h' line='342' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='342' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='344' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='343' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='345' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='51d715c2' size-in-bits='64' id='0588e2f0'/>
@@ -12246,6 +12246,14 @@
         <parameter type-id='6dcf57f3'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <class-decl name='__anonymous_struct__' size-in-bits='64' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/ipv6.h' line='83' column='1' id='0e625b6c'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='accept_ra_min_lft' type-id='3158a266' visibility='default' filepath='include/linux/ipv6.h' line='83' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='padding' type-id='19c2251e' visibility='default' filepath='include/linux/ipv6.h' line='83' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='3572f41a' size-in-bits='64' id='0e64a118'/>
       <array-type-def dimensions='1' type-id='e710f78e' size-in-bits='576' id='0e685653'>
         <subrange length='3' type-id='7ff19f0f' id='56f209d2'/>
@@ -12294,18 +12302,18 @@
           <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/sound/soc.h' line='660' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='ipv6_devstat' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='164' column='1' id='0e97f526'>
+      <class-decl name='ipv6_devstat' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='160' column='1' id='0e97f526'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='proc_dir_entry' type-id='d077e928' visibility='default' filepath='include/net/if_inet6.h' line='165' column='1'/>
+          <var-decl name='proc_dir_entry' type-id='d077e928' visibility='default' filepath='include/net/if_inet6.h' line='161' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='ipv6' type-id='30897c4e' visibility='default' filepath='include/net/if_inet6.h' line='166' column='1'/>
+          <var-decl name='ipv6' type-id='30897c4e' visibility='default' filepath='include/net/if_inet6.h' line='162' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='icmpv6dev' type-id='6551bd60' visibility='default' filepath='include/net/if_inet6.h' line='167' column='1'/>
+          <var-decl name='icmpv6dev' type-id='6551bd60' visibility='default' filepath='include/net/if_inet6.h' line='163' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='icmpv6msgdev' type-id='793f0d19' visibility='default' filepath='include/net/if_inet6.h' line='168' column='1'/>
+          <var-decl name='icmpv6msgdev' type-id='793f0d19' visibility='default' filepath='include/net/if_inet6.h' line='164' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='ipv6_rt_hdr' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/uapi/linux/ipv6.h' line='50' column='1' id='0eae882e'>
@@ -16460,33 +16468,33 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='41f25325' size-in-bits='64' id='18811e61'/>
-      <class-decl name='ifacaddr6' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='148' column='1' id='1883cd3d'>
+      <class-decl name='ifacaddr6' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='144' column='1' id='1883cd3d'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='aca_addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='149' column='1'/>
+          <var-decl name='aca_addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='145' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='aca_rt' type-id='fe454a75' visibility='default' filepath='include/net/if_inet6.h' line='150' column='1'/>
+          <var-decl name='aca_rt' type-id='fe454a75' visibility='default' filepath='include/net/if_inet6.h' line='146' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='aca_next' type-id='034d7ded' visibility='default' filepath='include/net/if_inet6.h' line='151' column='1'/>
+          <var-decl name='aca_next' type-id='034d7ded' visibility='default' filepath='include/net/if_inet6.h' line='147' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='aca_addr_lst' type-id='03a4a074' visibility='default' filepath='include/net/if_inet6.h' line='152' column='1'/>
+          <var-decl name='aca_addr_lst' type-id='03a4a074' visibility='default' filepath='include/net/if_inet6.h' line='148' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='aca_users' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='153' column='1'/>
+          <var-decl name='aca_users' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='149' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='416'>
-          <var-decl name='aca_refcnt' type-id='64615833' visibility='default' filepath='include/net/if_inet6.h' line='154' column='1'/>
+          <var-decl name='aca_refcnt' type-id='64615833' visibility='default' filepath='include/net/if_inet6.h' line='150' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='aca_cstamp' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='155' column='1'/>
+          <var-decl name='aca_cstamp' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='151' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='aca_tstamp' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='156' column='1'/>
+          <var-decl name='aca_tstamp' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='152' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/if_inet6.h' line='157' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/if_inet6.h' line='153' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='60588bb1' size-in-bits='64' id='18881289'/>
@@ -20588,12 +20596,12 @@
           <var-decl name='poll_completion' type-id='b50a4934' visibility='default' filepath='drivers/firmware/arm_scmi/common.h' line='85' column='1'/>
         </data-member>
       </class-decl>
-      <union-decl name='__anonymous_union__' size-in-bits='16' is-anonymous='yes' visibility='default' filepath='include/linux/ipv6.h' line='245' column='1' id='23d43bd5'>
+      <union-decl name='__anonymous_union__' size-in-bits='16' is-anonymous='yes' visibility='default' filepath='include/linux/ipv6.h' line='246' column='1' id='23d43bd5'>
         <data-member access='public'>
-          <var-decl name='bits' type-id='9ebd5abd' visibility='default' filepath='include/linux/ipv6.h' line='263' column='1'/>
+          <var-decl name='bits' type-id='9ebd5abd' visibility='default' filepath='include/linux/ipv6.h' line='264' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='all' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='264' column='1'/>
+          <var-decl name='all' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='265' column='1'/>
         </data-member>
       </union-decl>
       <pointer-type-def type-id='fd48a6e6' size-in-bits='64' id='23d6768c'/>
@@ -21792,7 +21800,7 @@
         <parameter type-id='98d7a132'/>
         <return type-id='02ac9d9d'/>
       </function-type>
-      <typedef-decl name='filldir_t' type-id='78efe913' filepath='include/linux/fs.h' line='1828' column='1' id='262124ef'/>
+      <typedef-decl name='filldir_t' type-id='78efe913' filepath='include/linux/fs.h' line='1871' column='1' id='262124ef'/>
       <class-decl name='snd_soc_tplg_vendor_value_elem' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/uapi/sound/asoc.h' line='207' column='1' id='26236645'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='token' type-id='2f162548' visibility='default' filepath='include/uapi/sound/asoc.h' line='208' column='1'/>
@@ -22523,7 +22531,7 @@
       <array-type-def dimensions='1' type-id='f0981eeb' size-in-bits='448' id='27cbf0c8'>
         <subrange length='14' type-id='7ff19f0f' id='48882d96'/>
       </array-type-def>
-      <typedef-decl name='dio_submit_t' type-id='6d229cce' filepath='include/linux/fs.h' line='3110' column='1' id='27d499b2'/>
+      <typedef-decl name='dio_submit_t' type-id='6d229cce' filepath='include/linux/fs.h' line='3153' column='1' id='27d499b2'/>
       <pointer-type-def type-id='af1e6651' size-in-bits='64' id='27db53a1'/>
       <class-decl name='snd_soc_dapm_wcache' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/sound/soc-dapm.h' line='683' column='1' id='27dc472b'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -25511,66 +25519,66 @@
       <pointer-type-def type-id='9502627f' size-in-bits='64' id='2f4077f3'/>
       <pointer-type-def type-id='676b848c' size-in-bits='64' id='2f4512ea'/>
       <pointer-type-def type-id='7364da7b' size-in-bits='64' id='2f59f71f'/>
-      <class-decl name='file_system_type' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='2308' column='1' id='2f5a60be'>
+      <class-decl name='file_system_type' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='2351' column='1' id='2f5a60be'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='include/linux/fs.h' line='2309' column='1'/>
+          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='include/linux/fs.h' line='2352' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='fs_flags' type-id='95e97e5e' visibility='default' filepath='include/linux/fs.h' line='2310' column='1'/>
+          <var-decl name='fs_flags' type-id='95e97e5e' visibility='default' filepath='include/linux/fs.h' line='2353' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='init_fs_context' type-id='57f0383a' visibility='default' filepath='include/linux/fs.h' line='2318' column='1'/>
+          <var-decl name='init_fs_context' type-id='57f0383a' visibility='default' filepath='include/linux/fs.h' line='2361' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='parameters' type-id='8d4f223b' visibility='default' filepath='include/linux/fs.h' line='2319' column='1'/>
+          <var-decl name='parameters' type-id='8d4f223b' visibility='default' filepath='include/linux/fs.h' line='2362' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='mount' type-id='d9394db1' visibility='default' filepath='include/linux/fs.h' line='2320' column='1'/>
+          <var-decl name='mount' type-id='d9394db1' visibility='default' filepath='include/linux/fs.h' line='2363' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='kill_sb' type-id='1ff54a45' visibility='default' filepath='include/linux/fs.h' line='2322' column='1'/>
+          <var-decl name='kill_sb' type-id='1ff54a45' visibility='default' filepath='include/linux/fs.h' line='2365' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/linux/fs.h' line='2323' column='1'/>
+          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/linux/fs.h' line='2366' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='next' type-id='21e53d44' visibility='default' filepath='include/linux/fs.h' line='2324' column='1'/>
+          <var-decl name='next' type-id='21e53d44' visibility='default' filepath='include/linux/fs.h' line='2367' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='fs_supers' type-id='e151255a' visibility='default' filepath='include/linux/fs.h' line='2325' column='1'/>
+          <var-decl name='fs_supers' type-id='e151255a' visibility='default' filepath='include/linux/fs.h' line='2368' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='s_lock_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2327' column='1'/>
+          <var-decl name='s_lock_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2370' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='s_umount_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2328' column='1'/>
+          <var-decl name='s_umount_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2371' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='s_vfs_rename_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2329' column='1'/>
+          <var-decl name='s_vfs_rename_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2372' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='s_writers_key' type-id='9c02e2a6' visibility='default' filepath='include/linux/fs.h' line='2330' column='1'/>
+          <var-decl name='s_writers_key' type-id='9c02e2a6' visibility='default' filepath='include/linux/fs.h' line='2373' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='i_lock_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2332' column='1'/>
+          <var-decl name='i_lock_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2375' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='i_mutex_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2333' column='1'/>
+          <var-decl name='i_mutex_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2376' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='i_mutex_dir_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2334' column='1'/>
+          <var-decl name='i_mutex_dir_key' type-id='47479831' visibility='default' filepath='include/linux/fs.h' line='2377' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2336' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2379' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2337' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2380' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2338' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2381' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2339' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2382' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='skcipher_instance' size-in-bits='6144' is-struct='yes' visibility='default' filepath='include/crypto/internal/skcipher.h' line='20' column='1' id='2f61a822'>
@@ -26551,12 +26559,12 @@
         <enumerator name='MODULE_STATE_GOING' value='2'/>
         <enumerator name='MODULE_STATE_UNFORMED' value='3'/>
       </enum-decl>
-      <class-decl name='clk_div_table' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/clk-provider.h' line='565' column='1' id='32858f34'>
+      <class-decl name='clk_div_table' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/clk-provider.h' line='579' column='1' id='32858f34'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='val' type-id='f0981eeb' visibility='default' filepath='include/linux/clk-provider.h' line='566' column='1'/>
+          <var-decl name='val' type-id='f0981eeb' visibility='default' filepath='include/linux/clk-provider.h' line='580' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='div' type-id='f0981eeb' visibility='default' filepath='include/linux/clk-provider.h' line='567' column='1'/>
+          <var-decl name='div' type-id='f0981eeb' visibility='default' filepath='include/linux/clk-provider.h' line='581' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='coredump_params' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/binfmts.h' line='77' column='1' id='3288a0f7'>
@@ -30758,15 +30766,15 @@
           <var-decl name='gre' type-id='29e36f6d' visibility='default' filepath='include/net/netfilter/nf_conntrack_tuple.h' line='64' column='1'/>
         </data-member>
       </union-decl>
-      <class-decl name='ip6_sf_socklist' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='86' column='1' id='3df0f7af'>
+      <class-decl name='ip6_sf_socklist' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='82' column='1' id='3df0f7af'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='sl_max' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='87' column='1'/>
+          <var-decl name='sl_max' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='83' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='sl_count' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='88' column='1'/>
+          <var-decl name='sl_count' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='84' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='sl_addr' type-id='0fdf6c82' visibility='default' filepath='include/net/if_inet6.h' line='89' column='1'/>
+          <var-decl name='sl_addr' type-id='0fdf6c82' visibility='default' filepath='include/net/if_inet6.h' line='85' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='17f9ad66' size-in-bits='64' id='3df34728'/>
@@ -32790,6 +32798,17 @@
       </class-decl>
       <pointer-type-def type-id='25baaf57' size-in-bits='64' id='42861783'/>
       <pointer-type-def type-id='e03e976a' size-in-bits='64' id='428819c0'/>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/linux/ipv6.h' line='83' column='1' id='4289decc'>
+        <data-member access='public'>
+          <var-decl name='' type-id='0e625b6c' visibility='default' filepath='include/linux/ipv6.h' line='83' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='' type-id='156952c4' visibility='default' filepath='include/linux/ipv6.h' line='83' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='' type-id='2a125a28' visibility='default' filepath='include/linux/ipv6.h' line='83' column='1'/>
+        </data-member>
+      </union-decl>
       <function-type size-in-bits='64' id='428b7011'>
         <return type-id='19c2251e'/>
       </function-type>
@@ -34253,9 +34272,9 @@
         <parameter type-id='2ae08426'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='ida' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/idr.h' line='244' column='1' id='46ce60fb'>
+      <class-decl name='ida' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/idr.h' line='246' column='1' id='46ce60fb'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='xa' type-id='d39738ac' visibility='default' filepath='include/linux/idr.h' line='245' column='1'/>
+          <var-decl name='xa' type-id='d39738ac' visibility='default' filepath='include/linux/idr.h' line='247' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='i3c_ibi_payload' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/i3c/device.h' line='298' column='1' id='46cf92da'>
@@ -38179,24 +38198,24 @@
         <parameter type-id='e90f4666'/>
         <return type-id='b59d7dce'/>
       </function-type>
-      <class-decl name='i3c_generic_ibi_pool' size-in-bits='448' is-struct='yes' visibility='default' filepath='drivers/i3c/master.c' line='2279' column='1' id='50fab010'>
+      <class-decl name='i3c_generic_ibi_pool' size-in-bits='448' is-struct='yes' visibility='default' filepath='drivers/i3c/master.c' line='2281' column='1' id='50fab010'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='drivers/i3c/master.c' line='2280' column='1'/>
+          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='drivers/i3c/master.c' line='2282' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='num_slots' type-id='f0981eeb' visibility='default' filepath='drivers/i3c/master.c' line='2281' column='1'/>
+          <var-decl name='num_slots' type-id='f0981eeb' visibility='default' filepath='drivers/i3c/master.c' line='2283' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='slots' type-id='07b1f77c' visibility='default' filepath='drivers/i3c/master.c' line='2282' column='1'/>
+          <var-decl name='slots' type-id='07b1f77c' visibility='default' filepath='drivers/i3c/master.c' line='2284' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='payload_buf' type-id='eaa32e2f' visibility='default' filepath='drivers/i3c/master.c' line='2283' column='1'/>
+          <var-decl name='payload_buf' type-id='eaa32e2f' visibility='default' filepath='drivers/i3c/master.c' line='2285' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='free_slots' type-id='72f469ec' visibility='default' filepath='drivers/i3c/master.c' line='2284' column='1'/>
+          <var-decl name='free_slots' type-id='72f469ec' visibility='default' filepath='drivers/i3c/master.c' line='2286' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='pending' type-id='72f469ec' visibility='default' filepath='drivers/i3c/master.c' line='2285' column='1'/>
+          <var-decl name='pending' type-id='72f469ec' visibility='default' filepath='drivers/i3c/master.c' line='2287' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='d7cfbbe1' size-in-bits='64' id='51119d2d'/>
@@ -39721,60 +39740,60 @@
           <var-decl name='' type-id='7432b366' visibility='default' filepath='include/linux/io-pgtable.h' line='96' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='tcp_congestion_ops' size-in-bits='1216' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1064' column='1' id='54718f09'>
+      <class-decl name='tcp_congestion_ops' size-in-bits='1216' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1067' column='1' id='54718f09'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/tcp.h' line='1065' column='1'/>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/tcp.h' line='1068' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='key' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1066' column='1'/>
+          <var-decl name='key' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1069' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1067' column='1'/>
+          <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1070' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='init' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='1070' column='1'/>
+          <var-decl name='init' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='1073' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='release' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='1072' column='1'/>
+          <var-decl name='release' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='1075' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='ssthresh' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1075' column='1'/>
+          <var-decl name='ssthresh' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1078' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='cong_avoid' type-id='ece3af1e' visibility='default' filepath='include/net/tcp.h' line='1077' column='1'/>
+          <var-decl name='cong_avoid' type-id='ece3af1e' visibility='default' filepath='include/net/tcp.h' line='1080' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='set_state' type-id='f5feb7a4' visibility='default' filepath='include/net/tcp.h' line='1079' column='1'/>
+          <var-decl name='set_state' type-id='f5feb7a4' visibility='default' filepath='include/net/tcp.h' line='1082' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='cwnd_event' type-id='bfacbc7a' visibility='default' filepath='include/net/tcp.h' line='1081' column='1'/>
+          <var-decl name='cwnd_event' type-id='bfacbc7a' visibility='default' filepath='include/net/tcp.h' line='1084' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='in_ack_event' type-id='815f64bf' visibility='default' filepath='include/net/tcp.h' line='1083' column='1'/>
+          <var-decl name='in_ack_event' type-id='815f64bf' visibility='default' filepath='include/net/tcp.h' line='1086' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='undo_cwnd' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1085' column='1'/>
+          <var-decl name='undo_cwnd' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1088' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='pkts_acked' type-id='bffb5883' visibility='default' filepath='include/net/tcp.h' line='1087' column='1'/>
+          <var-decl name='pkts_acked' type-id='bffb5883' visibility='default' filepath='include/net/tcp.h' line='1090' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='min_tso_segs' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1089' column='1'/>
+          <var-decl name='min_tso_segs' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1092' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='sndbuf_expand' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1091' column='1'/>
+          <var-decl name='sndbuf_expand' type-id='8af06487' visibility='default' filepath='include/net/tcp.h' line='1094' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='cong_control' type-id='636d3a20' visibility='default' filepath='include/net/tcp.h' line='1095' column='1'/>
+          <var-decl name='cong_control' type-id='636d3a20' visibility='default' filepath='include/net/tcp.h' line='1098' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='get_info' type-id='14ca5c08' visibility='default' filepath='include/net/tcp.h' line='1097' column='1'/>
+          <var-decl name='get_info' type-id='14ca5c08' visibility='default' filepath='include/net/tcp.h' line='1100' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/net/tcp.h' line='1100' column='1'/>
+          <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/net/tcp.h' line='1103' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/tcp.h' line='1101' column='1'/>
+          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/tcp.h' line='1104' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='673937f2' size-in-bits='64' id='5474f420'/>
@@ -40506,16 +40525,16 @@
           <var-decl name='sysctl_header' type-id='11b101bb' visibility='default' filepath='include/linux/ipv6.h' line='81' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1856'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/ipv6.h' line='83' column='1'/>
+          <var-decl name='' type-id='4289decc' visibility='default' filepath='include/linux/ipv6.h' line='83' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1920'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/ipv6.h' line='84' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/ipv6.h' line='85' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1984'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/ipv6.h' line='85' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/ipv6.h' line='86' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2048'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/ipv6.h' line='86' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/ipv6.h' line='87' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='blkg_policy_data' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/blk-cgroup.h' line='88' column='1' id='55eaf925'>
@@ -41101,12 +41120,12 @@
       </array-type-def>
       <pointer-type-def type-id='220a7484' size-in-bits='64' id='5819e862'/>
       <pointer-type-def type-id='3288a0f7' size-in-bits='64' id='581abdef'/>
-      <class-decl name='i3c_generic_ibi_slot' size-in-bits='704' is-struct='yes' visibility='default' filepath='drivers/i3c/master.c' line='2274' column='1' id='581d9826'>
+      <class-decl name='i3c_generic_ibi_slot' size-in-bits='704' is-struct='yes' visibility='default' filepath='drivers/i3c/master.c' line='2276' column='1' id='581d9826'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='node' type-id='72f469ec' visibility='default' filepath='drivers/i3c/master.c' line='2275' column='1'/>
+          <var-decl name='node' type-id='72f469ec' visibility='default' filepath='drivers/i3c/master.c' line='2277' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='base' type-id='81e9d700' visibility='default' filepath='drivers/i3c/master.c' line='2276' column='1'/>
+          <var-decl name='base' type-id='81e9d700' visibility='default' filepath='drivers/i3c/master.c' line='2278' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='be37740b' size-in-bits='64' id='581e52eb'/>
@@ -44782,7 +44801,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='4fb62cb0' size-in-bits='64' id='5f493a9f'/>
-      <enum-decl name='tcp_ca_event' filepath='include/net/tcp.h' line='1001' column='1' id='5f51e977'>
+      <enum-decl name='tcp_ca_event' filepath='include/net/tcp.h' line='1004' column='1' id='5f51e977'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='CA_EVENT_TX_START' value='0'/>
         <enumerator name='CA_EVENT_CWND_RESTART' value='1'/>
@@ -44792,81 +44811,81 @@
         <enumerator name='CA_EVENT_ECN_IS_CE' value='5'/>
       </enum-decl>
       <pointer-type-def type-id='ebcc73dc' size-in-bits='64' id='5f5506f6'/>
-      <class-decl name='inode_operations' size-in-bits='2048' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='1932' column='1' id='5f5aa1ff'>
+      <class-decl name='inode_operations' size-in-bits='2048' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='1975' column='1' id='5f5aa1ff'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='lookup' type-id='02f90a61' visibility='default' filepath='include/linux/fs.h' line='1933' column='1'/>
+          <var-decl name='lookup' type-id='02f90a61' visibility='default' filepath='include/linux/fs.h' line='1976' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='get_link' type-id='76ae8e1d' visibility='default' filepath='include/linux/fs.h' line='1934' column='1'/>
+          <var-decl name='get_link' type-id='76ae8e1d' visibility='default' filepath='include/linux/fs.h' line='1977' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='permission' type-id='f4f91b99' visibility='default' filepath='include/linux/fs.h' line='1935' column='1'/>
+          <var-decl name='permission' type-id='f4f91b99' visibility='default' filepath='include/linux/fs.h' line='1978' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='get_acl' type-id='7f30b822' visibility='default' filepath='include/linux/fs.h' line='1936' column='1'/>
+          <var-decl name='get_acl' type-id='7f30b822' visibility='default' filepath='include/linux/fs.h' line='1979' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='readlink' type-id='a57bd028' visibility='default' filepath='include/linux/fs.h' line='1938' column='1'/>
+          <var-decl name='readlink' type-id='a57bd028' visibility='default' filepath='include/linux/fs.h' line='1981' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='create' type-id='c9cd0e09' visibility='default' filepath='include/linux/fs.h' line='1940' column='1'/>
+          <var-decl name='create' type-id='c9cd0e09' visibility='default' filepath='include/linux/fs.h' line='1983' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='link' type-id='4b872e00' visibility='default' filepath='include/linux/fs.h' line='1941' column='1'/>
+          <var-decl name='link' type-id='4b872e00' visibility='default' filepath='include/linux/fs.h' line='1984' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='unlink' type-id='7f5be7f6' visibility='default' filepath='include/linux/fs.h' line='1942' column='1'/>
+          <var-decl name='unlink' type-id='7f5be7f6' visibility='default' filepath='include/linux/fs.h' line='1985' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='symlink' type-id='234843b5' visibility='default' filepath='include/linux/fs.h' line='1943' column='1'/>
+          <var-decl name='symlink' type-id='234843b5' visibility='default' filepath='include/linux/fs.h' line='1986' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='mkdir' type-id='98c2d938' visibility='default' filepath='include/linux/fs.h' line='1944' column='1'/>
+          <var-decl name='mkdir' type-id='98c2d938' visibility='default' filepath='include/linux/fs.h' line='1987' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='rmdir' type-id='7f5be7f6' visibility='default' filepath='include/linux/fs.h' line='1945' column='1'/>
+          <var-decl name='rmdir' type-id='7f5be7f6' visibility='default' filepath='include/linux/fs.h' line='1988' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='mknod' type-id='f9e0c0e5' visibility='default' filepath='include/linux/fs.h' line='1946' column='1'/>
+          <var-decl name='mknod' type-id='f9e0c0e5' visibility='default' filepath='include/linux/fs.h' line='1989' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='rename' type-id='7733ef81' visibility='default' filepath='include/linux/fs.h' line='1947' column='1'/>
+          <var-decl name='rename' type-id='7733ef81' visibility='default' filepath='include/linux/fs.h' line='1990' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='setattr' type-id='c237e829' visibility='default' filepath='include/linux/fs.h' line='1949' column='1'/>
+          <var-decl name='setattr' type-id='c237e829' visibility='default' filepath='include/linux/fs.h' line='1992' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='getattr' type-id='0b787edf' visibility='default' filepath='include/linux/fs.h' line='1950' column='1'/>
+          <var-decl name='getattr' type-id='0b787edf' visibility='default' filepath='include/linux/fs.h' line='1993' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='listxattr' type-id='3494e4bb' visibility='default' filepath='include/linux/fs.h' line='1951' column='1'/>
+          <var-decl name='listxattr' type-id='3494e4bb' visibility='default' filepath='include/linux/fs.h' line='1994' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='fiemap' type-id='0508acce' visibility='default' filepath='include/linux/fs.h' line='1952' column='1'/>
+          <var-decl name='fiemap' type-id='0508acce' visibility='default' filepath='include/linux/fs.h' line='1995' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='update_time' type-id='64ecf6a5' visibility='default' filepath='include/linux/fs.h' line='1954' column='1'/>
+          <var-decl name='update_time' type-id='64ecf6a5' visibility='default' filepath='include/linux/fs.h' line='1997' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='atomic_open' type-id='d3807eb0' visibility='default' filepath='include/linux/fs.h' line='1955' column='1'/>
+          <var-decl name='atomic_open' type-id='d3807eb0' visibility='default' filepath='include/linux/fs.h' line='1998' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='tmpfile' type-id='98c2d938' visibility='default' filepath='include/linux/fs.h' line='1958' column='1'/>
+          <var-decl name='tmpfile' type-id='98c2d938' visibility='default' filepath='include/linux/fs.h' line='2001' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='set_acl' type-id='820976ef' visibility='default' filepath='include/linux/fs.h' line='1959' column='1'/>
+          <var-decl name='set_acl' type-id='820976ef' visibility='default' filepath='include/linux/fs.h' line='2002' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1961' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2004' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1962' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2005' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1963' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2006' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1964' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2007' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='5f5b9bdb'>
@@ -46916,21 +46935,21 @@
       <pointer-type-def type-id='eaa32e2f' size-in-bits='64' id='63e171df'/>
       <typedef-decl name='__kernel_pid_t' type-id='95e97e5e' filepath='include/uapi/asm-generic/posix_types.h' line='28' column='1' id='63eb2bf2'/>
       <pointer-type-def type-id='e29a2892' size-in-bits='64' id='63faaa44'/>
-      <class-decl name='filename' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='2598' column='1' id='63fc6210'>
+      <class-decl name='filename' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='2641' column='1' id='63fc6210'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='include/linux/fs.h' line='2599' column='1'/>
+          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='include/linux/fs.h' line='2642' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='uptr' type-id='80f4b756' visibility='default' filepath='include/linux/fs.h' line='2600' column='1'/>
+          <var-decl name='uptr' type-id='80f4b756' visibility='default' filepath='include/linux/fs.h' line='2643' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='refcnt' type-id='95e97e5e' visibility='default' filepath='include/linux/fs.h' line='2601' column='1'/>
+          <var-decl name='refcnt' type-id='95e97e5e' visibility='default' filepath='include/linux/fs.h' line='2644' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='aname' type-id='5acb442f' visibility='default' filepath='include/linux/fs.h' line='2602' column='1'/>
+          <var-decl name='aname' type-id='5acb442f' visibility='default' filepath='include/linux/fs.h' line='2645' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='iname' type-id='0904d1cc' visibility='default' filepath='include/linux/fs.h' line='2603' column='1'/>
+          <var-decl name='iname' type-id='0904d1cc' visibility='default' filepath='include/linux/fs.h' line='2646' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='1aafc68e' size-in-bits='64' id='64015654'/>
@@ -49203,42 +49222,42 @@
       </function-type>
       <pointer-type-def type-id='262a563e' size-in-bits='64' id='6910c028'/>
       <typedef-decl name='efi_query_variable_info_t' type-id='23aa5fb5' filepath='include/linux/efi.h' line='255' column='1' id='69175bf8'/>
-      <class-decl name='dquot' size-in-bits='1792' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='294' column='1' id='691a06da'>
+      <class-decl name='dquot' size-in-bits='1792' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='296' column='1' id='691a06da'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='dq_hash' type-id='03a4a074' visibility='default' filepath='include/linux/quota.h' line='295' column='1'/>
+          <var-decl name='dq_hash' type-id='03a4a074' visibility='default' filepath='include/linux/quota.h' line='297' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='dq_inuse' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='296' column='1'/>
+          <var-decl name='dq_inuse' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='298' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='dq_free' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='297' column='1'/>
+          <var-decl name='dq_free' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='299' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='dq_dirty' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='298' column='1'/>
+          <var-decl name='dq_dirty' type-id='72f469ec' visibility='default' filepath='include/linux/quota.h' line='300' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='dq_lock' type-id='925167dc' visibility='default' filepath='include/linux/quota.h' line='299' column='1'/>
+          <var-decl name='dq_lock' type-id='925167dc' visibility='default' filepath='include/linux/quota.h' line='301' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='dq_dqb_lock' type-id='fb4018a0' visibility='default' filepath='include/linux/quota.h' line='300' column='1'/>
+          <var-decl name='dq_dqb_lock' type-id='fb4018a0' visibility='default' filepath='include/linux/quota.h' line='302' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='928'>
-          <var-decl name='dq_count' type-id='49178f86' visibility='default' filepath='include/linux/quota.h' line='301' column='1'/>
+          <var-decl name='dq_count' type-id='49178f86' visibility='default' filepath='include/linux/quota.h' line='303' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='dq_sb' type-id='42c8f564' visibility='default' filepath='include/linux/quota.h' line='302' column='1'/>
+          <var-decl name='dq_sb' type-id='42c8f564' visibility='default' filepath='include/linux/quota.h' line='304' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='dq_id' type-id='72028e1c' visibility='default' filepath='include/linux/quota.h' line='303' column='1'/>
+          <var-decl name='dq_id' type-id='72028e1c' visibility='default' filepath='include/linux/quota.h' line='305' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='dq_off' type-id='69bf7bee' visibility='default' filepath='include/linux/quota.h' line='304' column='1'/>
+          <var-decl name='dq_off' type-id='69bf7bee' visibility='default' filepath='include/linux/quota.h' line='306' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='dq_flags' type-id='7359adad' visibility='default' filepath='include/linux/quota.h' line='305' column='1'/>
+          <var-decl name='dq_flags' type-id='7359adad' visibility='default' filepath='include/linux/quota.h' line='307' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='dq_dqb' type-id='bd17a943' visibility='default' filepath='include/linux/quota.h' line='306' column='1'/>
+          <var-decl name='dq_dqb' type-id='bd17a943' visibility='default' filepath='include/linux/quota.h' line='308' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='8468004b' size-in-bits='64' id='691d1b3b'/>
@@ -55692,15 +55711,15 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='d800b1bf' size-in-bits='64' id='79dbccfb'/>
-      <class-decl name='inet6_cork' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/ipv6.h' line='194' column='1' id='79e3d9fd'>
+      <class-decl name='inet6_cork' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/ipv6.h' line='195' column='1' id='79e3d9fd'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='opt' type-id='d4145729' visibility='default' filepath='include/linux/ipv6.h' line='195' column='1'/>
+          <var-decl name='opt' type-id='d4145729' visibility='default' filepath='include/linux/ipv6.h' line='196' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='hop_limit' type-id='f9b06939' visibility='default' filepath='include/linux/ipv6.h' line='196' column='1'/>
+          <var-decl name='hop_limit' type-id='f9b06939' visibility='default' filepath='include/linux/ipv6.h' line='197' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='72'>
-          <var-decl name='tclass' type-id='f9b06939' visibility='default' filepath='include/linux/ipv6.h' line='197' column='1'/>
+          <var-decl name='tclass' type-id='f9b06939' visibility='default' filepath='include/linux/ipv6.h' line='198' column='1'/>
         </data-member>
       </class-decl>
       <qualified-type-def type-id='b16ef9f3' const='yes' id='79eccb20'/>
@@ -57490,114 +57509,114 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='c551f1b5' size-in-bits='64' id='7dfe7cd1'/>
-      <class-decl name='file_operations' size-in-bits='2304' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='1885' column='1' id='7dffcde2'>
+      <class-decl name='file_operations' size-in-bits='2304' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='1928' column='1' id='7dffcde2'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/linux/fs.h' line='1886' column='1'/>
+          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/linux/fs.h' line='1929' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='llseek' type-id='07ebb4cd' visibility='default' filepath='include/linux/fs.h' line='1887' column='1'/>
+          <var-decl name='llseek' type-id='07ebb4cd' visibility='default' filepath='include/linux/fs.h' line='1930' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='read' type-id='4d8f5625' visibility='default' filepath='include/linux/fs.h' line='1888' column='1'/>
+          <var-decl name='read' type-id='4d8f5625' visibility='default' filepath='include/linux/fs.h' line='1931' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='write' type-id='5f29549c' visibility='default' filepath='include/linux/fs.h' line='1889' column='1'/>
+          <var-decl name='write' type-id='5f29549c' visibility='default' filepath='include/linux/fs.h' line='1932' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='read_iter' type-id='227e209d' visibility='default' filepath='include/linux/fs.h' line='1890' column='1'/>
+          <var-decl name='read_iter' type-id='227e209d' visibility='default' filepath='include/linux/fs.h' line='1933' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='write_iter' type-id='227e209d' visibility='default' filepath='include/linux/fs.h' line='1891' column='1'/>
+          <var-decl name='write_iter' type-id='227e209d' visibility='default' filepath='include/linux/fs.h' line='1934' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='iopoll' type-id='6c4618be' visibility='default' filepath='include/linux/fs.h' line='1892' column='1'/>
+          <var-decl name='iopoll' type-id='6c4618be' visibility='default' filepath='include/linux/fs.h' line='1935' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='iterate' type-id='42beb73a' visibility='default' filepath='include/linux/fs.h' line='1893' column='1'/>
+          <var-decl name='iterate' type-id='42beb73a' visibility='default' filepath='include/linux/fs.h' line='1936' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='iterate_shared' type-id='42beb73a' visibility='default' filepath='include/linux/fs.h' line='1894' column='1'/>
+          <var-decl name='iterate_shared' type-id='42beb73a' visibility='default' filepath='include/linux/fs.h' line='1937' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='poll' type-id='4d01ede7' visibility='default' filepath='include/linux/fs.h' line='1895' column='1'/>
+          <var-decl name='poll' type-id='4d01ede7' visibility='default' filepath='include/linux/fs.h' line='1938' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='unlocked_ioctl' type-id='fc7daf55' visibility='default' filepath='include/linux/fs.h' line='1896' column='1'/>
+          <var-decl name='unlocked_ioctl' type-id='fc7daf55' visibility='default' filepath='include/linux/fs.h' line='1939' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='compat_ioctl' type-id='fc7daf55' visibility='default' filepath='include/linux/fs.h' line='1897' column='1'/>
+          <var-decl name='compat_ioctl' type-id='fc7daf55' visibility='default' filepath='include/linux/fs.h' line='1940' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='mmap' type-id='8ea2626c' visibility='default' filepath='include/linux/fs.h' line='1898' column='1'/>
+          <var-decl name='mmap' type-id='8ea2626c' visibility='default' filepath='include/linux/fs.h' line='1941' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='mmap_supported_flags' type-id='7359adad' visibility='default' filepath='include/linux/fs.h' line='1899' column='1'/>
+          <var-decl name='mmap_supported_flags' type-id='7359adad' visibility='default' filepath='include/linux/fs.h' line='1942' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='open' type-id='47800058' visibility='default' filepath='include/linux/fs.h' line='1900' column='1'/>
+          <var-decl name='open' type-id='47800058' visibility='default' filepath='include/linux/fs.h' line='1943' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='flush' type-id='5ddef2dd' visibility='default' filepath='include/linux/fs.h' line='1901' column='1'/>
+          <var-decl name='flush' type-id='5ddef2dd' visibility='default' filepath='include/linux/fs.h' line='1944' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='release' type-id='47800058' visibility='default' filepath='include/linux/fs.h' line='1902' column='1'/>
+          <var-decl name='release' type-id='47800058' visibility='default' filepath='include/linux/fs.h' line='1945' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='fsync' type-id='31cc9254' visibility='default' filepath='include/linux/fs.h' line='1903' column='1'/>
+          <var-decl name='fsync' type-id='31cc9254' visibility='default' filepath='include/linux/fs.h' line='1946' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='fasync' type-id='b94ac371' visibility='default' filepath='include/linux/fs.h' line='1904' column='1'/>
+          <var-decl name='fasync' type-id='b94ac371' visibility='default' filepath='include/linux/fs.h' line='1947' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='lock' type-id='12f0ff82' visibility='default' filepath='include/linux/fs.h' line='1905' column='1'/>
+          <var-decl name='lock' type-id='12f0ff82' visibility='default' filepath='include/linux/fs.h' line='1948' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='sendpage' type-id='40da47a8' visibility='default' filepath='include/linux/fs.h' line='1906' column='1'/>
+          <var-decl name='sendpage' type-id='40da47a8' visibility='default' filepath='include/linux/fs.h' line='1949' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='get_unmapped_area' type-id='d44a8cec' visibility='default' filepath='include/linux/fs.h' line='1907' column='1'/>
+          <var-decl name='get_unmapped_area' type-id='d44a8cec' visibility='default' filepath='include/linux/fs.h' line='1950' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='check_flags' type-id='7f416e10' visibility='default' filepath='include/linux/fs.h' line='1908' column='1'/>
+          <var-decl name='check_flags' type-id='7f416e10' visibility='default' filepath='include/linux/fs.h' line='1951' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='flock' type-id='12f0ff82' visibility='default' filepath='include/linux/fs.h' line='1909' column='1'/>
+          <var-decl name='flock' type-id='12f0ff82' visibility='default' filepath='include/linux/fs.h' line='1952' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='splice_write' type-id='b22f4610' visibility='default' filepath='include/linux/fs.h' line='1910' column='1'/>
+          <var-decl name='splice_write' type-id='b22f4610' visibility='default' filepath='include/linux/fs.h' line='1953' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='splice_read' type-id='72cd68b0' visibility='default' filepath='include/linux/fs.h' line='1911' column='1'/>
+          <var-decl name='splice_read' type-id='72cd68b0' visibility='default' filepath='include/linux/fs.h' line='1954' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='setlease' type-id='87e3d3e2' visibility='default' filepath='include/linux/fs.h' line='1912' column='1'/>
+          <var-decl name='setlease' type-id='87e3d3e2' visibility='default' filepath='include/linux/fs.h' line='1955' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1728'>
-          <var-decl name='fallocate' type-id='a53e2328' visibility='default' filepath='include/linux/fs.h' line='1913' column='1'/>
+          <var-decl name='fallocate' type-id='a53e2328' visibility='default' filepath='include/linux/fs.h' line='1956' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1792'>
-          <var-decl name='show_fdinfo' type-id='eda08098' visibility='default' filepath='include/linux/fs.h' line='1915' column='1'/>
+          <var-decl name='show_fdinfo' type-id='eda08098' visibility='default' filepath='include/linux/fs.h' line='1958' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1856'>
-          <var-decl name='copy_file_range' type-id='d0882d6b' visibility='default' filepath='include/linux/fs.h' line='1919' column='1'/>
+          <var-decl name='copy_file_range' type-id='d0882d6b' visibility='default' filepath='include/linux/fs.h' line='1962' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1920'>
-          <var-decl name='remap_file_range' type-id='c1de1086' visibility='default' filepath='include/linux/fs.h' line='1921' column='1'/>
+          <var-decl name='remap_file_range' type-id='c1de1086' visibility='default' filepath='include/linux/fs.h' line='1964' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1984'>
-          <var-decl name='fadvise' type-id='31cc9254' visibility='default' filepath='include/linux/fs.h' line='1924' column='1'/>
+          <var-decl name='fadvise' type-id='31cc9254' visibility='default' filepath='include/linux/fs.h' line='1967' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2048'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1926' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1969' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2112'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1927' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1970' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2176'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1928' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1971' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2240'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1929' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1972' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='7e019027'>
@@ -61674,96 +61693,96 @@
         <parameter type-id='231422bf'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='super_operations' size-in-bits='1920' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='2008' column='1' id='874691ab'>
+      <class-decl name='super_operations' size-in-bits='1920' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='2051' column='1' id='874691ab'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='alloc_inode' type-id='e8c4dba4' visibility='default' filepath='include/linux/fs.h' line='2009' column='1'/>
+          <var-decl name='alloc_inode' type-id='e8c4dba4' visibility='default' filepath='include/linux/fs.h' line='2052' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='destroy_inode' type-id='4f3d95df' visibility='default' filepath='include/linux/fs.h' line='2010' column='1'/>
+          <var-decl name='destroy_inode' type-id='4f3d95df' visibility='default' filepath='include/linux/fs.h' line='2053' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='free_inode' type-id='4f3d95df' visibility='default' filepath='include/linux/fs.h' line='2011' column='1'/>
+          <var-decl name='free_inode' type-id='4f3d95df' visibility='default' filepath='include/linux/fs.h' line='2054' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='dirty_inode' type-id='5f5506f6' visibility='default' filepath='include/linux/fs.h' line='2013' column='1'/>
+          <var-decl name='dirty_inode' type-id='5f5506f6' visibility='default' filepath='include/linux/fs.h' line='2056' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='write_inode' type-id='fd780be6' visibility='default' filepath='include/linux/fs.h' line='2014' column='1'/>
+          <var-decl name='write_inode' type-id='fd780be6' visibility='default' filepath='include/linux/fs.h' line='2057' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='drop_inode' type-id='28ba4492' visibility='default' filepath='include/linux/fs.h' line='2015' column='1'/>
+          <var-decl name='drop_inode' type-id='28ba4492' visibility='default' filepath='include/linux/fs.h' line='2058' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='evict_inode' type-id='4f3d95df' visibility='default' filepath='include/linux/fs.h' line='2016' column='1'/>
+          <var-decl name='evict_inode' type-id='4f3d95df' visibility='default' filepath='include/linux/fs.h' line='2059' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='put_super' type-id='1ff54a45' visibility='default' filepath='include/linux/fs.h' line='2017' column='1'/>
+          <var-decl name='put_super' type-id='1ff54a45' visibility='default' filepath='include/linux/fs.h' line='2060' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='sync_fs' type-id='dcab5203' visibility='default' filepath='include/linux/fs.h' line='2018' column='1'/>
+          <var-decl name='sync_fs' type-id='dcab5203' visibility='default' filepath='include/linux/fs.h' line='2061' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='freeze_super' type-id='d2f4c704' visibility='default' filepath='include/linux/fs.h' line='2019' column='1'/>
+          <var-decl name='freeze_super' type-id='d2f4c704' visibility='default' filepath='include/linux/fs.h' line='2062' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='freeze_fs' type-id='d2f4c704' visibility='default' filepath='include/linux/fs.h' line='2020' column='1'/>
+          <var-decl name='freeze_fs' type-id='d2f4c704' visibility='default' filepath='include/linux/fs.h' line='2063' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='thaw_super' type-id='d2f4c704' visibility='default' filepath='include/linux/fs.h' line='2021' column='1'/>
+          <var-decl name='thaw_super' type-id='d2f4c704' visibility='default' filepath='include/linux/fs.h' line='2064' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='unfreeze_fs' type-id='d2f4c704' visibility='default' filepath='include/linux/fs.h' line='2022' column='1'/>
+          <var-decl name='unfreeze_fs' type-id='d2f4c704' visibility='default' filepath='include/linux/fs.h' line='2065' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='statfs' type-id='35646c79' visibility='default' filepath='include/linux/fs.h' line='2023' column='1'/>
+          <var-decl name='statfs' type-id='35646c79' visibility='default' filepath='include/linux/fs.h' line='2066' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='remount_fs' type-id='552c8f87' visibility='default' filepath='include/linux/fs.h' line='2024' column='1'/>
+          <var-decl name='remount_fs' type-id='552c8f87' visibility='default' filepath='include/linux/fs.h' line='2067' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='umount_begin' type-id='1ff54a45' visibility='default' filepath='include/linux/fs.h' line='2025' column='1'/>
+          <var-decl name='umount_begin' type-id='1ff54a45' visibility='default' filepath='include/linux/fs.h' line='2068' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='show_options' type-id='c94f6b13' visibility='default' filepath='include/linux/fs.h' line='2027' column='1'/>
+          <var-decl name='show_options' type-id='c94f6b13' visibility='default' filepath='include/linux/fs.h' line='2070' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='show_devname' type-id='c94f6b13' visibility='default' filepath='include/linux/fs.h' line='2028' column='1'/>
+          <var-decl name='show_devname' type-id='c94f6b13' visibility='default' filepath='include/linux/fs.h' line='2071' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='show_path' type-id='c94f6b13' visibility='default' filepath='include/linux/fs.h' line='2029' column='1'/>
+          <var-decl name='show_path' type-id='c94f6b13' visibility='default' filepath='include/linux/fs.h' line='2072' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='show_stats' type-id='c94f6b13' visibility='default' filepath='include/linux/fs.h' line='2030' column='1'/>
+          <var-decl name='show_stats' type-id='c94f6b13' visibility='default' filepath='include/linux/fs.h' line='2073' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='quota_read' type-id='e295c77c' visibility='default' filepath='include/linux/fs.h' line='2032' column='1'/>
+          <var-decl name='quota_read' type-id='e295c77c' visibility='default' filepath='include/linux/fs.h' line='2075' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='quota_write' type-id='a9b95107' visibility='default' filepath='include/linux/fs.h' line='2033' column='1'/>
+          <var-decl name='quota_write' type-id='a9b95107' visibility='default' filepath='include/linux/fs.h' line='2076' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='get_dquots' type-id='ae02292a' visibility='default' filepath='include/linux/fs.h' line='2034' column='1'/>
+          <var-decl name='get_dquots' type-id='ae02292a' visibility='default' filepath='include/linux/fs.h' line='2077' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='bdev_try_to_free_page' type-id='ea44f8d2' visibility='default' filepath='include/linux/fs.h' line='2036' column='1'/>
+          <var-decl name='bdev_try_to_free_page' type-id='ea44f8d2' visibility='default' filepath='include/linux/fs.h' line='2079' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='nr_cached_objects' type-id='c4facf61' visibility='default' filepath='include/linux/fs.h' line='2037' column='1'/>
+          <var-decl name='nr_cached_objects' type-id='c4facf61' visibility='default' filepath='include/linux/fs.h' line='2080' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='free_cached_objects' type-id='c4facf61' visibility='default' filepath='include/linux/fs.h' line='2039' column='1'/>
+          <var-decl name='free_cached_objects' type-id='c4facf61' visibility='default' filepath='include/linux/fs.h' line='2082' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2042' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2085' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1728'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2043' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2086' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1792'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2044' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2087' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1856'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2045' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='2088' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='drm_agp_head' is-struct='yes' visibility='default' is-declaration-only='yes' id='874fb8c0'/>
@@ -61974,36 +61993,36 @@
           <var-decl name='hpd_data' type-id='eaa32e2f' visibility='default' filepath='include/drm/drm_bridge.h' line='762' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='quota_format_ops' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='310' column='1' id='87cad984'>
+      <class-decl name='quota_format_ops' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='312' column='1' id='87cad984'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='check_quota_file' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='311' column='1'/>
+          <var-decl name='check_quota_file' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='313' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='read_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='312' column='1'/>
+          <var-decl name='read_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='314' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='write_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='313' column='1'/>
+          <var-decl name='write_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='315' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='free_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='314' column='1'/>
+          <var-decl name='free_file_info' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='316' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='read_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='315' column='1'/>
+          <var-decl name='read_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='317' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='commit_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='316' column='1'/>
+          <var-decl name='commit_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='318' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='release_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='317' column='1'/>
+          <var-decl name='release_dqblk' type-id='24c1e1dc' visibility='default' filepath='include/linux/quota.h' line='319' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='get_next_id' type-id='70b08f83' visibility='default' filepath='include/linux/quota.h' line='318' column='1'/>
+          <var-decl name='get_next_id' type-id='70b08f83' visibility='default' filepath='include/linux/quota.h' line='320' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='320' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='322' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='321' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='323' column='1'/>
         </data-member>
       </class-decl>
       <array-type-def dimensions='1' type-id='8af57d41' size-in-bits='32' id='87ce7f1e'>
@@ -63267,21 +63286,21 @@
           <var-decl name='_pkey' type-id='3f1a6b60' visibility='default' filepath='include/uapi/asm-generic/siginfo.h' line='92' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='tcp_fastopen_request' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1689' column='1' id='8a4245ed'>
+      <class-decl name='tcp_fastopen_request' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1692' column='1' id='8a4245ed'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='cookie' type-id='98fc5aa2' visibility='default' filepath='include/net/tcp.h' line='1691' column='1'/>
+          <var-decl name='cookie' type-id='98fc5aa2' visibility='default' filepath='include/net/tcp.h' line='1694' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='data' type-id='6b9b777a' visibility='default' filepath='include/net/tcp.h' line='1692' column='1'/>
+          <var-decl name='data' type-id='6b9b777a' visibility='default' filepath='include/net/tcp.h' line='1695' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='size' type-id='b59d7dce' visibility='default' filepath='include/net/tcp.h' line='1693' column='1'/>
+          <var-decl name='size' type-id='b59d7dce' visibility='default' filepath='include/net/tcp.h' line='1696' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='copied' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1694' column='1'/>
+          <var-decl name='copied' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1697' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='uarg' type-id='73789784' visibility='default' filepath='include/net/tcp.h' line='1695' column='1'/>
+          <var-decl name='uarg' type-id='73789784' visibility='default' filepath='include/net/tcp.h' line='1698' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='snd_soc_tplg_vendor_array' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/uapi/sound/asoc.h' line='218' column='1' id='8a4504f5'>
@@ -64183,45 +64202,45 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='9df4c74e' size-in-bits='64' id='8ce270a4'/>
-      <class-decl name='quotactl_ops' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='434' column='1' id='8ce4ff83'>
+      <class-decl name='quotactl_ops' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='436' column='1' id='8ce4ff83'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='quota_on' type-id='de6b64d0' visibility='default' filepath='include/linux/quota.h' line='435' column='1'/>
+          <var-decl name='quota_on' type-id='de6b64d0' visibility='default' filepath='include/linux/quota.h' line='437' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='quota_off' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='436' column='1'/>
+          <var-decl name='quota_off' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='438' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='quota_enable' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='437' column='1'/>
+          <var-decl name='quota_enable' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='439' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='quota_disable' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='438' column='1'/>
+          <var-decl name='quota_disable' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='440' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='quota_sync' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='439' column='1'/>
+          <var-decl name='quota_sync' type-id='dcab5203' visibility='default' filepath='include/linux/quota.h' line='441' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='set_info' type-id='4e326e06' visibility='default' filepath='include/linux/quota.h' line='440' column='1'/>
+          <var-decl name='set_info' type-id='4e326e06' visibility='default' filepath='include/linux/quota.h' line='442' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='get_dqblk' type-id='9e27a8d4' visibility='default' filepath='include/linux/quota.h' line='441' column='1'/>
+          <var-decl name='get_dqblk' type-id='9e27a8d4' visibility='default' filepath='include/linux/quota.h' line='443' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='get_nextdqblk' type-id='483e8c3a' visibility='default' filepath='include/linux/quota.h' line='442' column='1'/>
+          <var-decl name='get_nextdqblk' type-id='483e8c3a' visibility='default' filepath='include/linux/quota.h' line='444' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='set_dqblk' type-id='9e27a8d4' visibility='default' filepath='include/linux/quota.h' line='444' column='1'/>
+          <var-decl name='set_dqblk' type-id='9e27a8d4' visibility='default' filepath='include/linux/quota.h' line='446' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='get_state' type-id='eb638046' visibility='default' filepath='include/linux/quota.h' line='445' column='1'/>
+          <var-decl name='get_state' type-id='eb638046' visibility='default' filepath='include/linux/quota.h' line='447' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='rm_xquota' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='446' column='1'/>
+          <var-decl name='rm_xquota' type-id='7aa5a21e' visibility='default' filepath='include/linux/quota.h' line='448' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='448' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='450' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='449' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='451' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='e09dbee3' size-in-bits='64' id='8ceda7f7'/>
@@ -64545,102 +64564,102 @@
           <var-decl name='pprev' type-id='e89ddc13' visibility='default' filepath='include/linux/list_bl.h' line='39' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='inet6_dev' size-in-bits='5632' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='171' column='1' id='8db8de2b'>
+      <class-decl name='inet6_dev' size-in-bits='5632' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='167' column='1' id='8db8de2b'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='dev' type-id='68a2d05b' visibility='default' filepath='include/net/if_inet6.h' line='172' column='1'/>
+          <var-decl name='dev' type-id='68a2d05b' visibility='default' filepath='include/net/if_inet6.h' line='168' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='addr_list' type-id='72f469ec' visibility='default' filepath='include/net/if_inet6.h' line='174' column='1'/>
+          <var-decl name='addr_list' type-id='72f469ec' visibility='default' filepath='include/net/if_inet6.h' line='170' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='mc_list' type-id='d1ca3a89' visibility='default' filepath='include/net/if_inet6.h' line='176' column='1'/>
+          <var-decl name='mc_list' type-id='d1ca3a89' visibility='default' filepath='include/net/if_inet6.h' line='172' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='mc_tomb' type-id='d1ca3a89' visibility='default' filepath='include/net/if_inet6.h' line='177' column='1'/>
+          <var-decl name='mc_tomb' type-id='d1ca3a89' visibility='default' filepath='include/net/if_inet6.h' line='173' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='mc_lock' type-id='fb4018a0' visibility='default' filepath='include/net/if_inet6.h' line='178' column='1'/>
+          <var-decl name='mc_lock' type-id='fb4018a0' visibility='default' filepath='include/net/if_inet6.h' line='174' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='352'>
-          <var-decl name='mc_qrv' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='180' column='1'/>
+          <var-decl name='mc_qrv' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='176' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='360'>
-          <var-decl name='mc_gq_running' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='181' column='1'/>
+          <var-decl name='mc_gq_running' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='177' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='368'>
-          <var-decl name='mc_ifc_count' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='182' column='1'/>
+          <var-decl name='mc_ifc_count' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='178' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='376'>
-          <var-decl name='mc_dad_count' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='183' column='1'/>
+          <var-decl name='mc_dad_count' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='179' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='mc_v1_seen' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='185' column='1'/>
+          <var-decl name='mc_v1_seen' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='181' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='mc_qi' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='186' column='1'/>
+          <var-decl name='mc_qi' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='182' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='mc_qri' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='187' column='1'/>
+          <var-decl name='mc_qri' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='183' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='mc_maxdelay' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='188' column='1'/>
+          <var-decl name='mc_maxdelay' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='184' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='mc_gq_timer' type-id='abe41e67' visibility='default' filepath='include/net/if_inet6.h' line='190' column='1'/>
+          <var-decl name='mc_gq_timer' type-id='abe41e67' visibility='default' filepath='include/net/if_inet6.h' line='186' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='mc_ifc_timer' type-id='abe41e67' visibility='default' filepath='include/net/if_inet6.h' line='191' column='1'/>
+          <var-decl name='mc_ifc_timer' type-id='abe41e67' visibility='default' filepath='include/net/if_inet6.h' line='187' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='mc_dad_timer' type-id='abe41e67' visibility='default' filepath='include/net/if_inet6.h' line='192' column='1'/>
+          <var-decl name='mc_dad_timer' type-id='abe41e67' visibility='default' filepath='include/net/if_inet6.h' line='188' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1984'>
-          <var-decl name='ac_list' type-id='034d7ded' visibility='default' filepath='include/net/if_inet6.h' line='194' column='1'/>
+          <var-decl name='ac_list' type-id='034d7ded' visibility='default' filepath='include/net/if_inet6.h' line='190' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2048'>
-          <var-decl name='lock' type-id='ac16795b' visibility='default' filepath='include/net/if_inet6.h' line='195' column='1'/>
+          <var-decl name='lock' type-id='ac16795b' visibility='default' filepath='include/net/if_inet6.h' line='191' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2112'>
-          <var-decl name='refcnt' type-id='64615833' visibility='default' filepath='include/net/if_inet6.h' line='196' column='1'/>
+          <var-decl name='refcnt' type-id='64615833' visibility='default' filepath='include/net/if_inet6.h' line='192' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2144'>
-          <var-decl name='if_flags' type-id='3f1a6b60' visibility='default' filepath='include/net/if_inet6.h' line='197' column='1'/>
+          <var-decl name='if_flags' type-id='3f1a6b60' visibility='default' filepath='include/net/if_inet6.h' line='193' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2176'>
-          <var-decl name='dead' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='198' column='1'/>
+          <var-decl name='dead' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='194' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2208'>
-          <var-decl name='desync_factor' type-id='19c2251e' visibility='default' filepath='include/net/if_inet6.h' line='200' column='1'/>
+          <var-decl name='desync_factor' type-id='19c2251e' visibility='default' filepath='include/net/if_inet6.h' line='196' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2240'>
-          <var-decl name='tempaddr_list' type-id='72f469ec' visibility='default' filepath='include/net/if_inet6.h' line='201' column='1'/>
+          <var-decl name='tempaddr_list' type-id='72f469ec' visibility='default' filepath='include/net/if_inet6.h' line='197' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2368'>
-          <var-decl name='token' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='203' column='1'/>
+          <var-decl name='token' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='199' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2496'>
-          <var-decl name='nd_parms' type-id='affe0fe2' visibility='default' filepath='include/net/if_inet6.h' line='205' column='1'/>
+          <var-decl name='nd_parms' type-id='affe0fe2' visibility='default' filepath='include/net/if_inet6.h' line='201' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2560'>
-          <var-decl name='cnf' type-id='55e8af82' visibility='default' filepath='include/net/if_inet6.h' line='206' column='1'/>
+          <var-decl name='cnf' type-id='55e8af82' visibility='default' filepath='include/net/if_inet6.h' line='202' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4672'>
-          <var-decl name='stats' type-id='0e97f526' visibility='default' filepath='include/net/if_inet6.h' line='207' column='1'/>
+          <var-decl name='stats' type-id='0e97f526' visibility='default' filepath='include/net/if_inet6.h' line='203' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4928'>
-          <var-decl name='rs_timer' type-id='abe41e67' visibility='default' filepath='include/net/if_inet6.h' line='209' column='1'/>
+          <var-decl name='rs_timer' type-id='abe41e67' visibility='default' filepath='include/net/if_inet6.h' line='205' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5376'>
-          <var-decl name='rs_interval' type-id='3158a266' visibility='default' filepath='include/net/if_inet6.h' line='210' column='1'/>
+          <var-decl name='rs_interval' type-id='3158a266' visibility='default' filepath='include/net/if_inet6.h' line='206' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5408'>
-          <var-decl name='rs_probes' type-id='8f048e17' visibility='default' filepath='include/net/if_inet6.h' line='211' column='1'/>
+          <var-decl name='rs_probes' type-id='8f048e17' visibility='default' filepath='include/net/if_inet6.h' line='207' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5440'>
-          <var-decl name='tstamp' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='213' column='1'/>
+          <var-decl name='tstamp' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='209' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5504'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/if_inet6.h' line='214' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/if_inet6.h' line='210' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='fwnode_reference_args' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/fwnode.h' line='72' column='1' id='8dbba1ec'>
@@ -65265,27 +65284,27 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='278d8d7c' size-in-bits='64' id='8f6b937a'/>
-      <class-decl name='ipv6_mc_socklist' size-in-bits='512' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='97' column='1' id='8f725b86'>
+      <class-decl name='ipv6_mc_socklist' size-in-bits='512' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='93' column='1' id='8f725b86'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='98' column='1'/>
+          <var-decl name='addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='94' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='ifindex' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='99' column='1'/>
+          <var-decl name='ifindex' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='95' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='sfmode' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='100' column='1'/>
+          <var-decl name='sfmode' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='96' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='next' type-id='3d802c7c' visibility='default' filepath='include/net/if_inet6.h' line='101' column='1'/>
+          <var-decl name='next' type-id='3d802c7c' visibility='default' filepath='include/net/if_inet6.h' line='97' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='sflock' type-id='ac16795b' visibility='default' filepath='include/net/if_inet6.h' line='102' column='1'/>
+          <var-decl name='sflock' type-id='ac16795b' visibility='default' filepath='include/net/if_inet6.h' line='98' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='sflist' type-id='b25391b7' visibility='default' filepath='include/net/if_inet6.h' line='103' column='1'/>
+          <var-decl name='sflist' type-id='b25391b7' visibility='default' filepath='include/net/if_inet6.h' line='99' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/if_inet6.h' line='104' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/if_inet6.h' line='100' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='d86551c2' size-in-bits='64' id='8f7ff038'/>
@@ -71597,30 +71616,30 @@
       <array-type-def dimensions='1' type-id='91ce1af9' size-in-bits='6144' id='9db16187'>
         <subrange length='96' type-id='7ff19f0f' id='1df62250'/>
       </array-type-def>
-      <class-decl name='qc_info' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='421' column='1' id='9dbdc7de'>
+      <class-decl name='qc_info' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='423' column='1' id='9dbdc7de'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='i_fieldmask' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='422' column='1'/>
+          <var-decl name='i_fieldmask' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='424' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='i_flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='423' column='1'/>
+          <var-decl name='i_flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='425' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='i_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='424' column='1'/>
+          <var-decl name='i_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='426' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='i_ino_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='426' column='1'/>
+          <var-decl name='i_ino_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='428' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='i_rt_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='427' column='1'/>
+          <var-decl name='i_rt_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='429' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='i_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='428' column='1'/>
+          <var-decl name='i_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='430' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='i_ino_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='429' column='1'/>
+          <var-decl name='i_ino_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='431' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='i_rt_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='430' column='1'/>
+          <var-decl name='i_rt_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='432' column='1'/>
         </data-member>
       </class-decl>
       <array-type-def dimensions='1' type-id='f22a8abb' size-in-bits='2432' id='9dc2293d'>
@@ -71992,51 +72011,51 @@
         <parameter type-id='19c2251e'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='__anonymous_struct__' size-in-bits='16' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/ipv6.h' line='246' column='1' id='9ebd5abd'>
+      <class-decl name='__anonymous_struct__' size-in-bits='16' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/ipv6.h' line='247' column='1' id='9ebd5abd'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='srcrt' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='247' column='1'/>
+          <var-decl name='srcrt' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='248' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='osrcrt' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='248' column='1'/>
+          <var-decl name='osrcrt' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='249' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2'>
-          <var-decl name='rxinfo' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='249' column='1'/>
+          <var-decl name='rxinfo' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='250' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3'>
-          <var-decl name='rxoinfo' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='250' column='1'/>
+          <var-decl name='rxoinfo' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='251' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4'>
-          <var-decl name='rxhlim' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='251' column='1'/>
+          <var-decl name='rxhlim' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='252' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5'>
-          <var-decl name='rxohlim' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='252' column='1'/>
+          <var-decl name='rxohlim' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='253' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6'>
-          <var-decl name='hopopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='253' column='1'/>
+          <var-decl name='hopopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='254' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7'>
-          <var-decl name='ohopopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='254' column='1'/>
+          <var-decl name='ohopopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='255' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8'>
-          <var-decl name='dstopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='255' column='1'/>
+          <var-decl name='dstopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='256' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9'>
-          <var-decl name='odstopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='256' column='1'/>
+          <var-decl name='odstopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='257' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10'>
-          <var-decl name='rxflow' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='257' column='1'/>
+          <var-decl name='rxflow' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='258' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='11'>
-          <var-decl name='rxtclass' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='258' column='1'/>
+          <var-decl name='rxtclass' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='259' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12'>
-          <var-decl name='rxpmtu' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='259' column='1'/>
+          <var-decl name='rxpmtu' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='260' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='13'>
-          <var-decl name='rxorigdstaddr' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='260' column='1'/>
+          <var-decl name='rxorigdstaddr' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='261' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='14'>
-          <var-decl name='recvfragsize' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='261' column='1'/>
+          <var-decl name='recvfragsize' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='262' column='1'/>
         </data-member>
       </class-decl>
       <enum-decl name='ehci_hrtimer_event' filepath='drivers/usb/host/ehci.h' line='94' column='1' id='9ebf0a72'>
@@ -72559,45 +72578,45 @@
         <parameter type-id='95e97e5e'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='rate_sample' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1048' column='1' id='a084c932'>
+      <class-decl name='rate_sample' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1051' column='1' id='a084c932'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='prior_mstamp' type-id='91ce1af9' visibility='default' filepath='include/net/tcp.h' line='1049' column='1'/>
+          <var-decl name='prior_mstamp' type-id='91ce1af9' visibility='default' filepath='include/net/tcp.h' line='1052' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='prior_delivered' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1050' column='1'/>
+          <var-decl name='prior_delivered' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1053' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='delivered' type-id='a7832498' visibility='default' filepath='include/net/tcp.h' line='1051' column='1'/>
+          <var-decl name='delivered' type-id='a7832498' visibility='default' filepath='include/net/tcp.h' line='1054' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='interval_us' type-id='bd54fe1a' visibility='default' filepath='include/net/tcp.h' line='1052' column='1'/>
+          <var-decl name='interval_us' type-id='bd54fe1a' visibility='default' filepath='include/net/tcp.h' line='1055' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='snd_interval_us' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1053' column='1'/>
+          <var-decl name='snd_interval_us' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1056' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='rcv_interval_us' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1054' column='1'/>
+          <var-decl name='rcv_interval_us' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1057' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='rtt_us' type-id='bd54fe1a' visibility='default' filepath='include/net/tcp.h' line='1055' column='1'/>
+          <var-decl name='rtt_us' type-id='bd54fe1a' visibility='default' filepath='include/net/tcp.h' line='1058' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='losses' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1056' column='1'/>
+          <var-decl name='losses' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1059' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='352'>
-          <var-decl name='acked_sacked' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1057' column='1'/>
+          <var-decl name='acked_sacked' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1060' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='prior_in_flight' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1058' column='1'/>
+          <var-decl name='prior_in_flight' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1061' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='416'>
-          <var-decl name='is_app_limited' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1059' column='1'/>
+          <var-decl name='is_app_limited' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1062' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='424'>
-          <var-decl name='is_retrans' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1060' column='1'/>
+          <var-decl name='is_retrans' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1063' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='432'>
-          <var-decl name='is_ack_delayed' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1061' column='1'/>
+          <var-decl name='is_ack_delayed' type-id='b50a4934' visibility='default' filepath='include/net/tcp.h' line='1064' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='a08a663b'>
@@ -76540,12 +76559,12 @@
         </data-member>
       </class-decl>
       <qualified-type-def type-id='4e0399c2' const='yes' id='a87d8ed1'/>
-      <class-decl name='wq_device' size-in-bits='7232' is-struct='yes' visibility='default' filepath='kernel/workqueue.c' line='5409' column='1' id='a88ecfc8'>
+      <class-decl name='wq_device' size-in-bits='7232' is-struct='yes' visibility='default' filepath='kernel/workqueue.c' line='5422' column='1' id='a88ecfc8'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='wq' type-id='242e3d19' visibility='default' filepath='kernel/workqueue.c' line='5410' column='1'/>
+          <var-decl name='wq' type-id='242e3d19' visibility='default' filepath='kernel/workqueue.c' line='5423' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='dev' type-id='66e487eb' visibility='default' filepath='kernel/workqueue.c' line='5411' column='1'/>
+          <var-decl name='dev' type-id='66e487eb' visibility='default' filepath='kernel/workqueue.c' line='5424' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='_ddebug' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/dynamic_debug.h' line='14' column='1' id='a88f76f1'>
@@ -79270,54 +79289,54 @@
       </enum-decl>
       <pointer-type-def type-id='3f9037c9' size-in-bits='64' id='aef0224d'/>
       <pointer-type-def type-id='e32a3610' size-in-bits='64' id='aef13606'/>
-      <class-decl name='qc_dqblk' size-in-bits='960' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='349' column='1' id='aef83a98'>
+      <class-decl name='qc_dqblk' size-in-bits='960' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='351' column='1' id='aef83a98'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='d_fieldmask' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='350' column='1'/>
+          <var-decl name='d_fieldmask' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='352' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='d_spc_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='351' column='1'/>
+          <var-decl name='d_spc_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='353' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='d_spc_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='352' column='1'/>
+          <var-decl name='d_spc_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='354' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='d_ino_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='353' column='1'/>
+          <var-decl name='d_ino_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='355' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='d_ino_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='354' column='1'/>
+          <var-decl name='d_ino_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='356' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='d_space' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='355' column='1'/>
+          <var-decl name='d_space' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='357' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='d_ino_count' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='356' column='1'/>
+          <var-decl name='d_ino_count' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='358' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='d_ino_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='357' column='1'/>
+          <var-decl name='d_ino_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='359' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='d_spc_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='359' column='1'/>
+          <var-decl name='d_spc_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='361' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='d_ino_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='360' column='1'/>
+          <var-decl name='d_ino_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='362' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='608'>
-          <var-decl name='d_spc_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='361' column='1'/>
+          <var-decl name='d_spc_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='363' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='d_rt_spc_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='362' column='1'/>
+          <var-decl name='d_rt_spc_hardlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='364' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='d_rt_spc_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='363' column='1'/>
+          <var-decl name='d_rt_spc_softlimit' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='365' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='d_rt_space' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='364' column='1'/>
+          <var-decl name='d_rt_space' type-id='91ce1af9' visibility='default' filepath='include/linux/quota.h' line='366' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='d_rt_spc_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='365' column='1'/>
+          <var-decl name='d_rt_spc_timer' type-id='9b7c55ef' visibility='default' filepath='include/linux/quota.h' line='367' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='d_rt_spc_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='366' column='1'/>
+          <var-decl name='d_rt_spc_warns' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='368' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='aefe43a8'>
@@ -83125,24 +83144,24 @@
         <enumerator name='NL80211_USER_REG_HINT_CELL_BASE' value='1'/>
         <enumerator name='NL80211_USER_REG_HINT_INDOOR' value='2'/>
       </enum-decl>
-      <class-decl name='ip6_sf_list' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='107' column='1' id='b83c8287'>
+      <class-decl name='ip6_sf_list' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='103' column='1' id='b83c8287'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='sf_next' type-id='60f4096f' visibility='default' filepath='include/net/if_inet6.h' line='108' column='1'/>
+          <var-decl name='sf_next' type-id='60f4096f' visibility='default' filepath='include/net/if_inet6.h' line='104' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='sf_addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='109' column='1'/>
+          <var-decl name='sf_addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='105' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='sf_count' type-id='f05e8e77' visibility='default' filepath='include/net/if_inet6.h' line='110' column='1'/>
+          <var-decl name='sf_count' type-id='f05e8e77' visibility='default' filepath='include/net/if_inet6.h' line='106' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='sf_gsresp' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='111' column='1'/>
+          <var-decl name='sf_gsresp' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='107' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='328'>
-          <var-decl name='sf_oldin' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='112' column='1'/>
+          <var-decl name='sf_oldin' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='108' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='336'>
-          <var-decl name='sf_crcount' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='113' column='1'/>
+          <var-decl name='sf_crcount' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='109' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='6f527014' size-in-bits='64' id='b8430c5e'/>
@@ -86446,117 +86465,117 @@
           <var-decl name='buf' type-id='0209ab38' visibility='default' filepath='include/uapi/linux/android/binder.h' line='356' column='1'/>
         </data-member>
       </union-decl>
-      <class-decl name='ipv6_pinfo' size-in-bits='1216' is-struct='yes' visibility='default' filepath='include/linux/ipv6.h' line='208' column='1' id='bcad3f73'>
+      <class-decl name='ipv6_pinfo' size-in-bits='1216' is-struct='yes' visibility='default' filepath='include/linux/ipv6.h' line='209' column='1' id='bcad3f73'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='saddr' type-id='f6ed712a' visibility='default' filepath='include/linux/ipv6.h' line='209' column='1'/>
+          <var-decl name='saddr' type-id='f6ed712a' visibility='default' filepath='include/linux/ipv6.h' line='210' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='sticky_pktinfo' type-id='91b426fc' visibility='default' filepath='include/linux/ipv6.h' line='210' column='1'/>
+          <var-decl name='sticky_pktinfo' type-id='91b426fc' visibility='default' filepath='include/linux/ipv6.h' line='211' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='daddr_cache' type-id='fea9c20b' visibility='default' filepath='include/linux/ipv6.h' line='211' column='1'/>
+          <var-decl name='daddr_cache' type-id='fea9c20b' visibility='default' filepath='include/linux/ipv6.h' line='212' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='flow_label' type-id='78a133c2' visibility='default' filepath='include/linux/ipv6.h' line='216' column='1'/>
+          <var-decl name='flow_label' type-id='78a133c2' visibility='default' filepath='include/linux/ipv6.h' line='217' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='416'>
-          <var-decl name='frag_size' type-id='3f1a6b60' visibility='default' filepath='include/linux/ipv6.h' line='217' column='1'/>
+          <var-decl name='frag_size' type-id='3f1a6b60' visibility='default' filepath='include/linux/ipv6.h' line='218' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='__unused_1' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='227' column='1'/>
+          <var-decl name='__unused_1' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='228' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7'>
-          <var-decl name='hop_limit' type-id='b55def60' visibility='default' filepath='include/linux/ipv6.h' line='228' column='1'/>
+          <var-decl name='hop_limit' type-id='b55def60' visibility='default' filepath='include/linux/ipv6.h' line='229' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='mc_loop' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='237' column='1'/>
+          <var-decl name='mc_loop' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='238' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='__unused_2' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='238' column='1'/>
+          <var-decl name='__unused_2' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='239' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7'>
-          <var-decl name='mcast_hops' type-id='b55def60' visibility='default' filepath='include/linux/ipv6.h' line='239' column='1'/>
+          <var-decl name='mcast_hops' type-id='b55def60' visibility='default' filepath='include/linux/ipv6.h' line='240' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='480'>
-          <var-decl name='ucast_oif' type-id='95e97e5e' visibility='default' filepath='include/linux/ipv6.h' line='241' column='1'/>
+          <var-decl name='ucast_oif' type-id='95e97e5e' visibility='default' filepath='include/linux/ipv6.h' line='242' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='mcast_oif' type-id='95e97e5e' visibility='default' filepath='include/linux/ipv6.h' line='242' column='1'/>
+          <var-decl name='mcast_oif' type-id='95e97e5e' visibility='default' filepath='include/linux/ipv6.h' line='243' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='544'>
-          <var-decl name='rxopt' type-id='23d43bd5' visibility='default' filepath='include/linux/ipv6.h' line='265' column='1'/>
+          <var-decl name='rxopt' type-id='23d43bd5' visibility='default' filepath='include/linux/ipv6.h' line='266' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='recverr' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='268' column='1'/>
+          <var-decl name='recverr' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='269' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='sndflow' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='269' column='1'/>
+          <var-decl name='sndflow' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='270' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2'>
-          <var-decl name='repflow' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='270' column='1'/>
+          <var-decl name='repflow' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='271' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3'>
-          <var-decl name='pmtudisc' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='271' column='1'/>
+          <var-decl name='pmtudisc' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='272' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6'>
-          <var-decl name='padding' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='272' column='1'/>
+          <var-decl name='padding' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='273' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7'>
-          <var-decl name='srcprefs' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='273' column='1'/>
+          <var-decl name='srcprefs' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='274' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10'>
-          <var-decl name='dontfrag' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='277' column='1'/>
+          <var-decl name='dontfrag' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='278' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='11'>
-          <var-decl name='autoflowlabel' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='278' column='1'/>
+          <var-decl name='autoflowlabel' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='279' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12'>
-          <var-decl name='autoflowlabel_set' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='279' column='1'/>
+          <var-decl name='autoflowlabel_set' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='280' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='13'>
-          <var-decl name='mc_all' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='280' column='1'/>
+          <var-decl name='mc_all' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='281' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='14'>
-          <var-decl name='recverr_rfc4884' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='281' column='1'/>
+          <var-decl name='recverr_rfc4884' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='282' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='15'>
-          <var-decl name='rtalert_isolate' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='282' column='1'/>
+          <var-decl name='rtalert_isolate' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='283' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='min_hopcount' type-id='8f048e17' visibility='default' filepath='include/linux/ipv6.h' line='283' column='1'/>
+          <var-decl name='min_hopcount' type-id='8f048e17' visibility='default' filepath='include/linux/ipv6.h' line='284' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='584'>
-          <var-decl name='tclass' type-id='8f048e17' visibility='default' filepath='include/linux/ipv6.h' line='284' column='1'/>
+          <var-decl name='tclass' type-id='8f048e17' visibility='default' filepath='include/linux/ipv6.h' line='285' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='608'>
-          <var-decl name='rcv_flowinfo' type-id='78a133c2' visibility='default' filepath='include/linux/ipv6.h' line='285' column='1'/>
+          <var-decl name='rcv_flowinfo' type-id='78a133c2' visibility='default' filepath='include/linux/ipv6.h' line='286' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='dst_cookie' type-id='3f1a6b60' visibility='default' filepath='include/linux/ipv6.h' line='287' column='1'/>
+          <var-decl name='dst_cookie' type-id='3f1a6b60' visibility='default' filepath='include/linux/ipv6.h' line='288' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='672'>
-          <var-decl name='rx_dst_cookie' type-id='3f1a6b60' visibility='default' filepath='include/linux/ipv6.h' line='288' column='1'/>
+          <var-decl name='rx_dst_cookie' type-id='3f1a6b60' visibility='default' filepath='include/linux/ipv6.h' line='289' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='ipv6_mc_list' type-id='3d802c7c' visibility='default' filepath='include/linux/ipv6.h' line='290' column='1'/>
+          <var-decl name='ipv6_mc_list' type-id='3d802c7c' visibility='default' filepath='include/linux/ipv6.h' line='291' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='ipv6_ac_list' type-id='0d2afef8' visibility='default' filepath='include/linux/ipv6.h' line='291' column='1'/>
+          <var-decl name='ipv6_ac_list' type-id='0d2afef8' visibility='default' filepath='include/linux/ipv6.h' line='292' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='ipv6_fl_list' type-id='3a14a5ee' visibility='default' filepath='include/linux/ipv6.h' line='292' column='1'/>
+          <var-decl name='ipv6_fl_list' type-id='3a14a5ee' visibility='default' filepath='include/linux/ipv6.h' line='293' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='opt' type-id='d4145729' visibility='default' filepath='include/linux/ipv6.h' line='294' column='1'/>
+          <var-decl name='opt' type-id='d4145729' visibility='default' filepath='include/linux/ipv6.h' line='295' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='pktoptions' type-id='0fbf3cfd' visibility='default' filepath='include/linux/ipv6.h' line='295' column='1'/>
+          <var-decl name='pktoptions' type-id='0fbf3cfd' visibility='default' filepath='include/linux/ipv6.h' line='296' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='rxpmtu' type-id='0fbf3cfd' visibility='default' filepath='include/linux/ipv6.h' line='296' column='1'/>
+          <var-decl name='rxpmtu' type-id='0fbf3cfd' visibility='default' filepath='include/linux/ipv6.h' line='297' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='cork' type-id='79e3d9fd' visibility='default' filepath='include/linux/ipv6.h' line='297' column='1'/>
+          <var-decl name='cork' type-id='79e3d9fd' visibility='default' filepath='include/linux/ipv6.h' line='298' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='bcb69272'>
@@ -89021,21 +89040,21 @@
         </data-member>
       </class-decl>
       <qualified-type-def type-id='9d0ae2a2' const='yes' id='c2623161'/>
-      <class-decl name='quota_info' size-in-bits='2688' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='527' column='1' id='c26e4ad8'>
+      <class-decl name='quota_info' size-in-bits='2688' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='529' column='1' id='c26e4ad8'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='528' column='1'/>
+          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='530' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='dqio_sem' type-id='f19fdb93' visibility='default' filepath='include/linux/quota.h' line='529' column='1'/>
+          <var-decl name='dqio_sem' type-id='f19fdb93' visibility='default' filepath='include/linux/quota.h' line='531' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='files' type-id='e6ff92fb' visibility='default' filepath='include/linux/quota.h' line='530' column='1'/>
+          <var-decl name='files' type-id='e6ff92fb' visibility='default' filepath='include/linux/quota.h' line='532' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='info' type-id='83ae09a1' visibility='default' filepath='include/linux/quota.h' line='531' column='1'/>
+          <var-decl name='info' type-id='83ae09a1' visibility='default' filepath='include/linux/quota.h' line='533' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2496'>
-          <var-decl name='ops' type-id='59bd9302' visibility='default' filepath='include/linux/quota.h' line='532' column='1'/>
+          <var-decl name='ops' type-id='59bd9302' visibility='default' filepath='include/linux/quota.h' line='534' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='fib_rule_port_range' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/uapi/linux/fib_rules.h' line='38' column='1' id='c27f07e7'>
@@ -89134,18 +89153,18 @@
           <var-decl name='lock' type-id='925167dc' visibility='default' filepath='include/media/cec.h' line='49' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='quota_format_type' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='452' column='1' id='c2be49b0'>
+      <class-decl name='quota_format_type' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='454' column='1' id='c2be49b0'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='qf_fmt_id' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='453' column='1'/>
+          <var-decl name='qf_fmt_id' type-id='95e97e5e' visibility='default' filepath='include/linux/quota.h' line='455' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='qf_ops' type-id='bd561d05' visibility='default' filepath='include/linux/quota.h' line='454' column='1'/>
+          <var-decl name='qf_ops' type-id='bd561d05' visibility='default' filepath='include/linux/quota.h' line='456' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='qf_owner' type-id='2730d015' visibility='default' filepath='include/linux/quota.h' line='455' column='1'/>
+          <var-decl name='qf_owner' type-id='2730d015' visibility='default' filepath='include/linux/quota.h' line='457' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='qf_next' type-id='eb9a3ab6' visibility='default' filepath='include/linux/quota.h' line='456' column='1'/>
+          <var-decl name='qf_next' type-id='eb9a3ab6' visibility='default' filepath='include/linux/quota.h' line='458' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='c2be64d1'>
@@ -93189,51 +93208,51 @@
           <var-decl name='flags' type-id='19c2251e' visibility='default' filepath='include/linux/fb.h' line='148' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='ifmcaddr6' size-in-bits='1280' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='122' column='1' id='cc23d6f1'>
+      <class-decl name='ifmcaddr6' size-in-bits='1280' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='118' column='1' id='cc23d6f1'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='mca_addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='123' column='1'/>
+          <var-decl name='mca_addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='119' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='idev' type-id='f026b16b' visibility='default' filepath='include/net/if_inet6.h' line='124' column='1'/>
+          <var-decl name='idev' type-id='f026b16b' visibility='default' filepath='include/net/if_inet6.h' line='120' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='next' type-id='d1ca3a89' visibility='default' filepath='include/net/if_inet6.h' line='125' column='1'/>
+          <var-decl name='next' type-id='d1ca3a89' visibility='default' filepath='include/net/if_inet6.h' line='121' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='mca_sources' type-id='60f4096f' visibility='default' filepath='include/net/if_inet6.h' line='126' column='1'/>
+          <var-decl name='mca_sources' type-id='60f4096f' visibility='default' filepath='include/net/if_inet6.h' line='122' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='mca_tomb' type-id='60f4096f' visibility='default' filepath='include/net/if_inet6.h' line='127' column='1'/>
+          <var-decl name='mca_tomb' type-id='60f4096f' visibility='default' filepath='include/net/if_inet6.h' line='123' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='mca_sfmode' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='128' column='1'/>
+          <var-decl name='mca_sfmode' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='124' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='416'>
-          <var-decl name='mca_crcount' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='129' column='1'/>
+          <var-decl name='mca_crcount' type-id='002ac4a6' visibility='default' filepath='include/net/if_inet6.h' line='125' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='mca_sfcount' type-id='f05e8e77' visibility='default' filepath='include/net/if_inet6.h' line='130' column='1'/>
+          <var-decl name='mca_sfcount' type-id='f05e8e77' visibility='default' filepath='include/net/if_inet6.h' line='126' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='mca_timer' type-id='abe41e67' visibility='default' filepath='include/net/if_inet6.h' line='131' column='1'/>
+          <var-decl name='mca_timer' type-id='abe41e67' visibility='default' filepath='include/net/if_inet6.h' line='127' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='mca_flags' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='132' column='1'/>
+          <var-decl name='mca_flags' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='128' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1056'>
-          <var-decl name='mca_users' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='133' column='1'/>
+          <var-decl name='mca_users' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='129' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='mca_refcnt' type-id='64615833' visibility='default' filepath='include/net/if_inet6.h' line='134' column='1'/>
+          <var-decl name='mca_refcnt' type-id='64615833' visibility='default' filepath='include/net/if_inet6.h' line='130' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1120'>
-          <var-decl name='mca_lock' type-id='fb4018a0' visibility='default' filepath='include/net/if_inet6.h' line='135' column='1'/>
+          <var-decl name='mca_lock' type-id='fb4018a0' visibility='default' filepath='include/net/if_inet6.h' line='131' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='mca_cstamp' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='136' column='1'/>
+          <var-decl name='mca_cstamp' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='132' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='mca_tstamp' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='137' column='1'/>
+          <var-decl name='mca_tstamp' type-id='7359adad' visibility='default' filepath='include/net/if_inet6.h' line='133' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='mmc_part' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/mmc/card.h' line='230' column='1' id='cc256810'>
@@ -93762,15 +93781,15 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='cfe4f8a2' size-in-bits='64' id='cd733e18'/>
-      <class-decl name='ack_sample' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1034' column='1' id='cd7d3c9d'>
+      <class-decl name='ack_sample' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1037' column='1' id='cd7d3c9d'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='pkts_acked' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1035' column='1'/>
+          <var-decl name='pkts_acked' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1038' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='rtt_us' type-id='a7832498' visibility='default' filepath='include/net/tcp.h' line='1036' column='1'/>
+          <var-decl name='rtt_us' type-id='a7832498' visibility='default' filepath='include/net/tcp.h' line='1039' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='in_flight' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1037' column='1'/>
+          <var-decl name='in_flight' type-id='19c2251e' visibility='default' filepath='include/net/tcp.h' line='1040' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='phylink_link_state' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/phylink.h' line='43' column='1' id='cd8ce92b'>
@@ -96998,12 +97017,12 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='db362995' size-in-bits='64' id='d543b7ad'/>
-      <class-decl name='dir_context' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='1831' column='1' id='d5476b80'>
+      <class-decl name='dir_context' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/fs.h' line='1874' column='1' id='d5476b80'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='actor' type-id='262124ef' visibility='default' filepath='include/linux/fs.h' line='1832' column='1'/>
+          <var-decl name='actor' type-id='262124ef' visibility='default' filepath='include/linux/fs.h' line='1875' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='pos' type-id='69bf7bee' visibility='default' filepath='include/linux/fs.h' line='1833' column='1'/>
+          <var-decl name='pos' type-id='69bf7bee' visibility='default' filepath='include/linux/fs.h' line='1876' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='i2c_bus_recovery_info' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/i2c.h' line='618' column='1' id='d5526a99'>
@@ -100892,15 +100911,15 @@
       </class-decl>
       <pointer-type-def type-id='a400949a' size-in-bits='64' id='dcea1110'/>
       <pointer-type-def type-id='e185e6a6' size-in-bits='64' id='dcf452cc'/>
-      <class-decl name='ipv6_ac_socklist' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='142' column='1' id='dcf61f1a'>
+      <class-decl name='ipv6_ac_socklist' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='138' column='1' id='dcf61f1a'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='acl_addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='143' column='1'/>
+          <var-decl name='acl_addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='139' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='acl_ifindex' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='144' column='1'/>
+          <var-decl name='acl_ifindex' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='140' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='acl_next' type-id='0d2afef8' visibility='default' filepath='include/net/if_inet6.h' line='145' column='1'/>
+          <var-decl name='acl_next' type-id='0d2afef8' visibility='default' filepath='include/net/if_inet6.h' line='141' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='__kernel_timex' size-in-bits='1664' is-struct='yes' visibility='default' filepath='include/uapi/linux/timex.h' line='102' column='1' id='dcf7564a'>
@@ -106519,36 +106538,36 @@
           <var-decl name='reverse' type-id='9b105293' visibility='default' filepath='include/linux/user_namespace.h' line='30' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='qc_type_state' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='401' column='1' id='e878d564'>
+      <class-decl name='qc_type_state' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='403' column='1' id='e878d564'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='402' column='1'/>
+          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='404' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='403' column='1'/>
+          <var-decl name='spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='405' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='ino_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='405' column='1'/>
+          <var-decl name='ino_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='407' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='rt_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='406' column='1'/>
+          <var-decl name='rt_spc_timelimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='408' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='407' column='1'/>
+          <var-decl name='spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='409' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='ino_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='408' column='1'/>
+          <var-decl name='ino_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='410' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='rt_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='409' column='1'/>
+          <var-decl name='rt_spc_warnlimit' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='411' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='ino' type-id='3a47d82b' visibility='default' filepath='include/linux/quota.h' line='410' column='1'/>
+          <var-decl name='ino' type-id='3a47d82b' visibility='default' filepath='include/linux/quota.h' line='412' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='blocks' type-id='17345459' visibility='default' filepath='include/linux/quota.h' line='411' column='1'/>
+          <var-decl name='blocks' type-id='17345459' visibility='default' filepath='include/linux/quota.h' line='413' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='nextents' type-id='17345459' visibility='default' filepath='include/linux/quota.h' line='412' column='1'/>
+          <var-decl name='nextents' type-id='17345459' visibility='default' filepath='include/linux/quota.h' line='414' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='c3fc04e5' size-in-bits='64' id='e879a339'/>
@@ -112568,12 +112587,12 @@
           <var-decl name='data' type-id='eaa32e2f' visibility='default' filepath='include/linux/alarmtimer.h' line='48' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='qc_state' size-in-bits='1408' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='415' column='1' id='f6be3c23'>
+      <class-decl name='qc_state' size-in-bits='1408' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='417' column='1' id='f6be3c23'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='s_incoredqs' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='416' column='1'/>
+          <var-decl name='s_incoredqs' type-id='f0981eeb' visibility='default' filepath='include/linux/quota.h' line='418' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='s_state' type-id='55d1e02d' visibility='default' filepath='include/linux/quota.h' line='417' column='1'/>
+          <var-decl name='s_state' type-id='55d1e02d' visibility='default' filepath='include/linux/quota.h' line='419' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='e56bc2e5' size-in-bits='64' id='f6c3a7a5'/>
@@ -112697,15 +112716,15 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='cdd79d4e' size-in-bits='64' id='f77c2568'/>
-      <class-decl name='tcp_fastopen_context' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1719' column='1' id='f77d4717'>
+      <class-decl name='tcp_fastopen_context' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1722' column='1' id='f77d4717'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='key' type-id='5b02a6fc' visibility='default' filepath='include/net/tcp.h' line='1720' column='1'/>
+          <var-decl name='key' type-id='5b02a6fc' visibility='default' filepath='include/net/tcp.h' line='1723' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='num' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1721' column='1'/>
+          <var-decl name='num' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1724' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/tcp.h' line='1722' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/tcp.h' line='1725' column='1'/>
         </data-member>
       </class-decl>
       <qualified-type-def type-id='e0584be6' const='yes' id='f7803e3d'/>
@@ -115000,33 +115019,33 @@
       </class-decl>
       <pointer-type-def type-id='1f54f780' size-in-bits='64' id='fcc1e09e'/>
       <pointer-type-def type-id='37d5ca21' size-in-bits='64' id='fcca6c75'/>
-      <class-decl name='tcp_ulp_ops' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='2217' column='1' id='fccb029f'>
+      <class-decl name='tcp_ulp_ops' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='2220' column='1' id='fccb029f'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/tcp.h' line='2218' column='1'/>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/tcp.h' line='2221' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='init' type-id='55530c47' visibility='default' filepath='include/net/tcp.h' line='2221' column='1'/>
+          <var-decl name='init' type-id='55530c47' visibility='default' filepath='include/net/tcp.h' line='2224' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='update' type-id='58220cf1' visibility='default' filepath='include/net/tcp.h' line='2223' column='1'/>
+          <var-decl name='update' type-id='58220cf1' visibility='default' filepath='include/net/tcp.h' line='2226' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='release' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='2226' column='1'/>
+          <var-decl name='release' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='2229' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='get_info' type-id='684afc90' visibility='default' filepath='include/net/tcp.h' line='2228' column='1'/>
+          <var-decl name='get_info' type-id='684afc90' visibility='default' filepath='include/net/tcp.h' line='2231' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='get_info_size' type-id='08a11828' visibility='default' filepath='include/net/tcp.h' line='2229' column='1'/>
+          <var-decl name='get_info_size' type-id='08a11828' visibility='default' filepath='include/net/tcp.h' line='2232' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='clone' type-id='e9e8c0f8' visibility='default' filepath='include/net/tcp.h' line='2231' column='1'/>
+          <var-decl name='clone' type-id='e9e8c0f8' visibility='default' filepath='include/net/tcp.h' line='2234' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/net/tcp.h' line='2234' column='1'/>
+          <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/net/tcp.h' line='2237' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/tcp.h' line='2235' column='1'/>
+          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/tcp.h' line='2238' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='c12c58ce' size-in-bits='64' id='fccfeeec'/>
@@ -116567,9 +116586,9 @@
       </function-type>
       <pointer-type-def type-id='46f53066' size-in-bits='64' id='fffb07a4'/>
       <qualified-type-def type-id='55efd1a3' const='yes' id='fffdaf52'/>
-      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='521' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
+      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='522' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
       <var-decl name='GKI_struct_selinux_state' type-id='4ae52763' mangled-name='GKI_struct_selinux_state' visibility='default' filepath='security/selinux/vendor_hooks.c' line='21' column='1' elf-symbol-id='GKI_struct_selinux_state'/>
-      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='526' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
+      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='527' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
       <function-decl name='PDE_DATA' mangled-name='PDE_DATA' filepath='fs/proc/generic.c' line='802' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='PDE_DATA'>
         <parameter type-id='c5a4eb7f' name='inode' filepath='fs/proc/generic.c' line='802' column='1'/>
         <return type-id='eaa32e2f'/>
@@ -117097,21 +117116,21 @@
         <parameter type-id='1d2c2b85' name='flags' filepath='lib/once.c' line='37' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='__dquot_alloc_space' mangled-name='__dquot_alloc_space' filepath='fs/quota/dquot.c' line='1723' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_alloc_space'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1723' column='1'/>
-        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1723' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='fs/quota/dquot.c' line='1723' column='1'/>
+      <function-decl name='__dquot_alloc_space' mangled-name='__dquot_alloc_space' filepath='fs/quota/dquot.c' line='1735' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_alloc_space'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1735' column='1'/>
+        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1735' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='fs/quota/dquot.c' line='1735' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__dquot_free_space' mangled-name='__dquot_free_space' filepath='fs/quota/dquot.c' line='1922' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_free_space'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1922' column='1'/>
-        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1922' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='fs/quota/dquot.c' line='1922' column='1'/>
+      <function-decl name='__dquot_free_space' mangled-name='__dquot_free_space' filepath='fs/quota/dquot.c' line='1934' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_free_space'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1934' column='1'/>
+        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1934' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='fs/quota/dquot.c' line='1934' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__dquot_transfer' mangled-name='__dquot_transfer' filepath='fs/quota/dquot.c' line='2022' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_transfer'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2022' column='1'/>
-        <parameter type-id='30677246' name='transfer_to' filepath='fs/quota/dquot.c' line='2022' column='1'/>
+      <function-decl name='__dquot_transfer' mangled-name='__dquot_transfer' filepath='fs/quota/dquot.c' line='2034' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__dquot_transfer'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2034' column='1'/>
+        <parameter type-id='30677246' name='transfer_to' filepath='fs/quota/dquot.c' line='2034' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__drm_atomic_helper_connector_destroy_state' mangled-name='__drm_atomic_helper_connector_destroy_state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='514' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__drm_atomic_helper_connector_destroy_state'>
@@ -117670,10 +117689,10 @@
         <parameter type-id='b59d7dce' name='count' filepath='arch/arm64/kernel/io.c' line='71' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__mmc_claim_host' mangled-name='__mmc_claim_host' filepath='drivers/mmc/core/core.c' line='780' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__mmc_claim_host'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='780' column='1'/>
-        <parameter type-id='f1e196e0' name='ctx' filepath='drivers/mmc/core/core.c' line='780' column='1'/>
-        <parameter type-id='8a47abc3' name='abort' filepath='drivers/mmc/core/core.c' line='781' column='1'/>
+      <function-decl name='__mmc_claim_host' mangled-name='__mmc_claim_host' filepath='drivers/mmc/core/core.c' line='785' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__mmc_claim_host'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='785' column='1'/>
+        <parameter type-id='f1e196e0' name='ctx' filepath='drivers/mmc/core/core.c' line='785' column='1'/>
+        <parameter type-id='8a47abc3' name='abort' filepath='drivers/mmc/core/core.c' line='786' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__mmc_send_status' mangled-name='__mmc_send_status' filepath='drivers/mmc/core/mmc_ops.c' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__mmc_send_status'>
@@ -117736,9 +117755,9 @@
         <parameter type-id='7359adad' name='nsecs' filepath='arch/arm64/lib/delay.c' line='55' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__neigh_event_send' mangled-name='__neigh_event_send' filepath='net/core/neighbour.c' line='1109' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__neigh_event_send'>
-        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='1109' column='1'/>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='1109' column='1'/>
+      <function-decl name='__neigh_event_send' mangled-name='__neigh_event_send' filepath='net/core/neighbour.c' line='1111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__neigh_event_send'>
+        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='1111' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='1111' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__netdev_alloc_skb' mangled-name='__netdev_alloc_skb' filepath='net/core/skbuff.c' line='431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__netdev_alloc_skb'>
@@ -122637,21 +122656,21 @@
         <parameter type-id='42c8f564' name='s' filepath='fs/libfs.c' line='1233' column='1'/>
         <return type-id='7e666abe'/>
       </function-decl>
-      <function-decl name='alloc_can_err_skb' mangled-name='alloc_can_err_skb' filepath='drivers/net/can/dev/dev.c' line='731' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_can_err_skb'>
-        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='731' column='1'/>
-        <parameter type-id='fb0c6b9f' name='cf' filepath='drivers/net/can/dev/dev.c' line='731' column='1'/>
+      <function-decl name='alloc_can_err_skb' mangled-name='alloc_can_err_skb' filepath='drivers/net/can/dev/dev.c' line='733' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_can_err_skb'>
+        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='733' column='1'/>
+        <parameter type-id='fb0c6b9f' name='cf' filepath='drivers/net/can/dev/dev.c' line='733' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='alloc_can_skb' mangled-name='alloc_can_skb' filepath='drivers/net/can/dev/dev.c' line='676' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_can_skb'>
-        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='676' column='1'/>
-        <parameter type-id='fb0c6b9f' name='cf' filepath='drivers/net/can/dev/dev.c' line='676' column='1'/>
+      <function-decl name='alloc_can_skb' mangled-name='alloc_can_skb' filepath='drivers/net/can/dev/dev.c' line='678' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_can_skb'>
+        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='678' column='1'/>
+        <parameter type-id='fb0c6b9f' name='cf' filepath='drivers/net/can/dev/dev.c' line='678' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='alloc_candev_mqs' mangled-name='alloc_candev_mqs' filepath='drivers/net/can/dev/dev.c' line='747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_candev_mqs'>
-        <parameter type-id='95e97e5e' name='sizeof_priv' filepath='drivers/net/can/dev/dev.c' line='747' column='1'/>
-        <parameter type-id='f0981eeb' name='echo_skb_max' filepath='drivers/net/can/dev/dev.c' line='747' column='1'/>
-        <parameter type-id='f0981eeb' name='txqs' filepath='drivers/net/can/dev/dev.c' line='748' column='1'/>
-        <parameter type-id='f0981eeb' name='rxqs' filepath='drivers/net/can/dev/dev.c' line='748' column='1'/>
+      <function-decl name='alloc_candev_mqs' mangled-name='alloc_candev_mqs' filepath='drivers/net/can/dev/dev.c' line='749' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_candev_mqs'>
+        <parameter type-id='95e97e5e' name='sizeof_priv' filepath='drivers/net/can/dev/dev.c' line='749' column='1'/>
+        <parameter type-id='f0981eeb' name='echo_skb_max' filepath='drivers/net/can/dev/dev.c' line='749' column='1'/>
+        <parameter type-id='f0981eeb' name='txqs' filepath='drivers/net/can/dev/dev.c' line='750' column='1'/>
+        <parameter type-id='f0981eeb' name='rxqs' filepath='drivers/net/can/dev/dev.c' line='750' column='1'/>
         <return type-id='68a2d05b'/>
       </function-decl>
       <function-decl name='alloc_chrdev_region' mangled-name='alloc_chrdev_region' filepath='fs/char_dev.c' line='236' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_chrdev_region'>
@@ -122708,10 +122727,10 @@
         <parameter type-id='3eb7c31c' name='gfp_mask' filepath='net/core/skbuff.c' line='5914' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='alloc_workqueue' mangled-name='alloc_workqueue' filepath='kernel/workqueue.c' line='4279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_workqueue'>
-        <parameter type-id='80f4b756' name='fmt' filepath='kernel/workqueue.c' line='4279' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='kernel/workqueue.c' line='4280' column='1'/>
-        <parameter type-id='95e97e5e' name='max_active' filepath='kernel/workqueue.c' line='4281' column='1'/>
+      <function-decl name='alloc_workqueue' mangled-name='alloc_workqueue' filepath='kernel/workqueue.c' line='4288' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_workqueue'>
+        <parameter type-id='80f4b756' name='fmt' filepath='kernel/workqueue.c' line='4288' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='kernel/workqueue.c' line='4289' column='1'/>
+        <parameter type-id='95e97e5e' name='max_active' filepath='kernel/workqueue.c' line='4290' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='242e3d19'/>
       </function-decl>
@@ -123762,10 +123781,10 @@
         <parameter type-id='5c39fc92' name='block' filepath='fs/inode.c' line='1743' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bpf_dispatcher_xdp_func' mangled-name='bpf_dispatcher_xdp_func' filepath='net/core/filter.c' line='10343' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_dispatcher_xdp_func'>
-        <parameter type-id='eaa32e2f' name='ctx' filepath='net/core/filter.c' line='10343' column='1'/>
-        <parameter type-id='acada613' name='insnsi' filepath='net/core/filter.c' line='10343' column='1'/>
-        <parameter type-id='531a7450' name='bpf_func' filepath='net/core/filter.c' line='10343' column='1'/>
+      <function-decl name='bpf_dispatcher_xdp_func' mangled-name='bpf_dispatcher_xdp_func' filepath='net/core/filter.c' line='10362' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_dispatcher_xdp_func'>
+        <parameter type-id='eaa32e2f' name='ctx' filepath='net/core/filter.c' line='10362' column='1'/>
+        <parameter type-id='acada613' name='insnsi' filepath='net/core/filter.c' line='10362' column='1'/>
+        <parameter type-id='531a7450' name='bpf_func' filepath='net/core/filter.c' line='10362' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='bpf_prog_add' mangled-name='bpf_prog_add' filepath='kernel/bpf/syscall.c' line='1878' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_prog_add'>
@@ -123782,7 +123801,7 @@
         <parameter type-id='95e97e5e' name='i' filepath='kernel/bpf/syscall.c' line='1884' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <var-decl name='bpf_stats_enabled_key' type-id='237c0d27' mangled-name='bpf_stats_enabled_key' visibility='default' filepath='kernel/bpf/core.c' line='2344' column='1' elf-symbol-id='bpf_stats_enabled_key'/>
+      <var-decl name='bpf_stats_enabled_key' type-id='237c0d27' mangled-name='bpf_stats_enabled_key' visibility='default' filepath='kernel/bpf/core.c' line='2348' column='1' elf-symbol-id='bpf_stats_enabled_key'/>
       <function-decl name='bpf_trace_run1' mangled-name='bpf_trace_run1' filepath='kernel/trace/bpf_trace.c' line='2097' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run1'>
         <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2097' column='1'/>
         <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2097' column='1'/>
@@ -123909,8 +123928,8 @@
         <parameter type-id='91ce1af9' name='arg8' filepath='kernel/trace/bpf_trace.c' line='2105' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_warn_invalid_xdp_action' mangled-name='bpf_warn_invalid_xdp_action' filepath='net/core/filter.c' line='7956' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_warn_invalid_xdp_action'>
-        <parameter type-id='19c2251e' name='act' filepath='net/core/filter.c' line='7956' column='1'/>
+      <function-decl name='bpf_warn_invalid_xdp_action' mangled-name='bpf_warn_invalid_xdp_action' filepath='net/core/filter.c' line='7975' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_warn_invalid_xdp_action'>
+        <parameter type-id='19c2251e' name='act' filepath='net/core/filter.c' line='7975' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='bsearch' mangled-name='bsearch' filepath='lib/bsearch.c' line='31' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bsearch'>
@@ -124035,9 +124054,9 @@
         <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='2078' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='call_rcu' mangled-name='call_rcu' filepath='kernel/rcu/tree.c' line='3047' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='call_rcu'>
-        <parameter type-id='69c138b1' name='head' filepath='kernel/rcu/tree.c' line='3047' column='1'/>
-        <parameter type-id='4edd56e3' name='func' filepath='kernel/rcu/tree.c' line='3047' column='1'/>
+      <function-decl name='call_rcu' mangled-name='call_rcu' filepath='kernel/rcu/tree.c' line='3048' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='call_rcu'>
+        <parameter type-id='69c138b1' name='head' filepath='kernel/rcu/tree.c' line='3048' column='1'/>
+        <parameter type-id='4edd56e3' name='func' filepath='kernel/rcu/tree.c' line='3048' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='call_rcu_tasks' mangled-name='call_rcu_tasks' filepath='kernel/rcu/tasks.h' line='530' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='call_rcu_tasks'>
@@ -124056,9 +124075,9 @@
         <parameter type-id='4edd56e3' name='func' filepath='kernel/rcu/srcutree.c' line='910' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='can_change_mtu' mangled-name='can_change_mtu' filepath='drivers/net/can/dev/dev.c' line='807' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='can_change_mtu'>
-        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='807' column='1'/>
-        <parameter type-id='95e97e5e' name='new_mtu' filepath='drivers/net/can/dev/dev.c' line='807' column='1'/>
+      <function-decl name='can_change_mtu' mangled-name='can_change_mtu' filepath='drivers/net/can/dev/dev.c' line='809' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='can_change_mtu'>
+        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='809' column='1'/>
+        <parameter type-id='95e97e5e' name='new_mtu' filepath='drivers/net/can/dev/dev.c' line='809' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='can_free_echo_skb' mangled-name='can_free_echo_skb' filepath='drivers/net/can/dev/dev.c' line='559' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='can_free_echo_skb'>
@@ -124077,12 +124096,12 @@
         <parameter type-id='f0981eeb' name='idx' filepath='drivers/net/can/dev/dev.c' line='461' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cancel_delayed_work' mangled-name='cancel_delayed_work' filepath='kernel/workqueue.c' line='3276' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cancel_delayed_work'>
-        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='3276' column='1'/>
+      <function-decl name='cancel_delayed_work' mangled-name='cancel_delayed_work' filepath='kernel/workqueue.c' line='3285' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cancel_delayed_work'>
+        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='3285' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='cancel_delayed_work_sync' mangled-name='cancel_delayed_work_sync' filepath='kernel/workqueue.c' line='3291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cancel_delayed_work_sync'>
-        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='3291' column='1'/>
+      <function-decl name='cancel_delayed_work_sync' mangled-name='cancel_delayed_work_sync' filepath='kernel/workqueue.c' line='3300' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cancel_delayed_work_sync'>
+        <parameter type-id='1a7ee447' name='dwork' filepath='kernel/workqueue.c' line='3300' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='cancel_work_sync' mangled-name='cancel_work_sync' filepath='kernel/workqueue.c' line='3195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cancel_work_sync'>
@@ -124497,9 +124516,9 @@
         <parameter type-id='9e6d4b4e' name='hw' filepath='drivers/clk/clk.c' line='522' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='clk_hw_register' mangled-name='clk_hw_register' filepath='drivers/clk/clk.c' line='4076' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_register'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4076' column='1'/>
-        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4076' column='1'/>
+      <function-decl name='clk_hw_register' mangled-name='clk_hw_register' filepath='drivers/clk/clk.c' line='4079' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4079' column='1'/>
+        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4079' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='clk_hw_register_composite' mangled-name='clk_hw_register_composite' filepath='drivers/clk/clk-composite.c' line='319' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_register_composite'>
@@ -124541,8 +124560,8 @@
         <parameter type-id='7359adad' name='max_rate' filepath='drivers/clk/clk.c' line='666' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_hw_unregister' mangled-name='clk_hw_unregister' filepath='drivers/clk/clk.c' line='4241' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_unregister'>
-        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4241' column='1'/>
+      <function-decl name='clk_hw_unregister' mangled-name='clk_hw_unregister' filepath='drivers/clk/clk.c' line='4244' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_unregister'>
+        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4244' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='clk_hw_unregister_divider' mangled-name='clk_hw_unregister_divider' filepath='drivers/clk/clk-divider.c' line='576' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_unregister_divider'>
@@ -124574,14 +124593,14 @@
       </function-decl>
       <var-decl name='clk_mux_ops' type-id='92072f8b' mangled-name='clk_mux_ops' visibility='default' filepath='drivers/clk/clk-mux.c' line='136' column='1' elf-symbol-id='clk_mux_ops'/>
       <var-decl name='clk_mux_ro_ops' type-id='92072f8b' mangled-name='clk_mux_ro_ops' visibility='default' filepath='drivers/clk/clk-mux.c' line='143' column='1' elf-symbol-id='clk_mux_ro_ops'/>
-      <function-decl name='clk_notifier_register' mangled-name='clk_notifier_register' filepath='drivers/clk/clk.c' line='4471' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_notifier_register'>
-        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4471' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/clk/clk.c' line='4471' column='1'/>
+      <function-decl name='clk_notifier_register' mangled-name='clk_notifier_register' filepath='drivers/clk/clk.c' line='4474' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_notifier_register'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4474' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/clk/clk.c' line='4474' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='clk_notifier_unregister' mangled-name='clk_notifier_unregister' filepath='drivers/clk/clk.c' line='4519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_notifier_unregister'>
-        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4519' column='1'/>
-        <parameter type-id='d504f73d' name='nb' filepath='drivers/clk/clk.c' line='4519' column='1'/>
+      <function-decl name='clk_notifier_unregister' mangled-name='clk_notifier_unregister' filepath='drivers/clk/clk.c' line='4522' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_notifier_unregister'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4522' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/clk/clk.c' line='4522' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='clk_prepare' mangled-name='clk_prepare' filepath='drivers/clk/clk.c' line='966' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_prepare'>
@@ -124592,9 +124611,9 @@
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clkdev.c' line='115' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_register' mangled-name='clk_register' filepath='drivers/clk/clk.c' line='4060' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_register'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4060' column='1'/>
-        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4060' column='1'/>
+      <function-decl name='clk_register' mangled-name='clk_register' filepath='drivers/clk/clk.c' line='4063' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4063' column='1'/>
+        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4063' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
       <function-decl name='clk_register_clkdev' mangled-name='clk_register_clkdev' filepath='drivers/clk/clkdev.c' line='341' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_register_clkdev'>
@@ -124706,8 +124725,8 @@
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='885' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_unregister' mangled-name='clk_unregister' filepath='drivers/clk/clk.c' line='4179' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_unregister'>
-        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4179' column='1'/>
+      <function-decl name='clk_unregister' mangled-name='clk_unregister' filepath='drivers/clk/clk.c' line='4182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_unregister'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4182' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='clockevents_config_and_register' mangled-name='clockevents_config_and_register' filepath='kernel/time/clockevents.c' line='505' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clockevents_config_and_register'>
@@ -124738,8 +124757,8 @@
         <parameter type-id='4dfe71de' name='c' filepath='drivers/clocksource/mmio.c' line='20' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='close_candev' mangled-name='close_candev' filepath='drivers/net/can/dev/dev.c' line='902' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='close_candev'>
-        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='902' column='1'/>
+      <function-decl name='close_candev' mangled-name='close_candev' filepath='drivers/net/can/dev/dev.c' line='904' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='close_candev'>
+        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='904' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='cma_alloc' mangled-name='cma_alloc' filepath='mm/cma.c' line='437' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cma_alloc'>
@@ -124850,8 +124869,8 @@
         <parameter type-id='eaa32e2f' name='data' filepath='drivers/base/component.c' line='549' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cond_synchronize_rcu' mangled-name='cond_synchronize_rcu' filepath='kernel/rcu/tree.c' line='3748' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cond_synchronize_rcu'>
-        <parameter type-id='7359adad' name='oldstate' filepath='kernel/rcu/tree.c' line='3748' column='1'/>
+      <function-decl name='cond_synchronize_rcu' mangled-name='cond_synchronize_rcu' filepath='kernel/rcu/tree.c' line='3757' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cond_synchronize_rcu'>
+        <parameter type-id='7359adad' name='oldstate' filepath='kernel/rcu/tree.c' line='3757' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='config_ep_by_speed' mangled-name='config_ep_by_speed' filepath='drivers/usb/gadget/composite.c' line='292' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='config_ep_by_speed'>
@@ -125767,7 +125786,7 @@
       <function-decl name='current_umask' mangled-name='current_umask' filepath='fs/fs_struct.c' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='current_umask'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='current_work' mangled-name='current_work' filepath='kernel/workqueue.c' line='4525' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='current_work'>
+      <function-decl name='current_work' mangled-name='current_work' filepath='kernel/workqueue.c' line='4534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='current_work'>
         <return type-id='83c1bde6'/>
       </function-decl>
       <function-decl name='d_add' mangled-name='d_add' filepath='fs/dcache.c' line='2695' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='d_add'>
@@ -126121,8 +126140,8 @@
         <parameter type-id='5bed570d' name='desc' filepath='drivers/gpio/gpiolib.c' line='164' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='destroy_workqueue' mangled-name='destroy_workqueue' filepath='kernel/workqueue.c' line='4398' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='destroy_workqueue'>
-        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='4398' column='1'/>
+      <function-decl name='destroy_workqueue' mangled-name='destroy_workqueue' filepath='kernel/workqueue.c' line='4407' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='destroy_workqueue'>
+        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='4407' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dev_alloc_name' mangled-name='dev_alloc_name' filepath='net/core/dev.c' line='1271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_alloc_name'>
@@ -127032,9 +127051,9 @@
         <parameter type-id='80f4b756' name='id' filepath='drivers/clk/clk-devres.c' line='82' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='devm_clk_hw_register' mangled-name='devm_clk_hw_register' filepath='drivers/clk/clk.c' line='4297' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_hw_register'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4297' column='1'/>
-        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4297' column='1'/>
+      <function-decl name='devm_clk_hw_register' mangled-name='devm_clk_hw_register' filepath='drivers/clk/clk.c' line='4300' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_hw_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4300' column='1'/>
+        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4300' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_clk_hw_register_clkdev' mangled-name='devm_clk_hw_register_clkdev' filepath='drivers/clk/clkdev.c' line='431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_hw_register_clkdev'>
@@ -127049,9 +127068,9 @@
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk-devres.c' line='195' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devm_clk_register' mangled-name='devm_clk_register' filepath='drivers/clk/clk.c' line='4267' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_register'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4267' column='1'/>
-        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4267' column='1'/>
+      <function-decl name='devm_clk_register' mangled-name='devm_clk_register' filepath='drivers/clk/clk.c' line='4270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4270' column='1'/>
+        <parameter type-id='3aaeef89' name='hw' filepath='drivers/clk/clk.c' line='4270' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
       <function-decl name='devm_devfreq_add_device' mangled-name='devm_devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='984' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_add_device'>
@@ -127418,14 +127437,14 @@
         <parameter type-id='7359adad' name='flags' filepath='kernel/iomem.c' line='140' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='devm_mfd_add_devices' mangled-name='devm_mfd_add_devices' filepath='drivers/mfd/mfd-core.c' line='419' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_mfd_add_devices'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/mfd/mfd-core.c' line='419' column='1'/>
-        <parameter type-id='95e97e5e' name='id' filepath='drivers/mfd/mfd-core.c' line='419' column='1'/>
-        <parameter type-id='1447e860' name='cells' filepath='drivers/mfd/mfd-core.c' line='420' column='1'/>
-        <parameter type-id='95e97e5e' name='n_devs' filepath='drivers/mfd/mfd-core.c' line='420' column='1'/>
-        <parameter type-id='c9d64c0d' name='mem_base' filepath='drivers/mfd/mfd-core.c' line='421' column='1'/>
-        <parameter type-id='95e97e5e' name='irq_base' filepath='drivers/mfd/mfd-core.c' line='422' column='1'/>
-        <parameter type-id='7544e824' name='domain' filepath='drivers/mfd/mfd-core.c' line='422' column='1'/>
+      <function-decl name='devm_mfd_add_devices' mangled-name='devm_mfd_add_devices' filepath='drivers/mfd/mfd-core.c' line='426' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_mfd_add_devices'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/mfd/mfd-core.c' line='426' column='1'/>
+        <parameter type-id='95e97e5e' name='id' filepath='drivers/mfd/mfd-core.c' line='426' column='1'/>
+        <parameter type-id='1447e860' name='cells' filepath='drivers/mfd/mfd-core.c' line='427' column='1'/>
+        <parameter type-id='95e97e5e' name='n_devs' filepath='drivers/mfd/mfd-core.c' line='427' column='1'/>
+        <parameter type-id='c9d64c0d' name='mem_base' filepath='drivers/mfd/mfd-core.c' line='428' column='1'/>
+        <parameter type-id='95e97e5e' name='irq_base' filepath='drivers/mfd/mfd-core.c' line='429' column='1'/>
+        <parameter type-id='7544e824' name='domain' filepath='drivers/mfd/mfd-core.c' line='429' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_nvmem_cell_get' mangled-name='devm_nvmem_cell_get' filepath='drivers/nvmem/core.c' line='1150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_nvmem_cell_get'>
@@ -127443,10 +127462,10 @@
         <parameter type-id='7bb280fa' name='config' filepath='drivers/nvmem/core.c' line='775' column='1'/>
         <return type-id='8179bc49'/>
       </function-decl>
-      <function-decl name='devm_of_clk_add_hw_provider' mangled-name='devm_of_clk_add_hw_provider' filepath='drivers/clk/clk.c' line='4785' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_of_clk_add_hw_provider'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4785' column='1'/>
-        <parameter type-id='a5186342' name='get' filepath='drivers/clk/clk.c' line='4786' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4788' column='1'/>
+      <function-decl name='devm_of_clk_add_hw_provider' mangled-name='devm_of_clk_add_hw_provider' filepath='drivers/clk/clk.c' line='4788' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_of_clk_add_hw_provider'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='4788' column='1'/>
+        <parameter type-id='a5186342' name='get' filepath='drivers/clk/clk.c' line='4789' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4791' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_of_icc_get' mangled-name='devm_of_icc_get' filepath='drivers/interconnect/core.c' line='402' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_of_icc_get'>
@@ -127753,12 +127772,12 @@
         <parameter type-id='f22e4524' name='ctlr' filepath='drivers/spi/spi.c' line='2831' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_thermal_of_cooling_device_register' mangled-name='devm_thermal_of_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1222' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_thermal_of_cooling_device_register'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/thermal/thermal_core.c' line='1222' column='1'/>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/thermal/thermal_core.c' line='1223' column='1'/>
-        <parameter type-id='26a90f95' name='type' filepath='drivers/thermal/thermal_core.c' line='1224' column='1'/>
-        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1224' column='1'/>
-        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1225' column='1'/>
+      <function-decl name='devm_thermal_of_cooling_device_register' mangled-name='devm_thermal_of_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_thermal_of_cooling_device_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/thermal/thermal_core.c' line='1224' column='1'/>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/thermal/thermal_core.c' line='1225' column='1'/>
+        <parameter type-id='26a90f95' name='type' filepath='drivers/thermal/thermal_core.c' line='1226' column='1'/>
+        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1226' column='1'/>
+        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1227' column='1'/>
         <return type-id='2feec21f'/>
       </function-decl>
       <function-decl name='devm_thermal_zone_of_sensor_register' mangled-name='devm_thermal_zone_of_sensor_register' filepath='drivers/thermal/thermal_of.c' line='615' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_thermal_zone_of_sensor_register'>
@@ -128522,9 +128541,9 @@
         <parameter type-id='27675065' name='dentry' filepath='fs/dcache.c' line='859' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dqget' mangled-name='dqget' filepath='fs/quota/dquot.c' line='920' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dqget'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='920' column='1'/>
-        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='920' column='1'/>
+      <function-decl name='dqget' mangled-name='dqget' filepath='fs/quota/dquot.c' line='932' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dqget'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='932' column='1'/>
+        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='932' column='1'/>
         <return type-id='e9a4c848'/>
       </function-decl>
       <function-decl name='dql_completed' mangled-name='dql_completed' filepath='lib/dynamic_queue_limits.c' line='18' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dql_completed'>
@@ -128536,149 +128555,149 @@
         <parameter type-id='6fe0e73c' name='dql' filepath='lib/dynamic_queue_limits.c' line='116' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dqput' mangled-name='dqput' filepath='fs/quota/dquot.c' line='848' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dqput'>
-        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='848' column='1'/>
+      <function-decl name='dqput' mangled-name='dqput' filepath='fs/quota/dquot.c' line='859' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dqput'>
+        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='859' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dquot_acquire' mangled-name='dquot_acquire' filepath='fs/quota/dquot.c' line='452' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_acquire'>
-        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='452' column='1'/>
+      <function-decl name='dquot_acquire' mangled-name='dquot_acquire' filepath='fs/quota/dquot.c' line='454' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_acquire'>
+        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='454' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_alloc' mangled-name='dquot_alloc' filepath='fs/quota/dquot.c' line='885' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_alloc'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='885' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='885' column='1'/>
+      <function-decl name='dquot_alloc' mangled-name='dquot_alloc' filepath='fs/quota/dquot.c' line='897' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_alloc'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='897' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='897' column='1'/>
         <return type-id='e9a4c848'/>
       </function-decl>
-      <function-decl name='dquot_alloc_inode' mangled-name='dquot_alloc_inode' filepath='fs/quota/dquot.c' line='1794' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_alloc_inode'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1794' column='1'/>
+      <function-decl name='dquot_alloc_inode' mangled-name='dquot_alloc_inode' filepath='fs/quota/dquot.c' line='1806' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_alloc_inode'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1806' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_claim_space_nodirty' mangled-name='dquot_claim_space_nodirty' filepath='fs/quota/dquot.c' line='1838' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_claim_space_nodirty'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1838' column='1'/>
-        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1838' column='1'/>
+      <function-decl name='dquot_claim_space_nodirty' mangled-name='dquot_claim_space_nodirty' filepath='fs/quota/dquot.c' line='1850' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_claim_space_nodirty'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1850' column='1'/>
+        <parameter type-id='33341965' name='number' filepath='fs/quota/dquot.c' line='1850' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_commit' mangled-name='dquot_commit' filepath='fs/quota/dquot.c' line='499' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_commit'>
-        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='499' column='1'/>
+      <function-decl name='dquot_commit' mangled-name='dquot_commit' filepath='fs/quota/dquot.c' line='501' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_commit'>
+        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='501' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_commit_info' mangled-name='dquot_commit_info' filepath='fs/quota/dquot.c' line='2190' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_commit_info'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2190' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2190' column='1'/>
+      <function-decl name='dquot_commit_info' mangled-name='dquot_commit_info' filepath='fs/quota/dquot.c' line='2202' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_commit_info'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2202' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2202' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_destroy' mangled-name='dquot_destroy' filepath='fs/quota/dquot.c' line='554' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_destroy'>
-        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='554' column='1'/>
+      <function-decl name='dquot_destroy' mangled-name='dquot_destroy' filepath='fs/quota/dquot.c' line='556' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_destroy'>
+        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='556' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dquot_disable' mangled-name='dquot_disable' filepath='fs/quota/dquot.c' line='2258' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_disable'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2258' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2258' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='fs/quota/dquot.c' line='2258' column='1'/>
+      <function-decl name='dquot_disable' mangled-name='dquot_disable' filepath='fs/quota/dquot.c' line='2270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_disable'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2270' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2270' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='fs/quota/dquot.c' line='2270' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_drop' mangled-name='dquot_drop' filepath='fs/quota/dquot.c' line='1653' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_drop'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1653' column='1'/>
+      <function-decl name='dquot_drop' mangled-name='dquot_drop' filepath='fs/quota/dquot.c' line='1665' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_drop'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1665' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dquot_file_open' mangled-name='dquot_file_open' filepath='fs/quota/dquot.c' line='2228' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_file_open'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2228' column='1'/>
-        <parameter type-id='77e79a4b' name='file' filepath='fs/quota/dquot.c' line='2228' column='1'/>
+      <function-decl name='dquot_file_open' mangled-name='dquot_file_open' filepath='fs/quota/dquot.c' line='2240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_file_open'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2240' column='1'/>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/quota/dquot.c' line='2240' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_free_inode' mangled-name='dquot_free_inode' filepath='fs/quota/dquot.c' line='1977' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_free_inode'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1977' column='1'/>
+      <function-decl name='dquot_free_inode' mangled-name='dquot_free_inode' filepath='fs/quota/dquot.c' line='1989' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_free_inode'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1989' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dquot_get_dqblk' mangled-name='dquot_get_dqblk' filepath='fs/quota/dquot.c' line='2686' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_dqblk'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2686' column='1'/>
-        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='2686' column='1'/>
-        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2687' column='1'/>
+      <function-decl name='dquot_get_dqblk' mangled-name='dquot_get_dqblk' filepath='fs/quota/dquot.c' line='2712' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_dqblk'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2712' column='1'/>
+        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='2712' column='1'/>
+        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2713' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_get_next_dqblk' mangled-name='dquot_get_next_dqblk' filepath='fs/quota/dquot.c' line='2701' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_next_dqblk'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2701' column='1'/>
-        <parameter type-id='cc8d835a' name='qid' filepath='fs/quota/dquot.c' line='2701' column='1'/>
-        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2702' column='1'/>
+      <function-decl name='dquot_get_next_dqblk' mangled-name='dquot_get_next_dqblk' filepath='fs/quota/dquot.c' line='2727' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_next_dqblk'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2727' column='1'/>
+        <parameter type-id='cc8d835a' name='qid' filepath='fs/quota/dquot.c' line='2727' column='1'/>
+        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2728' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_get_next_id' mangled-name='dquot_get_next_id' filepath='fs/quota/dquot.c' line='2198' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_next_id'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2198' column='1'/>
-        <parameter type-id='cc8d835a' name='qid' filepath='fs/quota/dquot.c' line='2198' column='1'/>
+      <function-decl name='dquot_get_next_id' mangled-name='dquot_get_next_id' filepath='fs/quota/dquot.c' line='2210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_next_id'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2210' column='1'/>
+        <parameter type-id='cc8d835a' name='qid' filepath='fs/quota/dquot.c' line='2210' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_get_state' mangled-name='dquot_get_state' filepath='fs/quota/dquot.c' line='2838' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_state'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2838' column='1'/>
-        <parameter type-id='6dcf57f3' name='state' filepath='fs/quota/dquot.c' line='2838' column='1'/>
+      <function-decl name='dquot_get_state' mangled-name='dquot_get_state' filepath='fs/quota/dquot.c' line='2864' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_get_state'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2864' column='1'/>
+        <parameter type-id='6dcf57f3' name='state' filepath='fs/quota/dquot.c' line='2864' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_initialize' mangled-name='dquot_initialize' filepath='fs/quota/dquot.c' line='1608' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_initialize'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1608' column='1'/>
+      <function-decl name='dquot_initialize' mangled-name='dquot_initialize' filepath='fs/quota/dquot.c' line='1620' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_initialize'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1620' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_initialize_needed' mangled-name='dquot_initialize_needed' filepath='fs/quota/dquot.c' line='1614' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_initialize_needed'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1614' column='1'/>
+      <function-decl name='dquot_initialize_needed' mangled-name='dquot_initialize_needed' filepath='fs/quota/dquot.c' line='1626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_initialize_needed'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='1626' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='dquot_load_quota_inode' mangled-name='dquot_load_quota_inode' filepath='fs/quota/dquot.c' line='2491' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_load_quota_inode'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2491' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2491' column='1'/>
-        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2491' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='fs/quota/dquot.c' line='2492' column='1'/>
+      <function-decl name='dquot_load_quota_inode' mangled-name='dquot_load_quota_inode' filepath='fs/quota/dquot.c' line='2517' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_load_quota_inode'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2517' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2517' column='1'/>
+        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2517' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='fs/quota/dquot.c' line='2518' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_mark_dquot_dirty' mangled-name='dquot_mark_dquot_dirty' filepath='fs/quota/dquot.c' line='376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_mark_dquot_dirty'>
-        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='376' column='1'/>
+      <function-decl name='dquot_mark_dquot_dirty' mangled-name='dquot_mark_dquot_dirty' filepath='fs/quota/dquot.c' line='378' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_mark_dquot_dirty'>
+        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='378' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_quota_off' mangled-name='dquot_quota_off' filepath='fs/quota/dquot.c' line='2364' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_off'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2364' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2364' column='1'/>
+      <function-decl name='dquot_quota_off' mangled-name='dquot_quota_off' filepath='fs/quota/dquot.c' line='2376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_off'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2376' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2376' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_quota_on' mangled-name='dquot_quota_on' filepath='fs/quota/dquot.c' line='2541' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_on'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2541' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2541' column='1'/>
-        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2541' column='1'/>
-        <parameter type-id='a77efac3' name='path' filepath='fs/quota/dquot.c' line='2542' column='1'/>
+      <function-decl name='dquot_quota_on' mangled-name='dquot_quota_on' filepath='fs/quota/dquot.c' line='2567' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_on'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2567' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2567' column='1'/>
+        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2567' column='1'/>
+        <parameter type-id='a77efac3' name='path' filepath='fs/quota/dquot.c' line='2568' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_quota_on_mount' mangled-name='dquot_quota_on_mount' filepath='fs/quota/dquot.c' line='2562' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_on_mount'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2562' column='1'/>
-        <parameter type-id='26a90f95' name='qf_name' filepath='fs/quota/dquot.c' line='2562' column='1'/>
-        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2563' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2563' column='1'/>
+      <function-decl name='dquot_quota_on_mount' mangled-name='dquot_quota_on_mount' filepath='fs/quota/dquot.c' line='2588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_quota_on_mount'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2588' column='1'/>
+        <parameter type-id='26a90f95' name='qf_name' filepath='fs/quota/dquot.c' line='2588' column='1'/>
+        <parameter type-id='95e97e5e' name='format_id' filepath='fs/quota/dquot.c' line='2589' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2589' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_release' mangled-name='dquot_release' filepath='fs/quota/dquot.c' line='525' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_release'>
-        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='525' column='1'/>
+      <function-decl name='dquot_release' mangled-name='dquot_release' filepath='fs/quota/dquot.c' line='527' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_release'>
+        <parameter type-id='e9a4c848' name='dquot' filepath='fs/quota/dquot.c' line='527' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_resume' mangled-name='dquot_resume' filepath='fs/quota/dquot.c' line='2507' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_resume'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2507' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2507' column='1'/>
+      <function-decl name='dquot_resume' mangled-name='dquot_resume' filepath='fs/quota/dquot.c' line='2533' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_resume'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2533' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2533' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_set_dqblk' mangled-name='dquot_set_dqblk' filepath='fs/quota/dquot.c' line='2819' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_set_dqblk'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2819' column='1'/>
-        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='2819' column='1'/>
-        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2820' column='1'/>
+      <function-decl name='dquot_set_dqblk' mangled-name='dquot_set_dqblk' filepath='fs/quota/dquot.c' line='2845' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_set_dqblk'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2845' column='1'/>
+        <parameter type-id='72028e1c' name='qid' filepath='fs/quota/dquot.c' line='2845' column='1'/>
+        <parameter type-id='39341f7e' name='di' filepath='fs/quota/dquot.c' line='2846' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_set_dqinfo' mangled-name='dquot_set_dqinfo' filepath='fs/quota/dquot.c' line='2873' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_set_dqinfo'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2873' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2873' column='1'/>
-        <parameter type-id='66b0cee4' name='ii' filepath='fs/quota/dquot.c' line='2873' column='1'/>
+      <function-decl name='dquot_set_dqinfo' mangled-name='dquot_set_dqinfo' filepath='fs/quota/dquot.c' line='2899' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_set_dqinfo'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='2899' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='2899' column='1'/>
+        <parameter type-id='66b0cee4' name='ii' filepath='fs/quota/dquot.c' line='2899' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_transfer' mangled-name='dquot_transfer' filepath='fs/quota/dquot.c' line='2148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_transfer'>
-        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2148' column='1'/>
-        <parameter type-id='ab7bbd67' name='iattr' filepath='fs/quota/dquot.c' line='2148' column='1'/>
+      <function-decl name='dquot_transfer' mangled-name='dquot_transfer' filepath='fs/quota/dquot.c' line='2160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_transfer'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/quota/dquot.c' line='2160' column='1'/>
+        <parameter type-id='ab7bbd67' name='iattr' filepath='fs/quota/dquot.c' line='2160' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dquot_writeback_dquots' mangled-name='dquot_writeback_dquots' filepath='fs/quota/dquot.c' line='678' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_writeback_dquots'>
-        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='678' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='678' column='1'/>
+      <function-decl name='dquot_writeback_dquots' mangled-name='dquot_writeback_dquots' filepath='fs/quota/dquot.c' line='683' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dquot_writeback_dquots'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/quota/dquot.c' line='683' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='fs/quota/dquot.c' line='683' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drain_workqueue' mangled-name='drain_workqueue' filepath='kernel/workqueue.c' line='2960' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drain_workqueue'>
@@ -131061,8 +131080,8 @@
         <parameter type-id='28271da3' name='fence' filepath='drivers/gpu/drm/drm_syncobj.c' line='322' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_sysfs_hotplug_event' mangled-name='drm_sysfs_hotplug_event' filepath='drivers/gpu/drm/drm_sysfs.c' line='336' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_sysfs_hotplug_event'>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_sysfs.c' line='336' column='1'/>
+      <function-decl name='drm_sysfs_hotplug_event' mangled-name='drm_sysfs_hotplug_event' filepath='drivers/gpu/drm/drm_sysfs.c' line='365' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_sysfs_hotplug_event'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_sysfs.c' line='365' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_universal_plane_init' mangled-name='drm_universal_plane_init' filepath='drivers/gpu/drm/drm_plane.c' line='173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_universal_plane_init'>
@@ -131937,8 +131956,8 @@
         <parameter type-id='c485c22c' name='bh' filepath='fs/buffer.c' line='3377' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='free_candev' mangled-name='free_candev' filepath='drivers/net/can/dev/dev.c' line='800' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_candev'>
-        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='800' column='1'/>
+      <function-decl name='free_candev' mangled-name='free_candev' filepath='drivers/net/can/dev/dev.c' line='802' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_candev'>
+        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='802' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='free_io_pgtable_ops' mangled-name='free_io_pgtable_ops' filepath='drivers/iommu/io-pgtable.c' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_io_pgtable_ops'>
@@ -132279,8 +132298,8 @@
         <parameter type-id='b88dd945' name='bdev' filepath='fs/block_dev.c' line='548' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ftrace_dump' mangled-name='ftrace_dump' filepath='kernel/trace/trace.c' line='9453' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ftrace_dump'>
-        <parameter type-id='9be0e7e4' name='oops_dump_mode' filepath='kernel/trace/trace.c' line='9453' column='1'/>
+      <function-decl name='ftrace_dump' mangled-name='ftrace_dump' filepath='kernel/trace/trace.c' line='9416' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ftrace_dump'>
+        <parameter type-id='9be0e7e4' name='oops_dump_mode' filepath='kernel/trace/trace.c' line='9416' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='full_name_hash' mangled-name='full_name_hash' filepath='fs/namei.c' line='2067' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='full_name_hash'>
@@ -132844,7 +132863,7 @@
         <parameter type-id='d225de01' name='sinfo' filepath='mm/slub.c' line='5911' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='get_state_synchronize_rcu' mangled-name='get_state_synchronize_rcu' filepath='kernel/rcu/tree.c' line='3723' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_state_synchronize_rcu'>
+      <function-decl name='get_state_synchronize_rcu' mangled-name='get_state_synchronize_rcu' filepath='kernel/rcu/tree.c' line='3732' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_state_synchronize_rcu'>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='get_task_exe_file' mangled-name='get_task_exe_file' filepath='kernel/fork.c' line='1246' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_exe_file'>
@@ -133288,8 +133307,8 @@
         <parameter type-id='76c7d88b' name='desc' filepath='kernel/irq/chip.c' line='556' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='handle_sysrq' mangled-name='handle_sysrq' filepath='drivers/tty/sysrq.c' line='632' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='handle_sysrq'>
-        <parameter type-id='95e97e5e' name='key' filepath='drivers/tty/sysrq.c' line='632' column='1'/>
+      <function-decl name='handle_sysrq' mangled-name='handle_sysrq' filepath='drivers/tty/sysrq.c' line='633' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='handle_sysrq'>
+        <parameter type-id='95e97e5e' name='key' filepath='drivers/tty/sysrq.c' line='633' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='hash_digest_size' type-id='9208c5df' mangled-name='hash_digest_size' visibility='default' filepath='crypto/hash_info.c' line='35' column='1' elf-symbol-id='hash_digest_size'/>
@@ -133801,27 +133820,27 @@
         <parameter type-id='554d9945' name='drv' filepath='drivers/i3c/device.c' line='276' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='i3c_generic_ibi_alloc_pool' mangled-name='i3c_generic_ibi_alloc_pool' filepath='drivers/i3c/master.c' line='2328' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_generic_ibi_alloc_pool'>
-        <parameter type-id='e9b5d134' name='dev' filepath='drivers/i3c/master.c' line='2328' column='1'/>
-        <parameter type-id='d0ddd4b8' name='req' filepath='drivers/i3c/master.c' line='2329' column='1'/>
+      <function-decl name='i3c_generic_ibi_alloc_pool' mangled-name='i3c_generic_ibi_alloc_pool' filepath='drivers/i3c/master.c' line='2330' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_generic_ibi_alloc_pool'>
+        <parameter type-id='e9b5d134' name='dev' filepath='drivers/i3c/master.c' line='2330' column='1'/>
+        <parameter type-id='d0ddd4b8' name='req' filepath='drivers/i3c/master.c' line='2331' column='1'/>
         <return type-id='d9481436'/>
       </function-decl>
-      <function-decl name='i3c_generic_ibi_free_pool' mangled-name='i3c_generic_ibi_free_pool' filepath='drivers/i3c/master.c' line='2294' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_generic_ibi_free_pool'>
-        <parameter type-id='d9481436' name='pool' filepath='drivers/i3c/master.c' line='2294' column='1'/>
+      <function-decl name='i3c_generic_ibi_free_pool' mangled-name='i3c_generic_ibi_free_pool' filepath='drivers/i3c/master.c' line='2296' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_generic_ibi_free_pool'>
+        <parameter type-id='d9481436' name='pool' filepath='drivers/i3c/master.c' line='2296' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='i3c_generic_ibi_get_free_slot' mangled-name='i3c_generic_ibi_get_free_slot' filepath='drivers/i3c/master.c' line='2390' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_generic_ibi_get_free_slot'>
-        <parameter type-id='d9481436' name='pool' filepath='drivers/i3c/master.c' line='2390' column='1'/>
+      <function-decl name='i3c_generic_ibi_get_free_slot' mangled-name='i3c_generic_ibi_get_free_slot' filepath='drivers/i3c/master.c' line='2392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_generic_ibi_get_free_slot'>
+        <parameter type-id='d9481436' name='pool' filepath='drivers/i3c/master.c' line='2392' column='1'/>
         <return type-id='80cda266'/>
       </function-decl>
-      <function-decl name='i3c_generic_ibi_recycle_slot' mangled-name='i3c_generic_ibi_recycle_slot' filepath='drivers/i3c/master.c' line='2414' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_generic_ibi_recycle_slot'>
-        <parameter type-id='d9481436' name='pool' filepath='drivers/i3c/master.c' line='2414' column='1'/>
-        <parameter type-id='80cda266' name='s' filepath='drivers/i3c/master.c' line='2415' column='1'/>
+      <function-decl name='i3c_generic_ibi_recycle_slot' mangled-name='i3c_generic_ibi_recycle_slot' filepath='drivers/i3c/master.c' line='2416' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_generic_ibi_recycle_slot'>
+        <parameter type-id='d9481436' name='pool' filepath='drivers/i3c/master.c' line='2416' column='1'/>
+        <parameter type-id='80cda266' name='s' filepath='drivers/i3c/master.c' line='2417' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='i3c_master_add_i3c_dev_locked' mangled-name='i3c_master_add_i3c_dev_locked' filepath='drivers/i3c/master.c' line='1853' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_add_i3c_dev_locked'>
-        <parameter type-id='0ac68794' name='master' filepath='drivers/i3c/master.c' line='1853' column='1'/>
-        <parameter type-id='f9b06939' name='addr' filepath='drivers/i3c/master.c' line='1854' column='1'/>
+      <function-decl name='i3c_master_add_i3c_dev_locked' mangled-name='i3c_master_add_i3c_dev_locked' filepath='drivers/i3c/master.c' line='1855' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_add_i3c_dev_locked'>
+        <parameter type-id='0ac68794' name='master' filepath='drivers/i3c/master.c' line='1855' column='1'/>
+        <parameter type-id='f9b06939' name='addr' filepath='drivers/i3c/master.c' line='1856' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='i3c_master_defslvs_locked' mangled-name='i3c_master_defslvs_locked' filepath='drivers/i3c/master.c' line='897' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_defslvs_locked'>
@@ -133834,8 +133853,8 @@
         <parameter type-id='f9b06939' name='evts' filepath='drivers/i3c/master.c' line='851' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='i3c_master_do_daa' mangled-name='i3c_master_do_daa' filepath='drivers/i3c/master.c' line='1533' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_do_daa'>
-        <parameter type-id='0ac68794' name='master' filepath='drivers/i3c/master.c' line='1533' column='1'/>
+      <function-decl name='i3c_master_do_daa' mangled-name='i3c_master_do_daa' filepath='drivers/i3c/master.c' line='1535' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_do_daa'>
+        <parameter type-id='0ac68794' name='master' filepath='drivers/i3c/master.c' line='1535' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='i3c_master_enec_locked' mangled-name='i3c_master_enec_locked' filepath='drivers/i3c/master.c' line='871' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_enec_locked'>
@@ -133853,25 +133872,25 @@
         <parameter type-id='f9b06939' name='start_addr' filepath='drivers/i3c/master.c' line='718' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='i3c_master_queue_ibi' mangled-name='i3c_master_queue_ibi' filepath='drivers/i3c/master.c' line='2241' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_queue_ibi'>
-        <parameter type-id='e9b5d134' name='dev' filepath='drivers/i3c/master.c' line='2241' column='1'/>
-        <parameter type-id='80cda266' name='slot' filepath='drivers/i3c/master.c' line='2241' column='1'/>
+      <function-decl name='i3c_master_queue_ibi' mangled-name='i3c_master_queue_ibi' filepath='drivers/i3c/master.c' line='2243' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_queue_ibi'>
+        <parameter type-id='e9b5d134' name='dev' filepath='drivers/i3c/master.c' line='2243' column='1'/>
+        <parameter type-id='80cda266' name='slot' filepath='drivers/i3c/master.c' line='2243' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='i3c_master_register' mangled-name='i3c_master_register' filepath='drivers/i3c/master.c' line='2465' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_register'>
-        <parameter type-id='0ac68794' name='master' filepath='drivers/i3c/master.c' line='2465' column='1'/>
-        <parameter type-id='fa0b179b' name='parent' filepath='drivers/i3c/master.c' line='2466' column='1'/>
-        <parameter type-id='b37211ac' name='ops' filepath='drivers/i3c/master.c' line='2467' column='1'/>
-        <parameter type-id='b50a4934' name='secondary' filepath='drivers/i3c/master.c' line='2468' column='1'/>
+      <function-decl name='i3c_master_register' mangled-name='i3c_master_register' filepath='drivers/i3c/master.c' line='2467' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_register'>
+        <parameter type-id='0ac68794' name='master' filepath='drivers/i3c/master.c' line='2467' column='1'/>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/i3c/master.c' line='2468' column='1'/>
+        <parameter type-id='b37211ac' name='ops' filepath='drivers/i3c/master.c' line='2469' column='1'/>
+        <parameter type-id='b50a4934' name='secondary' filepath='drivers/i3c/master.c' line='2470' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='i3c_master_set_info' mangled-name='i3c_master_set_info' filepath='drivers/i3c/master.c' line='1576' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_set_info'>
-        <parameter type-id='0ac68794' name='master' filepath='drivers/i3c/master.c' line='1576' column='1'/>
-        <parameter type-id='e7a3c515' name='info' filepath='drivers/i3c/master.c' line='1577' column='1'/>
+      <function-decl name='i3c_master_set_info' mangled-name='i3c_master_set_info' filepath='drivers/i3c/master.c' line='1578' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_set_info'>
+        <parameter type-id='0ac68794' name='master' filepath='drivers/i3c/master.c' line='1578' column='1'/>
+        <parameter type-id='e7a3c515' name='info' filepath='drivers/i3c/master.c' line='1579' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='i3c_master_unregister' mangled-name='i3c_master_unregister' filepath='drivers/i3c/master.c' line='2586' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_unregister'>
-        <parameter type-id='0ac68794' name='master' filepath='drivers/i3c/master.c' line='2586' column='1'/>
+      <function-decl name='i3c_master_unregister' mangled-name='i3c_master_unregister' filepath='drivers/i3c/master.c' line='2588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3c_master_unregister'>
+        <parameter type-id='0ac68794' name='master' filepath='drivers/i3c/master.c' line='2588' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='i3cdev_to_dev' mangled-name='i3cdev_to_dev' filepath='drivers/i3c/device.c' line='185' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i3cdev_to_dev'>
@@ -135439,17 +135458,17 @@
         <parameter type-id='95e97e5e' name='addrlen' filepath='net/socket.c' line='3413' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kernel_connect' mangled-name='kernel_connect' filepath='net/socket.c' line='3482' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_connect'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3482' column='1'/>
-        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3482' column='1'/>
-        <parameter type-id='95e97e5e' name='addrlen' filepath='net/socket.c' line='3482' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='net/socket.c' line='3483' column='1'/>
+      <function-decl name='kernel_connect' mangled-name='kernel_connect' filepath='net/socket.c' line='3486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_connect'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3486' column='1'/>
+        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3486' column='1'/>
+        <parameter type-id='95e97e5e' name='addrlen' filepath='net/socket.c' line='3486' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/socket.c' line='3487' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='kernel_cpustat' type-id='7b5f27b3' mangled-name='kernel_cpustat' visibility='default' filepath='kernel/sched/core.c' line='4178' column='1' elf-symbol-id='kernel_cpustat'/>
-      <function-decl name='kernel_getsockname' mangled-name='kernel_getsockname' filepath='net/socket.c' line='3502' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_getsockname'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3502' column='1'/>
-        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3502' column='1'/>
+      <function-decl name='kernel_getsockname' mangled-name='kernel_getsockname' filepath='net/socket.c' line='3506' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_getsockname'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3506' column='1'/>
+        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3506' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='kernel_kobj' type-id='d30bdc51' mangled-name='kernel_kobj' visibility='default' filepath='kernel/ksysfs.c' line='213' column='1' elf-symbol-id='kernel_kobj'/>
@@ -135467,7 +135486,7 @@
         <parameter type-id='2730d015' name='mod' filepath='kernel/params.c' line='589' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kernel_power_off' mangled-name='kernel_power_off' filepath='kernel/reboot.c' line='289' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_power_off'>
+      <function-decl name='kernel_power_off' mangled-name='kernel_power_off' filepath='kernel/reboot.c' line='290' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_power_off'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kernel_recvmsg' mangled-name='kernel_recvmsg' filepath='net/socket.c' line='941' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_recvmsg'>
@@ -135479,8 +135498,8 @@
         <parameter type-id='95e97e5e' name='flags' filepath='net/socket.c' line='942' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kernel_restart' mangled-name='kernel_restart' filepath='kernel/reboot.c' line='246' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_restart'>
-        <parameter type-id='26a90f95' name='cmd' filepath='kernel/reboot.c' line='246' column='1'/>
+      <function-decl name='kernel_restart' mangled-name='kernel_restart' filepath='kernel/reboot.c' line='247' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_restart'>
+        <parameter type-id='26a90f95' name='cmd' filepath='kernel/reboot.c' line='247' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kernel_sendmsg' mangled-name='kernel_sendmsg' filepath='net/socket.c' line='705' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_sendmsg'>
@@ -135496,9 +135515,9 @@
         <parameter type-id='8cdd9566' name='action' filepath='kernel/signal.c' line='3979' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kernel_sock_shutdown' mangled-name='kernel_sock_shutdown' filepath='net/socket.c' line='3579' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_sock_shutdown'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3579' column='1'/>
-        <parameter type-id='45c08bac' name='how' filepath='net/socket.c' line='3579' column='1'/>
+      <function-decl name='kernel_sock_shutdown' mangled-name='kernel_sock_shutdown' filepath='net/socket.c' line='3583' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_sock_shutdown'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3583' column='1'/>
+        <parameter type-id='45c08bac' name='how' filepath='net/socket.c' line='3583' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='kernfs_find_and_get_ns' mangled-name='kernfs_find_and_get_ns' filepath='fs/kernfs/dir.c' line='909' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernfs_find_and_get_ns'>
@@ -135691,47 +135710,47 @@
         <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3204' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <var-decl name='kobj_sysfs_ops' type-id='0f840455' mangled-name='kobj_sysfs_ops' visibility='default' filepath='lib/kobject.c' line='860' column='1' elf-symbol-id='kobj_sysfs_ops'/>
-      <function-decl name='kobject_add' mangled-name='kobject_add' filepath='lib/kobject.c' line='426' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_add'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='426' column='1'/>
-        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='426' column='1'/>
-        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='427' column='1'/>
+      <var-decl name='kobj_sysfs_ops' type-id='0f840455' mangled-name='kobj_sysfs_ops' visibility='default' filepath='lib/kobject.c' line='868' column='1' elf-symbol-id='kobj_sysfs_ops'/>
+      <function-decl name='kobject_add' mangled-name='kobject_add' filepath='lib/kobject.c' line='434' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_add'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='434' column='1'/>
+        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='434' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='435' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kobject_create_and_add' mangled-name='kobject_create_and_add' filepath='lib/kobject.c' line='805' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_create_and_add'>
-        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='805' column='1'/>
-        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='805' column='1'/>
+      <function-decl name='kobject_create_and_add' mangled-name='kobject_create_and_add' filepath='lib/kobject.c' line='813' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_create_and_add'>
+        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='813' column='1'/>
+        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='813' column='1'/>
         <return type-id='d30bdc51'/>
       </function-decl>
-      <function-decl name='kobject_del' mangled-name='kobject_del' filepath='lib/kobject.c' line='635' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_del'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='635' column='1'/>
+      <function-decl name='kobject_del' mangled-name='kobject_del' filepath='lib/kobject.c' line='643' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_del'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='643' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kobject_get' mangled-name='kobject_get' filepath='lib/kobject.c' line='652' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_get'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='652' column='1'/>
+      <function-decl name='kobject_get' mangled-name='kobject_get' filepath='lib/kobject.c' line='660' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_get'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='660' column='1'/>
         <return type-id='d30bdc51'/>
       </function-decl>
-      <function-decl name='kobject_init' mangled-name='kobject_init' filepath='lib/kobject.c' line='349' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='349' column='1'/>
-        <parameter type-id='c48b394e' name='ktype' filepath='lib/kobject.c' line='349' column='1'/>
+      <function-decl name='kobject_init' mangled-name='kobject_init' filepath='lib/kobject.c' line='357' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='357' column='1'/>
+        <parameter type-id='c48b394e' name='ktype' filepath='lib/kobject.c' line='357' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kobject_init_and_add' mangled-name='kobject_init_and_add' filepath='lib/kobject.c' line='464' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init_and_add'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='464' column='1'/>
-        <parameter type-id='c48b394e' name='ktype' filepath='lib/kobject.c' line='464' column='1'/>
-        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='465' column='1'/>
-        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='465' column='1'/>
+      <function-decl name='kobject_init_and_add' mangled-name='kobject_init_and_add' filepath='lib/kobject.c' line='472' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init_and_add'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='472' column='1'/>
+        <parameter type-id='c48b394e' name='ktype' filepath='lib/kobject.c' line='472' column='1'/>
+        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='473' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='473' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kobject_put' mangled-name='kobject_put' filepath='lib/kobject.c' line='746' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_put'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='746' column='1'/>
+      <function-decl name='kobject_put' mangled-name='kobject_put' filepath='lib/kobject.c' line='754' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_put'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='754' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kobject_set_name' mangled-name='kobject_set_name' filepath='lib/kobject.c' line='324' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_set_name'>
-        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='324' column='1'/>
-        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='324' column='1'/>
+      <function-decl name='kobject_set_name' mangled-name='kobject_set_name' filepath='lib/kobject.c' line='332' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_set_name'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='332' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='332' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -135752,23 +135771,23 @@
         <parameter type-id='3eb7c31c' name='flags' filepath='mm/slab_common.c' line='1132' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='kset_create_and_add' mangled-name='kset_create_and_add' filepath='lib/kobject.c' line='1010' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_create_and_add'>
-        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='1010' column='1'/>
-        <parameter type-id='86462700' name='uevent_ops' filepath='lib/kobject.c' line='1011' column='1'/>
-        <parameter type-id='d30bdc51' name='parent_kobj' filepath='lib/kobject.c' line='1012' column='1'/>
+      <function-decl name='kset_create_and_add' mangled-name='kset_create_and_add' filepath='lib/kobject.c' line='1018' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_create_and_add'>
+        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='1018' column='1'/>
+        <parameter type-id='86462700' name='uevent_ops' filepath='lib/kobject.c' line='1019' column='1'/>
+        <parameter type-id='d30bdc51' name='parent_kobj' filepath='lib/kobject.c' line='1020' column='1'/>
         <return type-id='89b70200'/>
       </function-decl>
-      <function-decl name='kset_find_obj' mangled-name='kset_find_obj' filepath='lib/kobject.c' line='913' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_find_obj'>
-        <parameter type-id='89b70200' name='kset' filepath='lib/kobject.c' line='913' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='913' column='1'/>
+      <function-decl name='kset_find_obj' mangled-name='kset_find_obj' filepath='lib/kobject.c' line='921' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_find_obj'>
+        <parameter type-id='89b70200' name='kset' filepath='lib/kobject.c' line='921' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='921' column='1'/>
         <return type-id='d30bdc51'/>
       </function-decl>
-      <function-decl name='kset_register' mangled-name='kset_register' filepath='lib/kobject.c' line='870' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_register'>
-        <parameter type-id='89b70200' name='k' filepath='lib/kobject.c' line='870' column='1'/>
+      <function-decl name='kset_register' mangled-name='kset_register' filepath='lib/kobject.c' line='878' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_register'>
+        <parameter type-id='89b70200' name='k' filepath='lib/kobject.c' line='878' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kset_unregister' mangled-name='kset_unregister' filepath='lib/kobject.c' line='895' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_unregister'>
-        <parameter type-id='89b70200' name='k' filepath='lib/kobject.c' line='895' column='1'/>
+      <function-decl name='kset_unregister' mangled-name='kset_unregister' filepath='lib/kobject.c' line='903' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_unregister'>
+        <parameter type-id='89b70200' name='k' filepath='lib/kobject.c' line='903' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ksize' mangled-name='ksize' filepath='mm/slab_common.c' line='1186' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ksize'>
@@ -136092,9 +136111,9 @@
         <parameter type-id='eaa32e2f' name='addr' filepath='mm/util.c' line='649' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kvfree_call_rcu' mangled-name='kvfree_call_rcu' filepath='kernel/rcu/tree.c' line='3500' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvfree_call_rcu'>
-        <parameter type-id='69c138b1' name='head' filepath='kernel/rcu/tree.c' line='3500' column='1'/>
-        <parameter type-id='4edd56e3' name='func' filepath='kernel/rcu/tree.c' line='3500' column='1'/>
+      <function-decl name='kvfree_call_rcu' mangled-name='kvfree_call_rcu' filepath='kernel/rcu/tree.c' line='3501' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvfree_call_rcu'>
+        <parameter type-id='69c138b1' name='head' filepath='kernel/rcu/tree.c' line='3501' column='1'/>
+        <parameter type-id='4edd56e3' name='func' filepath='kernel/rcu/tree.c' line='3501' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kvmalloc_node' mangled-name='kvmalloc_node' filepath='mm/util.c' line='587' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvmalloc_node'>
@@ -136583,8 +136602,8 @@
         <parameter type-id='ac429605' name='req' filepath='drivers/media/mc/mc-request.c' line='79' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mem_cgroup_from_id' mangled-name='mem_cgroup_from_id' filepath='mm/memcontrol.c' line='5232' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mem_cgroup_from_id'>
-        <parameter type-id='8efea9e5' name='id' filepath='mm/memcontrol.c' line='5232' column='1'/>
+      <function-decl name='mem_cgroup_from_id' mangled-name='mem_cgroup_from_id' filepath='mm/memcontrol.c' line='5233' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mem_cgroup_from_id'>
+        <parameter type-id='8efea9e5' name='id' filepath='mm/memcontrol.c' line='5233' column='1'/>
         <return type-id='223696fb'/>
       </function-decl>
       <function-decl name='mem_cgroup_update_lru_size' mangled-name='mem_cgroup_update_lru_size' filepath='mm/memcontrol.c' line='1420' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mem_cgroup_update_lru_size'>
@@ -136622,7 +136641,7 @@
       <function-decl name='memory_block_size_bytes' mangled-name='memory_block_size_bytes' filepath='drivers/base/memory.c' line='106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memory_block_size_bytes'>
         <return type-id='7359adad'/>
       </function-decl>
-      <var-decl name='memory_cgrp_subsys' type-id='1d115fd5' mangled-name='memory_cgrp_subsys' visibility='default' filepath='mm/memcontrol.c' line='6620' column='1' elf-symbol-id='memory_cgrp_subsys'/>
+      <var-decl name='memory_cgrp_subsys' type-id='1d115fd5' mangled-name='memory_cgrp_subsys' visibility='default' filepath='mm/memcontrol.c' line='6621' column='1' elf-symbol-id='memory_cgrp_subsys'/>
       <var-decl name='memory_cgrp_subsys_enabled_key' type-id='49a0ad34' mangled-name='memory_cgrp_subsys_enabled_key' visibility='default' filepath='include/linux/cgroup_subsys.h' line='29' column='1' elf-symbol-id='memory_cgrp_subsys_enabled_key'/>
       <function-decl name='memory_read_from_buffer' mangled-name='memory_read_from_buffer' filepath='fs/libfs.c' line='787' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memory_read_from_buffer'>
         <parameter type-id='eaa32e2f' name='to' filepath='fs/libfs.c' line='787' column='1'/>
@@ -136731,18 +136750,18 @@
         <parameter type-id='eaa32e2f' name='addr' filepath='kernel/iomem.c' line='122' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mfd_add_devices' mangled-name='mfd_add_devices' filepath='drivers/mfd/mfd-core.c' line='334' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mfd_add_devices'>
-        <parameter type-id='fa0b179b' name='parent' filepath='drivers/mfd/mfd-core.c' line='334' column='1'/>
-        <parameter type-id='95e97e5e' name='id' filepath='drivers/mfd/mfd-core.c' line='334' column='1'/>
-        <parameter type-id='1447e860' name='cells' filepath='drivers/mfd/mfd-core.c' line='335' column='1'/>
-        <parameter type-id='95e97e5e' name='n_devs' filepath='drivers/mfd/mfd-core.c' line='335' column='1'/>
-        <parameter type-id='c9d64c0d' name='mem_base' filepath='drivers/mfd/mfd-core.c' line='336' column='1'/>
-        <parameter type-id='95e97e5e' name='irq_base' filepath='drivers/mfd/mfd-core.c' line='337' column='1'/>
-        <parameter type-id='7544e824' name='domain' filepath='drivers/mfd/mfd-core.c' line='337' column='1'/>
+      <function-decl name='mfd_add_devices' mangled-name='mfd_add_devices' filepath='drivers/mfd/mfd-core.c' line='341' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mfd_add_devices'>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/mfd/mfd-core.c' line='341' column='1'/>
+        <parameter type-id='95e97e5e' name='id' filepath='drivers/mfd/mfd-core.c' line='341' column='1'/>
+        <parameter type-id='1447e860' name='cells' filepath='drivers/mfd/mfd-core.c' line='342' column='1'/>
+        <parameter type-id='95e97e5e' name='n_devs' filepath='drivers/mfd/mfd-core.c' line='342' column='1'/>
+        <parameter type-id='c9d64c0d' name='mem_base' filepath='drivers/mfd/mfd-core.c' line='343' column='1'/>
+        <parameter type-id='95e97e5e' name='irq_base' filepath='drivers/mfd/mfd-core.c' line='344' column='1'/>
+        <parameter type-id='7544e824' name='domain' filepath='drivers/mfd/mfd-core.c' line='344' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mfd_remove_devices' mangled-name='mfd_remove_devices' filepath='drivers/mfd/mfd-core.c' line='389' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mfd_remove_devices'>
-        <parameter type-id='fa0b179b' name='parent' filepath='drivers/mfd/mfd-core.c' line='389' column='1'/>
+      <function-decl name='mfd_remove_devices' mangled-name='mfd_remove_devices' filepath='drivers/mfd/mfd-core.c' line='396' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mfd_remove_devices'>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/mfd/mfd-core.c' line='396' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='migrate_page_copy' mangled-name='migrate_page_copy' filepath='mm/migrate.c' line='660' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='migrate_page_copy'>
@@ -136997,32 +137016,32 @@
         <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/sd_ops.c' line='21' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_calc_max_discard' mangled-name='mmc_calc_max_discard' filepath='drivers/mmc/core/core.c' line='2028' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_calc_max_discard'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='2028' column='1'/>
+      <function-decl name='mmc_calc_max_discard' mangled-name='mmc_calc_max_discard' filepath='drivers/mmc/core/core.c' line='2033' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_calc_max_discard'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='2033' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='mmc_can_erase' mangled-name='mmc_can_erase' filepath='drivers/mmc/core/core.c' line='1892' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_can_erase'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='1892' column='1'/>
+      <function-decl name='mmc_can_erase' mangled-name='mmc_can_erase' filepath='drivers/mmc/core/core.c' line='1897' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_can_erase'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='1897' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_can_gpio_cd' mangled-name='mmc_can_gpio_cd' filepath='drivers/mmc/core/slot-gpio.c' line='208' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_can_gpio_cd'>
         <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/slot-gpio.c' line='208' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='mmc_can_secure_erase_trim' mangled-name='mmc_can_secure_erase_trim' filepath='drivers/mmc/core/core.c' line='1930' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_can_secure_erase_trim'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='1930' column='1'/>
+      <function-decl name='mmc_can_secure_erase_trim' mangled-name='mmc_can_secure_erase_trim' filepath='drivers/mmc/core/core.c' line='1935' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_can_secure_erase_trim'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='1935' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_can_trim' mangled-name='mmc_can_trim' filepath='drivers/mmc/core/core.c' line='1900' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_can_trim'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='1900' column='1'/>
+      <function-decl name='mmc_can_trim' mangled-name='mmc_can_trim' filepath='drivers/mmc/core/core.c' line='1905' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_can_trim'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='1905' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_cmdq_disable' mangled-name='mmc_cmdq_disable' filepath='drivers/mmc/core/mmc_ops.c' line='1026' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_cmdq_disable'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='1026' column='1'/>
+      <function-decl name='mmc_cmdq_disable' mangled-name='mmc_cmdq_disable' filepath='drivers/mmc/core/mmc_ops.c' line='1027' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_cmdq_disable'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='1027' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_cmdq_enable' mangled-name='mmc_cmdq_enable' filepath='drivers/mmc/core/mmc_ops.c' line='1020' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_cmdq_enable'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='1020' column='1'/>
+      <function-decl name='mmc_cmdq_enable' mangled-name='mmc_cmdq_enable' filepath='drivers/mmc/core/mmc_ops.c' line='1021' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_cmdq_enable'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='1021' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_cqe_post_req' mangled-name='mmc_cqe_post_req' filepath='drivers/mmc/core/core.c' line='516' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_cqe_post_req'>
@@ -137053,39 +137072,39 @@
         <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/crypto.c' line='22' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_detect_card_removed' mangled-name='mmc_detect_card_removed' filepath='drivers/mmc/core/core.c' line='2219' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_detect_card_removed'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='2219' column='1'/>
+      <function-decl name='mmc_detect_card_removed' mangled-name='mmc_detect_card_removed' filepath='drivers/mmc/core/core.c' line='2224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_detect_card_removed'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='2224' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_detect_change' mangled-name='mmc_detect_change' filepath='drivers/mmc/core/core.c' line='1494' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_detect_change'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='1494' column='1'/>
-        <parameter type-id='7359adad' name='delay' filepath='drivers/mmc/core/core.c' line='1494' column='1'/>
+      <function-decl name='mmc_detect_change' mangled-name='mmc_detect_change' filepath='drivers/mmc/core/core.c' line='1499' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_detect_change'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='1499' column='1'/>
+        <parameter type-id='7359adad' name='delay' filepath='drivers/mmc/core/core.c' line='1499' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_erase' mangled-name='mmc_erase' filepath='drivers/mmc/core/core.c' line='1832' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_erase'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='1832' column='1'/>
-        <parameter type-id='f0981eeb' name='from' filepath='drivers/mmc/core/core.c' line='1832' column='1'/>
-        <parameter type-id='f0981eeb' name='nr' filepath='drivers/mmc/core/core.c' line='1832' column='1'/>
-        <parameter type-id='f0981eeb' name='arg' filepath='drivers/mmc/core/core.c' line='1833' column='1'/>
+      <function-decl name='mmc_erase' mangled-name='mmc_erase' filepath='drivers/mmc/core/core.c' line='1837' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_erase'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='1837' column='1'/>
+        <parameter type-id='f0981eeb' name='from' filepath='drivers/mmc/core/core.c' line='1837' column='1'/>
+        <parameter type-id='f0981eeb' name='nr' filepath='drivers/mmc/core/core.c' line='1837' column='1'/>
+        <parameter type-id='f0981eeb' name='arg' filepath='drivers/mmc/core/core.c' line='1838' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_erase_group_aligned' mangled-name='mmc_erase_group_aligned' filepath='drivers/mmc/core/core.c' line='1939' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_erase_group_aligned'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='1939' column='1'/>
-        <parameter type-id='f0981eeb' name='from' filepath='drivers/mmc/core/core.c' line='1939' column='1'/>
-        <parameter type-id='f0981eeb' name='nr' filepath='drivers/mmc/core/core.c' line='1940' column='1'/>
+      <function-decl name='mmc_erase_group_aligned' mangled-name='mmc_erase_group_aligned' filepath='drivers/mmc/core/core.c' line='1944' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_erase_group_aligned'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='1944' column='1'/>
+        <parameter type-id='f0981eeb' name='from' filepath='drivers/mmc/core/core.c' line='1944' column='1'/>
+        <parameter type-id='f0981eeb' name='nr' filepath='drivers/mmc/core/core.c' line='1945' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_flush_cache' mangled-name='mmc_flush_cache' filepath='drivers/mmc/core/mmc_ops.c' line='987' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_flush_cache'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='987' column='1'/>
+      <function-decl name='mmc_flush_cache' mangled-name='mmc_flush_cache' filepath='drivers/mmc/core/mmc_ops.c' line='988' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_flush_cache'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='988' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_free_host' mangled-name='mmc_free_host' filepath='drivers/mmc/core/host.c' line='614' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_free_host'>
         <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/host.c' line='614' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_get_card' mangled-name='mmc_get_card' filepath='drivers/mmc/core/core.c' line='857' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_get_card'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='857' column='1'/>
-        <parameter type-id='f1e196e0' name='ctx' filepath='drivers/mmc/core/core.c' line='857' column='1'/>
+      <function-decl name='mmc_get_card' mangled-name='mmc_get_card' filepath='drivers/mmc/core/core.c' line='862' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_get_card'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='862' column='1'/>
+        <parameter type-id='f1e196e0' name='ctx' filepath='drivers/mmc/core/core.c' line='862' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmc_get_ext_csd' mangled-name='mmc_get_ext_csd' filepath='drivers/mmc/core/mmc_ops.c' line='358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_get_ext_csd'>
@@ -137129,8 +137148,8 @@
         <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc.c' line='1558' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_hw_reset' mangled-name='mmc_hw_reset' filepath='drivers/mmc/core/core.c' line='2096' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_hw_reset'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='2096' column='1'/>
+      <function-decl name='mmc_hw_reset' mangled-name='mmc_hw_reset' filepath='drivers/mmc/core/core.c' line='2101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_hw_reset'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='2101' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_issue_type' mangled-name='mmc_issue_type' filepath='drivers/mmc/core/queue.c' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_issue_type'>
@@ -137147,9 +137166,9 @@
         <parameter type-id='f9409001' name='mask' filepath='drivers/mmc/core/host.c' line='392' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_put_card' mangled-name='mmc_put_card' filepath='drivers/mmc/core/core.c' line='868' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_put_card'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='868' column='1'/>
-        <parameter type-id='f1e196e0' name='ctx' filepath='drivers/mmc/core/core.c' line='868' column='1'/>
+      <function-decl name='mmc_put_card' mangled-name='mmc_put_card' filepath='drivers/mmc/core/core.c' line='873' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_put_card'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='873' column='1'/>
+        <parameter type-id='f1e196e0' name='ctx' filepath='drivers/mmc/core/core.c' line='873' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmc_pwrseq_register' mangled-name='mmc_pwrseq_register' filepath='drivers/mmc/core/pwrseq.c' line='96' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_pwrseq_register'>
@@ -137179,8 +137198,8 @@
         <parameter type-id='3b590e48' name='ios' filepath='drivers/mmc/core/regulator.c' line='179' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_release_host' mangled-name='mmc_release_host' filepath='drivers/mmc/core/core.c' line='828' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_release_host'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='828' column='1'/>
+      <function-decl name='mmc_release_host' mangled-name='mmc_release_host' filepath='drivers/mmc/core/core.c' line='833' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_release_host'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='833' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmc_remove_host' mangled-name='mmc_remove_host' filepath='drivers/mmc/core/host.c' line='593' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_remove_host'>
@@ -137208,12 +137227,12 @@
         <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/host.c' line='130' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_run_bkops' mangled-name='mmc_run_bkops' filepath='drivers/mmc/core/mmc_ops.c' line='949' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_run_bkops'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='949' column='1'/>
+      <function-decl name='mmc_run_bkops' mangled-name='mmc_run_bkops' filepath='drivers/mmc/core/mmc_ops.c' line='950' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_run_bkops'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='950' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_sanitize' mangled-name='mmc_sanitize' filepath='drivers/mmc/core/mmc_ops.c' line='1032' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_sanitize'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='1032' column='1'/>
+      <function-decl name='mmc_sanitize' mangled-name='mmc_sanitize' filepath='drivers/mmc/core/mmc_ops.c' line='1033' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_sanitize'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='1033' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_select_bus_width' mangled-name='mmc_select_bus_width' filepath='drivers/mmc/core/mmc.c' line='995' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_select_bus_width'>
@@ -137241,34 +137260,34 @@
         <parameter type-id='f9409001' name='status' filepath='drivers/mmc/core/mmc_ops.c' line='80' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_send_tuning' mangled-name='mmc_send_tuning' filepath='drivers/mmc/core/mmc_ops.c' line='640' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_send_tuning'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/mmc_ops.c' line='640' column='1'/>
-        <parameter type-id='19c2251e' name='opcode' filepath='drivers/mmc/core/mmc_ops.c' line='640' column='1'/>
-        <parameter type-id='7292109c' name='cmd_error' filepath='drivers/mmc/core/mmc_ops.c' line='640' column='1'/>
+      <function-decl name='mmc_send_tuning' mangled-name='mmc_send_tuning' filepath='drivers/mmc/core/mmc_ops.c' line='641' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_send_tuning'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/mmc_ops.c' line='641' column='1'/>
+        <parameter type-id='19c2251e' name='opcode' filepath='drivers/mmc/core/mmc_ops.c' line='641' column='1'/>
+        <parameter type-id='7292109c' name='cmd_error' filepath='drivers/mmc/core/mmc_ops.c' line='641' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_set_blocklen' mangled-name='mmc_set_blocklen' filepath='drivers/mmc/core/core.c' line='2062' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_set_blocklen'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='2062' column='1'/>
-        <parameter type-id='f0981eeb' name='blocklen' filepath='drivers/mmc/core/core.c' line='2062' column='1'/>
+      <function-decl name='mmc_set_blocklen' mangled-name='mmc_set_blocklen' filepath='drivers/mmc/core/core.c' line='2067' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_set_blocklen'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/core.c' line='2067' column='1'/>
+        <parameter type-id='f0981eeb' name='blocklen' filepath='drivers/mmc/core/core.c' line='2067' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_set_clock' mangled-name='mmc_set_clock' filepath='drivers/mmc/core/core.c' line='910' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_set_clock'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='910' column='1'/>
-        <parameter type-id='f0981eeb' name='hz' filepath='drivers/mmc/core/core.c' line='910' column='1'/>
+      <function-decl name='mmc_set_clock' mangled-name='mmc_set_clock' filepath='drivers/mmc/core/core.c' line='915' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_set_clock'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='915' column='1'/>
+        <parameter type-id='f0981eeb' name='hz' filepath='drivers/mmc/core/core.c' line='915' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_set_data_timeout' mangled-name='mmc_set_data_timeout' filepath='drivers/mmc/core/core.c' line='649' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_set_data_timeout'>
-        <parameter type-id='6de64ec1' name='data' filepath='drivers/mmc/core/core.c' line='649' column='1'/>
-        <parameter type-id='652034a8' name='card' filepath='drivers/mmc/core/core.c' line='649' column='1'/>
+      <function-decl name='mmc_set_data_timeout' mangled-name='mmc_set_data_timeout' filepath='drivers/mmc/core/core.c' line='654' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_set_data_timeout'>
+        <parameter type-id='6de64ec1' name='data' filepath='drivers/mmc/core/core.c' line='654' column='1'/>
+        <parameter type-id='652034a8' name='card' filepath='drivers/mmc/core/core.c' line='654' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_set_initial_state' mangled-name='mmc_set_initial_state' filepath='drivers/mmc/core/core.c' line='974' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_set_initial_state'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='974' column='1'/>
+      <function-decl name='mmc_set_initial_state' mangled-name='mmc_set_initial_state' filepath='drivers/mmc/core/core.c' line='979' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_set_initial_state'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='979' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_set_timing' mangled-name='mmc_set_timing' filepath='drivers/mmc/core/core.c' line='1268' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_set_timing'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='1268' column='1'/>
-        <parameter type-id='f0981eeb' name='timing' filepath='drivers/mmc/core/core.c' line='1268' column='1'/>
+      <function-decl name='mmc_set_timing' mangled-name='mmc_set_timing' filepath='drivers/mmc/core/core.c' line='1273' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_set_timing'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='1273' column='1'/>
+        <parameter type-id='f0981eeb' name='timing' filepath='drivers/mmc/core/core.c' line='1273' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmc_start_request' mangled-name='mmc_start_request' filepath='drivers/mmc/core/core.c' line='336' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_start_request'>
@@ -137276,31 +137295,31 @@
         <parameter type-id='47f117d4' name='mrq' filepath='drivers/mmc/core/core.c' line='336' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_sw_reset' mangled-name='mmc_sw_reset' filepath='drivers/mmc/core/core.c' line='2120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_sw_reset'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='2120' column='1'/>
+      <function-decl name='mmc_sw_reset' mangled-name='mmc_sw_reset' filepath='drivers/mmc/core/core.c' line='2125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_sw_reset'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='2125' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_switch' mangled-name='mmc_switch' filepath='drivers/mmc/core/mmc_ops.c' line='632' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_switch'>
-        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='632' column='1'/>
-        <parameter type-id='f9b06939' name='set' filepath='drivers/mmc/core/mmc_ops.c' line='632' column='1'/>
-        <parameter type-id='f9b06939' name='index' filepath='drivers/mmc/core/mmc_ops.c' line='632' column='1'/>
-        <parameter type-id='f9b06939' name='value' filepath='drivers/mmc/core/mmc_ops.c' line='632' column='1'/>
-        <parameter type-id='f0981eeb' name='timeout_ms' filepath='drivers/mmc/core/mmc_ops.c' line='633' column='1'/>
+      <function-decl name='mmc_switch' mangled-name='mmc_switch' filepath='drivers/mmc/core/mmc_ops.c' line='633' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_switch'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='633' column='1'/>
+        <parameter type-id='f9b06939' name='set' filepath='drivers/mmc/core/mmc_ops.c' line='633' column='1'/>
+        <parameter type-id='f9b06939' name='index' filepath='drivers/mmc/core/mmc_ops.c' line='633' column='1'/>
+        <parameter type-id='f9b06939' name='value' filepath='drivers/mmc/core/mmc_ops.c' line='633' column='1'/>
+        <parameter type-id='f0981eeb' name='timeout_ms' filepath='drivers/mmc/core/mmc_ops.c' line='634' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_unregister_driver' mangled-name='mmc_unregister_driver' filepath='drivers/mmc/core/bus.c' line='265' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_unregister_driver'>
         <parameter type-id='a46f3b5b' name='drv' filepath='drivers/mmc/core/bus.c' line='265' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_wait_for_cmd' mangled-name='mmc_wait_for_cmd' filepath='drivers/mmc/core/core.c' line='622' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_wait_for_cmd'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='622' column='1'/>
-        <parameter type-id='6df3750c' name='cmd' filepath='drivers/mmc/core/core.c' line='622' column='1'/>
-        <parameter type-id='95e97e5e' name='retries' filepath='drivers/mmc/core/core.c' line='622' column='1'/>
+      <function-decl name='mmc_wait_for_cmd' mangled-name='mmc_wait_for_cmd' filepath='drivers/mmc/core/core.c' line='627' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_wait_for_cmd'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='627' column='1'/>
+        <parameter type-id='6df3750c' name='cmd' filepath='drivers/mmc/core/core.c' line='627' column='1'/>
+        <parameter type-id='95e97e5e' name='retries' filepath='drivers/mmc/core/core.c' line='627' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_wait_for_req' mangled-name='mmc_wait_for_req' filepath='drivers/mmc/core/core.c' line='603' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_wait_for_req'>
-        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='603' column='1'/>
-        <parameter type-id='47f117d4' name='mrq' filepath='drivers/mmc/core/core.c' line='603' column='1'/>
+      <function-decl name='mmc_wait_for_req' mangled-name='mmc_wait_for_req' filepath='drivers/mmc/core/core.c' line='608' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_wait_for_req'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='608' column='1'/>
+        <parameter type-id='47f117d4' name='mrq' filepath='drivers/mmc/core/core.c' line='608' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmput' mangled-name='mmput' filepath='kernel/fork.c' line='1161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmput'>
@@ -137464,26 +137483,26 @@
         <return type-id='b50a4934'/>
       </function-decl>
       <var-decl name='nd_tbl' type-id='aebe1cff' mangled-name='nd_tbl' visibility='default' filepath='net/ipv6/ndisc.c' line='109' column='1' elf-symbol-id='nd_tbl'/>
-      <function-decl name='neigh_destroy' mangled-name='neigh_destroy' filepath='net/core/neighbour.c' line='828' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_destroy'>
-        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='828' column='1'/>
+      <function-decl name='neigh_destroy' mangled-name='neigh_destroy' filepath='net/core/neighbour.c' line='829' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_destroy'>
+        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='829' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='neigh_lookup' mangled-name='neigh_lookup' filepath='net/core/neighbour.c' line='554' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_lookup'>
-        <parameter type-id='6bbe39a7' name='tbl' filepath='net/core/neighbour.c' line='554' column='1'/>
-        <parameter type-id='eaa32e2f' name='pkey' filepath='net/core/neighbour.c' line='554' column='1'/>
-        <parameter type-id='68a2d05b' name='dev' filepath='net/core/neighbour.c' line='555' column='1'/>
+      <function-decl name='neigh_lookup' mangled-name='neigh_lookup' filepath='net/core/neighbour.c' line='555' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_lookup'>
+        <parameter type-id='6bbe39a7' name='tbl' filepath='net/core/neighbour.c' line='555' column='1'/>
+        <parameter type-id='eaa32e2f' name='pkey' filepath='net/core/neighbour.c' line='555' column='1'/>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/neighbour.c' line='556' column='1'/>
         <return type-id='3c330066'/>
       </function-decl>
-      <function-decl name='neigh_resolve_output' mangled-name='neigh_resolve_output' filepath='net/core/neighbour.c' line='1480' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_resolve_output'>
-        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='1480' column='1'/>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='1480' column='1'/>
+      <function-decl name='neigh_resolve_output' mangled-name='neigh_resolve_output' filepath='net/core/neighbour.c' line='1482' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_resolve_output'>
+        <parameter type-id='3c330066' name='neigh' filepath='net/core/neighbour.c' line='1482' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='1482' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='neigh_xmit' mangled-name='neigh_xmit' filepath='net/core/neighbour.c' line='2994' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_xmit'>
-        <parameter type-id='95e97e5e' name='index' filepath='net/core/neighbour.c' line='2994' column='1'/>
-        <parameter type-id='68a2d05b' name='dev' filepath='net/core/neighbour.c' line='2994' column='1'/>
-        <parameter type-id='eaa32e2f' name='addr' filepath='net/core/neighbour.c' line='2995' column='1'/>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='2995' column='1'/>
+      <function-decl name='neigh_xmit' mangled-name='neigh_xmit' filepath='net/core/neighbour.c' line='2997' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_xmit'>
+        <parameter type-id='95e97e5e' name='index' filepath='net/core/neighbour.c' line='2997' column='1'/>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/neighbour.c' line='2997' column='1'/>
+        <parameter type-id='eaa32e2f' name='addr' filepath='net/core/neighbour.c' line='2998' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/neighbour.c' line='2998' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='net_namespace_list' type-id='72f469ec' mangled-name='net_namespace_list' visibility='default' filepath='net/core/net_namespace.c' line='36' column='1' elf-symbol-id='net_namespace_list'/>
@@ -137952,68 +137971,68 @@
         <parameter type-id='c9d64c0d' name='r' filepath='drivers/of/address.c' line='867' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_alias_get_highest_id' mangled-name='of_alias_get_highest_id' filepath='drivers/of/base.c' line='2140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_alias_get_highest_id'>
-        <parameter type-id='80f4b756' name='stem' filepath='drivers/of/base.c' line='2140' column='1'/>
+      <function-decl name='of_alias_get_highest_id' mangled-name='of_alias_get_highest_id' filepath='drivers/of/base.c' line='2147' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_alias_get_highest_id'>
+        <parameter type-id='80f4b756' name='stem' filepath='drivers/of/base.c' line='2147' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_alias_get_id' mangled-name='of_alias_get_id' filepath='drivers/of/base.c' line='2059' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_alias_get_id'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/base.c' line='2059' column='1'/>
-        <parameter type-id='80f4b756' name='stem' filepath='drivers/of/base.c' line='2059' column='1'/>
+      <function-decl name='of_alias_get_id' mangled-name='of_alias_get_id' filepath='drivers/of/base.c' line='2066' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_alias_get_id'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/base.c' line='2066' column='1'/>
+        <parameter type-id='80f4b756' name='stem' filepath='drivers/of/base.c' line='2066' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_clk_add_hw_provider' mangled-name='of_clk_add_hw_provider' filepath='drivers/clk/clk.c' line='4713' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_add_hw_provider'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4713' column='1'/>
-        <parameter type-id='a5186342' name='get' filepath='drivers/clk/clk.c' line='4714' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4716' column='1'/>
+      <function-decl name='of_clk_add_hw_provider' mangled-name='of_clk_add_hw_provider' filepath='drivers/clk/clk.c' line='4716' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_add_hw_provider'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4716' column='1'/>
+        <parameter type-id='a5186342' name='get' filepath='drivers/clk/clk.c' line='4717' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4719' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_clk_add_provider' mangled-name='of_clk_add_provider' filepath='drivers/clk/clk.c' line='4671' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_add_provider'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4671' column='1'/>
-        <parameter type-id='f1c652ac' name='clk_src_get' filepath='drivers/clk/clk.c' line='4672' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4674' column='1'/>
+      <function-decl name='of_clk_add_provider' mangled-name='of_clk_add_provider' filepath='drivers/clk/clk.c' line='4674' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_add_provider'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4674' column='1'/>
+        <parameter type-id='f1c652ac' name='clk_src_get' filepath='drivers/clk/clk.c' line='4675' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4677' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_clk_del_provider' mangled-name='of_clk_del_provider' filepath='drivers/clk/clk.c' line='4815' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_del_provider'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4815' column='1'/>
+      <function-decl name='of_clk_del_provider' mangled-name='of_clk_del_provider' filepath='drivers/clk/clk.c' line='4818' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_del_provider'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4818' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='of_clk_get' mangled-name='of_clk_get' filepath='drivers/clk/clk.c' line='5015' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5015' column='1'/>
-        <parameter type-id='95e97e5e' name='index' filepath='drivers/clk/clk.c' line='5015' column='1'/>
+      <function-decl name='of_clk_get' mangled-name='of_clk_get' filepath='drivers/clk/clk.c' line='5018' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5018' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/clk/clk.c' line='5018' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='of_clk_get_by_name' mangled-name='of_clk_get_by_name' filepath='drivers/clk/clk.c' line='5030' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_by_name'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5030' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='drivers/clk/clk.c' line='5030' column='1'/>
+      <function-decl name='of_clk_get_by_name' mangled-name='of_clk_get_by_name' filepath='drivers/clk/clk.c' line='5033' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_by_name'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5033' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/clk/clk.c' line='5033' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='of_clk_get_from_provider' mangled-name='of_clk_get_from_provider' filepath='drivers/clk/clk.c' line='4981' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_from_provider'>
-        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4981' column='1'/>
+      <function-decl name='of_clk_get_from_provider' mangled-name='of_clk_get_from_provider' filepath='drivers/clk/clk.c' line='4984' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_from_provider'>
+        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4984' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='of_clk_get_parent_count' mangled-name='of_clk_get_parent_count' filepath='drivers/clk/clk.c' line='5045' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_parent_count'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/clk/clk.c' line='5045' column='1'/>
+      <function-decl name='of_clk_get_parent_count' mangled-name='of_clk_get_parent_count' filepath='drivers/clk/clk.c' line='5048' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_parent_count'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/clk/clk.c' line='5048' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='of_clk_get_parent_name' mangled-name='of_clk_get_parent_name' filepath='drivers/clk/clk.c' line='5057' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_parent_name'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/clk/clk.c' line='5057' column='1'/>
-        <parameter type-id='95e97e5e' name='index' filepath='drivers/clk/clk.c' line='5057' column='1'/>
+      <function-decl name='of_clk_get_parent_name' mangled-name='of_clk_get_parent_name' filepath='drivers/clk/clk.c' line='5060' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_parent_name'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/clk/clk.c' line='5060' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/clk/clk.c' line='5060' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='of_clk_hw_onecell_get' mangled-name='of_clk_hw_onecell_get' filepath='drivers/clk/clk.c' line='4649' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_hw_onecell_get'>
-        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4649' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4649' column='1'/>
+      <function-decl name='of_clk_hw_onecell_get' mangled-name='of_clk_hw_onecell_get' filepath='drivers/clk/clk.c' line='4652' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_hw_onecell_get'>
+        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4652' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4652' column='1'/>
         <return type-id='3aaeef89'/>
       </function-decl>
-      <function-decl name='of_clk_hw_simple_get' mangled-name='of_clk_hw_simple_get' filepath='drivers/clk/clk.c' line='4628' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_hw_simple_get'>
-        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4628' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4628' column='1'/>
+      <function-decl name='of_clk_hw_simple_get' mangled-name='of_clk_hw_simple_get' filepath='drivers/clk/clk.c' line='4631' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_hw_simple_get'>
+        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4631' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4631' column='1'/>
         <return type-id='3aaeef89'/>
       </function-decl>
-      <function-decl name='of_clk_parent_fill' mangled-name='of_clk_parent_fill' filepath='drivers/clk/clk.c' line='5126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_parent_fill'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5126' column='1'/>
-        <parameter type-id='7d3cd834' name='parents' filepath='drivers/clk/clk.c' line='5126' column='1'/>
-        <parameter type-id='f0981eeb' name='size' filepath='drivers/clk/clk.c' line='5127' column='1'/>
+      <function-decl name='of_clk_parent_fill' mangled-name='of_clk_parent_fill' filepath='drivers/clk/clk.c' line='5129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_parent_fill'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='5129' column='1'/>
+        <parameter type-id='7d3cd834' name='parents' filepath='drivers/clk/clk.c' line='5129' column='1'/>
+        <parameter type-id='f0981eeb' name='size' filepath='drivers/clk/clk.c' line='5130' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_clk_set_defaults' mangled-name='of_clk_set_defaults' filepath='drivers/clk/clk-conf.c' line='139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_set_defaults'>
@@ -138021,14 +138040,14 @@
         <parameter type-id='b50a4934' name='clk_supplier' filepath='drivers/clk/clk-conf.c' line='139' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_clk_src_onecell_get' mangled-name='of_clk_src_onecell_get' filepath='drivers/clk/clk.c' line='4634' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_src_onecell_get'>
-        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4634' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4634' column='1'/>
+      <function-decl name='of_clk_src_onecell_get' mangled-name='of_clk_src_onecell_get' filepath='drivers/clk/clk.c' line='4637' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_src_onecell_get'>
+        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4637' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4637' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='of_clk_src_simple_get' mangled-name='of_clk_src_simple_get' filepath='drivers/clk/clk.c' line='4621' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_src_simple_get'>
-        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4621' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4622' column='1'/>
+      <function-decl name='of_clk_src_simple_get' mangled-name='of_clk_src_simple_get' filepath='drivers/clk/clk.c' line='4624' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_src_simple_get'>
+        <parameter type-id='51a94113' name='clkspec' filepath='drivers/clk/clk.c' line='4624' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4625' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
       <function-decl name='of_count_phandle_with_args' mangled-name='of_count_phandle_with_args' filepath='drivers/of/base.c' line='1770' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_count_phandle_with_args'>
@@ -138208,7 +138227,7 @@
         <parameter type-id='7292109c' name='lenp' filepath='drivers/of/base.c' line='212' column='1'/>
         <return type-id='ddcd89c6'/>
       </function-decl>
-      <var-decl name='of_fwnode_ops' type-id='2eb8da02' mangled-name='of_fwnode_ops' visibility='default' filepath='drivers/of/property.c' line='1416' column='1' elf-symbol-id='of_fwnode_ops'/>
+      <var-decl name='of_fwnode_ops' type-id='2eb8da02' mangled-name='of_fwnode_ops' visibility='default' filepath='drivers/of/property.c' line='1434' column='1' elf-symbol-id='of_fwnode_ops'/>
       <function-decl name='of_gen_pool_get' mangled-name='of_gen_pool_get' filepath='lib/genalloc.c' line='873' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_gen_pool_get'>
         <parameter type-id='9a537bbe' name='np' filepath='lib/genalloc.c' line='873' column='1'/>
         <parameter type-id='80f4b756' name='propname' filepath='lib/genalloc.c' line='874' column='1'/>
@@ -138347,55 +138366,55 @@
         <parameter type-id='95e97e5e' name='index' filepath='drivers/video/of_videomode.c' line='31' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_graph_get_endpoint_by_regs' mangled-name='of_graph_get_endpoint_by_regs' filepath='drivers/of/property.c' line='689' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_endpoint_by_regs'>
-        <parameter type-id='0afa6ea3' name='parent' filepath='drivers/of/property.c' line='690' column='1'/>
-        <parameter type-id='95e97e5e' name='port_reg' filepath='drivers/of/property.c' line='690' column='1'/>
-        <parameter type-id='95e97e5e' name='reg' filepath='drivers/of/property.c' line='690' column='1'/>
+      <function-decl name='of_graph_get_endpoint_by_regs' mangled-name='of_graph_get_endpoint_by_regs' filepath='drivers/of/property.c' line='707' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_endpoint_by_regs'>
+        <parameter type-id='0afa6ea3' name='parent' filepath='drivers/of/property.c' line='708' column='1'/>
+        <parameter type-id='95e97e5e' name='port_reg' filepath='drivers/of/property.c' line='708' column='1'/>
+        <parameter type-id='95e97e5e' name='reg' filepath='drivers/of/property.c' line='708' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_graph_get_endpoint_count' mangled-name='of_graph_get_endpoint_count' filepath='drivers/of/property.c' line='792' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_endpoint_count'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='792' column='1'/>
+      <function-decl name='of_graph_get_endpoint_count' mangled-name='of_graph_get_endpoint_count' filepath='drivers/of/property.c' line='810' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_endpoint_count'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='810' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_graph_get_next_endpoint' mangled-name='of_graph_get_next_endpoint' filepath='drivers/of/property.c' line='620' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_next_endpoint'>
-        <parameter type-id='0afa6ea3' name='parent' filepath='drivers/of/property.c' line='620' column='1'/>
-        <parameter type-id='9a537bbe' name='prev' filepath='drivers/of/property.c' line='621' column='1'/>
+      <function-decl name='of_graph_get_next_endpoint' mangled-name='of_graph_get_next_endpoint' filepath='drivers/of/property.c' line='638' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_next_endpoint'>
+        <parameter type-id='0afa6ea3' name='parent' filepath='drivers/of/property.c' line='638' column='1'/>
+        <parameter type-id='9a537bbe' name='prev' filepath='drivers/of/property.c' line='639' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_graph_get_port_by_id' mangled-name='of_graph_get_port_by_id' filepath='drivers/of/property.c' line='588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_port_by_id'>
-        <parameter type-id='9a537bbe' name='parent' filepath='drivers/of/property.c' line='588' column='1'/>
-        <parameter type-id='19c2251e' name='id' filepath='drivers/of/property.c' line='588' column='1'/>
+      <function-decl name='of_graph_get_port_by_id' mangled-name='of_graph_get_port_by_id' filepath='drivers/of/property.c' line='606' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_port_by_id'>
+        <parameter type-id='9a537bbe' name='parent' filepath='drivers/of/property.c' line='606' column='1'/>
+        <parameter type-id='19c2251e' name='id' filepath='drivers/of/property.c' line='606' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_graph_get_port_parent' mangled-name='of_graph_get_port_parent' filepath='drivers/of/property.c' line='727' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_port_parent'>
-        <parameter type-id='9a537bbe' name='node' filepath='drivers/of/property.c' line='727' column='1'/>
+      <function-decl name='of_graph_get_port_parent' mangled-name='of_graph_get_port_parent' filepath='drivers/of/property.c' line='745' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_port_parent'>
+        <parameter type-id='9a537bbe' name='node' filepath='drivers/of/property.c' line='745' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_graph_get_remote_endpoint' mangled-name='of_graph_get_remote_endpoint' filepath='drivers/of/property.c' line='713' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_endpoint'>
-        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='713' column='1'/>
+      <function-decl name='of_graph_get_remote_endpoint' mangled-name='of_graph_get_remote_endpoint' filepath='drivers/of/property.c' line='731' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_endpoint'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='731' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_graph_get_remote_node' mangled-name='of_graph_get_remote_node' filepath='drivers/of/property.c' line='813' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_node'>
-        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='813' column='1'/>
-        <parameter type-id='19c2251e' name='port' filepath='drivers/of/property.c' line='814' column='1'/>
-        <parameter type-id='19c2251e' name='endpoint' filepath='drivers/of/property.c' line='814' column='1'/>
+      <function-decl name='of_graph_get_remote_node' mangled-name='of_graph_get_remote_node' filepath='drivers/of/property.c' line='831' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_node'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='831' column='1'/>
+        <parameter type-id='19c2251e' name='port' filepath='drivers/of/property.c' line='832' column='1'/>
+        <parameter type-id='19c2251e' name='endpoint' filepath='drivers/of/property.c' line='832' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_graph_get_remote_port' mangled-name='of_graph_get_remote_port' filepath='drivers/of/property.c' line='780' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_port'>
-        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='780' column='1'/>
+      <function-decl name='of_graph_get_remote_port' mangled-name='of_graph_get_remote_port' filepath='drivers/of/property.c' line='798' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_port'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='798' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_graph_get_remote_port_parent' mangled-name='of_graph_get_remote_port_parent' filepath='drivers/of/property.c' line='757' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_port_parent'>
-        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='758' column='1'/>
+      <function-decl name='of_graph_get_remote_port_parent' mangled-name='of_graph_get_remote_port_parent' filepath='drivers/of/property.c' line='775' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_port_parent'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='776' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
       <function-decl name='of_graph_is_present' mangled-name='of_graph_is_present' filepath='drivers/of/property.c' line='40' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_is_present'>
         <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='40' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='of_graph_parse_endpoint' mangled-name='of_graph_parse_endpoint' filepath='drivers/of/property.c' line='556' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_parse_endpoint'>
-        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='556' column='1'/>
-        <parameter type-id='a5eb3c12' name='endpoint' filepath='drivers/of/property.c' line='557' column='1'/>
+      <function-decl name='of_graph_parse_endpoint' mangled-name='of_graph_parse_endpoint' filepath='drivers/of/property.c' line='574' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_parse_endpoint'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='574' column='1'/>
+        <parameter type-id='a5eb3c12' name='endpoint' filepath='drivers/of/property.c' line='575' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_hwspin_lock_get_id' mangled-name='of_hwspin_lock_get_id' filepath='drivers/hwspinlock/hwspinlock_core.c' line='339' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_hwspin_lock_get_id'>
@@ -138591,93 +138610,93 @@
         <parameter type-id='fa0b179b' name='parent' filepath='drivers/of/platform.c' line='471' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_prop_next_string' mangled-name='of_prop_next_string' filepath='drivers/of/property.c' line='531' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_prop_next_string'>
-        <parameter type-id='ddcd89c6' name='prop' filepath='drivers/of/property.c' line='531' column='1'/>
-        <parameter type-id='80f4b756' name='cur' filepath='drivers/of/property.c' line='531' column='1'/>
+      <function-decl name='of_prop_next_string' mangled-name='of_prop_next_string' filepath='drivers/of/property.c' line='549' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_prop_next_string'>
+        <parameter type-id='ddcd89c6' name='prop' filepath='drivers/of/property.c' line='549' column='1'/>
+        <parameter type-id='80f4b756' name='cur' filepath='drivers/of/property.c' line='549' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='of_prop_next_u32' mangled-name='of_prop_next_u32' filepath='drivers/of/property.c' line='508' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_prop_next_u32'>
-        <parameter type-id='ddcd89c6' name='prop' filepath='drivers/of/property.c' line='508' column='1'/>
-        <parameter type-id='90144368' name='cur' filepath='drivers/of/property.c' line='508' column='1'/>
-        <parameter type-id='f9409001' name='pu' filepath='drivers/of/property.c' line='509' column='1'/>
+      <function-decl name='of_prop_next_u32' mangled-name='of_prop_next_u32' filepath='drivers/of/property.c' line='526' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_prop_next_u32'>
+        <parameter type-id='ddcd89c6' name='prop' filepath='drivers/of/property.c' line='526' column='1'/>
+        <parameter type-id='90144368' name='cur' filepath='drivers/of/property.c' line='526' column='1'/>
+        <parameter type-id='f9409001' name='pu' filepath='drivers/of/property.c' line='527' column='1'/>
         <return type-id='90144368'/>
       </function-decl>
-      <function-decl name='of_property_count_elems_of_size' mangled-name='of_property_count_elems_of_size' filepath='drivers/of/property.c' line='68' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_count_elems_of_size'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='68' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='69' column='1'/>
-        <parameter type-id='95e97e5e' name='elem_size' filepath='drivers/of/property.c' line='69' column='1'/>
+      <function-decl name='of_property_count_elems_of_size' mangled-name='of_property_count_elems_of_size' filepath='drivers/of/property.c' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_count_elems_of_size'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='70' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='71' column='1'/>
+        <parameter type-id='95e97e5e' name='elem_size' filepath='drivers/of/property.c' line='71' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_match_string' mangled-name='of_property_match_string' filepath='drivers/of/property.c' line='442' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_match_string'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='442' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='442' column='1'/>
-        <parameter type-id='80f4b756' name='string' filepath='drivers/of/property.c' line='443' column='1'/>
+      <function-decl name='of_property_match_string' mangled-name='of_property_match_string' filepath='drivers/of/property.c' line='460' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_match_string'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='460' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='460' column='1'/>
+        <parameter type-id='80f4b756' name='string' filepath='drivers/of/property.c' line='461' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_string' mangled-name='of_property_read_string' filepath='drivers/of/property.c' line='418' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_string'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='418' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='418' column='1'/>
-        <parameter type-id='7d3cd834' name='out_string' filepath='drivers/of/property.c' line='419' column='1'/>
+      <function-decl name='of_property_read_string' mangled-name='of_property_read_string' filepath='drivers/of/property.c' line='436' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_string'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='436' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='436' column='1'/>
+        <parameter type-id='7d3cd834' name='out_string' filepath='drivers/of/property.c' line='437' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_string_helper' mangled-name='of_property_read_string_helper' filepath='drivers/of/property.c' line='481' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_string_helper'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='481' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='482' column='1'/>
-        <parameter type-id='7d3cd834' name='out_strs' filepath='drivers/of/property.c' line='482' column='1'/>
-        <parameter type-id='b59d7dce' name='sz' filepath='drivers/of/property.c' line='483' column='1'/>
-        <parameter type-id='95e97e5e' name='skip' filepath='drivers/of/property.c' line='483' column='1'/>
+      <function-decl name='of_property_read_string_helper' mangled-name='of_property_read_string_helper' filepath='drivers/of/property.c' line='499' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_string_helper'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='499' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='500' column='1'/>
+        <parameter type-id='7d3cd834' name='out_strs' filepath='drivers/of/property.c' line='500' column='1'/>
+        <parameter type-id='b59d7dce' name='sz' filepath='drivers/of/property.c' line='501' column='1'/>
+        <parameter type-id='95e97e5e' name='skip' filepath='drivers/of/property.c' line='501' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_u32_index' mangled-name='of_property_read_u32_index' filepath='drivers/of/property.c' line='138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_u32_index'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='138' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='139' column='1'/>
-        <parameter type-id='19c2251e' name='index' filepath='drivers/of/property.c' line='140' column='1'/>
-        <parameter type-id='f9409001' name='out_value' filepath='drivers/of/property.c' line='140' column='1'/>
+      <function-decl name='of_property_read_u32_index' mangled-name='of_property_read_u32_index' filepath='drivers/of/property.c' line='143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_u32_index'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='143' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='144' column='1'/>
+        <parameter type-id='19c2251e' name='index' filepath='drivers/of/property.c' line='145' column='1'/>
+        <parameter type-id='f9409001' name='out_value' filepath='drivers/of/property.c' line='145' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_u64' mangled-name='of_property_read_u64' filepath='drivers/of/property.c' line='340' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_u64'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='340' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='340' column='1'/>
-        <parameter type-id='3df9fd28' name='out_value' filepath='drivers/of/property.c' line='341' column='1'/>
+      <function-decl name='of_property_read_u64' mangled-name='of_property_read_u64' filepath='drivers/of/property.c' line='355' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_u64'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='355' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='355' column='1'/>
+        <parameter type-id='3df9fd28' name='out_value' filepath='drivers/of/property.c' line='356' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_u64_index' mangled-name='of_property_read_u64_index' filepath='drivers/of/property.c' line='170' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_u64_index'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='170' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='171' column='1'/>
-        <parameter type-id='19c2251e' name='index' filepath='drivers/of/property.c' line='172' column='1'/>
-        <parameter type-id='3df9fd28' name='out_value' filepath='drivers/of/property.c' line='172' column='1'/>
+      <function-decl name='of_property_read_u64_index' mangled-name='of_property_read_u64_index' filepath='drivers/of/property.c' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_u64_index'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='177' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='178' column='1'/>
+        <parameter type-id='19c2251e' name='index' filepath='drivers/of/property.c' line='179' column='1'/>
+        <parameter type-id='3df9fd28' name='out_value' filepath='drivers/of/property.c' line='179' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_variable_u16_array' mangled-name='of_property_read_variable_u16_array' filepath='drivers/of/property.c' line='256' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u16_array'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='256' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='257' column='1'/>
-        <parameter type-id='26d4d46f' name='out_values' filepath='drivers/of/property.c' line='257' column='1'/>
-        <parameter type-id='b59d7dce' name='sz_min' filepath='drivers/of/property.c' line='258' column='1'/>
-        <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='258' column='1'/>
+      <function-decl name='of_property_read_variable_u16_array' mangled-name='of_property_read_variable_u16_array' filepath='drivers/of/property.c' line='267' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u16_array'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='267' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='268' column='1'/>
+        <parameter type-id='26d4d46f' name='out_values' filepath='drivers/of/property.c' line='268' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_min' filepath='drivers/of/property.c' line='269' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='269' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_variable_u32_array' mangled-name='of_property_read_variable_u32_array' filepath='drivers/of/property.c' line='301' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u32_array'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='301' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='302' column='1'/>
-        <parameter type-id='f9409001' name='out_values' filepath='drivers/of/property.c' line='302' column='1'/>
-        <parameter type-id='b59d7dce' name='sz_min' filepath='drivers/of/property.c' line='303' column='1'/>
-        <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='303' column='1'/>
+      <function-decl name='of_property_read_variable_u32_array' mangled-name='of_property_read_variable_u32_array' filepath='drivers/of/property.c' line='314' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u32_array'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='314' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='315' column='1'/>
+        <parameter type-id='f9409001' name='out_values' filepath='drivers/of/property.c' line='315' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_min' filepath='drivers/of/property.c' line='316' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='316' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_variable_u64_array' mangled-name='of_property_read_variable_u64_array' filepath='drivers/of/property.c' line='375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u64_array'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='375' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='376' column='1'/>
-        <parameter type-id='3df9fd28' name='out_values' filepath='drivers/of/property.c' line='376' column='1'/>
-        <parameter type-id='b59d7dce' name='sz_min' filepath='drivers/of/property.c' line='377' column='1'/>
-        <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='377' column='1'/>
+      <function-decl name='of_property_read_variable_u64_array' mangled-name='of_property_read_variable_u64_array' filepath='drivers/of/property.c' line='392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u64_array'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='392' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='393' column='1'/>
+        <parameter type-id='3df9fd28' name='out_values' filepath='drivers/of/property.c' line='393' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_min' filepath='drivers/of/property.c' line='394' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='394' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_variable_u8_array' mangled-name='of_property_read_variable_u8_array' filepath='drivers/of/property.c' line='208' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u8_array'>
-        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='208' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='209' column='1'/>
-        <parameter type-id='8bff8096' name='out_values' filepath='drivers/of/property.c' line='209' column='1'/>
-        <parameter type-id='b59d7dce' name='sz_min' filepath='drivers/of/property.c' line='210' column='1'/>
-        <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='210' column='1'/>
+      <function-decl name='of_property_read_variable_u8_array' mangled-name='of_property_read_variable_u8_array' filepath='drivers/of/property.c' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u8_array'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='217' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='218' column='1'/>
+        <parameter type-id='8bff8096' name='out_values' filepath='drivers/of/property.c' line='218' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_min' filepath='drivers/of/property.c' line='219' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='219' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_pwm_xlate_with_flags' mangled-name='of_pwm_xlate_with_flags' filepath='drivers/pwm/core.c' line='135' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_pwm_xlate_with_flags'>
@@ -138692,9 +138711,9 @@
         <parameter type-id='f0981eeb' name='num_matches' filepath='drivers/regulator/of_regulator.c' line='331' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_remove_property' mangled-name='of_remove_property' filepath='drivers/of/base.c' line='1881' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_remove_property'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/base.c' line='1881' column='1'/>
-        <parameter type-id='ddcd89c6' name='prop' filepath='drivers/of/base.c' line='1881' column='1'/>
+      <function-decl name='of_remove_property' mangled-name='of_remove_property' filepath='drivers/of/base.c' line='1887' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_remove_property'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/base.c' line='1887' column='1'/>
+        <parameter type-id='ddcd89c6' name='prop' filepath='drivers/of/base.c' line='1887' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_reserved_mem_device_init_by_idx' mangled-name='of_reserved_mem_device_init_by_idx' filepath='drivers/of/of_reserved_mem.c' line='321' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_reserved_mem_device_init_by_idx'>
@@ -138769,12 +138788,12 @@
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='oops_in_progress' type-id='95e97e5e' mangled-name='oops_in_progress' visibility='default' filepath='kernel/printk/printk.c' line='81' column='1' elf-symbol-id='oops_in_progress'/>
-      <function-decl name='open_candev' mangled-name='open_candev' filepath='drivers/net/can/dev/dev.c' line='848' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='open_candev'>
-        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='848' column='1'/>
+      <function-decl name='open_candev' mangled-name='open_candev' filepath='drivers/net/can/dev/dev.c' line='850' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='open_candev'>
+        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='850' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='orderly_poweroff' mangled-name='orderly_poweroff' filepath='kernel/reboot.c' line='496' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='orderly_poweroff'>
-        <parameter type-id='b50a4934' name='force' filepath='kernel/reboot.c' line='496' column='1'/>
+      <function-decl name='orderly_poweroff' mangled-name='orderly_poweroff' filepath='kernel/reboot.c' line='497' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='orderly_poweroff'>
+        <parameter type-id='b50a4934' name='force' filepath='kernel/reboot.c' line='497' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='out_of_line_wait_on_bit_timeout' mangled-name='out_of_line_wait_on_bit_timeout' filepath='kernel/sched/wait_bit.c' line='68' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='out_of_line_wait_on_bit_timeout'>
@@ -139689,50 +139708,50 @@
         <parameter type-id='91ce1af9' name='flags' filepath='kernel/events/ring_buffer.c' line='334' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_addr_filters_sync' mangled-name='perf_event_addr_filters_sync' filepath='kernel/events/core.c' line='3131' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_addr_filters_sync'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3131' column='1'/>
+      <function-decl name='perf_event_addr_filters_sync' mangled-name='perf_event_addr_filters_sync' filepath='kernel/events/core.c' line='3146' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_addr_filters_sync'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3146' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_create_kernel_counter' mangled-name='perf_event_create_kernel_counter' filepath='kernel/events/core.c' line='12218' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_create_kernel_counter'>
-        <parameter type-id='20862e61' name='attr' filepath='kernel/events/core.c' line='12218' column='1'/>
-        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/events/core.c' line='12218' column='1'/>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='12219' column='1'/>
-        <parameter type-id='20a2e4e6' name='overflow_handler' filepath='kernel/events/core.c' line='12220' column='1'/>
-        <parameter type-id='eaa32e2f' name='context' filepath='kernel/events/core.c' line='12221' column='1'/>
+      <function-decl name='perf_event_create_kernel_counter' mangled-name='perf_event_create_kernel_counter' filepath='kernel/events/core.c' line='12233' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_create_kernel_counter'>
+        <parameter type-id='20862e61' name='attr' filepath='kernel/events/core.c' line='12233' column='1'/>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/events/core.c' line='12233' column='1'/>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='12234' column='1'/>
+        <parameter type-id='20a2e4e6' name='overflow_handler' filepath='kernel/events/core.c' line='12235' column='1'/>
+        <parameter type-id='eaa32e2f' name='context' filepath='kernel/events/core.c' line='12236' column='1'/>
         <return type-id='2bf16f59'/>
       </function-decl>
-      <function-decl name='perf_event_disable' mangled-name='perf_event_disable' filepath='kernel/events/core.c' line='2460' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_disable'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='2460' column='1'/>
+      <function-decl name='perf_event_disable' mangled-name='perf_event_disable' filepath='kernel/events/core.c' line='2475' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_disable'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='2475' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_enable' mangled-name='perf_event_enable' filepath='kernel/events/core.c' line='3031' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_enable'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3031' column='1'/>
+      <function-decl name='perf_event_enable' mangled-name='perf_event_enable' filepath='kernel/events/core.c' line='3046' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_enable'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3046' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_pause' mangled-name='perf_event_pause' filepath='kernel/events/core.c' line='5394' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_pause'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5394' column='1'/>
-        <parameter type-id='b50a4934' name='reset' filepath='kernel/events/core.c' line='5394' column='1'/>
+      <function-decl name='perf_event_pause' mangled-name='perf_event_pause' filepath='kernel/events/core.c' line='5409' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_pause'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5409' column='1'/>
+        <parameter type-id='b50a4934' name='reset' filepath='kernel/events/core.c' line='5409' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='perf_event_read_local' mangled-name='perf_event_read_local' filepath='kernel/events/core.c' line='4343' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_local'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='4343' column='1'/>
-        <parameter type-id='3df9fd28' name='value' filepath='kernel/events/core.c' line='4343' column='1'/>
-        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='4344' column='1'/>
-        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='4344' column='1'/>
+      <function-decl name='perf_event_read_local' mangled-name='perf_event_read_local' filepath='kernel/events/core.c' line='4358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_local'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='4358' column='1'/>
+        <parameter type-id='3df9fd28' name='value' filepath='kernel/events/core.c' line='4358' column='1'/>
+        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='4359' column='1'/>
+        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='4359' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_event_read_value' mangled-name='perf_event_read_value' filepath='kernel/events/core.c' line='5152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_value'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5152' column='1'/>
-        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='5152' column='1'/>
-        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='5152' column='1'/>
+      <function-decl name='perf_event_read_value' mangled-name='perf_event_read_value' filepath='kernel/events/core.c' line='5167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_value'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5167' column='1'/>
+        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='5167' column='1'/>
+        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='5167' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='perf_event_release_kernel' mangled-name='perf_event_release_kernel' filepath='kernel/events/core.c' line='5002' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_release_kernel'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5002' column='1'/>
+      <function-decl name='perf_event_release_kernel' mangled-name='perf_event_release_kernel' filepath='kernel/events/core.c' line='5017' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_release_kernel'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5017' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_event_update_userpage' mangled-name='perf_event_update_userpage' filepath='kernel/events/core.c' line='5773' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_update_userpage'>
-        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5773' column='1'/>
+      <function-decl name='perf_event_update_userpage' mangled-name='perf_event_update_userpage' filepath='kernel/events/core.c' line='5788' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_update_userpage'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5788' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='perf_get_aux' mangled-name='perf_get_aux' filepath='kernel/events/ring_buffer.c' line='557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_get_aux'>
@@ -139742,20 +139761,20 @@
       <function-decl name='perf_num_counters' mangled-name='perf_num_counters' filepath='drivers/perf/arm_pmu.c' line='598' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_num_counters'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_pmu_migrate_context' mangled-name='perf_pmu_migrate_context' filepath='kernel/events/core.c' line='12297' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_migrate_context'>
-        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='12297' column='1'/>
-        <parameter type-id='95e97e5e' name='src_cpu' filepath='kernel/events/core.c' line='12297' column='1'/>
-        <parameter type-id='95e97e5e' name='dst_cpu' filepath='kernel/events/core.c' line='12297' column='1'/>
+      <function-decl name='perf_pmu_migrate_context' mangled-name='perf_pmu_migrate_context' filepath='kernel/events/core.c' line='12312' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_migrate_context'>
+        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='12312' column='1'/>
+        <parameter type-id='95e97e5e' name='src_cpu' filepath='kernel/events/core.c' line='12312' column='1'/>
+        <parameter type-id='95e97e5e' name='dst_cpu' filepath='kernel/events/core.c' line='12312' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_pmu_register' mangled-name='perf_pmu_register' filepath='kernel/events/core.c' line='10838' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_register'>
-        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10838' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='kernel/events/core.c' line='10838' column='1'/>
-        <parameter type-id='95e97e5e' name='type' filepath='kernel/events/core.c' line='10838' column='1'/>
+      <function-decl name='perf_pmu_register' mangled-name='perf_pmu_register' filepath='kernel/events/core.c' line='10853' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_register'>
+        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10853' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='kernel/events/core.c' line='10853' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='kernel/events/core.c' line='10853' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_pmu_unregister' mangled-name='perf_pmu_unregister' filepath='kernel/events/core.c' line='10974' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_unregister'>
-        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10974' column='1'/>
+      <function-decl name='perf_pmu_unregister' mangled-name='perf_pmu_unregister' filepath='kernel/events/core.c' line='10989' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_unregister'>
+        <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10989' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='perf_trace_buf_alloc' mangled-name='perf_trace_buf_alloc' filepath='kernel/trace/trace_event_perf.c' line='395' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_buf_alloc'>
@@ -139764,15 +139783,15 @@
         <parameter type-id='7292109c' name='rctxp' filepath='kernel/trace/trace_event_perf.c' line='395' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='perf_trace_run_bpf_submit' mangled-name='perf_trace_run_bpf_submit' filepath='kernel/events/core.c' line='9469' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_run_bpf_submit'>
-        <parameter type-id='eaa32e2f' name='raw_data' filepath='kernel/events/core.c' line='9469' column='1'/>
-        <parameter type-id='95e97e5e' name='size' filepath='kernel/events/core.c' line='9469' column='1'/>
-        <parameter type-id='95e97e5e' name='rctx' filepath='kernel/events/core.c' line='9469' column='1'/>
-        <parameter type-id='23d6768c' name='call' filepath='kernel/events/core.c' line='9470' column='1'/>
-        <parameter type-id='91ce1af9' name='count' filepath='kernel/events/core.c' line='9470' column='1'/>
-        <parameter type-id='4616a179' name='regs' filepath='kernel/events/core.c' line='9471' column='1'/>
-        <parameter type-id='030d0b18' name='head' filepath='kernel/events/core.c' line='9471' column='1'/>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='9472' column='1'/>
+      <function-decl name='perf_trace_run_bpf_submit' mangled-name='perf_trace_run_bpf_submit' filepath='kernel/events/core.c' line='9484' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_run_bpf_submit'>
+        <parameter type-id='eaa32e2f' name='raw_data' filepath='kernel/events/core.c' line='9484' column='1'/>
+        <parameter type-id='95e97e5e' name='size' filepath='kernel/events/core.c' line='9484' column='1'/>
+        <parameter type-id='95e97e5e' name='rctx' filepath='kernel/events/core.c' line='9484' column='1'/>
+        <parameter type-id='23d6768c' name='call' filepath='kernel/events/core.c' line='9485' column='1'/>
+        <parameter type-id='91ce1af9' name='count' filepath='kernel/events/core.c' line='9485' column='1'/>
+        <parameter type-id='4616a179' name='regs' filepath='kernel/events/core.c' line='9486' column='1'/>
+        <parameter type-id='030d0b18' name='head' filepath='kernel/events/core.c' line='9486' column='1'/>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='9487' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pfn_valid' mangled-name='pfn_valid' filepath='arch/arm64/mm/init.c' line='263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pfn_valid'>
@@ -140113,9 +140132,9 @@
         <parameter type-id='1dc6a898' name='val' filepath='drivers/net/phy/phy-core.c' line='877' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_connect_phy' mangled-name='phylink_connect_phy' filepath='drivers/net/phy/phylink.c' line='1069' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_connect_phy'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1069' column='1'/>
-        <parameter type-id='7efbcaaf' name='phy' filepath='drivers/net/phy/phylink.c' line='1069' column='1'/>
+      <function-decl name='phylink_connect_phy' mangled-name='phylink_connect_phy' filepath='drivers/net/phy/phylink.c' line='1070' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_connect_phy'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1070' column='1'/>
+        <parameter type-id='7efbcaaf' name='phy' filepath='drivers/net/phy/phylink.c' line='1070' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phylink_create' mangled-name='phylink_create' filepath='drivers/net/phy/phylink.c' line='823' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_create'>
@@ -140125,98 +140144,98 @@
         <parameter type-id='f6203fc2' name='mac_ops' filepath='drivers/net/phy/phylink.c' line='826' column='1'/>
         <return type-id='56f3c6ca'/>
       </function-decl>
-      <function-decl name='phylink_destroy' mangled-name='phylink_destroy' filepath='drivers/net/phy/phylink.c' line='923' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_destroy'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='923' column='1'/>
+      <function-decl name='phylink_destroy' mangled-name='phylink_destroy' filepath='drivers/net/phy/phylink.c' line='924' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_destroy'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='924' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phylink_disconnect_phy' mangled-name='phylink_disconnect_phy' filepath='drivers/net/phy/phylink.c' line='1154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_disconnect_phy'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1154' column='1'/>
+      <function-decl name='phylink_disconnect_phy' mangled-name='phylink_disconnect_phy' filepath='drivers/net/phy/phylink.c' line='1155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_disconnect_phy'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1155' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phylink_ethtool_get_eee' mangled-name='phylink_ethtool_get_eee' filepath='drivers/net/phy/phylink.c' line='1747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_get_eee'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1747' column='1'/>
-        <parameter type-id='eced47f6' name='eee' filepath='drivers/net/phy/phylink.c' line='1747' column='1'/>
+      <function-decl name='phylink_ethtool_get_eee' mangled-name='phylink_ethtool_get_eee' filepath='drivers/net/phy/phylink.c' line='1748' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_get_eee'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1748' column='1'/>
+        <parameter type-id='eced47f6' name='eee' filepath='drivers/net/phy/phylink.c' line='1748' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_ethtool_get_pauseparam' mangled-name='phylink_ethtool_get_pauseparam' filepath='drivers/net/phy/phylink.c' line='1604' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_get_pauseparam'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1604' column='1'/>
-        <parameter type-id='ab38066e' name='pause' filepath='drivers/net/phy/phylink.c' line='1605' column='1'/>
+      <function-decl name='phylink_ethtool_get_pauseparam' mangled-name='phylink_ethtool_get_pauseparam' filepath='drivers/net/phy/phylink.c' line='1605' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_get_pauseparam'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1605' column='1'/>
+        <parameter type-id='ab38066e' name='pause' filepath='drivers/net/phy/phylink.c' line='1606' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phylink_ethtool_get_wol' mangled-name='phylink_ethtool_get_wol' filepath='drivers/net/phy/phylink.c' line='1306' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_get_wol'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1306' column='1'/>
-        <parameter type-id='fde1bbcb' name='wol' filepath='drivers/net/phy/phylink.c' line='1306' column='1'/>
+      <function-decl name='phylink_ethtool_get_wol' mangled-name='phylink_ethtool_get_wol' filepath='drivers/net/phy/phylink.c' line='1307' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_get_wol'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1307' column='1'/>
+        <parameter type-id='fde1bbcb' name='wol' filepath='drivers/net/phy/phylink.c' line='1307' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phylink_ethtool_ksettings_get' mangled-name='phylink_ethtool_ksettings_get' filepath='drivers/net/phy/phylink.c' line='1373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_ksettings_get'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1373' column='1'/>
-        <parameter type-id='70de91e2' name='kset' filepath='drivers/net/phy/phylink.c' line='1374' column='1'/>
+      <function-decl name='phylink_ethtool_ksettings_get' mangled-name='phylink_ethtool_ksettings_get' filepath='drivers/net/phy/phylink.c' line='1374' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_ksettings_get'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1374' column='1'/>
+        <parameter type-id='70de91e2' name='kset' filepath='drivers/net/phy/phylink.c' line='1375' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_ethtool_ksettings_set' mangled-name='phylink_ethtool_ksettings_set' filepath='drivers/net/phy/phylink.c' line='1424' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_ksettings_set'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1424' column='1'/>
-        <parameter type-id='b2c34f11' name='kset' filepath='drivers/net/phy/phylink.c' line='1425' column='1'/>
+      <function-decl name='phylink_ethtool_ksettings_set' mangled-name='phylink_ethtool_ksettings_set' filepath='drivers/net/phy/phylink.c' line='1425' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_ksettings_set'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1425' column='1'/>
+        <parameter type-id='b2c34f11' name='kset' filepath='drivers/net/phy/phylink.c' line='1426' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_ethtool_nway_reset' mangled-name='phylink_ethtool_nway_reset' filepath='drivers/net/phy/phylink.c' line='1585' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_nway_reset'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1585' column='1'/>
+      <function-decl name='phylink_ethtool_nway_reset' mangled-name='phylink_ethtool_nway_reset' filepath='drivers/net/phy/phylink.c' line='1586' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_nway_reset'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1586' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_ethtool_set_eee' mangled-name='phylink_ethtool_set_eee' filepath='drivers/net/phy/phylink.c' line='1765' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_set_eee'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1765' column='1'/>
-        <parameter type-id='eced47f6' name='eee' filepath='drivers/net/phy/phylink.c' line='1765' column='1'/>
+      <function-decl name='phylink_ethtool_set_eee' mangled-name='phylink_ethtool_set_eee' filepath='drivers/net/phy/phylink.c' line='1766' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_set_eee'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1766' column='1'/>
+        <parameter type-id='eced47f6' name='eee' filepath='drivers/net/phy/phylink.c' line='1766' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_ethtool_set_pauseparam' mangled-name='phylink_ethtool_set_pauseparam' filepath='drivers/net/phy/phylink.c' line='1620' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_set_pauseparam'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1620' column='1'/>
-        <parameter type-id='ab38066e' name='pause' filepath='drivers/net/phy/phylink.c' line='1621' column='1'/>
+      <function-decl name='phylink_ethtool_set_pauseparam' mangled-name='phylink_ethtool_set_pauseparam' filepath='drivers/net/phy/phylink.c' line='1621' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_set_pauseparam'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1621' column='1'/>
+        <parameter type-id='ab38066e' name='pause' filepath='drivers/net/phy/phylink.c' line='1622' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_ethtool_set_wol' mangled-name='phylink_ethtool_set_wol' filepath='drivers/net/phy/phylink.c' line='1329' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_set_wol'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1329' column='1'/>
-        <parameter type-id='fde1bbcb' name='wol' filepath='drivers/net/phy/phylink.c' line='1329' column='1'/>
+      <function-decl name='phylink_ethtool_set_wol' mangled-name='phylink_ethtool_set_wol' filepath='drivers/net/phy/phylink.c' line='1330' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_ethtool_set_wol'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1330' column='1'/>
+        <parameter type-id='fde1bbcb' name='wol' filepath='drivers/net/phy/phylink.c' line='1330' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_get_eee_err' mangled-name='phylink_get_eee_err' filepath='drivers/net/phy/phylink.c' line='1711' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_get_eee_err'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1711' column='1'/>
+      <function-decl name='phylink_get_eee_err' mangled-name='phylink_get_eee_err' filepath='drivers/net/phy/phylink.c' line='1712' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_get_eee_err'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1712' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_mac_change' mangled-name='phylink_mac_change' filepath='drivers/net/phy/phylink.c' line='1182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_mac_change'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1182' column='1'/>
-        <parameter type-id='b50a4934' name='up' filepath='drivers/net/phy/phylink.c' line='1182' column='1'/>
+      <function-decl name='phylink_mac_change' mangled-name='phylink_mac_change' filepath='drivers/net/phy/phylink.c' line='1183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_mac_change'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1183' column='1'/>
+        <parameter type-id='b50a4934' name='up' filepath='drivers/net/phy/phylink.c' line='1183' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phylink_mii_ioctl' mangled-name='phylink_mii_ioctl' filepath='drivers/net/phy/phylink.c' line='1948' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_mii_ioctl'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1948' column='1'/>
-        <parameter type-id='d494b97c' name='ifr' filepath='drivers/net/phy/phylink.c' line='1948' column='1'/>
-        <parameter type-id='95e97e5e' name='cmd' filepath='drivers/net/phy/phylink.c' line='1948' column='1'/>
+      <function-decl name='phylink_mii_ioctl' mangled-name='phylink_mii_ioctl' filepath='drivers/net/phy/phylink.c' line='1949' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_mii_ioctl'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1949' column='1'/>
+        <parameter type-id='d494b97c' name='ifr' filepath='drivers/net/phy/phylink.c' line='1949' column='1'/>
+        <parameter type-id='95e97e5e' name='cmd' filepath='drivers/net/phy/phylink.c' line='1949' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_of_phy_connect' mangled-name='phylink_of_phy_connect' filepath='drivers/net/phy/phylink.c' line='1103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_of_phy_connect'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1103' column='1'/>
-        <parameter type-id='9a537bbe' name='dn' filepath='drivers/net/phy/phylink.c' line='1103' column='1'/>
-        <parameter type-id='19c2251e' name='flags' filepath='drivers/net/phy/phylink.c' line='1104' column='1'/>
+      <function-decl name='phylink_of_phy_connect' mangled-name='phylink_of_phy_connect' filepath='drivers/net/phy/phylink.c' line='1104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_of_phy_connect'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1104' column='1'/>
+        <parameter type-id='9a537bbe' name='dn' filepath='drivers/net/phy/phylink.c' line='1104' column='1'/>
+        <parameter type-id='19c2251e' name='flags' filepath='drivers/net/phy/phylink.c' line='1105' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phylink_set_port_modes' mangled-name='phylink_set_port_modes' filepath='drivers/net/phy/phylink.c' line='122' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_set_port_modes'>
         <parameter type-id='1d2c2b85' name='mask' filepath='drivers/net/phy/phylink.c' line='122' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phylink_speed_down' mangled-name='phylink_speed_down' filepath='drivers/net/phy/phylink.c' line='2020' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_speed_down'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='2020' column='1'/>
-        <parameter type-id='b50a4934' name='sync' filepath='drivers/net/phy/phylink.c' line='2020' column='1'/>
+      <function-decl name='phylink_speed_down' mangled-name='phylink_speed_down' filepath='drivers/net/phy/phylink.c' line='2021' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_speed_down'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='2021' column='1'/>
+        <parameter type-id='b50a4934' name='sync' filepath='drivers/net/phy/phylink.c' line='2021' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_speed_up' mangled-name='phylink_speed_up' filepath='drivers/net/phy/phylink.c' line='2043' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_speed_up'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='2043' column='1'/>
+      <function-decl name='phylink_speed_up' mangled-name='phylink_speed_up' filepath='drivers/net/phy/phylink.c' line='2044' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_speed_up'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='2044' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phylink_start' mangled-name='phylink_start' filepath='drivers/net/phy/phylink.c' line='1208' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_start'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1208' column='1'/>
+      <function-decl name='phylink_start' mangled-name='phylink_start' filepath='drivers/net/phy/phylink.c' line='1209' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_start'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1209' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phylink_stop' mangled-name='phylink_stop' filepath='drivers/net/phy/phylink.c' line='1279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_stop'>
-        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1279' column='1'/>
+      <function-decl name='phylink_stop' mangled-name='phylink_stop' filepath='drivers/net/phy/phylink.c' line='1280' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phylink_stop'>
+        <parameter type-id='56f3c6ca' name='pl' filepath='drivers/net/phy/phylink.c' line='1280' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pick_highest_pushable_task' mangled-name='pick_highest_pushable_task' filepath='kernel/sched/rt.c' line='1774' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pick_highest_pushable_task'>
@@ -141115,8 +141134,8 @@
         <parameter type-id='54ec2a4d' name='psi' filepath='fs/pstore/platform.c' line='561' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pstore_unregister' mangled-name='pstore_unregister' filepath='fs/pstore/platform.c' line='628' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pstore_unregister'>
-        <parameter type-id='54ec2a4d' name='psi' filepath='fs/pstore/platform.c' line='628' column='1'/>
+      <function-decl name='pstore_unregister' mangled-name='pstore_unregister' filepath='fs/pstore/platform.c' line='635' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pstore_unregister'>
+        <parameter type-id='54ec2a4d' name='psi' filepath='fs/pstore/platform.c' line='635' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='public_key_verify_signature' mangled-name='public_key_verify_signature' filepath='crypto/asymmetric_keys/public_key.c' line='313' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='public_key_verify_signature'>
@@ -141378,7 +141397,7 @@
         <parameter type-id='c5bcc2c0' name='root' filepath='lib/rbtree.c' line='554' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcu_barrier' mangled-name='rcu_barrier' filepath='kernel/rcu/tree.c' line='3871' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_barrier'>
+      <function-decl name='rcu_barrier' mangled-name='rcu_barrier' filepath='kernel/rcu/tree.c' line='3880' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_barrier'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rcu_barrier_tasks' mangled-name='rcu_barrier_tasks' filepath='kernel/rcu/tasks.h' line='566' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_barrier_tasks'>
@@ -141395,17 +141414,17 @@
       <function-decl name='rcu_expedite_gp' mangled-name='rcu_expedite_gp' filepath='kernel/rcu/update.c' line='167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_expedite_gp'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcu_force_quiescent_state' mangled-name='rcu_force_quiescent_state' filepath='kernel/rcu/tree.c' line='2653' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_force_quiescent_state'>
+      <function-decl name='rcu_force_quiescent_state' mangled-name='rcu_force_quiescent_state' filepath='kernel/rcu/tree.c' line='2654' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_force_quiescent_state'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rcu_fwd_progress_check' mangled-name='rcu_fwd_progress_check' filepath='kernel/rcu/tree_stall.h' line='806' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_fwd_progress_check'>
         <parameter type-id='7359adad' name='j' filepath='kernel/rcu/tree_stall.h' line='806' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcu_get_gp_kthreads_prio' mangled-name='rcu_get_gp_kthreads_prio' filepath='kernel/rcu/tree.c' line='184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_get_gp_kthreads_prio'>
+      <function-decl name='rcu_get_gp_kthreads_prio' mangled-name='rcu_get_gp_kthreads_prio' filepath='kernel/rcu/tree.c' line='185' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_get_gp_kthreads_prio'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rcu_get_gp_seq' mangled-name='rcu_get_gp_seq' filepath='kernel/rcu/tree.c' line='569' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_get_gp_seq'>
+      <function-decl name='rcu_get_gp_seq' mangled-name='rcu_get_gp_seq' filepath='kernel/rcu/tree.c' line='570' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_get_gp_seq'>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='rcu_gp_is_expedited' mangled-name='rcu_gp_is_expedited' filepath='kernel/rcu/update.c' line='154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_gp_is_expedited'>
@@ -141414,20 +141433,20 @@
       <function-decl name='rcu_gp_is_normal' mangled-name='rcu_gp_is_normal' filepath='kernel/rcu/update.c' line='138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_gp_is_normal'>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='rcu_gp_set_torture_wait' mangled-name='rcu_gp_set_torture_wait' filepath='kernel/rcu/tree.c' line='1692' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_gp_set_torture_wait'>
-        <parameter type-id='95e97e5e' name='duration' filepath='kernel/rcu/tree.c' line='1692' column='1'/>
+      <function-decl name='rcu_gp_set_torture_wait' mangled-name='rcu_gp_set_torture_wait' filepath='kernel/rcu/tree.c' line='1693' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_gp_set_torture_wait'>
+        <parameter type-id='95e97e5e' name='duration' filepath='kernel/rcu/tree.c' line='1693' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcu_idle_enter' mangled-name='rcu_idle_enter' filepath='kernel/rcu/tree.c' line='664' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_idle_enter'>
+      <function-decl name='rcu_idle_enter' mangled-name='rcu_idle_enter' filepath='kernel/rcu/tree.c' line='665' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_idle_enter'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcu_idle_exit' mangled-name='rcu_idle_exit' filepath='kernel/rcu/tree.c' line='882' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_idle_exit'>
+      <function-decl name='rcu_idle_exit' mangled-name='rcu_idle_exit' filepath='kernel/rcu/tree.c' line='883' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_idle_exit'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rcu_inkernel_boot_has_ended' mangled-name='rcu_inkernel_boot_has_ended' filepath='kernel/rcu/update.c' line='204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_inkernel_boot_has_ended'>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='rcu_is_watching' mangled-name='rcu_is_watching' filepath='kernel/rcu/tree.c' line='1106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_is_watching'>
+      <function-decl name='rcu_is_watching' mangled-name='rcu_is_watching' filepath='kernel/rcu/tree.c' line='1107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_is_watching'>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='rcu_jiffies_till_stall_check' mangled-name='rcu_jiffies_till_stall_check' filepath='kernel/rcu/tree_stall.h' line='28' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_jiffies_till_stall_check'>
@@ -141441,30 +141460,30 @@
       <function-decl name='rcu_unexpedite_gp' mangled-name='rcu_unexpedite_gp' filepath='kernel/rcu/update.c' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_unexpedite_gp'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcutorture_get_gp_data' mangled-name='rcutorture_get_gp_data' filepath='kernel/rcu/tree.c' line='598' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcutorture_get_gp_data'>
-        <parameter type-id='f63583e2' name='test_type' filepath='kernel/rcu/tree.c' line='598' column='1'/>
-        <parameter type-id='7292109c' name='flags' filepath='kernel/rcu/tree.c' line='598' column='1'/>
-        <parameter type-id='1d2c2b85' name='gp_seq' filepath='kernel/rcu/tree.c' line='599' column='1'/>
+      <function-decl name='rcutorture_get_gp_data' mangled-name='rcutorture_get_gp_data' filepath='kernel/rcu/tree.c' line='599' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcutorture_get_gp_data'>
+        <parameter type-id='f63583e2' name='test_type' filepath='kernel/rcu/tree.c' line='599' column='1'/>
+        <parameter type-id='7292109c' name='flags' filepath='kernel/rcu/tree.c' line='599' column='1'/>
+        <parameter type-id='1d2c2b85' name='gp_seq' filepath='kernel/rcu/tree.c' line='600' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rcuwait_wake_up' mangled-name='rcuwait_wake_up' filepath='kernel/exit.c' line='280' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcuwait_wake_up'>
         <parameter type-id='9b25216e' name='w' filepath='kernel/exit.c' line='280' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rdev_get_dev' mangled-name='rdev_get_dev' filepath='drivers/regulator/core.c' line='5670' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_dev'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5670' column='1'/>
+      <function-decl name='rdev_get_dev' mangled-name='rdev_get_dev' filepath='drivers/regulator/core.c' line='5666' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_dev'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5666' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='rdev_get_drvdata' mangled-name='rdev_get_drvdata' filepath='drivers/regulator/core.c' line='5630' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_drvdata'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5630' column='1'/>
+      <function-decl name='rdev_get_drvdata' mangled-name='rdev_get_drvdata' filepath='drivers/regulator/core.c' line='5626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_drvdata'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5626' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='rdev_get_id' mangled-name='rdev_get_id' filepath='drivers/regulator/core.c' line='5664' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_id'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5664' column='1'/>
+      <function-decl name='rdev_get_id' mangled-name='rdev_get_id' filepath='drivers/regulator/core.c' line='5660' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_id'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5660' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rdev_get_regmap' mangled-name='rdev_get_regmap' filepath='drivers/regulator/core.c' line='5676' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_regmap'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5676' column='1'/>
+      <function-decl name='rdev_get_regmap' mangled-name='rdev_get_regmap' filepath='drivers/regulator/core.c' line='5672' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_regmap'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5672' column='1'/>
         <return type-id='29af9a71'/>
       </function-decl>
       <function-decl name='read_cache_page' mangled-name='read_cache_page' filepath='mm/filemap.c' line='3293' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='read_cache_page'>
@@ -141560,8 +141579,8 @@
         <parameter type-id='80f4b756' name='name' filepath='block/genhd.c' line='440' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_candev' mangled-name='register_candev' filepath='drivers/net/can/dev/dev.c' line='1275' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_candev'>
-        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='1275' column='1'/>
+      <function-decl name='register_candev' mangled-name='register_candev' filepath='drivers/net/can/dev/dev.c' line='1277' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_candev'>
+        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='1277' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='register_chrdev_region' mangled-name='register_chrdev_region' filepath='fs/char_dev.c' line='200' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_chrdev_region'>
@@ -141656,12 +141675,12 @@
         <parameter type-id='d6369c88' name='qops' filepath='net/sched/sch_api.c' line='130' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_reboot_notifier' mangled-name='register_reboot_notifier' filepath='kernel/reboot.c' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_reboot_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='91' column='1'/>
+      <function-decl name='register_reboot_notifier' mangled-name='register_reboot_notifier' filepath='kernel/reboot.c' line='92' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_reboot_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='92' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_restart_handler' mangled-name='register_restart_handler' filepath='kernel/reboot.c' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_restart_handler'>
-        <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='183' column='1'/>
+      <function-decl name='register_restart_handler' mangled-name='register_restart_handler' filepath='kernel/reboot.c' line='184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_restart_handler'>
+        <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='184' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='register_shrinker' mangled-name='register_shrinker' filepath='mm/vmscan.c' line='411' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_shrinker'>
@@ -141706,8 +141725,8 @@
         <parameter type-id='a731d0ec' name='data' filepath='drivers/base/regmap/regmap-irq.c' line='857' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_async_complete' mangled-name='regmap_async_complete' filepath='drivers/base/regmap/regmap.c' line='3153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_async_complete'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3153' column='1'/>
+      <function-decl name='regmap_async_complete' mangled-name='regmap_async_complete' filepath='drivers/base/regmap/regmap.c' line='3155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_async_complete'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3155' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regmap_attach_dev' mangled-name='regmap_attach_dev' filepath='drivers/base/regmap/regmap.c' line='611' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_attach_dev'>
@@ -141716,18 +141735,18 @@
         <parameter type-id='9d19d4a7' name='config' filepath='drivers/base/regmap/regmap.c' line='612' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_bulk_read' mangled-name='regmap_bulk_read' filepath='drivers/base/regmap/regmap.c' line='2949' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_bulk_read'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2949' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2949' column='1'/>
-        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2949' column='1'/>
-        <parameter type-id='b59d7dce' name='val_count' filepath='drivers/base/regmap/regmap.c' line='2950' column='1'/>
+      <function-decl name='regmap_bulk_read' mangled-name='regmap_bulk_read' filepath='drivers/base/regmap/regmap.c' line='2951' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_bulk_read'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2951' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2951' column='1'/>
+        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2951' column='1'/>
+        <parameter type-id='b59d7dce' name='val_count' filepath='drivers/base/regmap/regmap.c' line='2952' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_bulk_write' mangled-name='regmap_bulk_write' filepath='drivers/base/regmap/regmap.c' line='2205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_bulk_write'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2205' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2205' column='1'/>
-        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2205' column='1'/>
-        <parameter type-id='b59d7dce' name='val_count' filepath='drivers/base/regmap/regmap.c' line='2206' column='1'/>
+      <function-decl name='regmap_bulk_write' mangled-name='regmap_bulk_write' filepath='drivers/base/regmap/regmap.c' line='2207' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_bulk_write'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2207' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2207' column='1'/>
+        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2207' column='1'/>
+        <parameter type-id='b59d7dce' name='val_count' filepath='drivers/base/regmap/regmap.c' line='2208' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regmap_check_range_table' mangled-name='regmap_check_range_table' filepath='drivers/base/regmap/regmap.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_check_range_table'>
@@ -141745,18 +141764,18 @@
         <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='1476' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='regmap_field_read' mangled-name='regmap_field_read' filepath='drivers/base/regmap/regmap.c' line='2889' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_field_read'>
-        <parameter type-id='476eb32c' name='field' filepath='drivers/base/regmap/regmap.c' line='2889' column='1'/>
-        <parameter type-id='807869d3' name='val' filepath='drivers/base/regmap/regmap.c' line='2889' column='1'/>
+      <function-decl name='regmap_field_read' mangled-name='regmap_field_read' filepath='drivers/base/regmap/regmap.c' line='2891' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_field_read'>
+        <parameter type-id='476eb32c' name='field' filepath='drivers/base/regmap/regmap.c' line='2891' column='1'/>
+        <parameter type-id='807869d3' name='val' filepath='drivers/base/regmap/regmap.c' line='2891' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_field_update_bits_base' mangled-name='regmap_field_update_bits_base' filepath='drivers/base/regmap/regmap.c' line='2148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_field_update_bits_base'>
-        <parameter type-id='476eb32c' name='field' filepath='drivers/base/regmap/regmap.c' line='2148' column='1'/>
-        <parameter type-id='f0981eeb' name='mask' filepath='drivers/base/regmap/regmap.c' line='2149' column='1'/>
-        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='2149' column='1'/>
-        <parameter type-id='d8e6b335' name='change' filepath='drivers/base/regmap/regmap.c' line='2150' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='drivers/base/regmap/regmap.c' line='2150' column='1'/>
-        <parameter type-id='b50a4934' name='force' filepath='drivers/base/regmap/regmap.c' line='2150' column='1'/>
+      <function-decl name='regmap_field_update_bits_base' mangled-name='regmap_field_update_bits_base' filepath='drivers/base/regmap/regmap.c' line='2150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_field_update_bits_base'>
+        <parameter type-id='476eb32c' name='field' filepath='drivers/base/regmap/regmap.c' line='2150' column='1'/>
+        <parameter type-id='f0981eeb' name='mask' filepath='drivers/base/regmap/regmap.c' line='2151' column='1'/>
+        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='2151' column='1'/>
+        <parameter type-id='d8e6b335' name='change' filepath='drivers/base/regmap/regmap.c' line='2152' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='drivers/base/regmap/regmap.c' line='2152' column='1'/>
+        <parameter type-id='b50a4934' name='force' filepath='drivers/base/regmap/regmap.c' line='2152' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regmap_get_device' mangled-name='regmap_get_device' filepath='drivers/base/regmap/regmap.c' line='1549' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_get_device'>
@@ -141776,71 +141795,71 @@
         <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap-mmio.c' line='368' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='regmap_multi_reg_write' mangled-name='regmap_multi_reg_write' filepath='drivers/base/regmap/regmap.c' line='2512' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_multi_reg_write'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2512' column='1'/>
-        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='2512' column='1'/>
-        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='2513' column='1'/>
+      <function-decl name='regmap_multi_reg_write' mangled-name='regmap_multi_reg_write' filepath='drivers/base/regmap/regmap.c' line='2514' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_multi_reg_write'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2514' column='1'/>
+        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='2514' column='1'/>
+        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='2515' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_multi_reg_write_bypassed' mangled-name='regmap_multi_reg_write_bypassed' filepath='drivers/base/regmap/regmap.c' line='2545' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_multi_reg_write_bypassed'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2545' column='1'/>
-        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='2546' column='1'/>
-        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='2547' column='1'/>
+      <function-decl name='regmap_multi_reg_write_bypassed' mangled-name='regmap_multi_reg_write_bypassed' filepath='drivers/base/regmap/regmap.c' line='2547' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_multi_reg_write_bypassed'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2547' column='1'/>
+        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='2548' column='1'/>
+        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='2549' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_raw_read' mangled-name='regmap_raw_read' filepath='drivers/base/regmap/regmap.c' line='2742' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_read'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2742' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2742' column='1'/>
-        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2742' column='1'/>
-        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2743' column='1'/>
+      <function-decl name='regmap_raw_read' mangled-name='regmap_raw_read' filepath='drivers/base/regmap/regmap.c' line='2744' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_read'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2744' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2744' column='1'/>
+        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2744' column='1'/>
+        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2745' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_raw_write' mangled-name='regmap_raw_write' filepath='drivers/base/regmap/regmap.c' line='2048' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_write'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2048' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2048' column='1'/>
-        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2049' column='1'/>
-        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2049' column='1'/>
+      <function-decl name='regmap_raw_write' mangled-name='regmap_raw_write' filepath='drivers/base/regmap/regmap.c' line='2050' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_write'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2050' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2050' column='1'/>
+        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2051' column='1'/>
+        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2051' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_raw_write_async' mangled-name='regmap_raw_write_async' filepath='drivers/base/regmap/regmap.c' line='2589' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_write_async'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2589' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2589' column='1'/>
-        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2590' column='1'/>
-        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2590' column='1'/>
+      <function-decl name='regmap_raw_write_async' mangled-name='regmap_raw_write_async' filepath='drivers/base/regmap/regmap.c' line='2591' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_raw_write_async'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2591' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2591' column='1'/>
+        <parameter type-id='eaa32e2f' name='val' filepath='drivers/base/regmap/regmap.c' line='2592' column='1'/>
+        <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2592' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_read' mangled-name='regmap_read' filepath='drivers/base/regmap/regmap.c' line='2714' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_read'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2714' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2714' column='1'/>
-        <parameter type-id='807869d3' name='val' filepath='drivers/base/regmap/regmap.c' line='2714' column='1'/>
+      <function-decl name='regmap_read' mangled-name='regmap_read' filepath='drivers/base/regmap/regmap.c' line='2716' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_read'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2716' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2716' column='1'/>
+        <parameter type-id='807869d3' name='val' filepath='drivers/base/regmap/regmap.c' line='2716' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_register_patch' mangled-name='regmap_register_patch' filepath='drivers/base/regmap/regmap.c' line='3194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_register_patch'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3194' column='1'/>
-        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='3194' column='1'/>
-        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='3195' column='1'/>
+      <function-decl name='regmap_register_patch' mangled-name='regmap_register_patch' filepath='drivers/base/regmap/regmap.c' line='3196' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_register_patch'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3196' column='1'/>
+        <parameter type-id='0472a368' name='regs' filepath='drivers/base/regmap/regmap.c' line='3196' column='1'/>
+        <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='3197' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_test_bits' mangled-name='regmap_test_bits' filepath='drivers/base/regmap/regmap.c' line='3100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_test_bits'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3100' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='3100' column='1'/>
-        <parameter type-id='f0981eeb' name='bits' filepath='drivers/base/regmap/regmap.c' line='3100' column='1'/>
+      <function-decl name='regmap_test_bits' mangled-name='regmap_test_bits' filepath='drivers/base/regmap/regmap.c' line='3102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_test_bits'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3102' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='3102' column='1'/>
+        <parameter type-id='f0981eeb' name='bits' filepath='drivers/base/regmap/regmap.c' line='3102' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_update_bits_base' mangled-name='regmap_update_bits_base' filepath='drivers/base/regmap/regmap.c' line='3069' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_update_bits_base'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3069' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='3069' column='1'/>
-        <parameter type-id='f0981eeb' name='mask' filepath='drivers/base/regmap/regmap.c' line='3070' column='1'/>
-        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='3070' column='1'/>
-        <parameter type-id='d8e6b335' name='change' filepath='drivers/base/regmap/regmap.c' line='3071' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='drivers/base/regmap/regmap.c' line='3071' column='1'/>
-        <parameter type-id='b50a4934' name='force' filepath='drivers/base/regmap/regmap.c' line='3071' column='1'/>
+      <function-decl name='regmap_update_bits_base' mangled-name='regmap_update_bits_base' filepath='drivers/base/regmap/regmap.c' line='3071' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_update_bits_base'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3071' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='3071' column='1'/>
+        <parameter type-id='f0981eeb' name='mask' filepath='drivers/base/regmap/regmap.c' line='3072' column='1'/>
+        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='3072' column='1'/>
+        <parameter type-id='d8e6b335' name='change' filepath='drivers/base/regmap/regmap.c' line='3073' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='drivers/base/regmap/regmap.c' line='3073' column='1'/>
+        <parameter type-id='b50a4934' name='force' filepath='drivers/base/regmap/regmap.c' line='3073' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_write' mangled-name='regmap_write' filepath='drivers/base/regmap/regmap.c' line='1946' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_write'>
-        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='1946' column='1'/>
-        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='1946' column='1'/>
-        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='1946' column='1'/>
+      <function-decl name='regmap_write' mangled-name='regmap_write' filepath='drivers/base/regmap/regmap.c' line='1948' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_write'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='1948' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='1948' column='1'/>
+        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='1948' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_allow_bypass' mangled-name='regulator_allow_bypass' filepath='drivers/regulator/core.c' line='4571' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_allow_bypass'>
@@ -141916,8 +141935,8 @@
         <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='827' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_get_drvdata' mangled-name='regulator_get_drvdata' filepath='drivers/regulator/core.c' line='5643' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_drvdata'>
-        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='5643' column='1'/>
+      <function-decl name='regulator_get_drvdata' mangled-name='regulator_get_drvdata' filepath='drivers/regulator/core.c' line='5639' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_drvdata'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='5639' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='regulator_get_linear_step' mangled-name='regulator_get_linear_step' filepath='drivers/regulator/core.c' line='3244' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_linear_step'>
@@ -142091,8 +142110,8 @@
         <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4210' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_unregister' mangled-name='regulator_unregister' filepath='drivers/regulator/core.c' line='5508' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_unregister'>
-        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5508' column='1'/>
+      <function-decl name='regulator_unregister' mangled-name='regulator_unregister' filepath='drivers/regulator/core.c' line='5504' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_unregister'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5504' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='regulator_unregister_notifier' mangled-name='regulator_unregister_notifier' filepath='drivers/regulator/core.c' line='4643' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_unregister_notifier'>
@@ -142906,38 +142925,38 @@
         <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='6711' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sched_trace_cfs_rq_avg' mangled-name='sched_trace_cfs_rq_avg' filepath='kernel/sched/fair.c' line='11737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_cfs_rq_avg'>
-        <parameter type-id='a6892387' name='cfs_rq' filepath='kernel/sched/fair.c' line='11737' column='1'/>
+      <function-decl name='sched_trace_cfs_rq_avg' mangled-name='sched_trace_cfs_rq_avg' filepath='kernel/sched/fair.c' line='11721' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_cfs_rq_avg'>
+        <parameter type-id='a6892387' name='cfs_rq' filepath='kernel/sched/fair.c' line='11721' column='1'/>
         <return type-id='847e6fee'/>
       </function-decl>
-      <function-decl name='sched_trace_cfs_rq_cpu' mangled-name='sched_trace_cfs_rq_cpu' filepath='kernel/sched/fair.c' line='11761' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_cfs_rq_cpu'>
-        <parameter type-id='a6892387' name='cfs_rq' filepath='kernel/sched/fair.c' line='11761' column='1'/>
+      <function-decl name='sched_trace_cfs_rq_cpu' mangled-name='sched_trace_cfs_rq_cpu' filepath='kernel/sched/fair.c' line='11745' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_cfs_rq_cpu'>
+        <parameter type-id='a6892387' name='cfs_rq' filepath='kernel/sched/fair.c' line='11745' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sched_trace_cfs_rq_path' mangled-name='sched_trace_cfs_rq_path' filepath='kernel/sched/fair.c' line='11747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_cfs_rq_path'>
-        <parameter type-id='a6892387' name='cfs_rq' filepath='kernel/sched/fair.c' line='11747' column='1'/>
-        <parameter type-id='26a90f95' name='str' filepath='kernel/sched/fair.c' line='11747' column='1'/>
-        <parameter type-id='95e97e5e' name='len' filepath='kernel/sched/fair.c' line='11747' column='1'/>
+      <function-decl name='sched_trace_cfs_rq_path' mangled-name='sched_trace_cfs_rq_path' filepath='kernel/sched/fair.c' line='11731' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_cfs_rq_path'>
+        <parameter type-id='a6892387' name='cfs_rq' filepath='kernel/sched/fair.c' line='11731' column='1'/>
+        <parameter type-id='26a90f95' name='str' filepath='kernel/sched/fair.c' line='11731' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='kernel/sched/fair.c' line='11731' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='sched_trace_rd_span' mangled-name='sched_trace_rd_span' filepath='kernel/sched/fair.c' line='11815' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_rd_span'>
-        <parameter type-id='c13bca88' name='rd' filepath='kernel/sched/fair.c' line='11815' column='1'/>
+      <function-decl name='sched_trace_rd_span' mangled-name='sched_trace_rd_span' filepath='kernel/sched/fair.c' line='11799' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_rd_span'>
+        <parameter type-id='c13bca88' name='rd' filepath='kernel/sched/fair.c' line='11799' column='1'/>
         <return type-id='5f8a1ac4'/>
       </function-decl>
-      <function-decl name='sched_trace_rq_avg_dl' mangled-name='sched_trace_rq_avg_dl' filepath='kernel/sched/fair.c' line='11777' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_rq_avg_dl'>
-        <parameter type-id='6ed6b432' name='rq' filepath='kernel/sched/fair.c' line='11777' column='1'/>
+      <function-decl name='sched_trace_rq_avg_dl' mangled-name='sched_trace_rq_avg_dl' filepath='kernel/sched/fair.c' line='11761' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_rq_avg_dl'>
+        <parameter type-id='6ed6b432' name='rq' filepath='kernel/sched/fair.c' line='11761' column='1'/>
         <return type-id='847e6fee'/>
       </function-decl>
-      <function-decl name='sched_trace_rq_avg_irq' mangled-name='sched_trace_rq_avg_irq' filepath='kernel/sched/fair.c' line='11787' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_rq_avg_irq'>
-        <parameter type-id='6ed6b432' name='rq' filepath='kernel/sched/fair.c' line='11787' column='1'/>
+      <function-decl name='sched_trace_rq_avg_irq' mangled-name='sched_trace_rq_avg_irq' filepath='kernel/sched/fair.c' line='11771' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_rq_avg_irq'>
+        <parameter type-id='6ed6b432' name='rq' filepath='kernel/sched/fair.c' line='11771' column='1'/>
         <return type-id='847e6fee'/>
       </function-decl>
-      <function-decl name='sched_trace_rq_avg_rt' mangled-name='sched_trace_rq_avg_rt' filepath='kernel/sched/fair.c' line='11767' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_rq_avg_rt'>
-        <parameter type-id='6ed6b432' name='rq' filepath='kernel/sched/fair.c' line='11767' column='1'/>
+      <function-decl name='sched_trace_rq_avg_rt' mangled-name='sched_trace_rq_avg_rt' filepath='kernel/sched/fair.c' line='11751' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_rq_avg_rt'>
+        <parameter type-id='6ed6b432' name='rq' filepath='kernel/sched/fair.c' line='11751' column='1'/>
         <return type-id='847e6fee'/>
       </function-decl>
-      <function-decl name='sched_trace_rq_cpu' mangled-name='sched_trace_rq_cpu' filepath='kernel/sched/fair.c' line='11797' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_rq_cpu'>
-        <parameter type-id='6ed6b432' name='rq' filepath='kernel/sched/fair.c' line='11797' column='1'/>
+      <function-decl name='sched_trace_rq_cpu' mangled-name='sched_trace_rq_cpu' filepath='kernel/sched/fair.c' line='11781' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_trace_rq_cpu'>
+        <parameter type-id='6ed6b432' name='rq' filepath='kernel/sched/fair.c' line='11781' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='sched_uclamp_used' type-id='237c0d27' mangled-name='sched_uclamp_used' visibility='default' filepath='kernel/sched/core.c' line='968' column='1' elf-symbol-id='sched_uclamp_used'/>
@@ -144444,12 +144463,12 @@
         <parameter type-id='52704eb7' name='card' filepath='sound/core/init.c' line='746' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_card_rw_proc_new' mangled-name='snd_card_rw_proc_new' filepath='sound/core/info.c' line='873' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_rw_proc_new'>
-        <parameter type-id='52704eb7' name='card' filepath='sound/core/info.c' line='873' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='sound/core/info.c' line='873' column='1'/>
-        <parameter type-id='eaa32e2f' name='private_data' filepath='sound/core/info.c' line='874' column='1'/>
-        <parameter type-id='f695e0b6' name='read' filepath='sound/core/info.c' line='875' column='1'/>
-        <parameter type-id='f695e0b6' name='write' filepath='sound/core/info.c' line='877' column='1'/>
+      <function-decl name='snd_card_rw_proc_new' mangled-name='snd_card_rw_proc_new' filepath='sound/core/info.c' line='878' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_rw_proc_new'>
+        <parameter type-id='52704eb7' name='card' filepath='sound/core/info.c' line='878' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='sound/core/info.c' line='878' column='1'/>
+        <parameter type-id='eaa32e2f' name='private_data' filepath='sound/core/info.c' line='879' column='1'/>
+        <parameter type-id='f695e0b6' name='read' filepath='sound/core/info.c' line='880' column='1'/>
+        <parameter type-id='f695e0b6' name='write' filepath='sound/core/info.c' line='882' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_component_add' mangled-name='snd_component_add' filepath='sound/core/init.c' line='892' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_component_add'>
@@ -144620,24 +144639,24 @@
         <parameter type-id='4f22192a' name='slave_config' filepath='sound/core/pcm_dmaengine.c' line='54' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_info_create_card_entry' mangled-name='snd_info_create_card_entry' filepath='sound/core/info.c' line='739' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_info_create_card_entry'>
-        <parameter type-id='52704eb7' name='card' filepath='sound/core/info.c' line='739' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='sound/core/info.c' line='740' column='1'/>
-        <parameter type-id='b9608bfc' name='parent' filepath='sound/core/info.c' line='741' column='1'/>
+      <function-decl name='snd_info_create_card_entry' mangled-name='snd_info_create_card_entry' filepath='sound/core/info.c' line='744' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_info_create_card_entry'>
+        <parameter type-id='52704eb7' name='card' filepath='sound/core/info.c' line='744' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='sound/core/info.c' line='745' column='1'/>
+        <parameter type-id='b9608bfc' name='parent' filepath='sound/core/info.c' line='746' column='1'/>
         <return type-id='b9608bfc'/>
       </function-decl>
-      <function-decl name='snd_info_create_module_entry' mangled-name='snd_info_create_module_entry' filepath='sound/core/info.c' line='719' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_info_create_module_entry'>
-        <parameter type-id='2730d015' name='module' filepath='sound/core/info.c' line='719' column='1'/>
-        <parameter type-id='80f4b756' name='name' filepath='sound/core/info.c' line='720' column='1'/>
-        <parameter type-id='b9608bfc' name='parent' filepath='sound/core/info.c' line='721' column='1'/>
+      <function-decl name='snd_info_create_module_entry' mangled-name='snd_info_create_module_entry' filepath='sound/core/info.c' line='724' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_info_create_module_entry'>
+        <parameter type-id='2730d015' name='module' filepath='sound/core/info.c' line='724' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='sound/core/info.c' line='725' column='1'/>
+        <parameter type-id='b9608bfc' name='parent' filepath='sound/core/info.c' line='726' column='1'/>
         <return type-id='b9608bfc'/>
       </function-decl>
-      <function-decl name='snd_info_free_entry' mangled-name='snd_info_free_entry' filepath='sound/core/info.c' line='767' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_info_free_entry'>
-        <parameter type-id='b9608bfc' name='entry' filepath='sound/core/info.c' line='767' column='1'/>
+      <function-decl name='snd_info_free_entry' mangled-name='snd_info_free_entry' filepath='sound/core/info.c' line='771' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_info_free_entry'>
+        <parameter type-id='b9608bfc' name='entry' filepath='sound/core/info.c' line='771' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_info_register' mangled-name='snd_info_register' filepath='sound/core/info.c' line='841' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_info_register'>
-        <parameter type-id='b9608bfc' name='entry' filepath='sound/core/info.c' line='841' column='1'/>
+      <function-decl name='snd_info_register' mangled-name='snd_info_register' filepath='sound/core/info.c' line='846' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_info_register'>
+        <parameter type-id='b9608bfc' name='entry' filepath='sound/core/info.c' line='846' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_interval_ranges' mangled-name='snd_interval_ranges' filepath='sound/core/pcm_lib.c' line='1043' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_interval_ranges'>
@@ -144841,13 +144860,13 @@
         <parameter type-id='b59d7dce' name='max' filepath='sound/core/pcm_memory.c' line='326' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_pcm_new' mangled-name='snd_pcm_new' filepath='sound/core/pcm.c' line='773' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_new'>
-        <parameter type-id='52704eb7' name='card' filepath='sound/core/pcm.c' line='773' column='1'/>
-        <parameter type-id='80f4b756' name='id' filepath='sound/core/pcm.c' line='773' column='1'/>
-        <parameter type-id='95e97e5e' name='device' filepath='sound/core/pcm.c' line='773' column='1'/>
-        <parameter type-id='95e97e5e' name='playback_count' filepath='sound/core/pcm.c' line='774' column='1'/>
-        <parameter type-id='95e97e5e' name='capture_count' filepath='sound/core/pcm.c' line='774' column='1'/>
-        <parameter type-id='0f9dfae3' name='rpcm' filepath='sound/core/pcm.c' line='774' column='1'/>
+      <function-decl name='snd_pcm_new' mangled-name='snd_pcm_new' filepath='sound/core/pcm.c' line='774' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_new'>
+        <parameter type-id='52704eb7' name='card' filepath='sound/core/pcm.c' line='774' column='1'/>
+        <parameter type-id='80f4b756' name='id' filepath='sound/core/pcm.c' line='774' column='1'/>
+        <parameter type-id='95e97e5e' name='device' filepath='sound/core/pcm.c' line='774' column='1'/>
+        <parameter type-id='95e97e5e' name='playback_count' filepath='sound/core/pcm.c' line='775' column='1'/>
+        <parameter type-id='95e97e5e' name='capture_count' filepath='sound/core/pcm.c' line='775' column='1'/>
+        <parameter type-id='0f9dfae3' name='rpcm' filepath='sound/core/pcm.c' line='775' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_pcm_open_substream' mangled-name='snd_pcm_open_substream' filepath='sound/core/pcm_native.c' line='2706' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_open_substream'>
@@ -146232,7 +146251,7 @@
       <function-decl name='synchronize_net' mangled-name='synchronize_net' filepath='net/core/dev.c' line='10637' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_net'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='synchronize_rcu' mangled-name='synchronize_rcu' filepath='kernel/rcu/tree.c' line='3701' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu'>
+      <function-decl name='synchronize_rcu' mangled-name='synchronize_rcu' filepath='kernel/rcu/tree.c' line='3710' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='synchronize_rcu_expedited' mangled-name='synchronize_rcu_expedited' filepath='kernel/rcu/tree_exp.h' line='821' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu_expedited'>
@@ -146506,12 +146525,12 @@
         <return type-id='b50a4934'/>
       </function-decl>
       <var-decl name='tcp_hashinfo' type-id='3482ac54' mangled-name='tcp_hashinfo' visibility='default' filepath='net/ipv4/tcp_ipv4.c' line='91' column='1' elf-symbol-id='tcp_hashinfo'/>
-      <function-decl name='tcp_parse_options' mangled-name='tcp_parse_options' filepath='net/ipv4/tcp_input.c' line='4021' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_parse_options'>
-        <parameter type-id='f91cf277' name='net' filepath='net/ipv4/tcp_input.c' line='4021' column='1'/>
-        <parameter type-id='11f4a000' name='skb' filepath='net/ipv4/tcp_input.c' line='4022' column='1'/>
-        <parameter type-id='61b9151d' name='opt_rx' filepath='net/ipv4/tcp_input.c' line='4023' column='1'/>
-        <parameter type-id='95e97e5e' name='estab' filepath='net/ipv4/tcp_input.c' line='4023' column='1'/>
-        <parameter type-id='f3a16a60' name='foc' filepath='net/ipv4/tcp_input.c' line='4024' column='1'/>
+      <function-decl name='tcp_parse_options' mangled-name='tcp_parse_options' filepath='net/ipv4/tcp_input.c' line='4026' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_parse_options'>
+        <parameter type-id='f91cf277' name='net' filepath='net/ipv4/tcp_input.c' line='4026' column='1'/>
+        <parameter type-id='11f4a000' name='skb' filepath='net/ipv4/tcp_input.c' line='4027' column='1'/>
+        <parameter type-id='61b9151d' name='opt_rx' filepath='net/ipv4/tcp_input.c' line='4028' column='1'/>
+        <parameter type-id='95e97e5e' name='estab' filepath='net/ipv4/tcp_input.c' line='4028' column='1'/>
+        <parameter type-id='f3a16a60' name='foc' filepath='net/ipv4/tcp_input.c' line='4029' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='tcp_register_congestion_control' mangled-name='tcp_register_congestion_control' filepath='net/ipv4/tcp_cong.c' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_register_congestion_control'>
@@ -146624,21 +146643,21 @@
         <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_helpers.c' line='188' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='thermal_cooling_device_register' mangled-name='thermal_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cooling_device_register'>
-        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1167' column='1'/>
-        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1167' column='1'/>
-        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1168' column='1'/>
+      <function-decl name='thermal_cooling_device_register' mangled-name='thermal_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1169' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cooling_device_register'>
+        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1169' column='1'/>
+        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1169' column='1'/>
+        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1170' column='1'/>
         <return type-id='2feec21f'/>
       </function-decl>
-      <function-decl name='thermal_cooling_device_unregister' mangled-name='thermal_cooling_device_unregister' filepath='drivers/thermal/thermal_core.c' line='1264' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cooling_device_unregister'>
-        <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_core.c' line='1264' column='1'/>
+      <function-decl name='thermal_cooling_device_unregister' mangled-name='thermal_cooling_device_unregister' filepath='drivers/thermal/thermal_core.c' line='1266' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cooling_device_unregister'>
+        <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_core.c' line='1266' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='thermal_of_cooling_device_register' mangled-name='thermal_of_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1190' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_of_cooling_device_register'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/thermal/thermal_core.c' line='1190' column='1'/>
-        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1191' column='1'/>
-        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1191' column='1'/>
-        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1192' column='1'/>
+      <function-decl name='thermal_of_cooling_device_register' mangled-name='thermal_of_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_of_cooling_device_register'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/thermal/thermal_core.c' line='1192' column='1'/>
+        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1193' column='1'/>
+        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1193' column='1'/>
+        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1194' column='1'/>
         <return type-id='2feec21f'/>
       </function-decl>
       <var-decl name='thermal_pressure' type-id='7359adad' mangled-name='thermal_pressure' visibility='default' filepath='drivers/base/arch_topology.c' line='71' column='1' elf-symbol-id='thermal_pressure'/>
@@ -146663,19 +146682,19 @@
         <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='535' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='thermal_zone_device_register' mangled-name='thermal_zone_device_register' filepath='drivers/thermal/thermal_core.c' line='1378' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_register'>
-        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1378' column='1'/>
-        <parameter type-id='95e97e5e' name='trips' filepath='drivers/thermal/thermal_core.c' line='1378' column='1'/>
-        <parameter type-id='95e97e5e' name='mask' filepath='drivers/thermal/thermal_core.c' line='1378' column='1'/>
-        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1379' column='1'/>
-        <parameter type-id='1e6fe389' name='ops' filepath='drivers/thermal/thermal_core.c' line='1379' column='1'/>
-        <parameter type-id='e2cbf964' name='tzp' filepath='drivers/thermal/thermal_core.c' line='1380' column='1'/>
-        <parameter type-id='95e97e5e' name='passive_delay' filepath='drivers/thermal/thermal_core.c' line='1380' column='1'/>
-        <parameter type-id='95e97e5e' name='polling_delay' filepath='drivers/thermal/thermal_core.c' line='1381' column='1'/>
+      <function-decl name='thermal_zone_device_register' mangled-name='thermal_zone_device_register' filepath='drivers/thermal/thermal_core.c' line='1380' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_register'>
+        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1380' column='1'/>
+        <parameter type-id='95e97e5e' name='trips' filepath='drivers/thermal/thermal_core.c' line='1380' column='1'/>
+        <parameter type-id='95e97e5e' name='mask' filepath='drivers/thermal/thermal_core.c' line='1380' column='1'/>
+        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1381' column='1'/>
+        <parameter type-id='1e6fe389' name='ops' filepath='drivers/thermal/thermal_core.c' line='1381' column='1'/>
+        <parameter type-id='e2cbf964' name='tzp' filepath='drivers/thermal/thermal_core.c' line='1382' column='1'/>
+        <parameter type-id='95e97e5e' name='passive_delay' filepath='drivers/thermal/thermal_core.c' line='1382' column='1'/>
+        <parameter type-id='95e97e5e' name='polling_delay' filepath='drivers/thermal/thermal_core.c' line='1383' column='1'/>
         <return type-id='404b1300'/>
       </function-decl>
-      <function-decl name='thermal_zone_device_unregister' mangled-name='thermal_zone_device_unregister' filepath='drivers/thermal/thermal_core.c' line='1519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_unregister'>
-        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='1519' column='1'/>
+      <function-decl name='thermal_zone_device_unregister' mangled-name='thermal_zone_device_unregister' filepath='drivers/thermal/thermal_core.c' line='1521' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_unregister'>
+        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='1521' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='thermal_zone_device_update' mangled-name='thermal_zone_device_update' filepath='drivers/thermal/thermal_core.c' line='549' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_update'>
@@ -146692,8 +146711,8 @@
         <parameter type-id='7292109c' name='temp' filepath='drivers/thermal/thermal_helpers.c' line='78' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='thermal_zone_get_zone_by_name' mangled-name='thermal_zone_get_zone_by_name' filepath='drivers/thermal/thermal_core.c' line='1587' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_get_zone_by_name'>
-        <parameter type-id='80f4b756' name='name' filepath='drivers/thermal/thermal_core.c' line='1587' column='1'/>
+      <function-decl name='thermal_zone_get_zone_by_name' mangled-name='thermal_zone_get_zone_by_name' filepath='drivers/thermal/thermal_core.c' line='1589' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_get_zone_by_name'>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/thermal/thermal_core.c' line='1589' column='1'/>
         <return type-id='404b1300'/>
       </function-decl>
       <function-decl name='thermal_zone_of_sensor_register' mangled-name='thermal_zone_of_sensor_register' filepath='drivers/thermal/thermal_of.c' line='493' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_of_sensor_register'>
@@ -146708,10 +146727,10 @@
         <parameter type-id='404b1300' name='tzd' filepath='drivers/thermal/thermal_of.c' line='552' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='thermal_zone_unbind_cooling_device' mangled-name='thermal_zone_unbind_cooling_device' filepath='drivers/thermal/thermal_core.c' line='949' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_unbind_cooling_device'>
-        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='949' column='1'/>
-        <parameter type-id='95e97e5e' name='trip' filepath='drivers/thermal/thermal_core.c' line='950' column='1'/>
-        <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_core.c' line='951' column='1'/>
+      <function-decl name='thermal_zone_unbind_cooling_device' mangled-name='thermal_zone_unbind_cooling_device' filepath='drivers/thermal/thermal_core.c' line='951' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_unbind_cooling_device'>
+        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='951' column='1'/>
+        <parameter type-id='95e97e5e' name='trip' filepath='drivers/thermal/thermal_core.c' line='952' column='1'/>
+        <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_core.c' line='953' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='thread_group_cputime_adjusted' mangled-name='thread_group_cputime_adjusted' filepath='kernel/sched/cputime.c' line='639' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thread_group_cputime_adjusted'>
@@ -146795,8 +146814,8 @@
         <parameter type-id='b50a4934' name='multitouch' filepath='drivers/input/touchscreen/of_touchscreen.c' line='197' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='trace_array_get_by_name' mangled-name='trace_array_get_by_name' filepath='kernel/trace/trace.c' line='8930' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_array_get_by_name'>
-        <parameter type-id='80f4b756' name='name' filepath='kernel/trace/trace.c' line='8930' column='1'/>
+      <function-decl name='trace_array_get_by_name' mangled-name='trace_array_get_by_name' filepath='kernel/trace/trace.c' line='8893' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_array_get_by_name'>
+        <parameter type-id='80f4b756' name='name' filepath='kernel/trace/trace.c' line='8893' column='1'/>
         <return type-id='898c1076'/>
       </function-decl>
       <function-decl name='trace_array_put' mangled-name='trace_array_put' filepath='kernel/trace/trace.c' line='468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_array_put'>
@@ -146813,8 +146832,8 @@
       <function-decl name='trace_clock_local' mangled-name='trace_clock_local' filepath='kernel/trace/trace_clock.c' line='32' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_clock_local'>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='trace_event_buffer_commit' mangled-name='trace_event_buffer_commit' filepath='kernel/trace/trace.c' line='2884' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_buffer_commit'>
-        <parameter type-id='9f548f9a' name='fbuffer' filepath='kernel/trace/trace.c' line='2884' column='1'/>
+      <function-decl name='trace_event_buffer_commit' mangled-name='trace_event_buffer_commit' filepath='kernel/trace/trace.c' line='2841' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_buffer_commit'>
+        <parameter type-id='9f548f9a' name='fbuffer' filepath='kernel/trace/trace.c' line='2841' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='trace_event_buffer_reserve' mangled-name='trace_event_buffer_reserve' filepath='kernel/trace/trace_events.c' line='252' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_buffer_reserve'>
@@ -146837,14 +146856,14 @@
         <parameter type-id='eaa32e2f' name='data' filepath='kernel/trace/trace_events.c' line='288' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='trace_get_event_file' mangled-name='trace_get_event_file' filepath='kernel/trace/trace_events.c' line='2762' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_get_event_file'>
-        <parameter type-id='80f4b756' name='instance' filepath='kernel/trace/trace_events.c' line='2762' column='1'/>
-        <parameter type-id='80f4b756' name='system' filepath='kernel/trace/trace_events.c' line='2763' column='1'/>
-        <parameter type-id='80f4b756' name='event' filepath='kernel/trace/trace_events.c' line='2764' column='1'/>
+      <function-decl name='trace_get_event_file' mangled-name='trace_get_event_file' filepath='kernel/trace/trace_events.c' line='2763' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_get_event_file'>
+        <parameter type-id='80f4b756' name='instance' filepath='kernel/trace/trace_events.c' line='2763' column='1'/>
+        <parameter type-id='80f4b756' name='system' filepath='kernel/trace/trace_events.c' line='2764' column='1'/>
+        <parameter type-id='80f4b756' name='event' filepath='kernel/trace/trace_events.c' line='2765' column='1'/>
         <return type-id='3d4ca6d2'/>
       </function-decl>
-      <function-decl name='trace_handle_return' mangled-name='trace_handle_return' filepath='kernel/trace/trace.c' line='2620' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_handle_return'>
-        <parameter type-id='fc932690' name='s' filepath='kernel/trace/trace.c' line='2620' column='1'/>
+      <function-decl name='trace_handle_return' mangled-name='trace_handle_return' filepath='kernel/trace/trace.c' line='2578' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_handle_return'>
+        <parameter type-id='fc932690' name='s' filepath='kernel/trace/trace.c' line='2578' column='1'/>
         <return type-id='b1a0a119'/>
       </function-decl>
       <function-decl name='trace_output_call' mangled-name='trace_output_call' filepath='kernel/trace/trace_output.c' line='326' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_output_call'>
@@ -147435,12 +147454,12 @@
         <parameter type-id='95e97e5e' name='count' filepath='drivers/usb/typec/bus.c' line='184' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='typec_get_drvdata' mangled-name='typec_get_drvdata' filepath='drivers/usb/typec/class.c' line='1950' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_get_drvdata'>
-        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1950' column='1'/>
+      <function-decl name='typec_get_drvdata' mangled-name='typec_get_drvdata' filepath='drivers/usb/typec/class.c' line='1951' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_get_drvdata'>
+        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1951' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='typec_get_negotiated_svdm_version' mangled-name='typec_get_negotiated_svdm_version' filepath='drivers/usb/typec/class.c' line='1930' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_get_negotiated_svdm_version'>
-        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1930' column='1'/>
+      <function-decl name='typec_get_negotiated_svdm_version' mangled-name='typec_get_negotiated_svdm_version' filepath='drivers/usb/typec/class.c' line='1931' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_get_negotiated_svdm_version'>
+        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1931' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='typec_mux_get_drvdata' mangled-name='typec_mux_get_drvdata' filepath='drivers/usb/typec/mux.c' line='373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_mux_get_drvdata'>
@@ -147461,53 +147480,53 @@
         <parameter type-id='374b228b' name='mux' filepath='drivers/usb/typec/mux.c' line='360' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='typec_partner_register_altmode' mangled-name='typec_partner_register_altmode' filepath='drivers/usb/typec/class.c' line='827' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_partner_register_altmode'>
-        <parameter type-id='33ca4bbb' name='partner' filepath='drivers/usb/typec/class.c' line='827' column='1'/>
-        <parameter type-id='064c3738' name='desc' filepath='drivers/usb/typec/class.c' line='828' column='1'/>
+      <function-decl name='typec_partner_register_altmode' mangled-name='typec_partner_register_altmode' filepath='drivers/usb/typec/class.c' line='828' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_partner_register_altmode'>
+        <parameter type-id='33ca4bbb' name='partner' filepath='drivers/usb/typec/class.c' line='828' column='1'/>
+        <parameter type-id='064c3738' name='desc' filepath='drivers/usb/typec/class.c' line='829' column='1'/>
         <return type-id='02913b69'/>
       </function-decl>
-      <function-decl name='typec_partner_set_identity' mangled-name='typec_partner_set_identity' filepath='drivers/usb/typec/class.c' line='749' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_partner_set_identity'>
-        <parameter type-id='33ca4bbb' name='partner' filepath='drivers/usb/typec/class.c' line='749' column='1'/>
+      <function-decl name='typec_partner_set_identity' mangled-name='typec_partner_set_identity' filepath='drivers/usb/typec/class.c' line='750' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_partner_set_identity'>
+        <parameter type-id='33ca4bbb' name='partner' filepath='drivers/usb/typec/class.c' line='750' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='typec_port_register_altmode' mangled-name='typec_port_register_altmode' filepath='drivers/usb/typec/class.c' line='1967' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_port_register_altmode'>
-        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1967' column='1'/>
-        <parameter type-id='064c3738' name='desc' filepath='drivers/usb/typec/class.c' line='1968' column='1'/>
+      <function-decl name='typec_port_register_altmode' mangled-name='typec_port_register_altmode' filepath='drivers/usb/typec/class.c' line='1968' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_port_register_altmode'>
+        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1968' column='1'/>
+        <parameter type-id='064c3738' name='desc' filepath='drivers/usb/typec/class.c' line='1969' column='1'/>
         <return type-id='02913b69'/>
       </function-decl>
-      <function-decl name='typec_register_partner' mangled-name='typec_register_partner' filepath='drivers/usb/typec/class.c' line='857' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_register_partner'>
-        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='857' column='1'/>
-        <parameter type-id='a5263fbd' name='desc' filepath='drivers/usb/typec/class.c' line='858' column='1'/>
+      <function-decl name='typec_register_partner' mangled-name='typec_register_partner' filepath='drivers/usb/typec/class.c' line='858' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_register_partner'>
+        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='858' column='1'/>
+        <parameter type-id='a5263fbd' name='desc' filepath='drivers/usb/typec/class.c' line='859' column='1'/>
         <return type-id='33ca4bbb'/>
       </function-decl>
-      <function-decl name='typec_register_port' mangled-name='typec_register_port' filepath='drivers/usb/typec/class.c' line='2050' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_register_port'>
-        <parameter type-id='fa0b179b' name='parent' filepath='drivers/usb/typec/class.c' line='2050' column='1'/>
-        <parameter type-id='287e28ea' name='cap' filepath='drivers/usb/typec/class.c' line='2051' column='1'/>
+      <function-decl name='typec_register_port' mangled-name='typec_register_port' filepath='drivers/usb/typec/class.c' line='2051' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_register_port'>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/usb/typec/class.c' line='2051' column='1'/>
+        <parameter type-id='287e28ea' name='cap' filepath='drivers/usb/typec/class.c' line='2052' column='1'/>
         <return type-id='b977ca56'/>
       </function-decl>
-      <function-decl name='typec_set_data_role' mangled-name='typec_set_data_role' filepath='drivers/usb/typec/class.c' line='1690' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_set_data_role'>
-        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1690' column='1'/>
-        <parameter type-id='e453a0cb' name='role' filepath='drivers/usb/typec/class.c' line='1690' column='1'/>
+      <function-decl name='typec_set_data_role' mangled-name='typec_set_data_role' filepath='drivers/usb/typec/class.c' line='1691' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_set_data_role'>
+        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1691' column='1'/>
+        <parameter type-id='e453a0cb' name='role' filepath='drivers/usb/typec/class.c' line='1691' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='typec_set_orientation' mangled-name='typec_set_orientation' filepath='drivers/usb/typec/class.c' line='1870' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_set_orientation'>
-        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1870' column='1'/>
-        <parameter type-id='131b0a9c' name='orientation' filepath='drivers/usb/typec/class.c' line='1871' column='1'/>
+      <function-decl name='typec_set_orientation' mangled-name='typec_set_orientation' filepath='drivers/usb/typec/class.c' line='1871' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_set_orientation'>
+        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1871' column='1'/>
+        <parameter type-id='131b0a9c' name='orientation' filepath='drivers/usb/typec/class.c' line='1872' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='typec_set_pwr_opmode' mangled-name='typec_set_pwr_opmode' filepath='drivers/usb/typec/class.c' line='1759' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_set_pwr_opmode'>
-        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1759' column='1'/>
-        <parameter type-id='44ea1984' name='opmode' filepath='drivers/usb/typec/class.c' line='1760' column='1'/>
+      <function-decl name='typec_set_pwr_opmode' mangled-name='typec_set_pwr_opmode' filepath='drivers/usb/typec/class.c' line='1760' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_set_pwr_opmode'>
+        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1760' column='1'/>
+        <parameter type-id='44ea1984' name='opmode' filepath='drivers/usb/typec/class.c' line='1761' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='typec_set_pwr_role' mangled-name='typec_set_pwr_role' filepath='drivers/usb/typec/class.c' line='1719' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_set_pwr_role'>
-        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1719' column='1'/>
-        <parameter type-id='ad61830a' name='role' filepath='drivers/usb/typec/class.c' line='1719' column='1'/>
+      <function-decl name='typec_set_pwr_role' mangled-name='typec_set_pwr_role' filepath='drivers/usb/typec/class.c' line='1720' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_set_pwr_role'>
+        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1720' column='1'/>
+        <parameter type-id='ad61830a' name='role' filepath='drivers/usb/typec/class.c' line='1720' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='typec_set_vconn_role' mangled-name='typec_set_vconn_role' filepath='drivers/usb/typec/class.c' line='1738' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_set_vconn_role'>
-        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1738' column='1'/>
-        <parameter type-id='ad61830a' name='role' filepath='drivers/usb/typec/class.c' line='1738' column='1'/>
+      <function-decl name='typec_set_vconn_role' mangled-name='typec_set_vconn_role' filepath='drivers/usb/typec/class.c' line='1739' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_set_vconn_role'>
+        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='1739' column='1'/>
+        <parameter type-id='ad61830a' name='role' filepath='drivers/usb/typec/class.c' line='1739' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='typec_switch_get_drvdata' mangled-name='typec_switch_get_drvdata' filepath='drivers/usb/typec/mux.c' line='176' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_switch_get_drvdata'>
@@ -147523,16 +147542,16 @@
         <parameter type-id='5d33005f' name='sw' filepath='drivers/usb/typec/mux.c' line='163' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='typec_unregister_altmode' mangled-name='typec_unregister_altmode' filepath='drivers/usb/typec/class.c' line='640' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_unregister_altmode'>
-        <parameter type-id='02913b69' name='adev' filepath='drivers/usb/typec/class.c' line='640' column='1'/>
+      <function-decl name='typec_unregister_altmode' mangled-name='typec_unregister_altmode' filepath='drivers/usb/typec/class.c' line='641' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_unregister_altmode'>
+        <parameter type-id='02913b69' name='adev' filepath='drivers/usb/typec/class.c' line='641' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='typec_unregister_partner' mangled-name='typec_unregister_partner' filepath='drivers/usb/typec/class.c' line='905' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_unregister_partner'>
-        <parameter type-id='33ca4bbb' name='partner' filepath='drivers/usb/typec/class.c' line='905' column='1'/>
+      <function-decl name='typec_unregister_partner' mangled-name='typec_unregister_partner' filepath='drivers/usb/typec/class.c' line='906' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_unregister_partner'>
+        <parameter type-id='33ca4bbb' name='partner' filepath='drivers/usb/typec/class.c' line='906' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='typec_unregister_port' mangled-name='typec_unregister_port' filepath='drivers/usb/typec/class.c' line='2152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_unregister_port'>
-        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='2152' column='1'/>
+      <function-decl name='typec_unregister_port' mangled-name='typec_unregister_port' filepath='drivers/usb/typec/class.c' line='2153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_unregister_port'>
+        <parameter type-id='b977ca56' name='port' filepath='drivers/usb/typec/class.c' line='2153' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='uart_add_one_port' mangled-name='uart_add_one_port' filepath='drivers/tty/serial/serial_core.c' line='2915' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='uart_add_one_port'>
@@ -147954,8 +147973,8 @@
         <parameter type-id='80f4b756' name='name' filepath='block/genhd.c' line='504' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='unregister_candev' mangled-name='unregister_candev' filepath='drivers/net/can/dev/dev.c' line='1301' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_candev'>
-        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='1301' column='1'/>
+      <function-decl name='unregister_candev' mangled-name='unregister_candev' filepath='drivers/net/can/dev/dev.c' line='1303' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_candev'>
+        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='1303' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='unregister_chrdev_region' mangled-name='unregister_chrdev_region' filepath='fs/char_dev.c' line='311' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_chrdev_region'>
@@ -148048,12 +148067,12 @@
         <parameter type-id='d6369c88' name='qops' filepath='net/sched/sch_api.c' line='174' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='unregister_reboot_notifier' mangled-name='unregister_reboot_notifier' filepath='kernel/reboot.c' line='106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_reboot_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='106' column='1'/>
+      <function-decl name='unregister_reboot_notifier' mangled-name='unregister_reboot_notifier' filepath='kernel/reboot.c' line='107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_reboot_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='107' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='unregister_restart_handler' mangled-name='unregister_restart_handler' filepath='kernel/reboot.c' line='198' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_restart_handler'>
-        <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='198' column='1'/>
+      <function-decl name='unregister_restart_handler' mangled-name='unregister_restart_handler' filepath='kernel/reboot.c' line='199' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_restart_handler'>
+        <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='199' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='unregister_rpmsg_driver' mangled-name='unregister_rpmsg_driver' filepath='drivers/rpmsg/rpmsg_core.c' line='659' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_rpmsg_driver'>
@@ -148338,8 +148357,8 @@
         <parameter type-id='85196e3f' name='xhci_pdev' filepath='drivers/usb/host/pci-quirks.c' line='1039' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_enable_lpm' mangled-name='usb_enable_lpm' filepath='drivers/usb/core/hub.c' line='4303' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_enable_lpm'>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='4303' column='1'/>
+      <function-decl name='usb_enable_lpm' mangled-name='usb_enable_lpm' filepath='drivers/usb/core/hub.c' line='4323' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_enable_lpm'>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='4323' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_ep_alloc_request' mangled-name='usb_ep_alloc_request' filepath='drivers/usb/gadget/udc/core.c' line='175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_alloc_request'>
@@ -148635,13 +148654,13 @@
       </function-decl>
       <var-decl name='usb_hcds_loaded' type-id='7359adad' mangled-name='usb_hcds_loaded' visibility='default' filepath='drivers/usb/core/hcd.c' line='81' column='1' elf-symbol-id='usb_hcds_loaded'/>
       <var-decl name='usb_hid_driver' type-id='0e5e2ca6' mangled-name='usb_hid_driver' visibility='default' filepath='drivers/hid/usbhid/hid-core.c' line='1316' column='1' elf-symbol-id='usb_hid_driver'/>
-      <function-decl name='usb_hub_clear_tt_buffer' mangled-name='usb_hub_clear_tt_buffer' filepath='drivers/usb/core/hub.c' line='867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hub_clear_tt_buffer'>
-        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hub.c' line='867' column='1'/>
+      <function-decl name='usb_hub_clear_tt_buffer' mangled-name='usb_hub_clear_tt_buffer' filepath='drivers/usb/core/hub.c' line='875' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hub_clear_tt_buffer'>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hub.c' line='875' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_hub_find_child' mangled-name='usb_hub_find_child' filepath='drivers/usb/core/hub.c' line='6187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hub_find_child'>
-        <parameter type-id='25e60cb2' name='hdev' filepath='drivers/usb/core/hub.c' line='6187' column='1'/>
-        <parameter type-id='95e97e5e' name='port1' filepath='drivers/usb/core/hub.c' line='6188' column='1'/>
+      <function-decl name='usb_hub_find_child' mangled-name='usb_hub_find_child' filepath='drivers/usb/core/hub.c' line='6207' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hub_find_child'>
+        <parameter type-id='25e60cb2' name='hdev' filepath='drivers/usb/core/hub.c' line='6207' column='1'/>
+        <parameter type-id='95e97e5e' name='port1' filepath='drivers/usb/core/hub.c' line='6208' column='1'/>
         <return type-id='25e60cb2'/>
       </function-decl>
       <function-decl name='usb_ifnum_to_if' mangled-name='usb_ifnum_to_if' filepath='drivers/usb/core/usb.c' line='348' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ifnum_to_if'>
@@ -148748,8 +148767,8 @@
         <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/usb.c' line='820' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_queue_reset_device' mangled-name='usb_queue_reset_device' filepath='drivers/usb/core/hub.c' line='6167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_queue_reset_device'>
-        <parameter type-id='8bf48c31' name='iface' filepath='drivers/usb/core/hub.c' line='6167' column='1'/>
+      <function-decl name='usb_queue_reset_device' mangled-name='usb_queue_reset_device' filepath='drivers/usb/core/hub.c' line='6187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_queue_reset_device'>
+        <parameter type-id='8bf48c31' name='iface' filepath='drivers/usb/core/hub.c' line='6187' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_register_dev' mangled-name='usb_register_dev' filepath='drivers/usb/core/file.c' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_register_dev'>
@@ -148780,8 +148799,8 @@
         <parameter type-id='ca9354d1' name='x' filepath='drivers/usb/phy/phy.c' line='703' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_reset_device' mangled-name='usb_reset_device' filepath='drivers/usb/core/hub.c' line='6049' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_reset_device'>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='6049' column='1'/>
+      <function-decl name='usb_reset_device' mangled-name='usb_reset_device' filepath='drivers/usb/core/hub.c' line='6069' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_reset_device'>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='6069' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_role_switch_find_by_fwnode' mangled-name='usb_role_switch_find_by_fwnode' filepath='drivers/usb/roles/class.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_find_by_fwnode'>
@@ -148818,17 +148837,17 @@
         <parameter type-id='3e3cd44f' name='sw' filepath='drivers/usb/roles/class.c' line='357' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_root_hub_lost_power' mangled-name='usb_root_hub_lost_power' filepath='drivers/usb/core/hub.c' line='3855' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_root_hub_lost_power'>
-        <parameter type-id='25e60cb2' name='rhdev' filepath='drivers/usb/core/hub.c' line='3855' column='1'/>
+      <function-decl name='usb_root_hub_lost_power' mangled-name='usb_root_hub_lost_power' filepath='drivers/usb/core/hub.c' line='3868' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_root_hub_lost_power'>
+        <parameter type-id='25e60cb2' name='rhdev' filepath='drivers/usb/core/hub.c' line='3868' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_scuttle_anchored_urbs' mangled-name='usb_scuttle_anchored_urbs' filepath='drivers/usb/core/urb.c' line='1009' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_scuttle_anchored_urbs'>
         <parameter type-id='bd300bf3' name='anchor' filepath='drivers/usb/core/urb.c' line='1009' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_set_device_state' mangled-name='usb_set_device_state' filepath='drivers/usb/core/hub.c' line='2048' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_set_device_state'>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='2048' column='1'/>
-        <parameter type-id='901a91cb' name='new_state' filepath='drivers/usb/core/hub.c' line='2049' column='1'/>
+      <function-decl name='usb_set_device_state' mangled-name='usb_set_device_state' filepath='drivers/usb/core/hub.c' line='2056' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_set_device_state'>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='2056' column='1'/>
+        <parameter type-id='901a91cb' name='new_state' filepath='drivers/usb/core/hub.c' line='2057' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_set_interface' mangled-name='usb_set_interface' filepath='drivers/usb/core/message.c' line='1518' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_set_interface'>
@@ -148889,13 +148908,13 @@
         <parameter type-id='f0981eeb' name='timeout' filepath='drivers/usb/core/urb.c' line='964' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_wakeup_enabled_descendants' mangled-name='usb_wakeup_enabled_descendants' filepath='drivers/usb/core/hub.c' line='3237' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_wakeup_enabled_descendants'>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='3237' column='1'/>
+      <function-decl name='usb_wakeup_enabled_descendants' mangled-name='usb_wakeup_enabled_descendants' filepath='drivers/usb/core/hub.c' line='3250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_wakeup_enabled_descendants'>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='3250' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='usb_wakeup_notification' mangled-name='usb_wakeup_notification' filepath='drivers/usb/core/hub.c' line='698' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_wakeup_notification'>
-        <parameter type-id='25e60cb2' name='hdev' filepath='drivers/usb/core/hub.c' line='698' column='1'/>
-        <parameter type-id='f0981eeb' name='portnum' filepath='drivers/usb/core/hub.c' line='699' column='1'/>
+      <function-decl name='usb_wakeup_notification' mangled-name='usb_wakeup_notification' filepath='drivers/usb/core/hub.c' line='706' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_wakeup_notification'>
+        <parameter type-id='25e60cb2' name='hdev' filepath='drivers/usb/core/hub.c' line='706' column='1'/>
+        <parameter type-id='f0981eeb' name='portnum' filepath='drivers/usb/core/hub.c' line='707' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usbnet_cdc_unbind' mangled-name='usbnet_cdc_unbind' filepath='drivers/net/usb/cdc_ether.c' line='345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_cdc_unbind'>
@@ -150705,20 +150724,20 @@
         <parameter type-id='eaa32e2f' name='key' filepath='kernel/sched/wait.c' line='466' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='work_busy' mangled-name='work_busy' filepath='kernel/workqueue.c' line='4601' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='work_busy'>
-        <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='4601' column='1'/>
+      <function-decl name='work_busy' mangled-name='work_busy' filepath='kernel/workqueue.c' line='4610' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='work_busy'>
+        <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='4610' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='work_on_cpu' mangled-name='work_on_cpu' filepath='kernel/workqueue.c' line='5158' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='work_on_cpu'>
-        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/workqueue.c' line='5158' column='1'/>
-        <parameter type-id='68883d61' name='fn' filepath='kernel/workqueue.c' line='5158' column='1'/>
-        <parameter type-id='eaa32e2f' name='arg' filepath='kernel/workqueue.c' line='5158' column='1'/>
+      <function-decl name='work_on_cpu' mangled-name='work_on_cpu' filepath='kernel/workqueue.c' line='5167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='work_on_cpu'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/workqueue.c' line='5167' column='1'/>
+        <parameter type-id='68883d61' name='fn' filepath='kernel/workqueue.c' line='5167' column='1'/>
+        <parameter type-id='eaa32e2f' name='arg' filepath='kernel/workqueue.c' line='5167' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='wq_worker_comm' mangled-name='wq_worker_comm' filepath='kernel/workqueue.c' line='4872' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wq_worker_comm'>
-        <parameter type-id='26a90f95' name='buf' filepath='kernel/workqueue.c' line='4872' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='kernel/workqueue.c' line='4872' column='1'/>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/workqueue.c' line='4872' column='1'/>
+      <function-decl name='wq_worker_comm' mangled-name='wq_worker_comm' filepath='kernel/workqueue.c' line='4881' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wq_worker_comm'>
+        <parameter type-id='26a90f95' name='buf' filepath='kernel/workqueue.c' line='4881' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='kernel/workqueue.c' line='4881' column='1'/>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/workqueue.c' line='4881' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='write_inode_now' mangled-name='write_inode_now' filepath='fs/fs-writeback.c' line='2565' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='write_inode_now'>
@@ -150789,13 +150808,13 @@
         <parameter type-id='38ed603d' name='xdp' filepath='net/core/xdp.c' line='417' column='1'/>
         <return type-id='cb1c5129'/>
       </function-decl>
-      <function-decl name='xdp_do_flush' mangled-name='xdp_do_flush' filepath='net/core/filter.c' line='3934' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_do_flush'>
+      <function-decl name='xdp_do_flush' mangled-name='xdp_do_flush' filepath='net/core/filter.c' line='3953' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_do_flush'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='xdp_do_redirect' mangled-name='xdp_do_redirect' filepath='net/core/filter.c' line='3975' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_do_redirect'>
-        <parameter type-id='68a2d05b' name='dev' filepath='net/core/filter.c' line='3975' column='1'/>
-        <parameter type-id='38ed603d' name='xdp' filepath='net/core/filter.c' line='3975' column='1'/>
-        <parameter type-id='bdcee7ae' name='xdp_prog' filepath='net/core/filter.c' line='3976' column='1'/>
+      <function-decl name='xdp_do_redirect' mangled-name='xdp_do_redirect' filepath='net/core/filter.c' line='3994' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_do_redirect'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/filter.c' line='3994' column='1'/>
+        <parameter type-id='38ed603d' name='xdp' filepath='net/core/filter.c' line='3994' column='1'/>
+        <parameter type-id='bdcee7ae' name='xdp_prog' filepath='net/core/filter.c' line='3995' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='xdp_return_frame' mangled-name='xdp_return_frame' filepath='net/core/xdp.c' line='375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_return_frame'>
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 5a049f604a24..575f50673c64 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -33,7 +33,6 @@ struct ipv6_devconf {
 	__s32		max_addresses;
 	__s32		accept_ra_defrtr;
 	__s32		accept_ra_min_hop_limit;
-	__s32		accept_ra_min_lft;
 	__s32		accept_ra_pinfo;
 	__s32		ignore_routes_with_linkdown;
 #ifdef CONFIG_IPV6_ROUTER_PREF
@@ -81,7 +80,8 @@ struct ipv6_devconf {
 
 	struct ctl_table_header *sysctl_header;
 
-	ANDROID_KABI_RESERVE(1);
+	ANDROID_KABI_USE(1, struct { __s32 accept_ra_min_lft; u32 padding; });
+
 	ANDROID_KABI_RESERVE(2);
 	ANDROID_KABI_RESERVE(3);
 	ANDROID_KABI_RESERVE(4);

From 44817294cfe4afa710fc37d3fe6953877a4232e0 Mon Sep 17 00:00:00 2001
From: Kalesh Singh <kaleshsingh@google.com>
Date: Thu, 25 Jan 2024 16:10:27 -0800
Subject: [PATCH 1018/1043] ANDROID: mm: Fix VMA ref count after fast-mremap

Since the cmpxchg() to unlock the VMA (reset ref count from -1), is
enclosed in VM_BUG_ON_VMA() it gets compiled out in non-debug builds
(CONFIG_DEBUG_VM=n). This means that any VMA that underwent a fast-remap
will have it's refcount stuck at -1, making it not be eligible for
future speculative faults, and preventing freeing of the VMA.

Bug: 322411509
Change-Id: If5bf61c7d94268700f2c4f096d946201b68abdb8
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
---
 mm/mremap.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/mm/mremap.c b/mm/mremap.c
index b1263e9a16af..57b73944bfbc 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -217,7 +217,7 @@ static inline bool trylock_vma_ref_count(struct vm_area_struct *vma)
 	 * If we have the only reference, swap the refcount to -1. This
 	 * will prevent other concurrent references by get_vma() for SPFs.
 	 */
-	return atomic_cmpxchg(&vma->vm_ref_count, 1, -1) == 1;
+	return atomic_cmpxchg_acquire(&vma->vm_ref_count, 1, -1) == 1;
 }
 
 /*
@@ -225,12 +225,13 @@ static inline bool trylock_vma_ref_count(struct vm_area_struct *vma)
  */
 static inline void unlock_vma_ref_count(struct vm_area_struct *vma)
 {
+	int old = atomic_xchg_release(&vma->vm_ref_count, 1);
+
 	/*
 	 * This should only be called after a corresponding,
 	 * successful trylock_vma_ref_count().
 	 */
-	VM_BUG_ON_VMA(atomic_cmpxchg(&vma->vm_ref_count, -1, 1) != -1,
-		      vma);
+	VM_BUG_ON_VMA(old != -1, vma);
 }
 #else	/* !CONFIG_SPECULATIVE_PAGE_FAULT */
 static inline bool trylock_vma_ref_count(struct vm_area_struct *vma)

From 6efebf1322d6e6bedae2eb867caecdcf4474bc27 Mon Sep 17 00:00:00 2001
From: Kalesh Singh <kaleshsingh@google.com>
Date: Thu, 25 Jan 2024 16:10:27 -0800
Subject: [PATCH 1019/1043] ANDROID: mm: Fix VMA ref count after fast-mremap

Since the cmpxchg() to unlock the VMA (reset ref count from -1), is
enclosed in VM_BUG_ON_VMA() it gets compiled out in non-debug builds
(CONFIG_DEBUG_VM=n). This means that any VMA that underwent a fast-remap
will have it's refcount stuck at -1, making it not be eligible for
future speculative faults, and preventing freeing of the VMA.

Bug: 322411509
Bug: 325969149
Change-Id: If5bf61c7d94268700f2c4f096d946201b68abdb8
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
(cherry picked from commit 44817294cfe4afa710fc37d3fe6953877a4232e0)
---
 mm/mremap.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/mm/mremap.c b/mm/mremap.c
index b1263e9a16af..57b73944bfbc 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -217,7 +217,7 @@ static inline bool trylock_vma_ref_count(struct vm_area_struct *vma)
 	 * If we have the only reference, swap the refcount to -1. This
 	 * will prevent other concurrent references by get_vma() for SPFs.
 	 */
-	return atomic_cmpxchg(&vma->vm_ref_count, 1, -1) == 1;
+	return atomic_cmpxchg_acquire(&vma->vm_ref_count, 1, -1) == 1;
 }
 
 /*
@@ -225,12 +225,13 @@ static inline bool trylock_vma_ref_count(struct vm_area_struct *vma)
  */
 static inline void unlock_vma_ref_count(struct vm_area_struct *vma)
 {
+	int old = atomic_xchg_release(&vma->vm_ref_count, 1);
+
 	/*
 	 * This should only be called after a corresponding,
 	 * successful trylock_vma_ref_count().
 	 */
-	VM_BUG_ON_VMA(atomic_cmpxchg(&vma->vm_ref_count, -1, 1) != -1,
-		      vma);
+	VM_BUG_ON_VMA(old != -1, vma);
 }
 #else	/* !CONFIG_SPECULATIVE_PAGE_FAULT */
 static inline bool trylock_vma_ref_count(struct vm_area_struct *vma)

From 2a717853b3cae90d4f4d5cad6f5ed3fe0cfc5ab3 Mon Sep 17 00:00:00 2001
From: Michael Grzeschik <m.grzeschik@pengutronix.de>
Date: Mon, 28 Jun 2021 17:53:09 +0200
Subject: [PATCH 1020/1043] UPSTREAM: usb: gadget: uvc: set v4l2_dev->dev in
 f_uvc

The v4l2_dev has no corresponding device to it. We will
point it to the gadget's dev.

Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Link: https://lore.kernel.org/r/20210628155311.16762-4-m.grzeschik@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit b9b82d3d0dbc45ee6b4817c7a7275a65152301f5)
Bug: 242344221
Bug: 325993121
Change-Id: Ic4af4e164a2bb01578b10dd3c478a142c244c9ad
Signed-off-by: Avichal Rakesh <arakesh@google.com>
Signed-off-by: Luca Stefani <luca@osomprivacy.com>
---
 drivers/usb/gadget/function/f_uvc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
index ba13d8997db8..ce973fae4091 100644
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -419,6 +419,7 @@ uvc_register_video(struct uvc_device *uvc)
 
 	/* TODO reference counting. */
 	uvc->vdev.v4l2_dev = &uvc->v4l2_dev;
+	uvc->vdev.v4l2_dev->dev = &cdev->gadget->dev;
 	uvc->vdev.fops = &uvc_v4l2_fops;
 	uvc->vdev.ioctl_ops = &uvc_v4l2_ioctl_ops;
 	uvc->vdev.release = video_device_release_empty;

From 92d263f290f0f70592e6f0f2e32f01165534b736 Mon Sep 17 00:00:00 2001
From: Wei Liu <liuwei.a@oppo.com>
Date: Fri, 23 Feb 2024 12:03:45 +0800
Subject: [PATCH 1021/1043] ANDROID: GKI: Update oplus symbol list

2 function symbol(s) added
  'int xt_register_match(struct xt_match*)'
  'void xt_unregister_match(struct xt_match*)'

Bug: 323695727

Change-Id: I2a9e68cbfc672bb0f8610cdabf7df99e75efeb43
Signed-off-by: Wei Liu <liuwei.a@oppo.com>
---
 android/abi_gki_aarch64.xml   | 301 ++++++++++++++++++++++++++++++++--
 android/abi_gki_aarch64_oplus |   2 +
 2 files changed, 291 insertions(+), 12 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index d67a4b4231c3..66e2d678b945 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -6393,6 +6393,8 @@
       <elf-symbol name='xhci_trb_virt_to_dma' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x83e71096'/>
       <elf-symbol name='xhci_update_erst_dequeue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x31c3e5d5'/>
       <elf-symbol name='xhci_vendor_get_ops' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5e9f7a97'/>
+      <elf-symbol name='xt_register_match' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7a6cae54'/>
+      <elf-symbol name='xt_unregister_match' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x283d2612'/>
       <elf-symbol name='zlib_deflate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf2c43f3f'/>
       <elf-symbol name='zlib_deflateEnd' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc890c008'/>
       <elf-symbol name='zlib_deflateInit2' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5a0b73d0'/>
@@ -13560,6 +13562,11 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='cc3a4f0c' size-in-bits='64' id='11c98e9a'/>
+      <function-type size-in-bits='64' id='11ce232b'>
+        <parameter type-id='11f4a000'/>
+        <parameter type-id='64ed5260'/>
+        <return type-id='b50a4934'/>
+      </function-type>
       <pointer-type-def type-id='c505fce2' size-in-bits='64' id='11d0d204'/>
       <enum-decl name='utf16_endian' filepath='include/linux/nls.h' line='41' column='1' id='11d12470'>
         <underlying-type type-id='9cac1fee'/>
@@ -15191,6 +15198,10 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='bc51cf2c' size-in-bits='64' id='156433b6'/>
+      <function-type size-in-bits='64' id='156670bc'>
+        <parameter type-id='f621031c'/>
+        <return type-id='95e97e5e'/>
+      </function-type>
       <pointer-type-def type-id='61a50456' size-in-bits='64' id='156888c8'/>
       <class-decl name='__anonymous_struct__' size-in-bits='64' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/sched.h' line='1380' column='1' id='156952c4'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -16873,6 +16884,7 @@
       <pointer-type-def type-id='aa1606dd' size-in-bits='64' id='198dd6d9'/>
       <qualified-type-def type-id='bec3f688' const='yes' id='199208f7'/>
       <pointer-type-def type-id='9e6bb89c' size-in-bits='64' id='1993c682'/>
+      <qualified-type-def type-id='fa0eab7f' const='yes' id='19952db6'/>
       <pointer-type-def type-id='e1f906a3' size-in-bits='64' id='19a26ee3'/>
       <function-type size-in-bits='64' id='19b22092'>
         <parameter type-id='b9608bfc'/>
@@ -17832,9 +17844,11 @@
           <var-decl name='list_op_pending' type-id='782d78af' visibility='default' filepath='include/linux/compat.h' line='365' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='70660701' size-in-bits='64' id='1b9d48b1'/>
       <pointer-type-def type-id='9d0ae2a2' size-in-bits='64' id='1bd40de0'/>
       <pointer-type-def type-id='7b29d65d' size-in-bits='64' id='1bdcd289'/>
       <pointer-type-def type-id='b73dd29b' size-in-bits='64' id='1be0f6ab'/>
+      <qualified-type-def type-id='9399d16b' const='yes' id='1beae906'/>
       <pointer-type-def type-id='5919d6b5' size-in-bits='64' id='1bf68965'/>
       <pointer-type-def type-id='242d8ed5' size-in-bits='64' id='1bff60d1'/>
       <class-decl name='ethhdr' size-in-bits='112' is-struct='yes' visibility='default' filepath='include/uapi/linux/if_ether.h' line='164' column='1' id='1c00b436'>
@@ -18742,6 +18756,7 @@
       </class-decl>
       <qualified-type-def type-id='76a6d6f8' const='yes' id='1ec04219'/>
       <qualified-type-def type-id='d334c4a2' const='yes' id='1ec1e54d'/>
+      <pointer-type-def type-id='1beae906' size-in-bits='64' id='1ecd1044'/>
       <pointer-type-def type-id='2922fb19' size-in-bits='64' id='1ed1e4cd'/>
       <pointer-type-def type-id='76959226' size-in-bits='64' id='1ed3660c'/>
       <class-decl name='iphdr' size-in-bits='160' is-struct='yes' visibility='default' filepath='include/uapi/linux/ip.h' line='87' column='1' id='1edbefa6'>
@@ -22030,6 +22045,10 @@
           <var-decl name='min_display_mastering_luminance' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/v4l2-controls.h' line='1230' column='1'/>
         </data-member>
       </class-decl>
+      <function-type size-in-bits='64' id='26b6dfe0'>
+        <parameter type-id='5dcd69c3'/>
+        <return type-id='48b5725f'/>
+      </function-type>
       <class-decl name='break_hook' size-in-bits='256' is-struct='yes' visibility='default' filepath='arch/arm64/include/asm/debug-monitors.h' line='88' column='1' id='26b98d12'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='node' type-id='72f469ec' visibility='default' filepath='arch/arm64/include/asm/debug-monitors.h' line='89' column='1'/>
@@ -23492,6 +23511,10 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <qualified-type-def type-id='1179f27e' const='yes' id='29c8dc19'/>
+      <function-type size-in-bits='64' id='29ca5ed4'>
+        <parameter type-id='8324c9fb'/>
+        <return type-id='48b5725f'/>
+      </function-type>
       <array-type-def dimensions='1' type-id='3158a266' size-in-bits='8160' id='29cc01cd'>
         <subrange length='255' type-id='7ff19f0f' id='36e7f891'/>
       </array-type-def>
@@ -24701,6 +24724,7 @@
           <var-decl name='pi_se' type-id='75eeb81d' visibility='default' filepath='include/linux/sched.h' line='596' column='1'/>
         </data-member>
       </class-decl>
+      <qualified-type-def type-id='7ad52504' const='yes' id='2d4ad53b'/>
       <array-type-def dimensions='2' type-id='b151a3a8' size-in-bits='384' id='2d507faf'>
         <subrange length='8' type-id='7ff19f0f' id='56e0c0b1'/>
         <subrange length='6' type-id='7ff19f0f' id='52fa524b'/>
@@ -28506,6 +28530,7 @@
           <var-decl name='alloc_func' type-id='ae795a50' visibility='default' filepath='include/linux/usb/composite.h' line='588' column='1'/>
         </data-member>
       </class-decl>
+      <qualified-type-def type-id='6cd62070' const='yes' id='38e0f6d3'/>
       <function-type size-in-bits='64' id='38e7219e'>
         <parameter type-id='347d8ccd' name='obj'/>
         <return type-id='48b5725f'/>
@@ -30695,6 +30720,14 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='ceee71ca' size-in-bits='64' id='3dad1a48'/>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='31' column='1' id='3db026b2'>
+        <data-member access='public'>
+          <var-decl name='match' type-id='1ecd1044' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='32' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='target' type-id='b7f14b36' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='33' column='1'/>
+        </data-member>
+      </union-decl>
       <class-decl name='i2c_device_id' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/mod_devicetable.h' line='457' column='1' id='3db54816'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='name' type-id='664ac0b7' visibility='default' filepath='include/linux/mod_devicetable.h' line='458' column='1'/>
@@ -33251,6 +33284,11 @@
       <pointer-type-def type-id='a6d8bab7' size-in-bits='64' id='442dc527'/>
       <pointer-type-def type-id='fbc017ef' size-in-bits='64' id='44372936'/>
       <qualified-type-def type-id='43795fda' const='yes' id='4443d9d9'/>
+      <function-type size-in-bits='64' id='4446be8a'>
+        <parameter type-id='0fbf3cfd'/>
+        <parameter type-id='1b9d48b1'/>
+        <return type-id='f0981eeb'/>
+      </function-type>
       <class-decl name='perf_cpu_context' size-in-bits='3520' is-struct='yes' visibility='default' filepath='include/linux/perf_event.h' line='865' column='1' id='4448fdd3'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='ctx' type-id='9d67acd5' visibility='default' filepath='include/linux/perf_event.h' line='866' column='1'/>
@@ -44068,6 +44106,7 @@
         <parameter type-id='95e97e5e'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <pointer-type-def type-id='2d4ad53b' size-in-bits='64' id='5dcd69c3'/>
       <array-type-def dimensions='1' type-id='a84c031d' size-in-bits='520' id='5ddd38d2'>
         <subrange length='65' type-id='7ff19f0f' id='b50e2e4a'/>
       </array-type-def>
@@ -45241,6 +45280,56 @@
       <pointer-type-def type-id='aac6e642' size-in-bits='64' id='601d7eac'/>
       <pointer-type-def type-id='818799b4' size-in-bits='64' id='60219102'/>
       <qualified-type-def type-id='74191d27' const='yes' id='60263890'/>
+      <class-decl name='xt_target' size-in-bits='1024' is-struct='yes' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='182' column='1' id='60289ffb'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='183' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='name' type-id='cff94a5f' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='185' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='360'>
+          <var-decl name='revision' type-id='892641a4' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='186' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='target' type-id='73cc7ee4' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='191' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='448'>
+          <var-decl name='checkentry' type-id='ef16e31e' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='198' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='512'>
+          <var-decl name='destroy' type-id='6307fc3e' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='201' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='576'>
+          <var-decl name='compat_from_user' type-id='debb4ee8' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='204' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='640'>
+          <var-decl name='compat_to_user' type-id='585e1de9' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='205' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='704'>
+          <var-decl name='me' type-id='2730d015' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='208' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='768'>
+          <var-decl name='table' type-id='80f4b756' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='210' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='832'>
+          <var-decl name='targetsize' type-id='f0981eeb' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='211' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='864'>
+          <var-decl name='usersize' type-id='f0981eeb' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='212' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='896'>
+          <var-decl name='compatsize' type-id='f0981eeb' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='214' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='928'>
+          <var-decl name='hooks' type-id='f0981eeb' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='216' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='960'>
+          <var-decl name='proto' type-id='8efea9e5' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='217' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='976'>
+          <var-decl name='family' type-id='8efea9e5' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='219' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='nf_exp_event_notifier' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/net/netfilter/nf_conntrack_ecache.h' line='161' column='1' id='602fd1a9'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='fcn' type-id='c8fa3070' visibility='default' filepath='include/net/netfilter/nf_conntrack_ecache.h' line='162' column='1'/>
@@ -46505,6 +46594,7 @@
       <pointer-type-def type-id='f01e85cf' size-in-bits='64' id='62fa2ea7'/>
       <pointer-type-def type-id='64249e24' size-in-bits='64' id='6301fad2'/>
       <pointer-type-def type-id='ebb2cb2f' size-in-bits='64' id='630307fa'/>
+      <pointer-type-def type-id='29ca5ed4' size-in-bits='64' id='6307fc3e'/>
       <class-decl name='uprobes_state' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/uprobes.h' line='101' column='1' id='6308a819'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='xol_area' type-id='3d15880e' visibility='default' filepath='include/linux/uprobes.h' line='102' column='1'/>
@@ -47177,6 +47267,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='c3b65e91' size-in-bits='64' id='64ecf6a5'/>
+      <pointer-type-def type-id='edb04712' size-in-bits='64' id='64ed5260'/>
       <pointer-type-def type-id='da556df0' size-in-bits='64' id='64efa47a'/>
       <function-type size-in-bits='64' id='64f1e67b'>
         <parameter type-id='b9af02c3'/>
@@ -50654,6 +50745,20 @@
       <pointer-type-def type-id='f65a797a' size-in-bits='64' id='6cd1df94'/>
       <pointer-type-def type-id='7bacac96' size-in-bits='64' id='6cd3ebf4'/>
       <pointer-type-def type-id='7f3ed7a2' size-in-bits='64' id='6cd5b5fc'/>
+      <class-decl name='xt_tgdtor_param' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='135' column='1' id='6cd62070'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='net' type-id='a2bff676' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='136' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='target' type-id='b7f14b36' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='137' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='targinfo' type-id='eaa32e2f' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='138' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='family' type-id='892641a4' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='139' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='a9c862bf' size-in-bits='64' id='6cd85f13'/>
       <array-type-def dimensions='1' type-id='88aa5216' size-in-bits='32768' id='6cdfafe7'>
         <subrange length='128' type-id='7ff19f0f' id='1eb1687a'/>
@@ -51792,6 +51897,7 @@
       <class-decl name='mmc_blk_data' is-struct='yes' visibility='default' is-declaration-only='yes' id='705909a1'/>
       <pointer-type-def type-id='11e11a61' size-in-bits='64' id='705c6411'/>
       <pointer-type-def type-id='2181e5cc' size-in-bits='64' id='705eaeca'/>
+      <qualified-type-def type-id='edb04712' const='yes' id='70660701'/>
       <function-type size-in-bits='64' id='706f3909'>
         <parameter type-id='e324928d'/>
         <parameter type-id='f0981eeb'/>
@@ -52280,6 +52386,14 @@
       </function-type>
       <pointer-type-def type-id='6ace3b65' size-in-bits='64' id='71a75d5d'/>
       <qualified-type-def type-id='73803d48' const='yes' id='71bae7c7'/>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='35' column='1' id='71be3d11'>
+        <data-member access='public'>
+          <var-decl name='matchinfo' type-id='eaa32e2f' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='36' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='targinfo' type-id='eaa32e2f' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='36' column='1'/>
+        </data-member>
+      </union-decl>
       <pointer-type-def type-id='f347e46a' size-in-bits='64' id='71c75804'/>
       <function-type size-in-bits='64' id='71cde6ad'>
         <parameter type-id='27f3f5d8'/>
@@ -53642,6 +53756,7 @@
       <array-type-def dimensions='1' type-id='95e97e5e' size-in-bits='480' id='73c97830'>
         <subrange length='15' type-id='7ff19f0f' id='8484ba73'/>
       </array-type-def>
+      <pointer-type-def type-id='4446be8a' size-in-bits='64' id='73cc7ee4'/>
       <enum-decl name='hdmi_audio_sample_size' filepath='include/linux/hdmi.h' line='279' column='1' id='73deb9e6'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='HDMI_AUDIO_SAMPLE_SIZE_STREAM' value='0'/>
@@ -55343,6 +55458,7 @@
       <pointer-type-def type-id='23de1228' size-in-bits='64' id='78965926'/>
       <typedef-decl name='__be32' type-id='3f1a6b60' filepath='include/uapi/linux/types.h' line='32' column='1' id='78a133c2'/>
       <pointer-type-def type-id='93286cfa' size-in-bits='64' id='78a34b70'/>
+      <pointer-type-def type-id='11ce232b' size-in-bits='64' id='78abc667'/>
       <function-type size-in-bits='64' id='78b081ff'>
         <parameter type-id='a05f1ecd'/>
         <parameter type-id='807869d3'/>
@@ -55725,6 +55841,7 @@
       <qualified-type-def type-id='b16ef9f3' const='yes' id='79eccb20'/>
       <pointer-type-def type-id='923a53bf' size-in-bits='64' id='79efa3b3'/>
       <pointer-type-def type-id='01ded187' size-in-bits='64' id='79f85ebf'/>
+      <qualified-type-def type-id='60289ffb' const='yes' id='79fae198'/>
       <class-decl name='__anonymous_struct__' size-in-bits='32' is-struct='yes' is-anonymous='yes' naming-typedef-id='49178f86' visibility='default' filepath='include/linux/types.h' line='166' column='1' id='79faeff3'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='counter' type-id='95e97e5e' visibility='default' filepath='include/linux/types.h' line='167' column='1'/>
@@ -56207,6 +56324,20 @@
       </function-type>
       <pointer-type-def type-id='dea13b10' size-in-bits='64' id='7ad47ca2'/>
       <pointer-type-def type-id='956881f1' size-in-bits='64' id='7ad49bc5'/>
+      <class-decl name='xt_mtdtor_param' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='107' column='1' id='7ad52504'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='net' type-id='a2bff676' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='108' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='match' type-id='1ecd1044' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='109' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='matchinfo' type-id='eaa32e2f' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='110' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='family' type-id='892641a4' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='111' column='1'/>
+        </data-member>
+      </class-decl>
       <function-type size-in-bits='64' id='7addb8a1'>
         <parameter type-id='1c475548'/>
         <return type-id='f0981eeb'/>
@@ -56609,6 +56740,7 @@
         <parameter type-id='2aeab85a'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <qualified-type-def type-id='b30ae843' const='yes' id='7be051de'/>
       <function-type size-in-bits='64' id='7be36c00'>
         <parameter type-id='d1347205'/>
         <parameter type-id='43c38462'/>
@@ -59837,6 +59969,7 @@
       <qualified-type-def type-id='101eeec5' const='yes' id='8316a080'/>
       <pointer-type-def type-id='3eb7c31c' size-in-bits='64' id='831e6e93'/>
       <pointer-type-def type-id='dedd4d90' size-in-bits='64' id='831f84c2'/>
+      <pointer-type-def type-id='38e0f6d3' size-in-bits='64' id='8324c9fb'/>
       <class-decl name='iw_discarded' size-in-bits='160' is-struct='yes' visibility='default' filepath='include/uapi/linux/wireless.h' line='731' column='1' id='832938ed'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='nwid' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/wireless.h' line='732' column='1'/>
@@ -67270,6 +67403,56 @@
       <array-type-def dimensions='1' type-id='8f048e17' size-in-bits='128' id='9396cabb'>
         <subrange length='16' type-id='7ff19f0f' id='848d0938'/>
       </array-type-def>
+      <class-decl name='xt_match' size-in-bits='1024' is-struct='yes' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='142' column='1' id='9399d16b'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='143' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='name' type-id='cff94a5f' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='145' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='360'>
+          <var-decl name='revision' type-id='892641a4' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='146' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='match' type-id='78abc667' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='153' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='448'>
+          <var-decl name='checkentry' type-id='f6865b36' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='157' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='512'>
+          <var-decl name='destroy' type-id='f0385e42' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='160' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='576'>
+          <var-decl name='compat_from_user' type-id='debb4ee8' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='163' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='640'>
+          <var-decl name='compat_to_user' type-id='585e1de9' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='164' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='704'>
+          <var-decl name='me' type-id='2730d015' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='167' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='768'>
+          <var-decl name='table' type-id='80f4b756' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='169' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='832'>
+          <var-decl name='matchsize' type-id='f0981eeb' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='170' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='864'>
+          <var-decl name='usersize' type-id='f0981eeb' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='171' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='896'>
+          <var-decl name='compatsize' type-id='f0981eeb' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='173' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='928'>
+          <var-decl name='hooks' type-id='f0981eeb' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='175' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='960'>
+          <var-decl name='proto' type-id='8efea9e5' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='176' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='976'>
+          <var-decl name='family' type-id='8efea9e5' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='178' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='228c7c6c' size-in-bits='64' id='939a8d9a'/>
       <function-type size-in-bits='64' id='93a4c7d5'>
         <parameter type-id='6dca061b'/>
@@ -80889,6 +81072,32 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='3ad2f92f' size-in-bits='64' id='b3002d4b'/>
+      <class-decl name='xt_mtchk_param' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='92' column='1' id='b30ae843'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='net' type-id='a2bff676' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='93' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='table' type-id='80f4b756' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='94' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='entryinfo' type-id='eaa32e2f' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='95' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='match' type-id='1ecd1044' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='96' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='matchinfo' type-id='eaa32e2f' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='97' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='hook_mask' type-id='f0981eeb' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='98' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='352'>
+          <var-decl name='family' type-id='892641a4' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='99' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='360'>
+          <var-decl name='nft_compat' type-id='b50a4934' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='100' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='02244303' size-in-bits='64' id='b316d9a3'/>
       <pointer-type-def type-id='2aaa0129' size-in-bits='64' id='b31a5ea1'/>
       <pointer-type-def type-id='dc1b9a32' size-in-bits='64' id='b31af340'/>
@@ -83033,6 +83242,7 @@
       </class-decl>
       <pointer-type-def type-id='21e2c677' size-in-bits='64' id='b7ee351b'/>
       <pointer-type-def type-id='d37cd54e' size-in-bits='64' id='b7f056d4'/>
+      <pointer-type-def type-id='79fae198' size-in-bits='64' id='b7f14b36'/>
       <pointer-type-def type-id='daa6240b' size-in-bits='64' id='b7f77f1f'/>
       <pointer-type-def type-id='579042ad' size-in-bits='64' id='b7f92ac9'/>
       <pointer-type-def type-id='c5c76c9c' size-in-bits='64' id='b7f9d8e6'/>
@@ -94800,6 +95010,9 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='fb4018a0' size-in-bits='64' id='cff2d845'/>
+      <array-type-def dimensions='1' type-id='9b45d938' size-in-bits='232' id='cff94a5f'>
+        <subrange length='29' type-id='7ff19f0f' id='01b8f6fa'/>
+      </array-type-def>
       <pointer-type-def type-id='7f3df443' size-in-bits='64' id='cfff5953'/>
       <class-decl name='io_context' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/iocontext.h' line='99' column='1' id='d002899d'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -103469,6 +103682,7 @@
         <parameter type-id='551eebc9'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <pointer-type-def type-id='19952db6' size-in-bits='64' id='e1d6cc94'/>
       <function-type size-in-bits='64' id='e1de5cb1'>
         <parameter type-id='404b1300'/>
         <return type-id='48b5725f'/>
@@ -103738,6 +103952,7 @@
         <parameter type-id='4e602d14'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <pointer-type-def type-id='9399d16b' size-in-bits='64' id='e25f5feb'/>
       <pointer-type-def type-id='bd36df2f' size-in-bits='64' id='e26114df'/>
       <pointer-type-def type-id='ef5bccc0' size-in-bits='64' id='e26652e6'/>
       <function-type size-in-bits='64' id='e26b47d7'>
@@ -109177,6 +109392,26 @@
           <var-decl name='group_data' type-id='d2f7b56a' visibility='default' filepath='include/drm/drm_connector.h' line='1667' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='xt_action_param' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='30' column='1' id='edb04712'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='' type-id='3db026b2' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='31' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='' type-id='71be3d11' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='35' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='state' type-id='309a5a26' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='38' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='fragoff' type-id='95e97e5e' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='39' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='224'>
+          <var-decl name='thoff' type-id='f0981eeb' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='40' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='hotdrop' type-id='b50a4934' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='41' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='rng_alg' size-in-bits='4096' is-struct='yes' visibility='default' filepath='include/crypto/rng.h' line='41' column='1' id='edc58e1f'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='generate' type-id='5cae2f79' visibility='default' filepath='include/crypto/rng.h' line='42' column='1'/>
@@ -109648,6 +109883,10 @@
         <parameter type-id='39341f7e'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <function-type size-in-bits='64' id='eeef65e4'>
+        <parameter type-id='e1d6cc94'/>
+        <return type-id='95e97e5e'/>
+      </function-type>
       <class-decl name='bpf_prog_offload' size-in-bits='576' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='494' column='1' id='eef53362'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/bpf.h' line='495' column='1'/>
@@ -109691,6 +109930,7 @@
         <enumerator name='__NL802154_CCA_OPT_ATTR_AFTER_LAST' value='2'/>
         <enumerator name='NL802154_CCA_OPT_ATTR_MAX' value='1'/>
       </enum-decl>
+      <pointer-type-def type-id='eeef65e4' size-in-bits='64' id='ef16e31e'/>
       <pointer-type-def type-id='418a6dbd' size-in-bits='64' id='ef2258e1'/>
       <class-decl name='drm_mode_set' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/drm/drm_crtc.h' line='1190' column='1' id='ef266a3b'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -110187,6 +110427,7 @@
         <parameter type-id='9c5c646e'/>
         <return type-id='b50a4934'/>
       </function-type>
+      <pointer-type-def type-id='26b6dfe0' size-in-bits='64' id='f0385e42'/>
       <pointer-type-def type-id='20919507' size-in-bits='64' id='f03e9a5b'/>
       <pointer-type-def type-id='09bcad51' size-in-bits='64' id='f03f21e9'/>
       <class-decl name='__anonymous_struct__' size-in-bits='32' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='4455' column='1' id='f052f7e3'>
@@ -112406,6 +112647,7 @@
       </function-type>
       <pointer-type-def type-id='fe71fd28' size-in-bits='64' id='f61d3a1e'/>
       <pointer-type-def type-id='9aae225c' size-in-bits='64' id='f6203fc2'/>
+      <pointer-type-def type-id='7be051de' size-in-bits='64' id='f621031c'/>
       <pointer-type-def type-id='d050fd8b' size-in-bits='64' id='f623d45b'/>
       <pointer-type-def type-id='e5e56b24' size-in-bits='64' id='f627870a'/>
       <function-type size-in-bits='64' id='f62797f7'>
@@ -112503,6 +112745,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='f24c165e' size-in-bits='64' id='f681f934'/>
+      <pointer-type-def type-id='156670bc' size-in-bits='64' id='f6865b36'/>
       <function-type size-in-bits='64' id='f6898056'>
         <parameter type-id='78e7cf52'/>
         <return type-id='b59d7dce'/>
@@ -113876,6 +114119,32 @@
       <array-type-def dimensions='1' type-id='d0622163' size-in-bits='512' id='fa0d0a7f'>
         <subrange length='8' type-id='7ff19f0f' id='56e0c0b1'/>
       </array-type-def>
+      <class-decl name='xt_tgchk_param' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='123' column='1' id='fa0eab7f'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='net' type-id='a2bff676' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='124' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='table' type-id='80f4b756' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='125' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='entryinfo' type-id='eaa32e2f' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='126' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='target' type-id='b7f14b36' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='127' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='targinfo' type-id='eaa32e2f' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='128' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='hook_mask' type-id='f0981eeb' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='129' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='352'>
+          <var-decl name='family' type-id='892641a4' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='130' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='360'>
+          <var-decl name='nft_compat' type-id='b50a4934' visibility='default' filepath='include/linux/netfilter/x_tables.h' line='131' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='9a9cf0bf' size-in-bits='64' id='fa0eba8f'/>
       <function-type size-in-bits='64' id='fa12cc76'>
         <parameter type-id='94f8595c'/>
@@ -116586,9 +116855,9 @@
       </function-type>
       <pointer-type-def type-id='46f53066' size-in-bits='64' id='fffb07a4'/>
       <qualified-type-def type-id='55efd1a3' const='yes' id='fffdaf52'/>
-      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='522' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
+      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='523' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
       <var-decl name='GKI_struct_selinux_state' type-id='4ae52763' mangled-name='GKI_struct_selinux_state' visibility='default' filepath='security/selinux/vendor_hooks.c' line='21' column='1' elf-symbol-id='GKI_struct_selinux_state'/>
-      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='527' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
+      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='528' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
       <function-decl name='PDE_DATA' mangled-name='PDE_DATA' filepath='fs/proc/generic.c' line='802' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='PDE_DATA'>
         <parameter type-id='c5a4eb7f' name='inode' filepath='fs/proc/generic.c' line='802' column='1'/>
         <return type-id='eaa32e2f'/>
@@ -122494,12 +122763,12 @@
         <parameter type-id='e0ea832a' name='lock' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='1109' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='access_process_vm' mangled-name='access_process_vm' filepath='mm/memory.c' line='5658' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='access_process_vm'>
-        <parameter type-id='f23e2572' name='tsk' filepath='mm/memory.c' line='5658' column='1'/>
-        <parameter type-id='7359adad' name='addr' filepath='mm/memory.c' line='5658' column='1'/>
-        <parameter type-id='eaa32e2f' name='buf' filepath='mm/memory.c' line='5659' column='1'/>
-        <parameter type-id='95e97e5e' name='len' filepath='mm/memory.c' line='5659' column='1'/>
-        <parameter type-id='f0981eeb' name='gup_flags' filepath='mm/memory.c' line='5659' column='1'/>
+      <function-decl name='access_process_vm' mangled-name='access_process_vm' filepath='mm/memory.c' line='5670' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='access_process_vm'>
+        <parameter type-id='f23e2572' name='tsk' filepath='mm/memory.c' line='5670' column='1'/>
+        <parameter type-id='7359adad' name='addr' filepath='mm/memory.c' line='5670' column='1'/>
+        <parameter type-id='eaa32e2f' name='buf' filepath='mm/memory.c' line='5671' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='mm/memory.c' line='5671' column='1'/>
+        <parameter type-id='f0981eeb' name='gup_flags' filepath='mm/memory.c' line='5671' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='ack_all_badblocks' mangled-name='ack_all_badblocks' filepath='block/badblocks.c' line='433' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ack_all_badblocks'>
@@ -131919,10 +132188,10 @@
         <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='2798' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='follow_pfn' mangled-name='follow_pfn' filepath='mm/memory.c' line='5494' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='follow_pfn'>
-        <parameter type-id='2ae08426' name='vma' filepath='mm/memory.c' line='5494' column='1'/>
-        <parameter type-id='7359adad' name='address' filepath='mm/memory.c' line='5494' column='1'/>
-        <parameter type-id='1d2c2b85' name='pfn' filepath='mm/memory.c' line='5495' column='1'/>
+      <function-decl name='follow_pfn' mangled-name='follow_pfn' filepath='mm/memory.c' line='5506' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='follow_pfn'>
+        <parameter type-id='2ae08426' name='vma' filepath='mm/memory.c' line='5506' column='1'/>
+        <parameter type-id='7359adad' name='address' filepath='mm/memory.c' line='5506' column='1'/>
+        <parameter type-id='1d2c2b85' name='pfn' filepath='mm/memory.c' line='5507' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='font_vga_8x16' type-id='d2d06e23' mangled-name='font_vga_8x16' visibility='default' filepath='lib/fonts/font_8x16.c' line='4625' column='1' elf-symbol-id='font_vga_8x16'/>
@@ -151040,6 +151309,14 @@
         <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci.c' line='4366' column='1'/>
         <return type-id='1e9ca7e3'/>
       </function-decl>
+      <function-decl name='xt_register_match' mangled-name='xt_register_match' filepath='net/netfilter/x_tables.c' line='119' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xt_register_match'>
+        <parameter type-id='e25f5feb' name='match' filepath='net/netfilter/x_tables.c' line='119' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='xt_unregister_match' mangled-name='xt_unregister_match' filepath='net/netfilter/x_tables.c' line='131' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xt_unregister_match'>
+        <parameter type-id='e25f5feb' name='match' filepath='net/netfilter/x_tables.c' line='131' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <var-decl name='zero_pfn' type-id='7359adad' mangled-name='zero_pfn' visibility='default' filepath='mm/memory.c' line='161' column='1' elf-symbol-id='zero_pfn'/>
       <function-decl name='zlib_deflate' mangled-name='zlib_deflate' filepath='lib/zlib_deflate/deflate.c' line='329' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflate'>
         <parameter type-id='fb4f8c25' name='strm' filepath='lib/zlib_deflate/deflate.c' line='330' column='1'/>
diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus
index 4117c5405e2b..5e9fe7e2cbb6 100644
--- a/android/abi_gki_aarch64_oplus
+++ b/android/abi_gki_aarch64_oplus
@@ -3721,4 +3721,6 @@
   xhci_ring_cmd_db
   xhci_ring_free
   xhci_trb_virt_to_dma
+  xt_register_match
+  xt_unregister_match
   zero_pfn

From 0415c5ccfe59527a1568bfbf796403cd4f5b393d Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed, 7 Feb 2024 18:49:51 +0100
Subject: [PATCH 1022/1043] UPSTREAM: netfilter: nft_set_rbtree: skip end
 interval element from gc

commit 60c0c230c6f046da536d3df8b39a20b9a9fd6af0 upstream.

rbtree lazy gc on insert might collect an end interval element that has
been just added in this transactions, skip end interval elements that
are not yet active.

Bug: 325477234
Fixes: f718863aca46 ("netfilter: nft_set_rbtree: fix overlap expiration walk")
Cc: stable@vger.kernel.org
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 1296c110c5a0b45a8fcf58e7d18bc5da61a565cb)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I42f7bca418d47948292b15ace9f371b81ccd7fe8
---
 net/netfilter/nft_set_rbtree.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 12d9d0d0c602..18c0d163dc76 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -237,7 +237,7 @@ static void nft_rbtree_gc_remove(struct net *net, struct nft_set *set,
 
 static const struct nft_rbtree_elem *
 nft_rbtree_gc_elem(const struct nft_set *__set, struct nft_rbtree *priv,
-		   struct nft_rbtree_elem *rbe, u8 genmask)
+		   struct nft_rbtree_elem *rbe)
 {
 	struct nft_set *set = (struct nft_set *)__set;
 	struct rb_node *prev = rb_prev(&rbe->node);
@@ -256,7 +256,7 @@ nft_rbtree_gc_elem(const struct nft_set *__set, struct nft_rbtree *priv,
 	while (prev) {
 		rbe_prev = rb_entry(prev, struct nft_rbtree_elem, node);
 		if (nft_rbtree_interval_end(rbe_prev) &&
-		    nft_set_elem_active(&rbe_prev->ext, genmask))
+		    nft_set_elem_active(&rbe_prev->ext, NFT_GENMASK_ANY))
 			break;
 
 		prev = rb_prev(prev);
@@ -367,7 +367,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
 		    nft_set_elem_active(&rbe->ext, cur_genmask)) {
 			const struct nft_rbtree_elem *removed_end;
 
-			removed_end = nft_rbtree_gc_elem(set, priv, rbe, genmask);
+			removed_end = nft_rbtree_gc_elem(set, priv, rbe);
 			if (IS_ERR(removed_end))
 				return PTR_ERR(removed_end);
 

From ca7dabaf67961aef9f9d4b11fc3cbc24208e2413 Mon Sep 17 00:00:00 2001
From: "qiwu.chen" <qiwu.chen@transsion.com>
Date: Tue, 6 Feb 2024 17:39:17 +0800
Subject: [PATCH 1023/1043] ANDROID: Add vendor hook for task exiting routine

Currently, there are various global init exit issues encountered
on Andriod/linux system. It's hard to debug these issues on product
environment without a usable coredump.

For example, it's hard to get the root cause why global init task exited from the below kmsg:
[ 4.696032][T400001] e2fsck: /dev/block/by-name/metadata: clean, 35/8192 files, 2083/8192 blocks
[ 4.696783][T500326] [bq27z561] fg_debug_dump_regs: slave_dump:Reg[0x0073] = 0x05C5
[ 4.700583][T400001] EXT4-fs (sdc17): mounted filesystem with ordered data mode. Opts: discard
[ 4.706445][T400001] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00007f0000
[ 4.706459][T400001] CPU: 4 PID: 1 Comm: init Tainted: G S W 5.10.136-android12-9-00005-gf9a66cbe7091-ab9177899 #1
[ 4.706464][T400001] Hardware name: MT6983Z/TCZA (DT)
[ 4.706469][T400001] Call trace:
[ 4.706482][T400001] dump_backtrace.cfi_jt+0x0/0x8
[ 4.706493][T400001] dump_stack_lvl+0xc4/0x140
[ 4.706504][T400001] panic+0x178/0x464
[ 4.706511][T400001] do_exit+0xb30/0xf9c
[ 4.706517][T400001] do_group_exit+0x130/0x1c8
[ 4.706523][T400001] do_group_exit+0x0/0x1c8
[ 4.706529][T400001] __do_sys_exit_group+0x0/0x18
[ 4.706535][T400001] __se_sys_exit_group+0x0/0x14
[ 4.706543][T400001] el0_svc_common+0xd4/0x270
[ 4.706551][T400001] el0_svc+0x28/0x88
[ 4.706559][T400001] el0_sync_handler+0x8c/0xf0
[ 4.706567][T400001] el0_sync+0x1b4/0x1c0

Add hook for task exiting routine, while will be helpful for OEMs to
get the reason of any exiting task to be noticed such as dump last
exit thread executable sections and registers info.

Bug: 324013972
Link: https://lore.kernel.org/lkml/20231110032043.34516-1-qiwu.chen@transsion.com/T/
Change-Id: Ibb7c9012af18b99a1bb458d236f166e6450241c3
Signed-off-by: qiwu.chen <qiwu.chen@transsion.com>
---
 drivers/android/vendor_hooks.c | 1 +
 include/trace/hooks/dtask.h    | 4 +++-
 kernel/exit.c                  | 2 ++
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index a45a4e21c68d..bc24a8510e02 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -515,6 +515,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_check_ctrl);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_print_ctrl);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_vmscan_kswapd_done);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_swap_page_spf);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_exit_check);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/dtask.h b/include/trace/hooks/dtask.h
index d8fa440ea6e9..1e77e78b8c3d 100644
--- a/include/trace/hooks/dtask.h
+++ b/include/trace/hooks/dtask.h
@@ -104,7 +104,9 @@ DECLARE_HOOK(android_vh_percpu_rwsem_wq_add,
 	TP_PROTO(struct percpu_rw_semaphore *sem, bool reader),
 	TP_ARGS(sem, reader));
 
-
+DECLARE_HOOK(android_vh_exit_check,
+	TP_PROTO(struct task_struct *tsk, long code, int group_dead),
+	TP_ARGS(tsk, code, group_dead));
 /* macro versions of hooks are no longer required */
 
 #endif /* _TRACE_HOOK_DTASK_H */
diff --git a/kernel/exit.c b/kernel/exit.c
index 7231d6afbdd8..10d801577b65 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -70,6 +70,7 @@
 #include <asm/unistd.h>
 #include <asm/mmu_context.h>
 #include <trace/hooks/mm.h>
+#include <trace/hooks/dtask.h>
 
 /*
  * The default value should be high enough to not crash a system that randomly
@@ -820,6 +821,7 @@ void __noreturn do_exit(long code)
 		sync_mm_rss(tsk->mm);
 	acct_update_integrals(tsk);
 	group_dead = atomic_dec_and_test(&tsk->signal->live);
+	trace_android_vh_exit_check(current, code, group_dead);
 	if (group_dead) {
 		/*
 		 * If the last thread of global init has exited, panic

From 0b886c607a4cde56fcef9bb6d2e33d76d96b5d28 Mon Sep 17 00:00:00 2001
From: "qiwu.chen" <qiwu.chen@transsion.com>
Date: Tue, 27 Feb 2024 14:30:38 +0800
Subject: [PATCH 1024/1043] ANDROID: GKI: Update symbol list

Update symbols to symbol list externed by transsion to add restricted hooks.

Leaf changes summary: 2 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 1 Added variable

1 Added function:

  [A] 'function int __traceiter_android_vh_exit_check(void*, task_struct*, long int, int)'

1 Added variable:

  [A] 'tracepoint __tracepoint_android_vh_exit_check'

Bug: 324013972
Change-Id: I6059a9a4e31a3c7e3dbd366a40cdf445ad82a6d4
Signed-off-by: qiwu.chen <qiwu.chen@transsion.com>
---
 android/abi_gki_aarch64.xml       | 56 +++++++++++--------------------
 android/abi_gki_aarch64_transsion |  2 ++
 2 files changed, 22 insertions(+), 36 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 66e2d678b945..ca3a5dd58993 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -512,6 +512,7 @@
       <elf-symbol name='__traceiter_android_vh_enable_thermal_genl_check' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc39a1e16'/>
       <elf-symbol name='__traceiter_android_vh_ep_create_wakeup_source' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1e8ed582'/>
       <elf-symbol name='__traceiter_android_vh_exclude_reserved_zone' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x697a6684'/>
+      <elf-symbol name='__traceiter_android_vh_exit_check' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3f7d6315'/>
       <elf-symbol name='__traceiter_android_vh_exit_creds' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1002fcf3'/>
       <elf-symbol name='__traceiter_android_vh_exit_mm' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x89978f8d'/>
       <elf-symbol name='__traceiter_android_vh_filemap_fault_cache_page' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf2c329c2'/>
@@ -6623,6 +6624,7 @@
       <elf-symbol name='__tracepoint_android_vh_enable_thermal_genl_check' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x901a2c7c'/>
       <elf-symbol name='__tracepoint_android_vh_ep_create_wakeup_source' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfdd7bb80'/>
       <elf-symbol name='__tracepoint_android_vh_exclude_reserved_zone' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8750976e'/>
+      <elf-symbol name='__tracepoint_android_vh_exit_check' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x231898d'/>
       <elf-symbol name='__tracepoint_android_vh_exit_creds' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xaf358872'/>
       <elf-symbol name='__tracepoint_android_vh_exit_mm' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7cc736a1'/>
       <elf-symbol name='__tracepoint_android_vh_filemap_fault_cache_page' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfcc31765'/>
@@ -15220,7 +15222,6 @@
         <subrange length='20' type-id='7ff19f0f' id='fdca39cf'/>
       </array-type-def>
       <pointer-type-def type-id='80b3d6aa' size-in-bits='64' id='157eca44'/>
-      <pointer-type-def type-id='504ee449' size-in-bits='64' id='1583af75'/>
       <class-decl name='bpf_cgroup_storage' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/bpf-cgroup.h' line='53' column='1' id='15881542'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='' type-id='dad3eb71' visibility='default' filepath='include/linux/bpf-cgroup.h' line='54' column='1'/>
@@ -37767,12 +37768,6 @@
           <var-decl name='data' type-id='5e6516ee' visibility='default' filepath='include/keys/asymmetric-type.h' line='52' column='1'/>
         </data-member>
       </class-decl>
-      <function-type size-in-bits='64' id='504ee449'>
-        <parameter type-id='6dca061b'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='4c98e95d'/>
-        <return type-id='95e97e5e'/>
-      </function-type>
       <class-decl name='drm_mode_config' size-in-bits='9856' is-struct='yes' visibility='default' filepath='include/drm/drm_mode_config.h' line='358' column='1' id='5052051f'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='mutex' type-id='925167dc' visibility='default' filepath='include/drm/drm_mode_config.h' line='369' column='1'/>
@@ -70308,26 +70303,7 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='4b365417' size-in-bits='64' id='9a9cf0bf'/>
-      <class-decl name='tcf_walker' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/pkt_cls.h' line='16' column='1' id='9a9d8c1d'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='stop' type-id='95e97e5e' visibility='default' filepath='include/net/pkt_cls.h' line='17' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='skip' type-id='95e97e5e' visibility='default' filepath='include/net/pkt_cls.h' line='18' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='count' type-id='95e97e5e' visibility='default' filepath='include/net/pkt_cls.h' line='19' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='nonempty' type-id='b50a4934' visibility='default' filepath='include/net/pkt_cls.h' line='20' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='cookie' type-id='7359adad' visibility='default' filepath='include/net/pkt_cls.h' line='21' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='fn' type-id='1583af75' visibility='default' filepath='include/net/pkt_cls.h' line='22' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='tcf_walker' is-struct='yes' visibility='default' is-declaration-only='yes' id='9a9d8c1d'/>
       <pointer-type-def type-id='2974aa72' size-in-bits='64' id='9aa82888'/>
       <typedef-decl name='substring_t' type-id='52365588' filepath='include/linux/parser.h' line='28' column='1' id='9aadee6c'/>
       <qualified-type-def type-id='b7aba18f' const='yes' id='9aae225c'/>
@@ -116855,9 +116831,9 @@
       </function-type>
       <pointer-type-def type-id='46f53066' size-in-bits='64' id='fffb07a4'/>
       <qualified-type-def type-id='55efd1a3' const='yes' id='fffdaf52'/>
-      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='523' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
+      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='524' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
       <var-decl name='GKI_struct_selinux_state' type-id='4ae52763' mangled-name='GKI_struct_selinux_state' visibility='default' filepath='security/selinux/vendor_hooks.c' line='21' column='1' elf-symbol-id='GKI_struct_selinux_state'/>
-      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='528' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
+      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='529' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
       <function-decl name='PDE_DATA' mangled-name='PDE_DATA' filepath='fs/proc/generic.c' line='802' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='PDE_DATA'>
         <parameter type-id='c5a4eb7f' name='inode' filepath='fs/proc/generic.c' line='802' column='1'/>
         <return type-id='eaa32e2f'/>
@@ -119992,6 +119968,13 @@
         <parameter type-id='452b82fa' name='info' filepath='include/trace/hooks/mm.h' line='91' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_vh_exit_check' mangled-name='__traceiter_android_vh_exit_check' filepath='include/trace/hooks/dtask.h' line='107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_exit_check'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/dtask.h' line='107' column='1'/>
+        <parameter type-id='f23e2572' name='tsk' filepath='include/trace/hooks/dtask.h' line='107' column='1'/>
+        <parameter type-id='bd54fe1a' name='code' filepath='include/trace/hooks/dtask.h' line='107' column='1'/>
+        <parameter type-id='95e97e5e' name='group_dead' filepath='include/trace/hooks/dtask.h' line='107' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_vh_exit_creds' mangled-name='__traceiter_android_vh_exit_creds' filepath='include/trace/hooks/creds.h' line='27' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_exit_creds'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/creds.h' line='27' column='1'/>
         <parameter type-id='b42ffb57' name='task' filepath='include/trace/hooks/creds.h' line='27' column='1'/>
@@ -122021,6 +122004,7 @@
       <var-decl name='__tracepoint_android_vh_enable_thermal_genl_check' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_enable_thermal_genl_check' visibility='default' filepath='include/trace/hooks/thermal.h' line='19' column='1' elf-symbol-id='__tracepoint_android_vh_enable_thermal_genl_check'/>
       <var-decl name='__tracepoint_android_vh_ep_create_wakeup_source' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ep_create_wakeup_source' visibility='default' filepath='include/trace/hooks/fs.h' line='13' column='1' elf-symbol-id='__tracepoint_android_vh_ep_create_wakeup_source'/>
       <var-decl name='__tracepoint_android_vh_exclude_reserved_zone' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_exclude_reserved_zone' visibility='default' filepath='include/trace/hooks/mm.h' line='91' column='1' elf-symbol-id='__tracepoint_android_vh_exclude_reserved_zone'/>
+      <var-decl name='__tracepoint_android_vh_exit_check' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_exit_check' visibility='default' filepath='include/trace/hooks/dtask.h' line='107' column='1' elf-symbol-id='__tracepoint_android_vh_exit_check'/>
       <var-decl name='__tracepoint_android_vh_exit_creds' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_exit_creds' visibility='default' filepath='include/trace/hooks/creds.h' line='27' column='1' elf-symbol-id='__tracepoint_android_vh_exit_creds'/>
       <var-decl name='__tracepoint_android_vh_exit_mm' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_exit_mm' visibility='default' filepath='include/trace/hooks/mm.h' line='84' column='1' elf-symbol-id='__tracepoint_android_vh_exit_mm'/>
       <var-decl name='__tracepoint_android_vh_filemap_fault_cache_page' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_filemap_fault_cache_page' visibility='default' filepath='include/trace/hooks/mm.h' line='78' column='1' elf-symbol-id='__tracepoint_android_vh_filemap_fault_cache_page'/>
@@ -125077,9 +125061,9 @@
         <parameter type-id='389faaf7' name='x' filepath='kernel/sched/completion.c' line='57' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='complete_and_exit' mangled-name='complete_and_exit' filepath='kernel/exit.c' line='940' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='complete_and_exit'>
-        <parameter type-id='389faaf7' name='comp' filepath='kernel/exit.c' line='940' column='1'/>
-        <parameter type-id='bd54fe1a' name='code' filepath='kernel/exit.c' line='940' column='1'/>
+      <function-decl name='complete_and_exit' mangled-name='complete_and_exit' filepath='kernel/exit.c' line='942' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='complete_and_exit'>
+        <parameter type-id='389faaf7' name='comp' filepath='kernel/exit.c' line='942' column='1'/>
+        <parameter type-id='bd54fe1a' name='code' filepath='kernel/exit.c' line='942' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='completion_done' mangled-name='completion_done' filepath='kernel/sched/completion.c' line='315' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='completion_done'>
@@ -128736,8 +128720,8 @@
         <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_io.c' line='3045' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='do_exit' mangled-name='do_exit' filepath='kernel/exit.c' line='762' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='do_exit'>
-        <parameter type-id='bd54fe1a' name='code' filepath='kernel/exit.c' line='762' column='1'/>
+      <function-decl name='do_exit' mangled-name='do_exit' filepath='kernel/exit.c' line='763' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='do_exit'>
+        <parameter type-id='bd54fe1a' name='code' filepath='kernel/exit.c' line='763' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='do_trace_rcu_torture_read' mangled-name='do_trace_rcu_torture_read' filepath='kernel/rcu/update.c' line='467' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='do_trace_rcu_torture_read'>
@@ -141735,8 +141719,8 @@
         <parameter type-id='1d2c2b85' name='gp_seq' filepath='kernel/rcu/tree.c' line='600' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcuwait_wake_up' mangled-name='rcuwait_wake_up' filepath='kernel/exit.c' line='280' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcuwait_wake_up'>
-        <parameter type-id='9b25216e' name='w' filepath='kernel/exit.c' line='280' column='1'/>
+      <function-decl name='rcuwait_wake_up' mangled-name='rcuwait_wake_up' filepath='kernel/exit.c' line='281' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcuwait_wake_up'>
+        <parameter type-id='9b25216e' name='w' filepath='kernel/exit.c' line='281' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='rdev_get_dev' mangled-name='rdev_get_dev' filepath='drivers/regulator/core.c' line='5666' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_dev'>
diff --git a/android/abi_gki_aarch64_transsion b/android/abi_gki_aarch64_transsion
index d238c721db9e..44ebe94b4069 100644
--- a/android/abi_gki_aarch64_transsion
+++ b/android/abi_gki_aarch64_transsion
@@ -46,6 +46,7 @@
   __traceiter_android_vh_unuse_swap_page
   __traceiter_android_vh_waiting_for_page_migration
   __traceiter_android_vh_should_end_madvise
+  __traceiter_android_vh_exit_check
   __tracepoint_android_rvh_alloc_si
   __tracepoint_android_rvh_alloc_swap_slot_cache
   __tracepoint_android_rvh_drain_slots_cache_cpu
@@ -82,4 +83,5 @@
   __tracepoint_android_vh_unuse_swap_page
   __tracepoint_android_vh_waiting_for_page_migration
   __tracepoint_android_vh_should_end_madvise
+  __tracepoint_android_vh_exit_check
   zero_pfn

From 517fdcc1f8c370c06e4cbae1a210cc01e35e9ac7 Mon Sep 17 00:00:00 2001
From: Fuchun Liao <lfc@oppo.com>
Date: Wed, 21 Feb 2024 10:21:26 +0800
Subject: [PATCH 1025/1043] ANDROID: binder: Add vendor hook to fix priority
 restore

When cpu loading is high, the task maybe preempted after restoring the
sched priority in trace_android_vh_binder_free_buf(). This means that
node->has_async_transaction can't be cleared immediately and the work
isn't added to the proc->todo queue as soon as possible.

To fix this we add a new hook trace_android_vh_binder_buffer_release()
to restore the priority after node->has_async_transaction has been
updated and the node->work has been added to the proc->todo queue.

Note: the old trace_android_vh_binder_free_buf() hook is kept to avoid
breaking KMI but is not extrictly needed.

Bug: 327307900
Fixes: 0eb66ec39ca8 ("ANDROID: vendor_hooks: Add hooks for binder")
Change-Id: I8126c79c9c68faa3ce0cd87ce83e2591bd61d5dd
Signed-off-by: Fuchun Liao <lfc@oppo.com>
[cmllamas: fix-up commit log and variable naming]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
---
 drivers/android/binder.c       | 4 ++++
 drivers/android/vendor_hooks.c | 1 +
 include/trace/hooks/binder.h   | 4 ++++
 3 files changed, 9 insertions(+)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index cf3ffa31dbff..77086b16de49 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3830,12 +3830,14 @@ binder_free_buf(struct binder_proc *proc,
 		struct binder_buffer *buffer, bool is_failure)
 {
 	bool enqueue_task = true;
+	bool has_transaction = false;
 
 	trace_android_vh_binder_free_buf(proc, thread, buffer);
 	binder_inner_proc_lock(proc);
 	if (buffer->transaction) {
 		buffer->transaction->buffer = NULL;
 		buffer->transaction = NULL;
+		has_transaction = true;
 	}
 	binder_inner_proc_unlock(proc);
 	if (buffer->async_transaction && buffer->target_node) {
@@ -3859,6 +3861,8 @@ binder_free_buf(struct binder_proc *proc,
 		}
 		binder_node_inner_unlock(buf_node);
 	}
+	trace_android_vh_binder_buffer_release(proc, thread, buffer,
+			has_transaction);
 	trace_binder_transaction_buffer_release(buffer);
 	binder_release_entire_buffer(proc, thread, buffer, is_failure);
 	binder_alloc_free_buf(&proc->alloc, buffer);
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index bc24a8510e02..cbe29c8749b1 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -506,6 +506,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_transaction_received);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_free_oem_binder_struct);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_special_task);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_free_buf);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_binder_buffer_release);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_perf_huristic_ctrl);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_send_command_post_change);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_abort_success_ctrl);
diff --git a/include/trace/hooks/binder.h b/include/trace/hooks/binder.h
index c12926edc615..234917699ee1 100644
--- a/include/trace/hooks/binder.h
+++ b/include/trace/hooks/binder.h
@@ -140,6 +140,10 @@ DECLARE_HOOK(android_vh_binder_free_buf,
 	TP_PROTO(struct binder_proc *proc, struct binder_thread *thread,
 		struct binder_buffer *buffer),
 	TP_ARGS(proc, thread, buffer));
+DECLARE_HOOK(android_vh_binder_buffer_release,
+	TP_PROTO(struct binder_proc *proc, struct binder_thread *thread,
+		struct binder_buffer *buffer, bool has_transaction),
+	TP_ARGS(proc, thread, buffer, has_transaction));
 /* macro versions of hooks are no longer required */
 
 #endif /* _TRACE_HOOK_BINDER_H */

From b2e58fe5d71c3fc5ccb77ed78a98670df2a76b50 Mon Sep 17 00:00:00 2001
From: lfc <lfc@oppo.com>
Date: Wed, 28 Feb 2024 16:20:17 +0800
Subject: [PATCH 1026/1043] ANDROID: ABI: Update oplus symbol list

1 Added function:
  [A] 'function int __traceiter_android_vh_binder_buffer_release(void*, binder_proc*, binder_thread*, binder_buffer*, bool)'

1 Added variable:
  [A] 'tracepoint __tracepoint_android_vh_binder_buffer_release'

Bug: 327307900

Change-Id: I6bca73bc3edb2d1deadc38daec96baa486f15929
Signed-off-by: Fuchun Liao <lfc@oppo.com>
---
 android/abi_gki_aarch64.xml   | 11 +++++++++++
 android/abi_gki_aarch64_oplus |  2 ++
 2 files changed, 13 insertions(+)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index ca3a5dd58993..4ca70aaed6bf 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -439,6 +439,7 @@
       <elf-symbol name='__traceiter_android_vh_alter_rwsem_list_add' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2817e3af'/>
       <elf-symbol name='__traceiter_android_vh_arch_set_freq_scale' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb98e0e01'/>
       <elf-symbol name='__traceiter_android_vh_binder_alloc_new_buf_locked' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb4774778'/>
+      <elf-symbol name='__traceiter_android_vh_binder_buffer_release' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3de41161'/>
       <elf-symbol name='__traceiter_android_vh_binder_del_ref' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdd48448e'/>
       <elf-symbol name='__traceiter_android_vh_binder_free_buf' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x71365aee'/>
       <elf-symbol name='__traceiter_android_vh_binder_free_proc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1542af58'/>
@@ -6551,6 +6552,7 @@
       <elf-symbol name='__tracepoint_android_vh_alter_rwsem_list_add' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf6e930a'/>
       <elf-symbol name='__tracepoint_android_vh_arch_set_freq_scale' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x31d4f5d9'/>
       <elf-symbol name='__tracepoint_android_vh_binder_alloc_new_buf_locked' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfc0fb264'/>
+      <elf-symbol name='__tracepoint_android_vh_binder_buffer_release' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x41b14d7'/>
       <elf-symbol name='__tracepoint_android_vh_binder_del_ref' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xeff065ad'/>
       <elf-symbol name='__tracepoint_android_vh_binder_free_buf' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x35d0b77f'/>
       <elf-symbol name='__tracepoint_android_vh_binder_free_proc' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7a91a84d'/>
@@ -119477,6 +119479,14 @@
         <parameter type-id='95e97e5e' name='is_async' filepath='include/trace/hooks/binder.h' line='62' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_vh_binder_buffer_release' mangled-name='__traceiter_android_vh_binder_buffer_release' filepath='include/trace/hooks/binder.h' line='143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_binder_buffer_release'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/binder.h' line='143' column='1'/>
+        <parameter type-id='d1cf113c' name='proc' filepath='include/trace/hooks/binder.h' line='143' column='1'/>
+        <parameter type-id='dd695fa4' name='thread' filepath='include/trace/hooks/binder.h' line='143' column='1'/>
+        <parameter type-id='5819e862' name='buffer' filepath='include/trace/hooks/binder.h' line='143' column='1'/>
+        <parameter type-id='b50a4934' name='has_transaction' filepath='include/trace/hooks/binder.h' line='143' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_vh_binder_del_ref' mangled-name='__traceiter_android_vh_binder_del_ref' filepath='include/trace/hooks/binder.h' line='93' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_binder_del_ref'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/binder.h' line='93' column='1'/>
         <parameter type-id='f23e2572' name='proc' filepath='include/trace/hooks/binder.h' line='93' column='1'/>
@@ -121931,6 +121941,7 @@
       <var-decl name='__tracepoint_android_vh_alter_rwsem_list_add' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_alter_rwsem_list_add' visibility='default' filepath='include/trace/hooks/rwsem.h' line='29' column='1' elf-symbol-id='__tracepoint_android_vh_alter_rwsem_list_add'/>
       <var-decl name='__tracepoint_android_vh_arch_set_freq_scale' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_arch_set_freq_scale' visibility='default' filepath='include/trace/hooks/topology.h' line='14' column='1' elf-symbol-id='__tracepoint_android_vh_arch_set_freq_scale'/>
       <var-decl name='__tracepoint_android_vh_binder_alloc_new_buf_locked' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_binder_alloc_new_buf_locked' visibility='default' filepath='include/trace/hooks/binder.h' line='62' column='1' elf-symbol-id='__tracepoint_android_vh_binder_alloc_new_buf_locked'/>
+      <var-decl name='__tracepoint_android_vh_binder_buffer_release' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_binder_buffer_release' visibility='default' filepath='include/trace/hooks/binder.h' line='143' column='1' elf-symbol-id='__tracepoint_android_vh_binder_buffer_release'/>
       <var-decl name='__tracepoint_android_vh_binder_del_ref' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_binder_del_ref' visibility='default' filepath='include/trace/hooks/binder.h' line='93' column='1' elf-symbol-id='__tracepoint_android_vh_binder_del_ref'/>
       <var-decl name='__tracepoint_android_vh_binder_free_buf' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_binder_free_buf' visibility='default' filepath='include/trace/hooks/binder.h' line='139' column='1' elf-symbol-id='__tracepoint_android_vh_binder_free_buf'/>
       <var-decl name='__tracepoint_android_vh_binder_free_proc' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_binder_free_proc' visibility='default' filepath='include/trace/hooks/binder.h' line='107' column='1' elf-symbol-id='__tracepoint_android_vh_binder_free_proc'/>
diff --git a/android/abi_gki_aarch64_oplus b/android/abi_gki_aarch64_oplus
index 5e9fe7e2cbb6..078753815e90 100644
--- a/android/abi_gki_aarch64_oplus
+++ b/android/abi_gki_aarch64_oplus
@@ -2976,6 +2976,7 @@
   __traceiter_android_vh_free_oem_binder_struct
   __traceiter_android_vh_binder_special_task
   __traceiter_android_vh_binder_free_buf
+  __traceiter_android_vh_binder_buffer_release
   __tracepoint_android_rvh_account_irq
   __tracepoint_android_rvh_after_enqueue_task
   __tracepoint_android_rvh_build_perf_domains
@@ -3257,6 +3258,7 @@
   __tracepoint_android_vh_free_oem_binder_struct
   __tracepoint_android_vh_binder_special_task
   __tracepoint_android_vh_binder_free_buf
+  __tracepoint_android_vh_binder_buffer_release
   trace_print_array_seq
   trace_print_flags_seq
   trace_print_hex_seq

From 34338029ab2a14f3688f3098e5c6e59afa8bdeab Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 14:59:29 +0800
Subject: [PATCH 1027/1043] ANDROID: add hooks into bio.c for customized I/O
 scheduler

android_vh_bio_free: We have added some additional information to
each bio, which needs to be freed simultaneously when the bio is free

Bug: 319582497

Change-Id: I532f98fa0569f2eb8da66cff746349c828e0912c
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/bio.c                    | 2 ++
 drivers/android/vendor_hooks.c | 1 +
 include/trace/hooks/block.h    | 5 +++++
 3 files changed, 8 insertions(+)

diff --git a/block/bio.c b/block/bio.c
index 6d6e7b96b002..d03952b9e76d 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -21,6 +21,7 @@
 #include <linux/blk-crypto.h>
 
 #include <trace/events/block.h>
+#include <trace/hooks/block.h>
 #include "blk.h"
 #include "blk-rq-qos.h"
 
@@ -252,6 +253,7 @@ static void bio_free(struct bio *bio)
 	struct bio_set *bs = bio->bi_pool;
 	void *p;
 
+	trace_android_vh_bio_free(bio);
 	bio_uninit(bio);
 
 	if (bs) {
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index cbe29c8749b1..b5e1c85f1472 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -517,6 +517,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_print_ctrl);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_vmscan_kswapd_done);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_swap_page_spf);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_exit_check);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_bio_free);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/block.h b/include/trace/hooks/block.h
index a5a7ac70a2ee..a748dae4671e 100644
--- a/include/trace/hooks/block.h
+++ b/include/trace/hooks/block.h
@@ -22,6 +22,7 @@ struct blk_mq_tag_set;
 /* struct blk_mq_tag_set */
 #include <linux/blk-mq.h>
 #endif /* __GENKSYMS__ */
+struct bio;
 
 DECLARE_HOOK(android_vh_blk_alloc_rqs,
 	TP_PROTO(size_t *rq_size, struct blk_mq_tag_set *set,
@@ -33,6 +34,10 @@ DECLARE_HOOK(android_vh_blk_rq_ctx_init,
 		struct blk_mq_alloc_data *data, u64 alloc_time_ns),
 	TP_ARGS(rq, tags, data, alloc_time_ns));
 
+DECLARE_HOOK(android_vh_bio_free,
+	TP_PROTO(struct bio *bio),
+	TP_ARGS(bio));
+
 #endif /* _TRACE_HOOK_BLOCK_H */
 
 /* This part must be outside protection */

From ccbc7f88080dc680f0c029bf13a3665e12c80f0a Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 19:49:07 +0800
Subject: [PATCH 1028/1043] ANDROID: add hooks into blk-mq.c for customized I/O
 scheduler.

Our scheduler uses the ANDROID_OEM_DATA field in the request_queue
structure to customize a set of ops operations for the request queue
applied by the ufs/emmc driver. Adopt fine-grained IO scheduling
strategies based on specific request types and user scenarios

android_rvh_internal_blk_mq_alloc_request: Obtain a new tag.
This process may be scheduled because the tag cannot be allocated
quickly, so a restricted hook is required.

android_vh_internal_blk_mq_free_request: Release individually allocated
tags

android_vh_blk_mq_complete_request: Record the time when the request was
completed

android_vh_blk_mq_add_to_requeue_list: Add requests to a separate
distribution queue

android_rvh_blk_mq_delay_run_hw_queue: The process of calling queue_rq
to handle the request may be scheduled, so restricted hooks need to be
used

android_vh_blk_mq_run_hw_queue: Set need_run to true

android_vh_blk_mq_insert_request: Insert the request into a customized
queue

android_rvh_blk_mq_alloc_rq_map: The process of assigning customized
tags may be scheduled, so restricted hooks need to be used

android_rvh_blk_mq_init_allocated_queue: The customized scheduler is
initialized and needs to allocate some resources. This process may be
scheduled, so restricted hooks need to be used

android_vh_blk_mq_exit_queue: Release resources allocated by the
customized scheduler

android_vh_blk_mq_alloc_tag_set: Get tagset information

Bug: 319582497

Change-Id: I2b16d69a1e7085a4f5f82660b75188c517b01894
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/blk-mq.c                 | 46 ++++++++++++++++++++++---
 drivers/android/vendor_hooks.c | 11 ++++++
 include/trace/hooks/block.h    | 62 +++++++++++++++++++++++++++++++++-
 3 files changed, 114 insertions(+), 5 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 21544b119a7e..f5dc90f25d31 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -353,6 +353,7 @@ static struct request *__blk_mq_alloc_request(struct blk_mq_alloc_data *data)
 	struct elevator_queue *e = q->elevator;
 	u64 alloc_time_ns = 0;
 	unsigned int tag;
+	bool skip = false;
 
 	/* alloc_time includes depth and tag waits */
 	if (blk_queue_rq_alloc_time(q))
@@ -384,7 +385,9 @@ static struct request *__blk_mq_alloc_request(struct blk_mq_alloc_data *data)
 	 * case just retry the hctx assignment and tag allocation as CPU hotplug
 	 * should have migrated us to an online CPU by now.
 	 */
-	tag = blk_mq_get_tag(data);
+	trace_android_rvh_internal_blk_mq_alloc_request(&skip, &tag, data);
+	if (!skip)
+		tag = blk_mq_get_tag(data);
 	if (tag == BLK_MQ_NO_TAG) {
 		if (data->flags & BLK_MQ_REQ_NOWAIT)
 			return NULL;
@@ -496,12 +499,17 @@ static void __blk_mq_free_request(struct request *rq)
 	struct blk_mq_ctx *ctx = rq->mq_ctx;
 	struct blk_mq_hw_ctx *hctx = rq->mq_hctx;
 	const int sched_tag = rq->internal_tag;
+	bool skip = false;
 
 	blk_crypto_free_request(rq);
 	blk_pm_mark_last_busy(rq);
 	rq->mq_hctx = NULL;
-	if (rq->tag != BLK_MQ_NO_TAG)
-		blk_mq_put_tag(hctx->tags, ctx, rq->tag);
+
+	trace_android_vh_internal_blk_mq_free_request(&skip, rq, hctx);
+	if (!skip) {
+		if (rq->tag != BLK_MQ_NO_TAG)
+			blk_mq_put_tag(hctx->tags, ctx, rq->tag);
+	}
 	if (sched_tag != BLK_MQ_NO_TAG)
 		blk_mq_put_tag(hctx->sched_tags, ctx, sched_tag);
 	blk_mq_sched_restart(hctx);
@@ -701,6 +709,11 @@ EXPORT_SYMBOL_GPL(blk_mq_complete_request_remote);
  **/
 void blk_mq_complete_request(struct request *rq)
 {
+	bool skip = false;
+
+	trace_android_vh_blk_mq_complete_request(&skip, rq);
+	if (skip)
+		return;
 	if (!blk_mq_complete_request_remote(rq))
 		rq->q->mq_ops->complete(rq);
 }
@@ -827,7 +840,12 @@ void blk_mq_add_to_requeue_list(struct request *rq, bool at_head,
 {
 	struct request_queue *q = rq->q;
 	unsigned long flags;
+	bool skip = false;
 
+	trace_android_vh_blk_mq_add_to_requeue_list(&skip, rq,
+						     kick_requeue_list);
+	if (skip)
+		return;
 	/*
 	 * We abuse this flag that is otherwise used by the I/O scheduler to
 	 * request head insertion from the workqueue.
@@ -1593,9 +1611,15 @@ static int blk_mq_hctx_next_cpu(struct blk_mq_hw_ctx *hctx)
 static void __blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async,
 					unsigned long msecs)
 {
+	bool skip = false;
+
 	if (unlikely(blk_mq_hctx_stopped(hctx)))
 		return;
 
+	trace_android_rvh_blk_mq_delay_run_hw_queue(&skip, hctx, async);
+	if (skip)
+		return;
+
 	if (!async && !(hctx->flags & BLK_MQ_F_BLOCKING)) {
 		int cpu = get_cpu();
 		if (cpumask_test_cpu(cpu, hctx->cpumask)) {
@@ -1651,6 +1675,7 @@ void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
 		blk_mq_hctx_has_pending(hctx);
 	hctx_unlock(hctx, srcu_idx);
 
+	trace_android_vh_blk_mq_run_hw_queue(&need_run, hctx);
 	if (need_run)
 		__blk_mq_delay_run_hw_queue(hctx, async, 0);
 }
@@ -1877,9 +1902,14 @@ void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
 			     bool at_head)
 {
 	struct blk_mq_ctx *ctx = rq->mq_ctx;
+	bool skip = false;
 
 	lockdep_assert_held(&ctx->lock);
 
+	trace_android_vh_blk_mq_insert_request(&skip, hctx, rq);
+	if (skip)
+		return;
+
 	__blk_mq_insert_req_list(hctx, rq, at_head);
 	blk_mq_hctx_mark_pending(hctx, ctx);
 }
@@ -2419,12 +2449,15 @@ struct blk_mq_tags *blk_mq_alloc_rq_map(struct blk_mq_tag_set *set,
 {
 	struct blk_mq_tags *tags;
 	int node;
+	bool skip = false;
 
 	node = blk_mq_hw_queue_to_node(&set->map[HCTX_TYPE_DEFAULT], hctx_idx);
 	if (node == NUMA_NO_NODE)
 		node = set->numa_node;
 
-	tags = blk_mq_init_tags(nr_tags, reserved_tags, node, flags);
+	trace_android_rvh_blk_mq_alloc_rq_map(&skip, &tags, set, node, flags);
+	if (!skip)
+		tags = blk_mq_init_tags(nr_tags, reserved_tags, node, flags);
 	if (!tags)
 		return NULL;
 
@@ -3362,6 +3395,8 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
 	blk_mq_add_queue_tag_set(set, q);
 	blk_mq_map_swqueue(q);
 
+	trace_android_rvh_blk_mq_init_allocated_queue(q);
+
 	if (elevator_init)
 		elevator_init_mq(q);
 
@@ -3385,6 +3420,7 @@ void blk_mq_exit_queue(struct request_queue *q)
 {
 	struct blk_mq_tag_set *set = q->tag_set;
 
+	trace_android_vh_blk_mq_exit_queue(q);
 	/* Checks hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED. */
 	blk_mq_exit_hw_queues(q, set, set->nr_hw_queues);
 	/* May clear BLK_MQ_F_TAG_QUEUE_SHARED in hctx->flags. */
@@ -3575,6 +3611,8 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set)
 	if (ret)
 		goto out_free_mq_map;
 
+	trace_android_vh_blk_mq_alloc_tag_set(set);
+
 	ret = blk_mq_alloc_map_and_requests(set);
 	if (ret)
 		goto out_free_mq_map;
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index b5e1c85f1472..88c5f093c6b5 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -518,6 +518,17 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_vmscan_kswapd_done);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_do_swap_page_spf);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_exit_check);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_bio_free);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_internal_blk_mq_alloc_request);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_internal_blk_mq_free_request);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_complete_request);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_add_to_requeue_list);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_mq_delay_run_hw_queue);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_run_hw_queue);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_insert_request);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_mq_alloc_rq_map);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_mq_init_allocated_queue);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_exit_queue);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_alloc_tag_set);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/block.h b/include/trace/hooks/block.h
index a748dae4671e..39cba4bd0756 100644
--- a/include/trace/hooks/block.h
+++ b/include/trace/hooks/block.h
@@ -14,15 +14,18 @@
 struct blk_mq_tags;
 struct blk_mq_alloc_data;
 struct blk_mq_tag_set;
+struct blk_mq_hw_ctx;
 #else
 /* struct blk_mq_tags */
 #include <../block/blk-mq-tag.h>
 /* struct blk_mq_alloc_data */
 #include <../block/blk-mq.h>
-/* struct blk_mq_tag_set */
+/* struct blk_mq_tag_set struct blk_mq_hw_ctx*/
 #include <linux/blk-mq.h>
 #endif /* __GENKSYMS__ */
 struct bio;
+struct request_queue;
+struct request;
 
 DECLARE_HOOK(android_vh_blk_alloc_rqs,
 	TP_PROTO(size_t *rq_size, struct blk_mq_tag_set *set,
@@ -38,6 +41,63 @@ DECLARE_HOOK(android_vh_bio_free,
 	TP_PROTO(struct bio *bio),
 	TP_ARGS(bio));
 
+DECLARE_RESTRICTED_HOOK(android_rvh_internal_blk_mq_alloc_request,
+	TP_PROTO(bool *skip, int *tag, struct blk_mq_alloc_data *data),
+	TP_ARGS(skip, tag, data), 1);
+
+DECLARE_HOOK(android_vh_internal_blk_mq_free_request,
+	TP_PROTO(bool *skip, struct request *rq, struct blk_mq_hw_ctx *hctx),
+	TP_ARGS(skip, rq, hctx));
+
+DECLARE_HOOK(android_vh_blk_mq_complete_request,
+	TP_PROTO(bool *skip, struct request *rq),
+	TP_ARGS(skip, rq));
+
+DECLARE_HOOK(android_vh_blk_mq_add_to_requeue_list,
+	TP_PROTO(bool *skip, struct request *rq, bool kick_requeue_list),
+	TP_ARGS(skip, rq, kick_requeue_list));
+
+DECLARE_HOOK(android_vh_blk_mq_get_driver_tag,
+	TP_PROTO(struct request *rq),
+	TP_ARGS(rq));
+
+DECLARE_RESTRICTED_HOOK(android_rvh_blk_mq_delay_run_hw_queue,
+	TP_PROTO(bool *skip, struct blk_mq_hw_ctx *hctx, bool async),
+	TP_ARGS(skip, hctx, async), 1);
+
+DECLARE_HOOK(android_vh_blk_mq_run_hw_queue,
+	TP_PROTO(bool *need_run, struct blk_mq_hw_ctx *hctx),
+	TP_ARGS(need_run, hctx));
+
+DECLARE_HOOK(android_vh_blk_mq_insert_request,
+	TP_PROTO(bool *skip, struct blk_mq_hw_ctx *hctx, struct request *rq),
+	TP_ARGS(skip, hctx, rq));
+
+DECLARE_RESTRICTED_HOOK(android_rvh_blk_mq_alloc_rq_map,
+	TP_PROTO(bool *skip, struct blk_mq_tags **tags,
+		struct blk_mq_tag_set *set, int node, unsigned int flags),
+	TP_ARGS(skip, tags, set, node, flags), 1);
+
+DECLARE_HOOK(android_vh_blk_mq_hctx_notify_dead,
+	TP_PROTO(bool *skip, struct blk_mq_hw_ctx *hctx),
+	TP_ARGS(skip, hctx));
+
+DECLARE_RESTRICTED_HOOK(android_rvh_blk_mq_init_allocated_queue,
+	TP_PROTO(struct request_queue *q),
+	TP_ARGS(q), 1);
+
+DECLARE_HOOK(android_vh_blk_mq_exit_queue,
+	TP_PROTO(struct request_queue *q),
+	TP_ARGS(q));
+
+DECLARE_HOOK(android_vh_blk_mq_alloc_tag_set,
+	TP_PROTO(struct blk_mq_tag_set *set),
+	TP_ARGS(set));
+
+DECLARE_HOOK(android_vh_blk_mq_update_nr_requests,
+	TP_PROTO(bool *skip, struct request_queue *q),
+	TP_ARGS(skip, q));
+
 #endif /* _TRACE_HOOK_BLOCK_H */
 
 /* This part must be outside protection */

From d26999236603f8ec32f2ba54ab5cbce4717ed7c2 Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 19:55:59 +0800
Subject: [PATCH 1029/1043] ANDROID: add hooks into blk-core.c for customized
 I/O scheduler

android_rvh_blk_allocated_queue_init: Allocate specific request_queue
information and save the pointer address in the ANDROID_OEM_DATA field.
The allocation process may be scheduled, so a restricted hook function
is used

android_rvh_blk_flush_plug_list: Flush the customized plug list. During
this process, the scheduled queue_rq will be called to process the
request, so a restricted hook function is used

Bug: 319582497

Change-Id: I0af3915de899b678ffd4f207cac2e35a744936b8
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/blk-core.c               | 9 +++++++++
 drivers/android/vendor_hooks.c | 2 ++
 include/trace/hooks/block.h    | 9 +++++++++
 3 files changed, 20 insertions(+)

diff --git a/block/blk-core.c b/block/blk-core.c
index d64ce14cbe6c..73adca697336 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -66,6 +66,9 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(block_rq_merge);
 EXPORT_TRACEPOINT_SYMBOL_GPL(block_rq_requeue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(block_rq_complete);
 
+#undef CREATE_TRACE_POINTS
+#include <trace/hooks/block.h>
+
 DEFINE_IDA(blk_queue_ida);
 
 /*
@@ -522,6 +525,7 @@ struct request_queue *blk_alloc_queue(int node_id)
 {
 	struct request_queue *q;
 	int ret;
+	bool skip = false;
 
 	q = kmem_cache_alloc_node(blk_requestq_cachep,
 				GFP_KERNEL | __GFP_ZERO, node_id);
@@ -585,6 +589,10 @@ struct request_queue *blk_alloc_queue(int node_id)
 	blk_set_default_limits(&q->limits);
 	q->nr_requests = BLKDEV_MAX_RQ;
 
+	trace_android_rvh_blk_allocated_queue_init(&skip, q);
+	if (skip)
+		goto fail_ref;
+
 	return q;
 
 fail_ref:
@@ -1761,6 +1769,7 @@ EXPORT_SYMBOL(blk_check_plugged);
 
 void blk_flush_plug_list(struct blk_plug *plug, bool from_schedule)
 {
+	trace_android_rvh_blk_flush_plug_list(plug, from_schedule);
 	flush_plug_callbacks(plug, from_schedule);
 
 	if (!list_empty(&plug->mq_list))
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 88c5f093c6b5..343ce4f1774e 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -529,6 +529,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_mq_alloc_rq_map);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_mq_init_allocated_queue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_exit_queue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_alloc_tag_set);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_allocated_queue_init);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_flush_plug_list);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/block.h b/include/trace/hooks/block.h
index 39cba4bd0756..9d2db2257e16 100644
--- a/include/trace/hooks/block.h
+++ b/include/trace/hooks/block.h
@@ -26,6 +26,7 @@ struct blk_mq_hw_ctx;
 struct bio;
 struct request_queue;
 struct request;
+struct blk_plug;
 
 DECLARE_HOOK(android_vh_blk_alloc_rqs,
 	TP_PROTO(size_t *rq_size, struct blk_mq_tag_set *set,
@@ -98,6 +99,14 @@ DECLARE_HOOK(android_vh_blk_mq_update_nr_requests,
 	TP_PROTO(bool *skip, struct request_queue *q),
 	TP_ARGS(skip, q));
 
+DECLARE_RESTRICTED_HOOK(android_rvh_blk_allocated_queue_init,
+	TP_PROTO(bool *skip, struct request_queue *q),
+	TP_ARGS(skip, q), 1);
+
+DECLARE_RESTRICTED_HOOK(android_rvh_blk_flush_plug_list,
+	TP_PROTO(struct blk_plug *plug, bool from_schedule),
+	TP_ARGS(plug, from_schedule), 1);
+
 #endif /* _TRACE_HOOK_BLOCK_H */
 
 /* This part must be outside protection */

From f76294a6557b6c99c9ca58d89232171cf693eac2 Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 20:18:19 +0800
Subject: [PATCH 1030/1043] ANDROID: add hooks into blk-flush.c for customized
 I/O scheduler

android_vh_blk_alloc_flush_queue: Expand the flush request size to carry
more customized information

Bug: 319582497

Change-Id: I728852bd29ff7f851545c52fbdeafa7cd3a4addf
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/blk-flush.c              | 10 ++++++++--
 drivers/android/vendor_hooks.c |  1 +
 include/trace/hooks/block.h    |  6 ++++++
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/block/blk-flush.c b/block/blk-flush.c
index 33b487b5cbf7..af59a7e4684f 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -467,11 +467,13 @@ int blkdev_issue_flush(struct block_device *bdev, gfp_t gfp_mask)
 }
 EXPORT_SYMBOL(blkdev_issue_flush);
 
+#include <trace/hooks/block.h>
 struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size,
 					      gfp_t flags)
 {
 	struct blk_flush_queue *fq;
 	int rq_sz = sizeof(struct request);
+	bool skip = false;
 
 	fq = kzalloc_node(sizeof(*fq), flags, node);
 	if (!fq)
@@ -479,8 +481,12 @@ struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size,
 
 	spin_lock_init(&fq->mq_flush_lock);
 
-	rq_sz = round_up(rq_sz + cmd_size, cache_line_size());
-	fq->flush_rq = kzalloc_node(rq_sz, flags, node);
+	trace_android_vh_blk_alloc_flush_queue(&skip, cmd_size, flags, node,
+					       fq);
+	if (!skip) {
+		rq_sz = round_up(rq_sz + cmd_size, cache_line_size());
+		fq->flush_rq = kzalloc_node(rq_sz, flags, node);
+	}
 	if (!fq->flush_rq)
 		goto fail_rq;
 
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 343ce4f1774e..6d881eb37081 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -531,6 +531,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_exit_queue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_alloc_tag_set);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_allocated_queue_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_flush_plug_list);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_alloc_flush_queue);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/block.h b/include/trace/hooks/block.h
index 9d2db2257e16..a58e5de14a70 100644
--- a/include/trace/hooks/block.h
+++ b/include/trace/hooks/block.h
@@ -27,6 +27,7 @@ struct bio;
 struct request_queue;
 struct request;
 struct blk_plug;
+struct blk_flush_queue;
 
 DECLARE_HOOK(android_vh_blk_alloc_rqs,
 	TP_PROTO(size_t *rq_size, struct blk_mq_tag_set *set,
@@ -107,6 +108,11 @@ DECLARE_RESTRICTED_HOOK(android_rvh_blk_flush_plug_list,
 	TP_PROTO(struct blk_plug *plug, bool from_schedule),
 	TP_ARGS(plug, from_schedule), 1);
 
+DECLARE_HOOK(android_vh_blk_alloc_flush_queue,
+	TP_PROTO(bool *skip, int cmd_size, int flags, int node,
+		 struct blk_flush_queue *fq),
+	TP_ARGS(skip, cmd_size, flags, node, fq));
+
 #endif /* _TRACE_HOOK_BLOCK_H */
 
 /* This part must be outside protection */

From 6912e0c8e9ff6035679c642c15ea31c077f248e2 Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 20:24:00 +0800
Subject: [PATCH 1031/1043] ANDROID: add hooks into blk-ma-tag.c for customized
 I/O scheduler

android_vh_blk_mq_all_tag_iter: The customized solution adds a new tag
type, so need to use the customized solution for traversal

android_vh_blk_mq_queue_tag_busy_iter: The customized solution adds a
new tag type, so need to use the customized solution for traversal

android_vh_blk_mq_free_tags: Release the customized tag

Bug: 319582497

Change-Id: I648a9a31c11c284a75653405b8f8521d9da34d20
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/blk-mq-tag.c             | 19 +++++++++++++++++++
 drivers/android/vendor_hooks.c |  4 ++++
 include/trace/hooks/blk_mq.h   | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 56 insertions(+)
 create mode 100644 include/trace/hooks/blk_mq.h

diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 16ad9e656610..a1125b9e34f1 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -15,6 +15,8 @@
 #include "blk-mq.h"
 #include "blk-mq-tag.h"
 
+#include <trace/hooks/blk_mq.h>
+
 /*
  * If a previously inactive queue goes active, bump the active user count.
  * We need to do this before try to allocate driver tag, then even if fail
@@ -336,8 +338,13 @@ static void bt_tags_for_each(struct blk_mq_tags *tags, struct sbitmap_queue *bt,
 static void __blk_mq_all_tag_iter(struct blk_mq_tags *tags,
 		busy_tag_iter_fn *fn, void *priv, unsigned int flags)
 {
+	bool skip = false;
+
 	WARN_ON_ONCE(flags & BT_TAG_ITER_RESERVED);
 
+	trace_android_vh_blk_mq_all_tag_iter(&skip, tags, fn, priv);
+	if (skip)
+		return;
 	if (tags->nr_reserved_tags)
 		bt_tags_for_each(tags, tags->breserved_tags, fn, priv,
 				 flags | BT_TAG_ITER_RESERVED);
@@ -438,6 +445,7 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn,
 {
 	struct blk_mq_hw_ctx *hctx;
 	int i;
+	bool skip = false;
 
 	/*
 	 * __blk_mq_update_nr_hw_queues() updates nr_hw_queues and queue_hw_ctx
@@ -457,6 +465,11 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn,
 		if (!blk_mq_hw_queue_mapped(hctx))
 			continue;
 
+		trace_android_vh_blk_mq_queue_tag_busy_iter(&skip, hctx, fn,
+							    priv);
+		if (skip)
+			continue;
+
 		if (tags->nr_reserved_tags)
 			bt_for_each(hctx, tags->breserved_tags, fn, priv, true);
 		bt_for_each(hctx, tags->bitmap_tags, fn, priv, false);
@@ -556,6 +569,12 @@ struct blk_mq_tags *blk_mq_init_tags(unsigned int total_tags,
 
 void blk_mq_free_tags(struct blk_mq_tags *tags, unsigned int flags)
 {
+	bool skip = false;
+
+	trace_android_vh_blk_mq_free_tags(&skip, tags);
+	if (skip)
+		return;
+
 	if (!(flags & BLK_MQ_F_TAG_HCTX_SHARED)) {
 		sbitmap_queue_free(tags->bitmap_tags);
 		sbitmap_queue_free(tags->breserved_tags);
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 6d881eb37081..57dc13ae6978 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -45,6 +45,7 @@
 #include <trace/hooks/thermal.h>
 #include <trace/hooks/ufshcd.h>
 #include <trace/hooks/block.h>
+#include <trace/hooks/blk_mq.h>
 #include <trace/hooks/cgroup.h>
 #include <trace/hooks/sys.h>
 #include <trace/hooks/traps.h>
@@ -532,6 +533,9 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_alloc_tag_set);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_allocated_queue_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_flush_plug_list);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_alloc_flush_queue);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_all_tag_iter);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_queue_tag_busy_iter);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_free_tags);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/blk_mq.h b/include/trace/hooks/blk_mq.h
new file mode 100644
index 000000000000..75d36a48ebad
--- /dev/null
+++ b/include/trace/hooks/blk_mq.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM blk_mq
+
+#define TRACE_INCLUDE_PATH trace/hooks
+
+#if !defined(_TRACE_HOOK_BLK_MQ_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_HOOK_BLK_MQ_H
+
+#include <trace/hooks/vendor_hooks.h>
+
+struct blk_mq_tag_set;
+struct blk_mq_hw_ctx;
+
+
+DECLARE_HOOK(android_vh_blk_mq_all_tag_iter,
+	TP_PROTO(bool *skip, struct blk_mq_tags *tags, busy_tag_iter_fn *fn,
+		 void *priv),
+	TP_ARGS(skip, tags, fn, priv));
+
+DECLARE_HOOK(android_vh_blk_mq_queue_tag_busy_iter,
+	TP_PROTO(bool *skip, struct blk_mq_hw_ctx *hctx, busy_iter_fn * fn,
+		 void *priv),
+	TP_ARGS(skip, hctx, fn, priv));
+
+DECLARE_HOOK(android_vh_blk_mq_free_tags,
+	TP_PROTO(bool *skip, struct blk_mq_tags *tags),
+	TP_ARGS(skip, tags));
+
+#endif /* _TRACE_HOOK_BLK_MQ_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>

From 94b9d8e5138287ff1e4a414c543b3b8e0fdd61a4 Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 20:36:37 +0800
Subject: [PATCH 1032/1043] ANDROID: add hooks into blk-mq-sched.c for
 customized I/O scheduler

android_vh_blk_mq_sched_insert_request: Add judgment on rq. If it is a
customized rq, it needs to be added to the corresponding customized
queue

Bug: 319582497

Change-Id: I2bf8fee37273b3495d60c64bb53e43debceb5614
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/blk-mq-sched.c           | 6 +++++-
 drivers/android/vendor_hooks.c | 1 +
 include/trace/hooks/block.h    | 4 ++++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index 91b7626dbcd1..856fe30f1a3c 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -422,6 +422,7 @@ static bool blk_mq_sched_bypass_insert(struct blk_mq_hw_ctx *hctx,
 	return false;
 }
 
+#include <trace/hooks/block.h>
 void blk_mq_sched_insert_request(struct request *rq, bool at_head,
 				 bool run_queue, bool async)
 {
@@ -429,10 +430,13 @@ void blk_mq_sched_insert_request(struct request *rq, bool at_head,
 	struct elevator_queue *e = q->elevator;
 	struct blk_mq_ctx *ctx = rq->mq_ctx;
 	struct blk_mq_hw_ctx *hctx = rq->mq_hctx;
+	bool skip = false;
 
 	WARN_ON(e && (rq->tag != BLK_MQ_NO_TAG));
 
-	if (blk_mq_sched_bypass_insert(hctx, !!e, rq)) {
+	trace_android_vh_blk_mq_sched_insert_request(&skip, rq);
+
+	if (!skip && blk_mq_sched_bypass_insert(hctx, !!e, rq)) {
 		/*
 		 * Firstly normal IO request is inserted to scheduler queue or
 		 * sw queue, meantime we add flush request to dispatch queue(
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 57dc13ae6978..04db2df1a662 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -536,6 +536,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_alloc_flush_queue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_all_tag_iter);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_queue_tag_busy_iter);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_free_tags);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_sched_insert_request);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/block.h b/include/trace/hooks/block.h
index a58e5de14a70..9126e6c0e3ff 100644
--- a/include/trace/hooks/block.h
+++ b/include/trace/hooks/block.h
@@ -113,6 +113,10 @@ DECLARE_HOOK(android_vh_blk_alloc_flush_queue,
 		 struct blk_flush_queue *fq),
 	TP_ARGS(skip, cmd_size, flags, node, fq));
 
+DECLARE_HOOK(android_vh_blk_mq_sched_insert_request,
+	TP_PROTO(bool *skip, struct request *rq),
+	TP_ARGS(skip, rq));
+
 #endif /* _TRACE_HOOK_BLOCK_H */
 
 /* This part must be outside protection */

From f6c4f779c6265de02ab98da360998a2b39e0476f Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Thu, 29 Feb 2024 09:18:41 +0800
Subject: [PATCH 1033/1043] ANDROID: GKI: Update symbols to symbol list

Leaf changes summary: 38 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 19 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 19 Added variables

19 Added functions:

  [A] 'function int __traceiter_android_rvh_blk_allocated_queue_init(void*, bool*, request_queue*)'
  [A] 'function int __traceiter_android_rvh_blk_flush_plug_list(void*, blk_plug*, bool)'
  [A] 'function int __traceiter_android_rvh_blk_mq_alloc_rq_map(void*, bool*, blk_mq_tags**, blk_mq_tag_set*, int, unsigned int)'
  [A] 'function int __traceiter_android_rvh_blk_mq_delay_run_hw_queue(void*, bool*, blk_mq_hw_ctx*, bool)'
  [A] 'function int __traceiter_android_rvh_blk_mq_init_allocated_queue(void*, request_queue*)'
  [A] 'function int __traceiter_android_rvh_internal_blk_mq_alloc_request(void*, bool*, int*, blk_mq_alloc_data*)'
  [A] 'function int __traceiter_android_vh_bio_free(void*, bio*)'
  [A] 'function int __traceiter_android_vh_blk_alloc_flush_queue(void*, bool*, int, int, int, blk_flush_queue*)'
  [A] 'function int __traceiter_android_vh_blk_mq_add_to_requeue_list(void*, bool*, request*, bool)'
  [A] 'function int __traceiter_android_vh_blk_mq_all_tag_iter(void*, bool*, blk_mq_tags*, busy_tag_iter_fn*, void*)'
  [A] 'function int __traceiter_android_vh_blk_mq_alloc_tag_set(void*, blk_mq_tag_set*)'
  [A] 'function int __traceiter_android_vh_blk_mq_complete_request(void*, bool*, request*)'
  [A] 'function int __traceiter_android_vh_blk_mq_exit_queue(void*, request_queue*)'
  [A] 'function int __traceiter_android_vh_blk_mq_free_tags(void*, bool*, blk_mq_tags*)'
  [A] 'function int __traceiter_android_vh_blk_mq_insert_request(void*, bool*, blk_mq_hw_ctx*, request*)'
  [A] 'function int __traceiter_android_vh_blk_mq_queue_tag_busy_iter(void*, bool*, blk_mq_hw_ctx*, busy_iter_fn*, void*)'
  [A] 'function int __traceiter_android_vh_blk_mq_run_hw_queue(void*, bool*, blk_mq_hw_ctx*)'
  [A] 'function int __traceiter_android_vh_blk_mq_sched_insert_request(void*, bool*, request*)'
  [A] 'function int __traceiter_android_vh_internal_blk_mq_free_request(void*, bool*, request*, blk_mq_hw_ctx*)'

19 Added variables:

  [A] 'tracepoint __tracepoint_android_rvh_blk_allocated_queue_init'
  [A] 'tracepoint __tracepoint_android_rvh_blk_flush_plug_list'
  [A] 'tracepoint __tracepoint_android_rvh_blk_mq_alloc_rq_map'
  [A] 'tracepoint __tracepoint_android_rvh_blk_mq_delay_run_hw_queue'
  [A] 'tracepoint __tracepoint_android_rvh_blk_mq_init_allocated_queue'
  [A] 'tracepoint __tracepoint_android_rvh_internal_blk_mq_alloc_request'
  [A] 'tracepoint __tracepoint_android_vh_bio_free'
  [A] 'tracepoint __tracepoint_android_vh_blk_alloc_flush_queue'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_add_to_requeue_list'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_all_tag_iter'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_alloc_tag_set'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_complete_request'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_exit_queue'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_free_tags'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_insert_request'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_queue_tag_busy_iter'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_run_hw_queue'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_sched_insert_request'
  [A] 'tracepoint __tracepoint_android_vh_internal_blk_mq_free_request'

Bug: 319582497

Change-Id: I35d4708c6fa74041783784299a5182b68eb762b2
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 android/abi_gki_aarch64.xml       | 617 ++++++++++++++++++++----------
 android/abi_gki_aarch64_transsion |  38 ++
 2 files changed, 455 insertions(+), 200 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 4ca70aaed6bf..0a23f060cffa 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -312,6 +312,11 @@
       <elf-symbol name='__traceiter_android_rvh_arm64_serror_panic' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe90dfa30'/>
       <elf-symbol name='__traceiter_android_rvh_bad_mode' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3dc2e9e1'/>
       <elf-symbol name='__traceiter_android_rvh_binder_transaction' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf57c4087'/>
+      <elf-symbol name='__traceiter_android_rvh_blk_allocated_queue_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe1a72e48'/>
+      <elf-symbol name='__traceiter_android_rvh_blk_flush_plug_list' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x563beda3'/>
+      <elf-symbol name='__traceiter_android_rvh_blk_mq_alloc_rq_map' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2c5a29eb'/>
+      <elf-symbol name='__traceiter_android_rvh_blk_mq_delay_run_hw_queue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x96ab47'/>
+      <elf-symbol name='__traceiter_android_rvh_blk_mq_init_allocated_queue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4d9a2052'/>
       <elf-symbol name='__traceiter_android_rvh_build_perf_domains' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4b4a53af'/>
       <elf-symbol name='__traceiter_android_rvh_can_migrate_task' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x44f6f339'/>
       <elf-symbol name='__traceiter_android_rvh_cgroup_force_kthread_migration' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x453305e0'/>
@@ -352,6 +357,7 @@
       <elf-symbol name='__traceiter_android_rvh_get_swap_page' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x465de79d'/>
       <elf-symbol name='__traceiter_android_rvh_gic_v3_set_affinity' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x25a6dad6'/>
       <elf-symbol name='__traceiter_android_rvh_handle_pte_fault_end' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4d48345a'/>
+      <elf-symbol name='__traceiter_android_rvh_internal_blk_mq_alloc_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe50e1ee'/>
       <elf-symbol name='__traceiter_android_rvh_iommu_setup_dma_ops' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x18bdcba6'/>
       <elf-symbol name='__traceiter_android_rvh_irqs_disable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x707d1f10'/>
       <elf-symbol name='__traceiter_android_rvh_irqs_enable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7a345722'/>
@@ -464,7 +470,19 @@
       <elf-symbol name='__traceiter_android_vh_binder_transaction_received' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xffec96fd'/>
       <elf-symbol name='__traceiter_android_vh_binder_wait_for_work' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1c902cd9'/>
       <elf-symbol name='__traceiter_android_vh_binder_wakeup_ilocked' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x418a26b2'/>
+      <elf-symbol name='__traceiter_android_vh_bio_free' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2a161502'/>
+      <elf-symbol name='__traceiter_android_vh_blk_alloc_flush_queue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x92bac4d9'/>
       <elf-symbol name='__traceiter_android_vh_blk_alloc_rqs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9ed158df'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_add_to_requeue_list' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbe59fea7'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_all_tag_iter' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8020ae79'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_alloc_tag_set' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd4323541'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_complete_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3a9056f9'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_exit_queue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x251264f0'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_free_tags' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9dc87c69'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_insert_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x67063237'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_queue_tag_busy_iter' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd4033674'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_run_hw_queue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x884b716c'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_sched_insert_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2ed2b5a'/>
       <elf-symbol name='__traceiter_android_vh_blk_rq_ctx_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x644af33f'/>
       <elf-symbol name='__traceiter_android_vh_build_sched_domains' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf1522f52'/>
       <elf-symbol name='__traceiter_android_vh_cgroup_attach' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5ce3c902'/>
@@ -550,6 +568,7 @@
       <elf-symbol name='__traceiter_android_vh_inactive_is_low' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x500ba3a7'/>
       <elf-symbol name='__traceiter_android_vh_include_reserved_zone' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe1272155'/>
       <elf-symbol name='__traceiter_android_vh_init_swap_info_struct' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x98d473fa'/>
+      <elf-symbol name='__traceiter_android_vh_internal_blk_mq_free_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xaeb2449d'/>
       <elf-symbol name='__traceiter_android_vh_iommu_alloc_iova' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfc2a81cc'/>
       <elf-symbol name='__traceiter_android_vh_iommu_free_iova' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x364f5d4'/>
       <elf-symbol name='__traceiter_android_vh_iommu_iovad_alloc_iova' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x55a0de3'/>
@@ -6425,6 +6444,11 @@
       <elf-symbol name='__tracepoint_android_rvh_arm64_serror_panic' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3eeb0795'/>
       <elf-symbol name='__tracepoint_android_rvh_bad_mode' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x11c4733a'/>
       <elf-symbol name='__tracepoint_android_rvh_binder_transaction' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4f8ddeb5'/>
+      <elf-symbol name='__tracepoint_android_rvh_blk_allocated_queue_init' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9f5ed90a'/>
+      <elf-symbol name='__tracepoint_android_rvh_blk_flush_plug_list' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x76830e1f'/>
+      <elf-symbol name='__tracepoint_android_rvh_blk_mq_alloc_rq_map' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9675344f'/>
+      <elf-symbol name='__tracepoint_android_rvh_blk_mq_delay_run_hw_queue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcdbc5348'/>
+      <elf-symbol name='__tracepoint_android_rvh_blk_mq_init_allocated_queue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb501ea69'/>
       <elf-symbol name='__tracepoint_android_rvh_build_perf_domains' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7ff307b5'/>
       <elf-symbol name='__tracepoint_android_rvh_can_migrate_task' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x89ef9455'/>
       <elf-symbol name='__tracepoint_android_rvh_cgroup_force_kthread_migration' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc180285'/>
@@ -6465,6 +6489,7 @@
       <elf-symbol name='__tracepoint_android_rvh_get_swap_page' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x647dedce'/>
       <elf-symbol name='__tracepoint_android_rvh_gic_v3_set_affinity' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6ffd12d7'/>
       <elf-symbol name='__tracepoint_android_rvh_handle_pte_fault_end' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6adf3b7c'/>
+      <elf-symbol name='__tracepoint_android_rvh_internal_blk_mq_alloc_request' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc10682d1'/>
       <elf-symbol name='__tracepoint_android_rvh_iommu_setup_dma_ops' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2461d175'/>
       <elf-symbol name='__tracepoint_android_rvh_irqs_disable' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x44ac9f4b'/>
       <elf-symbol name='__tracepoint_android_rvh_irqs_enable' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc9d53b36'/>
@@ -6577,7 +6602,19 @@
       <elf-symbol name='__tracepoint_android_vh_binder_transaction_received' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x886b6106'/>
       <elf-symbol name='__tracepoint_android_vh_binder_wait_for_work' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9168ce14'/>
       <elf-symbol name='__tracepoint_android_vh_binder_wakeup_ilocked' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x45c1c15b'/>
+      <elf-symbol name='__tracepoint_android_vh_bio_free' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb55c7078'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_alloc_flush_queue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1267dea4'/>
       <elf-symbol name='__tracepoint_android_vh_blk_alloc_rqs' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x23957f60'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_add_to_requeue_list' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2ea47a42'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_all_tag_iter' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xeaf2ce99'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_alloc_tag_set' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5974d1f8'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_complete_request' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf382518d'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_exit_queue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa8cd98b7'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_free_tags' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd65200b7'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_insert_request' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd940959e'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_queue_tag_busy_iter' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb51b6eda'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_run_hw_queue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xebf20441'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_sched_insert_request' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd9a5bc2f'/>
       <elf-symbol name='__tracepoint_android_vh_blk_rq_ctx_init' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa5491a33'/>
       <elf-symbol name='__tracepoint_android_vh_build_sched_domains' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe9491ecd'/>
       <elf-symbol name='__tracepoint_android_vh_cgroup_attach' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x83be6a33'/>
@@ -6663,6 +6700,7 @@
       <elf-symbol name='__tracepoint_android_vh_inactive_is_low' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9da95945'/>
       <elf-symbol name='__tracepoint_android_vh_include_reserved_zone' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdf6b3544'/>
       <elf-symbol name='__tracepoint_android_vh_init_swap_info_struct' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1264c599'/>
+      <elf-symbol name='__tracepoint_android_vh_internal_blk_mq_free_request' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x54ae9e4'/>
       <elf-symbol name='__tracepoint_android_vh_iommu_alloc_iova' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x456fc48'/>
       <elf-symbol name='__tracepoint_android_vh_iommu_free_iova' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd04c533c'/>
       <elf-symbol name='__tracepoint_android_vh_iommu_iovad_alloc_iova' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7907ef49'/>
@@ -7526,6 +7564,7 @@
           <var-decl name='last_rowner' type-id='7359adad' visibility='default' filepath='include/linux/rwsem.h' line='69' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='b7aeff71' size-in-bits='64' id='01aeefda'/>
       <pointer-type-def type-id='6d8d26fb' size-in-bits='64' id='01b378ab'/>
       <pointer-type-def type-id='5547c428' size-in-bits='64' id='01b4845e'/>
       <pointer-type-def type-id='fdbf7a0f' size-in-bits='64' id='01b75fec'/>
@@ -15224,6 +15263,7 @@
         <subrange length='20' type-id='7ff19f0f' id='fdca39cf'/>
       </array-type-def>
       <pointer-type-def type-id='80b3d6aa' size-in-bits='64' id='157eca44'/>
+      <pointer-type-def type-id='504ee449' size-in-bits='64' id='1583af75'/>
       <class-decl name='bpf_cgroup_storage' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/bpf-cgroup.h' line='53' column='1' id='15881542'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='' type-id='dad3eb71' visibility='default' filepath='include/linux/bpf-cgroup.h' line='54' column='1'/>
@@ -37770,6 +37810,12 @@
           <var-decl name='data' type-id='5e6516ee' visibility='default' filepath='include/keys/asymmetric-type.h' line='52' column='1'/>
         </data-member>
       </class-decl>
+      <function-type size-in-bits='64' id='504ee449'>
+        <parameter type-id='6dca061b'/>
+        <parameter type-id='eaa32e2f'/>
+        <parameter type-id='4c98e95d'/>
+        <return type-id='95e97e5e'/>
+      </function-type>
       <class-decl name='drm_mode_config' size-in-bits='9856' is-struct='yes' visibility='default' filepath='include/drm/drm_mode_config.h' line='358' column='1' id='5052051f'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='mutex' type-id='925167dc' visibility='default' filepath='include/drm/drm_mode_config.h' line='369' column='1'/>
@@ -46618,6 +46664,13 @@
         <parameter type-id='00c7b870'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <function-type size-in-bits='64' id='632545b7'>
+        <parameter type-id='a47d3467'/>
+        <parameter type-id='3dad1a48'/>
+        <parameter type-id='eaa32e2f'/>
+        <parameter type-id='b50a4934'/>
+        <return type-id='b50a4934'/>
+      </function-type>
       <function-type size-in-bits='64' id='632cd7c3'>
         <parameter type-id='fbc017ef'/>
         <parameter type-id='aff725d5'/>
@@ -70305,7 +70358,26 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='4b365417' size-in-bits='64' id='9a9cf0bf'/>
-      <class-decl name='tcf_walker' is-struct='yes' visibility='default' is-declaration-only='yes' id='9a9d8c1d'/>
+      <class-decl name='tcf_walker' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/pkt_cls.h' line='16' column='1' id='9a9d8c1d'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='stop' type-id='95e97e5e' visibility='default' filepath='include/net/pkt_cls.h' line='17' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='skip' type-id='95e97e5e' visibility='default' filepath='include/net/pkt_cls.h' line='18' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='count' type-id='95e97e5e' visibility='default' filepath='include/net/pkt_cls.h' line='19' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='96'>
+          <var-decl name='nonempty' type-id='b50a4934' visibility='default' filepath='include/net/pkt_cls.h' line='20' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='cookie' type-id='7359adad' visibility='default' filepath='include/net/pkt_cls.h' line='21' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='fn' type-id='1583af75' visibility='default' filepath='include/net/pkt_cls.h' line='22' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='2974aa72' size-in-bits='64' id='9aa82888'/>
       <typedef-decl name='substring_t' type-id='52365588' filepath='include/linux/parser.h' line='28' column='1' id='9aadee6c'/>
       <qualified-type-def type-id='b7aba18f' const='yes' id='9aae225c'/>
@@ -83157,6 +83229,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='ab342f3f' size-in-bits='64' id='b7ad3a03'/>
+      <typedef-decl name='busy_iter_fn' type-id='632545b7' filepath='include/linux/blk-mq.h' line='278' column='1' id='b7aeff71'/>
       <function-type size-in-bits='64' id='b7b43e53'>
         <parameter type-id='0fbf3cfd'/>
         <parameter type-id='07b9ee34'/>
@@ -116833,9 +116906,9 @@
       </function-type>
       <pointer-type-def type-id='46f53066' size-in-bits='64' id='fffb07a4'/>
       <qualified-type-def type-id='55efd1a3' const='yes' id='fffdaf52'/>
-      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='524' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
+      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='545' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
       <var-decl name='GKI_struct_selinux_state' type-id='4ae52763' mangled-name='GKI_struct_selinux_state' visibility='default' filepath='security/selinux/vendor_hooks.c' line='21' column='1' elf-symbol-id='GKI_struct_selinux_state'/>
-      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='529' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
+      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='550' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
       <function-decl name='PDE_DATA' mangled-name='PDE_DATA' filepath='fs/proc/generic.c' line='802' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='PDE_DATA'>
         <parameter type-id='c5a4eb7f' name='inode' filepath='fs/proc/generic.c' line='802' column='1'/>
         <return type-id='eaa32e2f'/>
@@ -116969,9 +117042,9 @@
         <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq-debugfs.c' line='331' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__blk_mq_end_request' mangled-name='__blk_mq_end_request' filepath='block/blk-mq.c' line='542' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__blk_mq_end_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='542' column='1'/>
-        <parameter type-id='f4e2facd' name='error' filepath='block/blk-mq.c' line='542' column='1'/>
+      <function-decl name='__blk_mq_end_request' mangled-name='__blk_mq_end_request' filepath='block/blk-mq.c' line='550' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__blk_mq_end_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='550' column='1'/>
+        <parameter type-id='f4e2facd' name='error' filepath='block/blk-mq.c' line='550' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='__blk_rq_map_sg' mangled-name='__blk_rq_map_sg' filepath='block/blk-merge.c' line='525' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__blk_rq_map_sg'>
@@ -118638,6 +118711,39 @@
         <parameter type-id='55866c73' name='tr' filepath='include/trace/hooks/binder.h' line='73' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_rvh_blk_allocated_queue_init' mangled-name='__traceiter_android_rvh_blk_allocated_queue_init' filepath='include/trace/hooks/block.h' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_blk_allocated_queue_init'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='103' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='103' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='include/trace/hooks/block.h' line='103' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_rvh_blk_flush_plug_list' mangled-name='__traceiter_android_rvh_blk_flush_plug_list' filepath='include/trace/hooks/block.h' line='107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_blk_flush_plug_list'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='107' column='1'/>
+        <parameter type-id='39944481' name='plug' filepath='include/trace/hooks/block.h' line='107' column='1'/>
+        <parameter type-id='b50a4934' name='from_schedule' filepath='include/trace/hooks/block.h' line='107' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_rvh_blk_mq_alloc_rq_map' mangled-name='__traceiter_android_rvh_blk_mq_alloc_rq_map' filepath='include/trace/hooks/block.h' line='78' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_blk_mq_alloc_rq_map'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <parameter type-id='c527e30d' name='tags' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <parameter type-id='cc26d15f' name='set' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <parameter type-id='95e97e5e' name='node' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_rvh_blk_mq_delay_run_hw_queue' mangled-name='__traceiter_android_rvh_blk_mq_delay_run_hw_queue' filepath='include/trace/hooks/block.h' line='66' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_blk_mq_delay_run_hw_queue'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='66' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='66' column='1'/>
+        <parameter type-id='a47d3467' name='hctx' filepath='include/trace/hooks/block.h' line='66' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='include/trace/hooks/block.h' line='66' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_rvh_blk_mq_init_allocated_queue' mangled-name='__traceiter_android_rvh_blk_mq_init_allocated_queue' filepath='include/trace/hooks/block.h' line='87' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_blk_mq_init_allocated_queue'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='87' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='include/trace/hooks/block.h' line='87' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_rvh_build_perf_domains' mangled-name='__traceiter_android_rvh_build_perf_domains' filepath='include/trace/hooks/sched.h' line='203' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_build_perf_domains'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/sched.h' line='203' column='1'/>
         <parameter type-id='d8e6b335' name='eas_check' filepath='include/trace/hooks/sched.h' line='203' column='1'/>
@@ -118911,6 +119017,13 @@
         <parameter type-id='7359adad' name='highest_memmap_pfn' filepath='include/trace/hooks/mm.h' line='229' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_rvh_internal_blk_mq_alloc_request' mangled-name='__traceiter_android_rvh_internal_blk_mq_alloc_request' filepath='include/trace/hooks/block.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_internal_blk_mq_alloc_request'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='46' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='46' column='1'/>
+        <parameter type-id='7292109c' name='tag' filepath='include/trace/hooks/block.h' line='46' column='1'/>
+        <parameter type-id='3620a178' name='data' filepath='include/trace/hooks/block.h' line='46' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_rvh_iommu_setup_dma_ops' mangled-name='__traceiter_android_rvh_iommu_setup_dma_ops' filepath='include/trace/hooks/iommu.h' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_iommu_setup_dma_ops'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='21' column='1'/>
         <parameter type-id='fa0b179b' name='dev' filepath='include/trace/hooks/iommu.h' line='21' column='1'/>
@@ -119659,19 +119772,97 @@
         <parameter type-id='d1cf113c' name='proc' filepath='include/trace/hooks/binder.h' line='53' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_blk_alloc_rqs' mangled-name='__traceiter_android_vh_blk_alloc_rqs' filepath='include/trace/hooks/block.h' line='26' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_alloc_rqs'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='26' column='1'/>
-        <parameter type-id='78c01427' name='rq_size' filepath='include/trace/hooks/block.h' line='26' column='1'/>
-        <parameter type-id='cc26d15f' name='set' filepath='include/trace/hooks/block.h' line='26' column='1'/>
-        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/block.h' line='26' column='1'/>
+      <function-decl name='__traceiter_android_vh_bio_free' mangled-name='__traceiter_android_vh_bio_free' filepath='include/trace/hooks/block.h' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_bio_free'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='42' column='1'/>
+        <parameter type-id='fb55efa1' name='bio' filepath='include/trace/hooks/block.h' line='42' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_blk_rq_ctx_init' mangled-name='__traceiter_android_vh_blk_rq_ctx_init' filepath='include/trace/hooks/block.h' line='31' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_rq_ctx_init'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='31' column='1'/>
-        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='31' column='1'/>
-        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/block.h' line='31' column='1'/>
-        <parameter type-id='3620a178' name='data' filepath='include/trace/hooks/block.h' line='31' column='1'/>
-        <parameter type-id='91ce1af9' name='alloc_time_ns' filepath='include/trace/hooks/block.h' line='31' column='1'/>
+      <function-decl name='__traceiter_android_vh_blk_alloc_flush_queue' mangled-name='__traceiter_android_vh_blk_alloc_flush_queue' filepath='include/trace/hooks/block.h' line='111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_alloc_flush_queue'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <parameter type-id='95e97e5e' name='cmd_size' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <parameter type-id='95e97e5e' name='node' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <parameter type-id='e118aff9' name='fq' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_alloc_rqs' mangled-name='__traceiter_android_vh_blk_alloc_rqs' filepath='include/trace/hooks/block.h' line='32' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_alloc_rqs'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='32' column='1'/>
+        <parameter type-id='78c01427' name='rq_size' filepath='include/trace/hooks/block.h' line='32' column='1'/>
+        <parameter type-id='cc26d15f' name='set' filepath='include/trace/hooks/block.h' line='32' column='1'/>
+        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/block.h' line='32' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_add_to_requeue_list' mangled-name='__traceiter_android_vh_blk_mq_add_to_requeue_list' filepath='include/trace/hooks/block.h' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_add_to_requeue_list'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='58' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='58' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='58' column='1'/>
+        <parameter type-id='b50a4934' name='kick_requeue_list' filepath='include/trace/hooks/block.h' line='58' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_all_tag_iter' mangled-name='__traceiter_android_vh_blk_mq_all_tag_iter' filepath='include/trace/hooks/blk_mq.h' line='16' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_all_tag_iter'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/blk_mq.h' line='16' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/blk_mq.h' line='16' column='1'/>
+        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/blk_mq.h' line='16' column='1'/>
+        <parameter type-id='65a8a3df' name='fn' filepath='include/trace/hooks/blk_mq.h' line='16' column='1'/>
+        <parameter type-id='eaa32e2f' name='priv' filepath='include/trace/hooks/blk_mq.h' line='16' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_alloc_tag_set' mangled-name='__traceiter_android_vh_blk_mq_alloc_tag_set' filepath='include/trace/hooks/block.h' line='95' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_alloc_tag_set'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='95' column='1'/>
+        <parameter type-id='cc26d15f' name='set' filepath='include/trace/hooks/block.h' line='95' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_complete_request' mangled-name='__traceiter_android_vh_blk_mq_complete_request' filepath='include/trace/hooks/block.h' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_complete_request'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='54' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='54' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='54' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_exit_queue' mangled-name='__traceiter_android_vh_blk_mq_exit_queue' filepath='include/trace/hooks/block.h' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_exit_queue'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='91' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='include/trace/hooks/block.h' line='91' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_free_tags' mangled-name='__traceiter_android_vh_blk_mq_free_tags' filepath='include/trace/hooks/blk_mq.h' line='26' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_free_tags'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/blk_mq.h' line='26' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/blk_mq.h' line='26' column='1'/>
+        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/blk_mq.h' line='26' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_insert_request' mangled-name='__traceiter_android_vh_blk_mq_insert_request' filepath='include/trace/hooks/block.h' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_insert_request'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='74' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='74' column='1'/>
+        <parameter type-id='a47d3467' name='hctx' filepath='include/trace/hooks/block.h' line='74' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='74' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_queue_tag_busy_iter' mangled-name='__traceiter_android_vh_blk_mq_queue_tag_busy_iter' filepath='include/trace/hooks/blk_mq.h' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_queue_tag_busy_iter'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/blk_mq.h' line='21' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/blk_mq.h' line='21' column='1'/>
+        <parameter type-id='a47d3467' name='hctx' filepath='include/trace/hooks/blk_mq.h' line='21' column='1'/>
+        <parameter type-id='01aeefda' name='fn' filepath='include/trace/hooks/blk_mq.h' line='21' column='1'/>
+        <parameter type-id='eaa32e2f' name='priv' filepath='include/trace/hooks/blk_mq.h' line='21' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_run_hw_queue' mangled-name='__traceiter_android_vh_blk_mq_run_hw_queue' filepath='include/trace/hooks/block.h' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_run_hw_queue'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='70' column='1'/>
+        <parameter type-id='d8e6b335' name='need_run' filepath='include/trace/hooks/block.h' line='70' column='1'/>
+        <parameter type-id='a47d3467' name='hctx' filepath='include/trace/hooks/block.h' line='70' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_sched_insert_request' mangled-name='__traceiter_android_vh_blk_mq_sched_insert_request' filepath='include/trace/hooks/block.h' line='116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_sched_insert_request'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='116' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='116' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='116' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_rq_ctx_init' mangled-name='__traceiter_android_vh_blk_rq_ctx_init' filepath='include/trace/hooks/block.h' line='37' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_rq_ctx_init'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='37' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='37' column='1'/>
+        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/block.h' line='37' column='1'/>
+        <parameter type-id='3620a178' name='data' filepath='include/trace/hooks/block.h' line='37' column='1'/>
+        <parameter type-id='91ce1af9' name='alloc_time_ns' filepath='include/trace/hooks/block.h' line='37' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__traceiter_android_vh_build_sched_domains' mangled-name='__traceiter_android_vh_build_sched_domains' filepath='include/trace/hooks/sched.h' line='291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_build_sched_domains'>
@@ -120210,6 +120401,13 @@
         <parameter type-id='63de1ba0' name='swap_avail_heads' filepath='include/trace/hooks/mm.h' line='317' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_vh_internal_blk_mq_free_request' mangled-name='__traceiter_android_vh_internal_blk_mq_free_request' filepath='include/trace/hooks/block.h' line='50' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_internal_blk_mq_free_request'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='50' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='50' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='50' column='1'/>
+        <parameter type-id='a47d3467' name='hctx' filepath='include/trace/hooks/block.h' line='50' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_vh_iommu_alloc_iova' mangled-name='__traceiter_android_vh_iommu_alloc_iova' filepath='include/trace/hooks/iommu.h' line='29' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_iommu_alloc_iova'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='29' column='1'/>
         <parameter type-id='fa0b179b' name='dev' filepath='include/trace/hooks/iommu.h' line='29' column='1'/>
@@ -121814,6 +122012,11 @@
       <var-decl name='__tracepoint_android_rvh_arm64_serror_panic' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_arm64_serror_panic' visibility='default' filepath='include/trace/hooks/traps.h' line='34' column='1' elf-symbol-id='__tracepoint_android_rvh_arm64_serror_panic'/>
       <var-decl name='__tracepoint_android_rvh_bad_mode' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_bad_mode' visibility='default' filepath='include/trace/hooks/traps.h' line='30' column='1' elf-symbol-id='__tracepoint_android_rvh_bad_mode'/>
       <var-decl name='__tracepoint_android_rvh_binder_transaction' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_binder_transaction' visibility='default' filepath='include/trace/hooks/binder.h' line='73' column='1' elf-symbol-id='__tracepoint_android_rvh_binder_transaction'/>
+      <var-decl name='__tracepoint_android_rvh_blk_allocated_queue_init' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_blk_allocated_queue_init' visibility='default' filepath='include/trace/hooks/block.h' line='103' column='1' elf-symbol-id='__tracepoint_android_rvh_blk_allocated_queue_init'/>
+      <var-decl name='__tracepoint_android_rvh_blk_flush_plug_list' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_blk_flush_plug_list' visibility='default' filepath='include/trace/hooks/block.h' line='107' column='1' elf-symbol-id='__tracepoint_android_rvh_blk_flush_plug_list'/>
+      <var-decl name='__tracepoint_android_rvh_blk_mq_alloc_rq_map' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_blk_mq_alloc_rq_map' visibility='default' filepath='include/trace/hooks/block.h' line='78' column='1' elf-symbol-id='__tracepoint_android_rvh_blk_mq_alloc_rq_map'/>
+      <var-decl name='__tracepoint_android_rvh_blk_mq_delay_run_hw_queue' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_blk_mq_delay_run_hw_queue' visibility='default' filepath='include/trace/hooks/block.h' line='66' column='1' elf-symbol-id='__tracepoint_android_rvh_blk_mq_delay_run_hw_queue'/>
+      <var-decl name='__tracepoint_android_rvh_blk_mq_init_allocated_queue' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_blk_mq_init_allocated_queue' visibility='default' filepath='include/trace/hooks/block.h' line='87' column='1' elf-symbol-id='__tracepoint_android_rvh_blk_mq_init_allocated_queue'/>
       <var-decl name='__tracepoint_android_rvh_build_perf_domains' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_build_perf_domains' visibility='default' filepath='include/trace/hooks/sched.h' line='203' column='1' elf-symbol-id='__tracepoint_android_rvh_build_perf_domains'/>
       <var-decl name='__tracepoint_android_rvh_can_migrate_task' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_can_migrate_task' visibility='default' filepath='include/trace/hooks/sched.h' line='57' column='1' elf-symbol-id='__tracepoint_android_rvh_can_migrate_task'/>
       <var-decl name='__tracepoint_android_rvh_cgroup_force_kthread_migration' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_cgroup_force_kthread_migration' visibility='default' filepath='include/trace/hooks/cgroup.h' line='31' column='1' elf-symbol-id='__tracepoint_android_rvh_cgroup_force_kthread_migration'/>
@@ -121854,6 +122057,7 @@
       <var-decl name='__tracepoint_android_rvh_get_swap_page' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_get_swap_page' visibility='default' filepath='include/trace/hooks/mm.h' line='282' column='1' elf-symbol-id='__tracepoint_android_rvh_get_swap_page'/>
       <var-decl name='__tracepoint_android_rvh_gic_v3_set_affinity' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_gic_v3_set_affinity' visibility='default' filepath='include/trace/hooks/gic_v3.h' line='22' column='1' elf-symbol-id='__tracepoint_android_rvh_gic_v3_set_affinity'/>
       <var-decl name='__tracepoint_android_rvh_handle_pte_fault_end' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_handle_pte_fault_end' visibility='default' filepath='include/trace/hooks/mm.h' line='229' column='1' elf-symbol-id='__tracepoint_android_rvh_handle_pte_fault_end'/>
+      <var-decl name='__tracepoint_android_rvh_internal_blk_mq_alloc_request' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_internal_blk_mq_alloc_request' visibility='default' filepath='include/trace/hooks/block.h' line='46' column='1' elf-symbol-id='__tracepoint_android_rvh_internal_blk_mq_alloc_request'/>
       <var-decl name='__tracepoint_android_rvh_iommu_setup_dma_ops' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_iommu_setup_dma_ops' visibility='default' filepath='include/trace/hooks/iommu.h' line='21' column='1' elf-symbol-id='__tracepoint_android_rvh_iommu_setup_dma_ops'/>
       <var-decl name='__tracepoint_android_rvh_irqs_disable' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_irqs_disable' visibility='default' filepath='include/trace/hooks/preemptirq.h' line='22' column='1' elf-symbol-id='__tracepoint_android_rvh_irqs_disable'/>
       <var-decl name='__tracepoint_android_rvh_irqs_enable' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_irqs_enable' visibility='default' filepath='include/trace/hooks/preemptirq.h' line='26' column='1' elf-symbol-id='__tracepoint_android_rvh_irqs_enable'/>
@@ -121966,8 +122170,20 @@
       <var-decl name='__tracepoint_android_vh_binder_transaction_received' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_binder_transaction_received' visibility='default' filepath='include/trace/hooks/binder.h' line='127' column='1' elf-symbol-id='__tracepoint_android_vh_binder_transaction_received'/>
       <var-decl name='__tracepoint_android_vh_binder_wait_for_work' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_binder_wait_for_work' visibility='default' filepath='include/trace/hooks/binder.h' line='56' column='1' elf-symbol-id='__tracepoint_android_vh_binder_wait_for_work'/>
       <var-decl name='__tracepoint_android_vh_binder_wakeup_ilocked' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_binder_wakeup_ilocked' visibility='default' filepath='include/trace/hooks/binder.h' line='53' column='1' elf-symbol-id='__tracepoint_android_vh_binder_wakeup_ilocked'/>
-      <var-decl name='__tracepoint_android_vh_blk_alloc_rqs' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_alloc_rqs' visibility='default' filepath='include/trace/hooks/block.h' line='26' column='1' elf-symbol-id='__tracepoint_android_vh_blk_alloc_rqs'/>
-      <var-decl name='__tracepoint_android_vh_blk_rq_ctx_init' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_rq_ctx_init' visibility='default' filepath='include/trace/hooks/block.h' line='31' column='1' elf-symbol-id='__tracepoint_android_vh_blk_rq_ctx_init'/>
+      <var-decl name='__tracepoint_android_vh_bio_free' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_bio_free' visibility='default' filepath='include/trace/hooks/block.h' line='42' column='1' elf-symbol-id='__tracepoint_android_vh_bio_free'/>
+      <var-decl name='__tracepoint_android_vh_blk_alloc_flush_queue' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_alloc_flush_queue' visibility='default' filepath='include/trace/hooks/block.h' line='111' column='1' elf-symbol-id='__tracepoint_android_vh_blk_alloc_flush_queue'/>
+      <var-decl name='__tracepoint_android_vh_blk_alloc_rqs' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_alloc_rqs' visibility='default' filepath='include/trace/hooks/block.h' line='32' column='1' elf-symbol-id='__tracepoint_android_vh_blk_alloc_rqs'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_add_to_requeue_list' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_add_to_requeue_list' visibility='default' filepath='include/trace/hooks/block.h' line='58' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_add_to_requeue_list'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_all_tag_iter' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_all_tag_iter' visibility='default' filepath='include/trace/hooks/blk_mq.h' line='16' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_all_tag_iter'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_alloc_tag_set' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_alloc_tag_set' visibility='default' filepath='include/trace/hooks/block.h' line='95' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_alloc_tag_set'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_complete_request' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_complete_request' visibility='default' filepath='include/trace/hooks/block.h' line='54' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_complete_request'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_exit_queue' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_exit_queue' visibility='default' filepath='include/trace/hooks/block.h' line='91' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_exit_queue'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_free_tags' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_free_tags' visibility='default' filepath='include/trace/hooks/blk_mq.h' line='26' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_free_tags'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_insert_request' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_insert_request' visibility='default' filepath='include/trace/hooks/block.h' line='74' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_insert_request'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_queue_tag_busy_iter' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_queue_tag_busy_iter' visibility='default' filepath='include/trace/hooks/blk_mq.h' line='21' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_queue_tag_busy_iter'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_run_hw_queue' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_run_hw_queue' visibility='default' filepath='include/trace/hooks/block.h' line='70' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_run_hw_queue'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_sched_insert_request' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_sched_insert_request' visibility='default' filepath='include/trace/hooks/block.h' line='116' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_sched_insert_request'/>
+      <var-decl name='__tracepoint_android_vh_blk_rq_ctx_init' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_rq_ctx_init' visibility='default' filepath='include/trace/hooks/block.h' line='37' column='1' elf-symbol-id='__tracepoint_android_vh_blk_rq_ctx_init'/>
       <var-decl name='__tracepoint_android_vh_build_sched_domains' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_build_sched_domains' visibility='default' filepath='include/trace/hooks/sched.h' line='291' column='1' elf-symbol-id='__tracepoint_android_vh_build_sched_domains'/>
       <var-decl name='__tracepoint_android_vh_cgroup_attach' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_cgroup_attach' visibility='default' filepath='include/trace/hooks/cgroup.h' line='38' column='1' elf-symbol-id='__tracepoint_android_vh_cgroup_attach'/>
       <var-decl name='__tracepoint_android_vh_cgroup_set_task' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_cgroup_set_task' visibility='default' filepath='include/trace/hooks/cgroup.h' line='25' column='1' elf-symbol-id='__tracepoint_android_vh_cgroup_set_task'/>
@@ -122052,6 +122268,7 @@
       <var-decl name='__tracepoint_android_vh_inactive_is_low' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_inactive_is_low' visibility='default' filepath='include/trace/hooks/vmscan.h' line='46' column='1' elf-symbol-id='__tracepoint_android_vh_inactive_is_low'/>
       <var-decl name='__tracepoint_android_vh_include_reserved_zone' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_include_reserved_zone' visibility='default' filepath='include/trace/hooks/mm.h' line='94' column='1' elf-symbol-id='__tracepoint_android_vh_include_reserved_zone'/>
       <var-decl name='__tracepoint_android_vh_init_swap_info_struct' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_init_swap_info_struct' visibility='default' filepath='include/trace/hooks/mm.h' line='317' column='1' elf-symbol-id='__tracepoint_android_vh_init_swap_info_struct'/>
+      <var-decl name='__tracepoint_android_vh_internal_blk_mq_free_request' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_internal_blk_mq_free_request' visibility='default' filepath='include/trace/hooks/block.h' line='50' column='1' elf-symbol-id='__tracepoint_android_vh_internal_blk_mq_free_request'/>
       <var-decl name='__tracepoint_android_vh_iommu_alloc_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_alloc_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='29' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_alloc_iova'/>
       <var-decl name='__tracepoint_android_vh_iommu_free_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_free_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='38' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_free_iova'/>
       <var-decl name='__tracepoint_android_vh_iommu_iovad_alloc_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_iovad_alloc_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='34' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_iovad_alloc_iova'/>
@@ -123277,25 +123494,25 @@
         <parameter type-id='b59d7dce' name='count' filepath='lib/hexdump.c' line='95' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='bio_add_page' mangled-name='bio_add_page' filepath='block/bio.c' line='934' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_add_page'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='934' column='1'/>
-        <parameter type-id='02f11ed4' name='page' filepath='block/bio.c' line='934' column='1'/>
-        <parameter type-id='f0981eeb' name='len' filepath='block/bio.c' line='935' column='1'/>
-        <parameter type-id='f0981eeb' name='offset' filepath='block/bio.c' line='935' column='1'/>
+      <function-decl name='bio_add_page' mangled-name='bio_add_page' filepath='block/bio.c' line='936' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_add_page'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='936' column='1'/>
+        <parameter type-id='02f11ed4' name='page' filepath='block/bio.c' line='936' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='block/bio.c' line='937' column='1'/>
+        <parameter type-id='f0981eeb' name='offset' filepath='block/bio.c' line='937' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bio_add_pc_page' mangled-name='bio_add_pc_page' filepath='block/bio.c' line='846' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_add_pc_page'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/bio.c' line='846' column='1'/>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='846' column='1'/>
-        <parameter type-id='02f11ed4' name='page' filepath='block/bio.c' line='847' column='1'/>
-        <parameter type-id='f0981eeb' name='len' filepath='block/bio.c' line='847' column='1'/>
-        <parameter type-id='f0981eeb' name='offset' filepath='block/bio.c' line='847' column='1'/>
+      <function-decl name='bio_add_pc_page' mangled-name='bio_add_pc_page' filepath='block/bio.c' line='848' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_add_pc_page'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/bio.c' line='848' column='1'/>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='848' column='1'/>
+        <parameter type-id='02f11ed4' name='page' filepath='block/bio.c' line='849' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='block/bio.c' line='849' column='1'/>
+        <parameter type-id='f0981eeb' name='offset' filepath='block/bio.c' line='849' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bio_alloc_bioset' mangled-name='bio_alloc_bioset' filepath='block/bio.c' line='437' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_alloc_bioset'>
-        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='block/bio.c' line='437' column='1'/>
-        <parameter type-id='f0981eeb' name='nr_iovecs' filepath='block/bio.c' line='437' column='1'/>
-        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='438' column='1'/>
+      <function-decl name='bio_alloc_bioset' mangled-name='bio_alloc_bioset' filepath='block/bio.c' line='439' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_alloc_bioset'>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='block/bio.c' line='439' column='1'/>
+        <parameter type-id='f0981eeb' name='nr_iovecs' filepath='block/bio.c' line='439' column='1'/>
+        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='440' column='1'/>
         <return type-id='fb55efa1'/>
       </function-decl>
       <function-decl name='bio_associate_blkg' mangled-name='bio_associate_blkg' filepath='block/blk-cgroup.c' line='1882' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_associate_blkg'>
@@ -123307,9 +123524,9 @@
         <parameter type-id='cfff5953' name='css' filepath='block/blk-cgroup.c' line='1859' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_chain' mangled-name='bio_chain' filepath='block/bio.c' line='338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_chain'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='338' column='1'/>
-        <parameter type-id='fb55efa1' name='parent' filepath='block/bio.c' line='338' column='1'/>
+      <function-decl name='bio_chain' mangled-name='bio_chain' filepath='block/bio.c' line='340' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_chain'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='340' column='1'/>
+        <parameter type-id='fb55efa1' name='parent' filepath='block/bio.c' line='340' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='bio_clone_blkg_association' mangled-name='bio_clone_blkg_association' filepath='block/blk-cgroup.c' line='1904' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_clone_blkg_association'>
@@ -123324,40 +123541,40 @@
         <parameter type-id='3eb7c31c' name='gfp_mask' filepath='block/blk-crypto.c' line='83' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_endio' mangled-name='bio_endio' filepath='block/bio.c' line='1426' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_endio'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1426' column='1'/>
+      <function-decl name='bio_endio' mangled-name='bio_endio' filepath='block/bio.c' line='1428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_endio'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1428' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_init' mangled-name='bio_init' filepath='block/bio.c' line='278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_init'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='278' column='1'/>
-        <parameter type-id='cddcb53e' name='table' filepath='block/bio.c' line='278' column='1'/>
-        <parameter type-id='8efea9e5' name='max_vecs' filepath='block/bio.c' line='279' column='1'/>
+      <function-decl name='bio_init' mangled-name='bio_init' filepath='block/bio.c' line='280' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_init'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='280' column='1'/>
+        <parameter type-id='cddcb53e' name='table' filepath='block/bio.c' line='280' column='1'/>
+        <parameter type-id='8efea9e5' name='max_vecs' filepath='block/bio.c' line='281' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_put' mangled-name='bio_put' filepath='block/bio.c' line='648' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_put'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='648' column='1'/>
+      <function-decl name='bio_put' mangled-name='bio_put' filepath='block/bio.c' line='650' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_put'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='650' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_reset' mangled-name='bio_reset' filepath='block/bio.c' line='300' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_reset'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='300' column='1'/>
+      <function-decl name='bio_reset' mangled-name='bio_reset' filepath='block/bio.c' line='302' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_reset'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='302' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_split' mangled-name='bio_split' filepath='block/bio.c' line='1477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_split'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1477' column='1'/>
-        <parameter type-id='95e97e5e' name='sectors' filepath='block/bio.c' line='1477' column='1'/>
-        <parameter type-id='3eb7c31c' name='gfp' filepath='block/bio.c' line='1478' column='1'/>
-        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1478' column='1'/>
+      <function-decl name='bio_split' mangled-name='bio_split' filepath='block/bio.c' line='1479' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_split'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1479' column='1'/>
+        <parameter type-id='95e97e5e' name='sectors' filepath='block/bio.c' line='1479' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='block/bio.c' line='1480' column='1'/>
+        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1480' column='1'/>
         <return type-id='fb55efa1'/>
       </function-decl>
-      <function-decl name='bioset_exit' mangled-name='bioset_exit' filepath='block/bio.c' line='1549' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_exit'>
-        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1549' column='1'/>
+      <function-decl name='bioset_exit' mangled-name='bioset_exit' filepath='block/bio.c' line='1551' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_exit'>
+        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1551' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bioset_init' mangled-name='bioset_init' filepath='block/bio.c' line='1586' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_init'>
-        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1586' column='1'/>
-        <parameter type-id='f0981eeb' name='pool_size' filepath='block/bio.c' line='1587' column='1'/>
-        <parameter type-id='f0981eeb' name='front_pad' filepath='block/bio.c' line='1588' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='block/bio.c' line='1589' column='1'/>
+      <function-decl name='bioset_init' mangled-name='bioset_init' filepath='block/bio.c' line='1588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_init'>
+        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1588' column='1'/>
+        <parameter type-id='f0981eeb' name='pool_size' filepath='block/bio.c' line='1589' column='1'/>
+        <parameter type-id='f0981eeb' name='front_pad' filepath='block/bio.c' line='1590' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='block/bio.c' line='1591' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='bit_wait_timeout' mangled-name='bit_wait_timeout' filepath='kernel/sched/wait_bit.c' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bit_wait_timeout'>
@@ -123450,8 +123667,8 @@
         <parameter type-id='3eb7c31c' name='flags' filepath='lib/bitmap.c' line='1255' column='1'/>
         <return type-id='1d2c2b85'/>
       </function-decl>
-      <function-decl name='blk_alloc_queue' mangled-name='blk_alloc_queue' filepath='block/blk-core.c' line='521' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_alloc_queue'>
-        <parameter type-id='95e97e5e' name='node_id' filepath='block/blk-core.c' line='521' column='1'/>
+      <function-decl name='blk_alloc_queue' mangled-name='blk_alloc_queue' filepath='block/blk-core.c' line='524' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_alloc_queue'>
+        <parameter type-id='95e97e5e' name='node_id' filepath='block/blk-core.c' line='524' column='1'/>
         <return type-id='e7d2a5fc'/>
       </function-decl>
       <function-decl name='blk_bio_list_merge' mangled-name='blk_bio_list_merge' filepath='block/blk-merge.c' line='1094' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_bio_list_merge'>
@@ -123461,14 +123678,14 @@
         <parameter type-id='f0981eeb' name='nr_segs' filepath='block/blk-merge.c' line='1095' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='blk_check_plugged' mangled-name='blk_check_plugged' filepath='block/blk-core.c' line='1737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_check_plugged'>
-        <parameter type-id='f31816b5' name='unplug' filepath='block/blk-core.c' line='1737' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='block/blk-core.c' line='1737' column='1'/>
-        <parameter type-id='95e97e5e' name='size' filepath='block/blk-core.c' line='1738' column='1'/>
+      <function-decl name='blk_check_plugged' mangled-name='blk_check_plugged' filepath='block/blk-core.c' line='1745' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_check_plugged'>
+        <parameter type-id='f31816b5' name='unplug' filepath='block/blk-core.c' line='1745' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='block/blk-core.c' line='1745' column='1'/>
+        <parameter type-id='95e97e5e' name='size' filepath='block/blk-core.c' line='1746' column='1'/>
         <return type-id='39914f13'/>
       </function-decl>
-      <function-decl name='blk_cleanup_queue' mangled-name='blk_cleanup_queue' filepath='block/blk-core.c' line='376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_cleanup_queue'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='376' column='1'/>
+      <function-decl name='blk_cleanup_queue' mangled-name='blk_cleanup_queue' filepath='block/blk-core.c' line='379' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_cleanup_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='379' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_execute_rq' mangled-name='blk_execute_rq' filepath='block/blk-exec.c' line='79' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_execute_rq'>
@@ -123486,27 +123703,27 @@
         <parameter type-id='5afdaa66' name='done' filepath='block/blk-exec.c' line='50' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_finish_plug' mangled-name='blk_finish_plug' filepath='block/blk-core.c' line='1780' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_finish_plug'>
-        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1780' column='1'/>
+      <function-decl name='blk_finish_plug' mangled-name='blk_finish_plug' filepath='block/blk-core.c' line='1789' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_finish_plug'>
+        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1789' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_freeze_queue_start' mangled-name='blk_freeze_queue_start' filepath='block/blk-mq.c' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_freeze_queue_start'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='136' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_get_queue' mangled-name='blk_get_queue' filepath='block/blk-core.c' line='614' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_queue'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='614' column='1'/>
+      <function-decl name='blk_get_queue' mangled-name='blk_get_queue' filepath='block/blk-core.c' line='622' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='622' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='blk_get_request' mangled-name='blk_get_request' filepath='block/blk-core.c' line='631' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_request'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='631' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='631' column='1'/>
-        <parameter type-id='346d62be' name='flags' filepath='block/blk-core.c' line='632' column='1'/>
+      <function-decl name='blk_get_request' mangled-name='blk_get_request' filepath='block/blk-core.c' line='639' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_request'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='639' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='639' column='1'/>
+        <parameter type-id='346d62be' name='flags' filepath='block/blk-core.c' line='640' column='1'/>
         <return type-id='3dad1a48'/>
       </function-decl>
-      <function-decl name='blk_insert_cloned_request' mangled-name='blk_insert_cloned_request' filepath='block/blk-core.c' line='1195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_insert_cloned_request'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='1195' column='1'/>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1195' column='1'/>
+      <function-decl name='blk_insert_cloned_request' mangled-name='blk_insert_cloned_request' filepath='block/blk-core.c' line='1203' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_insert_cloned_request'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='1203' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1203' column='1'/>
         <return type-id='f4e2facd'/>
       </function-decl>
       <function-decl name='blk_ksm_get_slot_idx' mangled-name='blk_ksm_get_slot_idx' filepath='block/keyslot-manager.c' line='211' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_ksm_get_slot_idx'>
@@ -123531,29 +123748,29 @@
         <parameter type-id='bf8a20d2' name='ksm' filepath='block/keyslot-manager.c' line='413' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_alloc_request' mangled-name='blk_mq_alloc_request' filepath='block/blk-mq.c' line='403' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_request'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='403' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-mq.c' line='403' column='1'/>
-        <parameter type-id='346d62be' name='flags' filepath='block/blk-mq.c' line='404' column='1'/>
+      <function-decl name='blk_mq_alloc_request' mangled-name='blk_mq_alloc_request' filepath='block/blk-mq.c' line='406' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_request'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='406' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-mq.c' line='406' column='1'/>
+        <parameter type-id='346d62be' name='flags' filepath='block/blk-mq.c' line='407' column='1'/>
         <return type-id='3dad1a48'/>
       </function-decl>
-      <function-decl name='blk_mq_alloc_request_hctx' mangled-name='blk_mq_alloc_request_hctx' filepath='block/blk-mq.c' line='431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_request_hctx'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='431' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-mq.c' line='432' column='1'/>
-        <parameter type-id='346d62be' name='flags' filepath='block/blk-mq.c' line='432' column='1'/>
-        <parameter type-id='f0981eeb' name='hctx_idx' filepath='block/blk-mq.c' line='432' column='1'/>
+      <function-decl name='blk_mq_alloc_request_hctx' mangled-name='blk_mq_alloc_request_hctx' filepath='block/blk-mq.c' line='434' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_request_hctx'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='434' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-mq.c' line='435' column='1'/>
+        <parameter type-id='346d62be' name='flags' filepath='block/blk-mq.c' line='435' column='1'/>
+        <parameter type-id='f0981eeb' name='hctx_idx' filepath='block/blk-mq.c' line='435' column='1'/>
         <return type-id='3dad1a48'/>
       </function-decl>
-      <function-decl name='blk_mq_alloc_tag_set' mangled-name='blk_mq_alloc_tag_set' filepath='block/blk-mq.c' line='3514' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_tag_set'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3514' column='1'/>
+      <function-decl name='blk_mq_alloc_tag_set' mangled-name='blk_mq_alloc_tag_set' filepath='block/blk-mq.c' line='3550' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_tag_set'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3550' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_mq_complete_request' mangled-name='blk_mq_complete_request' filepath='block/blk-mq.c' line='702' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_complete_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='702' column='1'/>
+      <function-decl name='blk_mq_complete_request' mangled-name='blk_mq_complete_request' filepath='block/blk-mq.c' line='710' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_complete_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='710' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_complete_request_remote' mangled-name='blk_mq_complete_request_remote' filepath='block/blk-mq.c' line='669' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_complete_request_remote'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='669' column='1'/>
+      <function-decl name='blk_mq_complete_request_remote' mangled-name='blk_mq_complete_request_remote' filepath='block/blk-mq.c' line='677' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_complete_request_remote'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='677' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='blk_mq_debugfs_rq_show' mangled-name='blk_mq_debugfs_rq_show' filepath='block/blk-mq-debugfs.c' line='358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_debugfs_rq_show'>
@@ -123561,22 +123778,22 @@
         <parameter type-id='eaa32e2f' name='v' filepath='block/blk-mq-debugfs.c' line='358' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_mq_delay_kick_requeue_list' mangled-name='blk_mq_delay_kick_requeue_list' filepath='block/blk-mq.c' line='856' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_delay_kick_requeue_list'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='856' column='1'/>
-        <parameter type-id='7359adad' name='msecs' filepath='block/blk-mq.c' line='857' column='1'/>
+      <function-decl name='blk_mq_delay_kick_requeue_list' mangled-name='blk_mq_delay_kick_requeue_list' filepath='block/blk-mq.c' line='874' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_delay_kick_requeue_list'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='874' column='1'/>
+        <parameter type-id='7359adad' name='msecs' filepath='block/blk-mq.c' line='875' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_end_request' mangled-name='blk_mq_end_request' filepath='block/blk-mq.c' line='567' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_end_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='567' column='1'/>
-        <parameter type-id='f4e2facd' name='error' filepath='block/blk-mq.c' line='567' column='1'/>
+      <function-decl name='blk_mq_end_request' mangled-name='blk_mq_end_request' filepath='block/blk-mq.c' line='575' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_end_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='575' column='1'/>
+        <parameter type-id='f4e2facd' name='error' filepath='block/blk-mq.c' line='575' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_free_request' mangled-name='blk_mq_free_request' filepath='block/blk-mq.c' line='511' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='511' column='1'/>
+      <function-decl name='blk_mq_free_request' mangled-name='blk_mq_free_request' filepath='block/blk-mq.c' line='519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='519' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_free_tag_set' mangled-name='blk_mq_free_tag_set' filepath='block/blk-mq.c' line='3610' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_tag_set'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3610' column='1'/>
+      <function-decl name='blk_mq_free_tag_set' mangled-name='blk_mq_free_tag_set' filepath='block/blk-mq.c' line='3648' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_tag_set'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3648' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_freeze_queue' mangled-name='blk_mq_freeze_queue' filepath='block/blk-mq.c' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_freeze_queue'>
@@ -123592,15 +123809,15 @@
         <parameter type-id='7359adad' name='timeout' filepath='block/blk-mq.c' line='157' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_mq_init_queue' mangled-name='blk_mq_init_queue' filepath='block/blk-mq.c' line='3161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_queue'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3161' column='1'/>
+      <function-decl name='blk_mq_init_queue' mangled-name='blk_mq_init_queue' filepath='block/blk-mq.c' line='3194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_queue'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3194' column='1'/>
         <return type-id='e7d2a5fc'/>
       </function-decl>
-      <function-decl name='blk_mq_init_sq_queue' mangled-name='blk_mq_init_sq_queue' filepath='block/blk-mq.c' line='3171' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_sq_queue'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3171' column='1'/>
-        <parameter type-id='e1962c5d' name='ops' filepath='block/blk-mq.c' line='3172' column='1'/>
-        <parameter type-id='f0981eeb' name='queue_depth' filepath='block/blk-mq.c' line='3173' column='1'/>
-        <parameter type-id='f0981eeb' name='set_flags' filepath='block/blk-mq.c' line='3174' column='1'/>
+      <function-decl name='blk_mq_init_sq_queue' mangled-name='blk_mq_init_sq_queue' filepath='block/blk-mq.c' line='3204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_sq_queue'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3204' column='1'/>
+        <parameter type-id='e1962c5d' name='ops' filepath='block/blk-mq.c' line='3205' column='1'/>
+        <parameter type-id='f0981eeb' name='queue_depth' filepath='block/blk-mq.c' line='3206' column='1'/>
+        <parameter type-id='f0981eeb' name='set_flags' filepath='block/blk-mq.c' line='3207' column='1'/>
         <return type-id='e7d2a5fc'/>
       </function-decl>
       <function-decl name='blk_mq_map_queues' mangled-name='blk_mq_map_queues' filepath='block/blk-mq-cpumap.c' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_map_queues'>
@@ -123613,31 +123830,31 @@
         <parameter type-id='95e97e5e' name='offset' filepath='block/blk-mq-pci.c' line='27' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_mq_queue_inflight' mangled-name='blk_mq_queue_inflight' filepath='block/blk-mq.c' line='892' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_queue_inflight'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='892' column='1'/>
+      <function-decl name='blk_mq_queue_inflight' mangled-name='blk_mq_queue_inflight' filepath='block/blk-mq.c' line='910' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_queue_inflight'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='910' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='blk_mq_quiesce_queue' mangled-name='blk_mq_quiesce_queue' filepath='block/blk-mq.c' line='224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_quiesce_queue'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='224' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_requeue_request' mangled-name='blk_mq_requeue_request' filepath='block/blk-mq.c' line='777' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_requeue_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='777' column='1'/>
-        <parameter type-id='b50a4934' name='kick_requeue_list' filepath='block/blk-mq.c' line='777' column='1'/>
+      <function-decl name='blk_mq_requeue_request' mangled-name='blk_mq_requeue_request' filepath='block/blk-mq.c' line='790' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_requeue_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='790' column='1'/>
+        <parameter type-id='b50a4934' name='kick_requeue_list' filepath='block/blk-mq.c' line='790' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_rq_cpu' mangled-name='blk_mq_rq_cpu' filepath='block/blk-mq.c' line='4031' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_rq_cpu'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='4031' column='1'/>
+      <function-decl name='blk_mq_rq_cpu' mangled-name='blk_mq_rq_cpu' filepath='block/blk-mq.c' line='4069' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_rq_cpu'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='4069' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='blk_mq_run_hw_queue' mangled-name='blk_mq_run_hw_queue' filepath='block/blk-mq.c' line='1636' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_run_hw_queue'>
-        <parameter type-id='a47d3467' name='hctx' filepath='block/blk-mq.c' line='1636' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1636' column='1'/>
+      <function-decl name='blk_mq_run_hw_queue' mangled-name='blk_mq_run_hw_queue' filepath='block/blk-mq.c' line='1660' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_run_hw_queue'>
+        <parameter type-id='a47d3467' name='hctx' filepath='block/blk-mq.c' line='1660' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1660' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_run_hw_queues' mangled-name='blk_mq_run_hw_queues' filepath='block/blk-mq.c' line='1699' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_run_hw_queues'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='1699' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1699' column='1'/>
+      <function-decl name='blk_mq_run_hw_queues' mangled-name='blk_mq_run_hw_queues' filepath='block/blk-mq.c' line='1724' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_run_hw_queues'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='1724' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1724' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_sched_mark_restart_hctx' mangled-name='blk_mq_sched_mark_restart_hctx' filepath='block/blk-mq-sched.c' line='50' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_sched_mark_restart_hctx'>
@@ -123660,49 +123877,49 @@
         <parameter type-id='79808846' name='merged_request' filepath='block/blk-merge.c' line='1120' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='blk_mq_start_request' mangled-name='blk_mq_start_request' filepath='block/blk-mq.c' line='737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_start_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='737' column='1'/>
+      <function-decl name='blk_mq_start_request' mangled-name='blk_mq_start_request' filepath='block/blk-mq.c' line='750' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_start_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='750' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_start_stopped_hw_queues' mangled-name='blk_mq_start_stopped_hw_queues' filepath='block/blk-mq.c' line='1834' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_start_stopped_hw_queues'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='1834' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1834' column='1'/>
+      <function-decl name='blk_mq_start_stopped_hw_queues' mangled-name='blk_mq_start_stopped_hw_queues' filepath='block/blk-mq.c' line='1859' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_start_stopped_hw_queues'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='1859' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1859' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_stop_hw_queue' mangled-name='blk_mq_stop_hw_queue' filepath='block/blk-mq.c' line='1779' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_stop_hw_queue'>
-        <parameter type-id='a47d3467' name='hctx' filepath='block/blk-mq.c' line='1779' column='1'/>
+      <function-decl name='blk_mq_stop_hw_queue' mangled-name='blk_mq_stop_hw_queue' filepath='block/blk-mq.c' line='1804' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_stop_hw_queue'>
+        <parameter type-id='a47d3467' name='hctx' filepath='block/blk-mq.c' line='1804' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_tag_to_rq' mangled-name='blk_mq_tag_to_rq' filepath='block/blk-mq.c' line='864' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tag_to_rq'>
-        <parameter type-id='0461ecf5' name='tags' filepath='block/blk-mq.c' line='864' column='1'/>
-        <parameter type-id='f0981eeb' name='tag' filepath='block/blk-mq.c' line='864' column='1'/>
+      <function-decl name='blk_mq_tag_to_rq' mangled-name='blk_mq_tag_to_rq' filepath='block/blk-mq.c' line='882' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tag_to_rq'>
+        <parameter type-id='0461ecf5' name='tags' filepath='block/blk-mq.c' line='882' column='1'/>
+        <parameter type-id='f0981eeb' name='tag' filepath='block/blk-mq.c' line='882' column='1'/>
         <return type-id='3dad1a48'/>
       </function-decl>
-      <function-decl name='blk_mq_tagset_busy_iter' mangled-name='blk_mq_tagset_busy_iter' filepath='block/blk-mq-tag.c' line='378' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tagset_busy_iter'>
-        <parameter type-id='cc26d15f' name='tagset' filepath='block/blk-mq-tag.c' line='378' column='1'/>
-        <parameter type-id='65a8a3df' name='fn' filepath='block/blk-mq-tag.c' line='379' column='1'/>
-        <parameter type-id='eaa32e2f' name='priv' filepath='block/blk-mq-tag.c' line='379' column='1'/>
+      <function-decl name='blk_mq_tagset_busy_iter' mangled-name='blk_mq_tagset_busy_iter' filepath='block/blk-mq-tag.c' line='385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tagset_busy_iter'>
+        <parameter type-id='cc26d15f' name='tagset' filepath='block/blk-mq-tag.c' line='385' column='1'/>
+        <parameter type-id='65a8a3df' name='fn' filepath='block/blk-mq-tag.c' line='386' column='1'/>
+        <parameter type-id='eaa32e2f' name='priv' filepath='block/blk-mq-tag.c' line='386' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_tagset_wait_completed_request' mangled-name='blk_mq_tagset_wait_completed_request' filepath='block/blk-mq-tag.c' line='408' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tagset_wait_completed_request'>
-        <parameter type-id='cc26d15f' name='tagset' filepath='block/blk-mq-tag.c' line='408' column='1'/>
+      <function-decl name='blk_mq_tagset_wait_completed_request' mangled-name='blk_mq_tagset_wait_completed_request' filepath='block/blk-mq-tag.c' line='415' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tagset_wait_completed_request'>
+        <parameter type-id='cc26d15f' name='tagset' filepath='block/blk-mq-tag.c' line='415' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_unfreeze_queue' mangled-name='blk_mq_unfreeze_queue' filepath='block/blk-mq.c' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_unfreeze_queue'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='192' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_unique_tag' mangled-name='blk_mq_unique_tag' filepath='block/blk-mq-tag.c' line='638' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_unique_tag'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq-tag.c' line='638' column='1'/>
+      <function-decl name='blk_mq_unique_tag' mangled-name='blk_mq_unique_tag' filepath='block/blk-mq-tag.c' line='657' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_unique_tag'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq-tag.c' line='657' column='1'/>
         <return type-id='19c2251e'/>
       </function-decl>
       <function-decl name='blk_mq_unquiesce_queue' mangled-name='blk_mq_unquiesce_queue' filepath='block/blk-mq.c' line='250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_unquiesce_queue'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='250' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_update_nr_hw_queues' mangled-name='blk_mq_update_nr_hw_queues' filepath='block/blk-mq.c' line='3813' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_update_nr_hw_queues'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3813' column='1'/>
-        <parameter type-id='95e97e5e' name='nr_hw_queues' filepath='block/blk-mq.c' line='3813' column='1'/>
+      <function-decl name='blk_mq_update_nr_hw_queues' mangled-name='blk_mq_update_nr_hw_queues' filepath='block/blk-mq.c' line='3851' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_update_nr_hw_queues'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3851' column='1'/>
+        <parameter type-id='95e97e5e' name='nr_hw_queues' filepath='block/blk-mq.c' line='3851' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_virtio_map_queues' mangled-name='blk_mq_virtio_map_queues' filepath='block/blk-mq-virtio.c' line='24' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_virtio_map_queues'>
@@ -123711,22 +123928,22 @@
         <parameter type-id='95e97e5e' name='first_vec' filepath='block/blk-mq-virtio.c' line='25' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_op_str' mangled-name='blk_op_str' filepath='block/blk-core.c' line='164' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_op_str'>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='164' column='1'/>
+      <function-decl name='blk_op_str' mangled-name='blk_op_str' filepath='block/blk-core.c' line='167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_op_str'>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='167' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='blk_poll' mangled-name='blk_poll' filepath='block/blk-mq.c' line='3977' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_poll'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='3977' column='1'/>
-        <parameter type-id='041bc907' name='cookie' filepath='block/blk-mq.c' line='3977' column='1'/>
-        <parameter type-id='b50a4934' name='spin' filepath='block/blk-mq.c' line='3977' column='1'/>
+      <function-decl name='blk_poll' mangled-name='blk_poll' filepath='block/blk-mq.c' line='4015' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_poll'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='4015' column='1'/>
+        <parameter type-id='041bc907' name='cookie' filepath='block/blk-mq.c' line='4015' column='1'/>
+        <parameter type-id='b50a4934' name='spin' filepath='block/blk-mq.c' line='4015' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_put_queue' mangled-name='blk_put_queue' filepath='block/blk-core.c' line='342' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_queue'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='342' column='1'/>
+      <function-decl name='blk_put_queue' mangled-name='blk_put_queue' filepath='block/blk-core.c' line='345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='345' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_put_request' mangled-name='blk_put_request' filepath='block/blk-core.c' line='647' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_request'>
-        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='647' column='1'/>
+      <function-decl name='blk_put_request' mangled-name='blk_put_request' filepath='block/blk-core.c' line='655' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_request'>
+        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='655' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_queue_alignment_offset' mangled-name='blk_queue_alignment_offset' filepath='block/blk-settings.c' line='367' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_alignment_offset'>
@@ -123754,19 +123971,19 @@
         <parameter type-id='95e97e5e' name='mask' filepath='block/blk-settings.c' line='732' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_queue_flag_clear' mangled-name='blk_queue_flag_clear' filepath='block/blk-core.c' line='97' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_clear'>
-        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='97' column='1'/>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='97' column='1'/>
+      <function-decl name='blk_queue_flag_clear' mangled-name='blk_queue_flag_clear' filepath='block/blk-core.c' line='100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_clear'>
+        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='100' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='100' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_queue_flag_set' mangled-name='blk_queue_flag_set' filepath='block/blk-core.c' line='86' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_set'>
-        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='86' column='1'/>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='86' column='1'/>
+      <function-decl name='blk_queue_flag_set' mangled-name='blk_queue_flag_set' filepath='block/blk-core.c' line='89' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_set'>
+        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='89' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='89' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_queue_flag_test_and_set' mangled-name='blk_queue_flag_test_and_set' filepath='block/blk-core.c' line='111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_test_and_set'>
-        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='111' column='1'/>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='111' column='1'/>
+      <function-decl name='blk_queue_flag_test_and_set' mangled-name='blk_queue_flag_test_and_set' filepath='block/blk-core.c' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_test_and_set'>
+        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='114' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='114' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='blk_queue_io_min' mangled-name='blk_queue_io_min' filepath='block/blk-settings.c' line='425' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_io_min'>
@@ -123897,28 +124114,28 @@
         <parameter type-id='fb55efa1' name='bio' filepath='block/blk-map.c' line='644' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_set_queue_dying' mangled-name='blk_set_queue_dying' filepath='block/blk-core.c' line='348' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_set_queue_dying'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='348' column='1'/>
+      <function-decl name='blk_set_queue_dying' mangled-name='blk_set_queue_dying' filepath='block/blk-core.c' line='351' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_set_queue_dying'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='351' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_set_stacking_limits' mangled-name='blk_set_stacking_limits' filepath='block/blk-settings.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_set_stacking_limits'>
         <parameter type-id='7604ff1d' name='lim' filepath='block/blk-settings.c' line='74' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_start_plug' mangled-name='blk_start_plug' filepath='block/blk-core.c' line='1696' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_start_plug'>
-        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1696' column='1'/>
+      <function-decl name='blk_start_plug' mangled-name='blk_start_plug' filepath='block/blk-core.c' line='1704' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_start_plug'>
+        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1704' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_stat_enable_accounting' mangled-name='blk_stat_enable_accounting' filepath='block/blk-stat.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_stat_enable_accounting'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-stat.c' line='187' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_status_to_errno' mangled-name='blk_status_to_errno' filepath='block/blk-core.c' line='216' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_status_to_errno'>
-        <parameter type-id='f4e2facd' name='status' filepath='block/blk-core.c' line='216' column='1'/>
+      <function-decl name='blk_status_to_errno' mangled-name='blk_status_to_errno' filepath='block/blk-core.c' line='219' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_status_to_errno'>
+        <parameter type-id='f4e2facd' name='status' filepath='block/blk-core.c' line='219' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_sync_queue' mangled-name='blk_sync_queue' filepath='block/blk-core.c' line='304' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_sync_queue'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='304' column='1'/>
+      <function-decl name='blk_sync_queue' mangled-name='blk_sync_queue' filepath='block/blk-core.c' line='307' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_sync_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='307' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_unregister_region' mangled-name='blk_unregister_region' filepath='block/genhd.c' line='659' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_unregister_region'>
@@ -123926,10 +124143,10 @@
         <parameter type-id='7359adad' name='range' filepath='block/genhd.c' line='659' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_update_request' mangled-name='blk_update_request' filepath='block/blk-core.c' line='1435' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_update_request'>
-        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='1435' column='1'/>
-        <parameter type-id='f4e2facd' name='error' filepath='block/blk-core.c' line='1435' column='1'/>
-        <parameter type-id='f0981eeb' name='nr_bytes' filepath='block/blk-core.c' line='1436' column='1'/>
+      <function-decl name='blk_update_request' mangled-name='blk_update_request' filepath='block/blk-core.c' line='1443' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_update_request'>
+        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='1443' column='1'/>
+        <parameter type-id='f4e2facd' name='error' filepath='block/blk-core.c' line='1443' column='1'/>
+        <parameter type-id='f0981eeb' name='nr_bytes' filepath='block/blk-core.c' line='1444' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='blk_verify_command' mangled-name='blk_verify_command' filepath='block/scsi_ioctl.c' line='200' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_verify_command'>
@@ -128124,10 +128341,10 @@
         <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='2334' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='disk_end_io_acct' mangled-name='disk_end_io_acct' filepath='block/blk-core.c' line='1381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_end_io_acct'>
-        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1381' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1381' column='1'/>
-        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1382' column='1'/>
+      <function-decl name='disk_end_io_acct' mangled-name='disk_end_io_acct' filepath='block/blk-core.c' line='1389' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_end_io_acct'>
+        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1389' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1389' column='1'/>
+        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1390' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='disk_stack_limits' mangled-name='disk_stack_limits' filepath='block/blk-settings.c' line='648' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_stack_limits'>
@@ -128136,10 +128353,10 @@
         <parameter type-id='a42536cd' name='offset' filepath='block/blk-settings.c' line='649' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='disk_start_io_acct' mangled-name='disk_start_io_acct' filepath='block/blk-core.c' line='1352' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_start_io_acct'>
-        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1352' column='1'/>
-        <parameter type-id='f0981eeb' name='sectors' filepath='block/blk-core.c' line='1352' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1353' column='1'/>
+      <function-decl name='disk_start_io_acct' mangled-name='disk_start_io_acct' filepath='block/blk-core.c' line='1360' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_start_io_acct'>
+        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1360' column='1'/>
+        <parameter type-id='f0981eeb' name='sectors' filepath='block/blk-core.c' line='1360' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1361' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='display_timings_release' mangled-name='display_timings_release' filepath='drivers/video/display_timing.c' line='12' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='display_timings_release'>
@@ -132308,7 +132525,7 @@
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='freq_scale' type-id='7359adad' mangled-name='freq_scale' visibility='default' filepath='drivers/base/arch_topology.c' line='35' column='1' elf-symbol-id='freq_scale'/>
-      <var-decl name='fs_bio_set' type-id='dfa886b2' mangled-name='fs_bio_set' visibility='default' filepath='block/bio.c' line='48' column='1' elf-symbol-id='fs_bio_set'/>
+      <var-decl name='fs_bio_set' type-id='dfa886b2' mangled-name='fs_bio_set' visibility='default' filepath='block/bio.c' line='49' column='1' elf-symbol-id='fs_bio_set'/>
       <function-decl name='fscrypt_decrypt_bio' mangled-name='fscrypt_decrypt_bio' filepath='fs/crypto/bio.c' line='29' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fscrypt_decrypt_bio'>
         <parameter type-id='fb55efa1' name='bio' filepath='fs/crypto/bio.c' line='29' column='1'/>
         <return type-id='48b5725f'/>
@@ -139314,16 +139531,16 @@
         <parameter type-id='edcbd723' name='kp' filepath='kernel/params.c' line='242' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='part_end_io_acct' mangled-name='part_end_io_acct' filepath='block/blk-core.c' line='1373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_end_io_acct'>
-        <parameter type-id='84dc82b7' name='part' filepath='block/blk-core.c' line='1373' column='1'/>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1373' column='1'/>
-        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1374' column='1'/>
+      <function-decl name='part_end_io_acct' mangled-name='part_end_io_acct' filepath='block/blk-core.c' line='1381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_end_io_acct'>
+        <parameter type-id='84dc82b7' name='part' filepath='block/blk-core.c' line='1381' column='1'/>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1381' column='1'/>
+        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1382' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='part_start_io_acct' mangled-name='part_start_io_acct' filepath='block/blk-core.c' line='1343' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_start_io_acct'>
-        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1343' column='1'/>
-        <parameter type-id='c4219d27' name='part' filepath='block/blk-core.c' line='1343' column='1'/>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1344' column='1'/>
+      <function-decl name='part_start_io_acct' mangled-name='part_start_io_acct' filepath='block/blk-core.c' line='1351' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_start_io_acct'>
+        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1351' column='1'/>
+        <parameter type-id='c4219d27' name='part' filepath='block/blk-core.c' line='1351' column='1'/>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1352' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='passthru_features_check' mangled-name='passthru_features_check' filepath='net/core/dev.c' line='3507' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='passthru_features_check'>
@@ -142916,8 +143133,8 @@
         <return type-id='4bdecfd7'/>
       </function-decl>
       <var-decl name='rps_needed' type-id='237c0d27' mangled-name='rps_needed' visibility='default' filepath='net/core/dev.c' line='4296' column='1' elf-symbol-id='rps_needed'/>
-      <function-decl name='rq_flush_dcache_pages' mangled-name='rq_flush_dcache_pages' filepath='block/blk-core.c' line='1534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rq_flush_dcache_pages'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1534' column='1'/>
+      <function-decl name='rq_flush_dcache_pages' mangled-name='rq_flush_dcache_pages' filepath='block/blk-core.c' line='1542' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rq_flush_dcache_pages'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1542' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rsa_parse_priv_key' mangled-name='rsa_parse_priv_key' filepath='crypto/rsa_helper.c' line='181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rsa_parse_priv_key'>
@@ -146434,16 +146651,16 @@
         <parameter type-id='c485c22c' name='bh' filepath='fs/buffer.c' line='3086' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='submit_bio' mangled-name='submit_bio' filepath='block/blk-core.c' line='1077' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1077' column='1'/>
+      <function-decl name='submit_bio' mangled-name='submit_bio' filepath='block/blk-core.c' line='1085' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1085' column='1'/>
         <return type-id='041bc907'/>
       </function-decl>
-      <function-decl name='submit_bio_noacct' mangled-name='submit_bio_noacct' filepath='block/blk-core.c' line='1042' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_noacct'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1042' column='1'/>
+      <function-decl name='submit_bio_noacct' mangled-name='submit_bio_noacct' filepath='block/blk-core.c' line='1050' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_noacct'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1050' column='1'/>
         <return type-id='041bc907'/>
       </function-decl>
-      <function-decl name='submit_bio_wait' mangled-name='submit_bio_wait' filepath='block/bio.c' line='1155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_wait'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1155' column='1'/>
+      <function-decl name='submit_bio_wait' mangled-name='submit_bio_wait' filepath='block/bio.c' line='1157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_wait'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1157' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='subsys_system_register' mangled-name='subsys_system_register' filepath='drivers/base/bus.c' line='1159' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='subsys_system_register'>
diff --git a/android/abi_gki_aarch64_transsion b/android/abi_gki_aarch64_transsion
index 44ebe94b4069..0cf3b5d164b9 100644
--- a/android/abi_gki_aarch64_transsion
+++ b/android/abi_gki_aarch64_transsion
@@ -47,6 +47,25 @@
   __traceiter_android_vh_waiting_for_page_migration
   __traceiter_android_vh_should_end_madvise
   __traceiter_android_vh_exit_check
+  __traceiter_android_vh_bio_free
+  __traceiter_android_rvh_internal_blk_mq_alloc_request
+  __traceiter_android_vh_internal_blk_mq_free_request
+  __traceiter_android_vh_blk_mq_complete_request
+  __traceiter_android_vh_blk_mq_add_to_requeue_list
+  __traceiter_android_rvh_blk_mq_delay_run_hw_queue
+  __traceiter_android_vh_blk_mq_run_hw_queue
+  __traceiter_android_vh_blk_mq_insert_request
+  __traceiter_android_rvh_blk_mq_alloc_rq_map
+  __traceiter_android_rvh_blk_mq_init_allocated_queue
+  __traceiter_android_vh_blk_mq_exit_queue
+  __traceiter_android_vh_blk_mq_alloc_tag_set
+  __traceiter_android_rvh_blk_allocated_queue_init
+  __traceiter_android_rvh_blk_flush_plug_list
+  __traceiter_android_vh_blk_alloc_flush_queue
+  __traceiter_android_vh_blk_mq_all_tag_iter
+  __traceiter_android_vh_blk_mq_queue_tag_busy_iter
+  __traceiter_android_vh_blk_mq_free_tags
+  __traceiter_android_vh_blk_mq_sched_insert_request
   __tracepoint_android_rvh_alloc_si
   __tracepoint_android_rvh_alloc_swap_slot_cache
   __tracepoint_android_rvh_drain_slots_cache_cpu
@@ -84,4 +103,23 @@
   __tracepoint_android_vh_waiting_for_page_migration
   __tracepoint_android_vh_should_end_madvise
   __tracepoint_android_vh_exit_check
+  __tracepoint_android_vh_bio_free
+  __tracepoint_android_rvh_internal_blk_mq_alloc_request
+  __tracepoint_android_vh_internal_blk_mq_free_request
+  __tracepoint_android_vh_blk_mq_complete_request
+  __tracepoint_android_vh_blk_mq_add_to_requeue_list
+  __tracepoint_android_rvh_blk_mq_delay_run_hw_queue
+  __tracepoint_android_vh_blk_mq_run_hw_queue
+  __tracepoint_android_vh_blk_mq_insert_request
+  __tracepoint_android_rvh_blk_mq_alloc_rq_map
+  __tracepoint_android_rvh_blk_mq_init_allocated_queue
+  __tracepoint_android_vh_blk_mq_exit_queue
+  __tracepoint_android_vh_blk_mq_alloc_tag_set
+  __tracepoint_android_rvh_blk_allocated_queue_init
+  __tracepoint_android_rvh_blk_flush_plug_list
+  __tracepoint_android_vh_blk_alloc_flush_queue
+  __tracepoint_android_vh_blk_mq_all_tag_iter
+  __tracepoint_android_vh_blk_mq_queue_tag_busy_iter
+  __tracepoint_android_vh_blk_mq_free_tags
+  __tracepoint_android_vh_blk_mq_sched_insert_request
   zero_pfn

From 5e21de099e6537c7b3646b2bfdc1889746e29455 Mon Sep 17 00:00:00 2001
From: Wesley Cheng <quic_wcheng@quicinc.com>
Date: Thu, 20 Apr 2023 14:27:59 -0700
Subject: [PATCH 1034/1043] UPSTREAM: usb: dwc3: gadget: Refactor EP0 forced
 stall/restart into a separate API

Several sequences utilize the same routine for forcing the control endpoint
back into the SETUP phase.  This is required, because those operations need
to ensure that EP0 is back in the default state.

Fixes: c96683798e27 ("usb: dwc3: ep0: Don't prepare beyond Setup stage")
Cc: stable@vger.kernel.org
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
Link: https://lore.kernel.org/r/20230420212759.29429-2-quic_wcheng@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 327520570
Change-Id: I9b468a021b04e765b074d9b48f46c6e828022705
(cherry picked from commit 8f40fc0808137c157dd408d2632e63bfca2aecdb)
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
---
 drivers/usb/dwc3/gadget.c | 53 ++++++++++++++++-----------------------
 1 file changed, 21 insertions(+), 32 deletions(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 5388c6e6ba83..6eb3b02501f6 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -139,6 +139,24 @@ int dwc3_gadget_set_link_state(struct dwc3 *dwc, enum dwc3_link_state state)
 	return -ETIMEDOUT;
 }
 
+static void dwc3_ep0_reset_state(struct dwc3 *dwc)
+{
+	unsigned int	dir;
+
+	if (dwc->ep0state != EP0_SETUP_PHASE) {
+		dir = !!dwc->ep0_expect_in;
+		if (dwc->ep0state == EP0_DATA_PHASE)
+			dwc3_ep0_end_control_data(dwc, dwc->eps[dir]);
+		else
+			dwc3_ep0_end_control_data(dwc, dwc->eps[!dir]);
+
+		dwc->eps[0]->trb_enqueue = 0;
+		dwc->eps[1]->trb_enqueue = 0;
+
+		dwc3_ep0_stall_and_restart(dwc);
+	}
+}
+
 /**
  * dwc3_ep_inc_trb - increment a trb index.
  * @index: Pointer to the TRB index to increment.
@@ -2547,16 +2565,9 @@ static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc)
 		ret = wait_for_completion_timeout(&dwc->ep0_in_setup,
 				msecs_to_jiffies(DWC3_PULL_UP_TIMEOUT));
 		if (ret == 0) {
-			unsigned int    dir;
-
 			dev_warn(dwc->dev, "wait for SETUP phase timed out\n");
 			spin_lock_irqsave(&dwc->lock, flags);
-			dir = !!dwc->ep0_expect_in;
-			if (dwc->ep0state == EP0_DATA_PHASE)
-				dwc3_ep0_end_control_data(dwc, dwc->eps[dir]);
-			else
-				dwc3_ep0_end_control_data(dwc, dwc->eps[!dir]);
-			dwc3_ep0_stall_and_restart(dwc);
+			dwc3_ep0_reset_state(dwc);
 			spin_unlock_irqrestore(&dwc->lock, flags);
 		}
 	}
@@ -3849,16 +3860,7 @@ static void dwc3_gadget_disconnect_interrupt(struct dwc3 *dwc)
 	dwc->setup_packet_pending = false;
 	usb_gadget_set_state(dwc->gadget, USB_STATE_NOTATTACHED);
 
-	if (dwc->ep0state != EP0_SETUP_PHASE) {
-		unsigned int    dir;
-
-		dir = !!dwc->ep0_expect_in;
-		if (dwc->ep0state == EP0_DATA_PHASE)
-			dwc3_ep0_end_control_data(dwc, dwc->eps[dir]);
-		else
-			dwc3_ep0_end_control_data(dwc, dwc->eps[!dir]);
-		dwc3_ep0_stall_and_restart(dwc);
-	}
+	dwc3_ep0_reset_state(dwc);
 }
 
 static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
@@ -3912,20 +3914,7 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
 	 * phase. So ensure that EP0 is in setup phase by issuing a stall
 	 * and restart if EP0 is not in setup phase.
 	 */
-	if (dwc->ep0state != EP0_SETUP_PHASE) {
-		unsigned int	dir;
-
-		dir = !!dwc->ep0_expect_in;
-		if (dwc->ep0state == EP0_DATA_PHASE)
-			dwc3_ep0_end_control_data(dwc, dwc->eps[dir]);
-		else
-			dwc3_ep0_end_control_data(dwc, dwc->eps[!dir]);
-
-		dwc->eps[0]->trb_enqueue = 0;
-		dwc->eps[1]->trb_enqueue = 0;
-
-		dwc3_ep0_stall_and_restart(dwc);
-	}
+	dwc3_ep0_reset_state(dwc);
 
 	/*
 	 * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a

From 91714391174041bea724e68eff7ed9b5c1f439df Mon Sep 17 00:00:00 2001
From: Wesley Cheng <quic_wcheng@quicinc.com>
Date: Tue, 21 Nov 2023 14:52:53 -0800
Subject: [PATCH 1035/1043] UPSTREAM: usb: dwc3: gadget: Handle EP0 request
 dequeuing properly

Current EP0 dequeue path will share the same as other EPs.  However, there
are some special considerations that need to be made for EP0 transfers:

  - EP0 transfers never transition into the started_list
  - EP0 only has one active request at a time

In case there is a vendor specific control message for a function over USB
FFS, then there is no guarantee on the timeline which the DATA/STATUS stage
is responded to.  While this occurs, any attempt to end transfers on
non-control EPs will end up having the DWC3_EP_DELAY_STOP flag set, and
defer issuing of the end transfer command.  If the USB FFS application
decides to timeout the control transfer, or if USB FFS AIO path exits, the
USB FFS driver will issue a call to usb_ep_dequeue() for the ep0 request.

In case of the AIO exit path, the AIO FS blocks until all pending USB
requests utilizing the AIO path is completed.  However, since the dequeue
of ep0 req does not happen properly, all non-control EPs with the
DWC3_EP_DELAY_STOP flag set will not be handled, and the AIO exit path will
be stuck waiting for the USB FFS data endpoints to receive a completion
callback.

Fix is to utilize dwc3_ep0_reset_state() in the dequeue API to ensure EP0
is brought back to the SETUP state, and ensures that any deferred end
transfer commands are handled.  This also will end any active transfers
on EP0, compared to the previous implementation which directly called
giveback only.

Fixes: fcd2def66392 ("usb: dwc3: gadget: Refactor dwc3_gadget_ep_dequeue")
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>

Bug: 327520570
Change-Id: Ic00684db4b502f1aab128f7e49f22510dda24f60
(cherry picked from commit 730e12fbec53ab59dd807d981a204258a4cfb29a)
Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
---
 drivers/usb/dwc3/gadget.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 6eb3b02501f6..bb8888696867 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2086,7 +2086,17 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
 
 	list_for_each_entry(r, &dep->pending_list, list) {
 		if (r == req) {
-			dwc3_gadget_giveback(dep, req, -ECONNRESET);
+			/*
+			 * Explicitly check for EP0/1 as dequeue for those
+			 * EPs need to be handled differently.  Control EP
+			 * only deals with one USB req, and giveback will
+			 * occur during dwc3_ep0_stall_and_restart().  EP0
+			 * requests are never added to started_list.
+			 */
+			if (dep->number > 1)
+				dwc3_gadget_giveback(dep, req, -ECONNRESET);
+			else
+				dwc3_ep0_reset_state(dwc);
 			goto out;
 		}
 	}

From 004e22c4b0d8cd35833afa8d34f6d36e154a74df Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 14:59:29 +0800
Subject: [PATCH 1036/1043] ANDROID: add hooks into bio.c for customized I/O
 scheduler

android_vh_bio_free: We have added some additional information to
each bio, which needs to be freed simultaneously when the bio is free

Bug: 319582497
Bug: 327716807

Change-Id: I532f98fa0569f2eb8da66cff746349c828e0912c
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/bio.c                    | 2 ++
 drivers/android/vendor_hooks.c | 1 +
 include/trace/hooks/block.h    | 5 +++++
 3 files changed, 8 insertions(+)

diff --git a/block/bio.c b/block/bio.c
index 6d6e7b96b002..d03952b9e76d 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -21,6 +21,7 @@
 #include <linux/blk-crypto.h>
 
 #include <trace/events/block.h>
+#include <trace/hooks/block.h>
 #include "blk.h"
 #include "blk-rq-qos.h"
 
@@ -252,6 +253,7 @@ static void bio_free(struct bio *bio)
 	struct bio_set *bs = bio->bi_pool;
 	void *p;
 
+	trace_android_vh_bio_free(bio);
 	bio_uninit(bio);
 
 	if (bs) {
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 21496961475e..44eb4a22960b 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -512,6 +512,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_compl_rsp_check_done);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_handler);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_check_ctrl);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_print_ctrl);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_bio_free);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/block.h b/include/trace/hooks/block.h
index a5a7ac70a2ee..a748dae4671e 100644
--- a/include/trace/hooks/block.h
+++ b/include/trace/hooks/block.h
@@ -22,6 +22,7 @@ struct blk_mq_tag_set;
 /* struct blk_mq_tag_set */
 #include <linux/blk-mq.h>
 #endif /* __GENKSYMS__ */
+struct bio;
 
 DECLARE_HOOK(android_vh_blk_alloc_rqs,
 	TP_PROTO(size_t *rq_size, struct blk_mq_tag_set *set,
@@ -33,6 +34,10 @@ DECLARE_HOOK(android_vh_blk_rq_ctx_init,
 		struct blk_mq_alloc_data *data, u64 alloc_time_ns),
 	TP_ARGS(rq, tags, data, alloc_time_ns));
 
+DECLARE_HOOK(android_vh_bio_free,
+	TP_PROTO(struct bio *bio),
+	TP_ARGS(bio));
+
 #endif /* _TRACE_HOOK_BLOCK_H */
 
 /* This part must be outside protection */

From fb5aa97544fd07f9e0229d1fec9f01668f376e48 Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 19:49:07 +0800
Subject: [PATCH 1037/1043] ANDROID: add hooks into blk-mq.c for customized I/O
 scheduler.

Our scheduler uses the ANDROID_OEM_DATA field in the request_queue
structure to customize a set of ops operations for the request queue
applied by the ufs/emmc driver. Adopt fine-grained IO scheduling
strategies based on specific request types and user scenarios

android_rvh_internal_blk_mq_alloc_request: Obtain a new tag.
This process may be scheduled because the tag cannot be allocated
quickly, so a restricted hook is required.

android_vh_internal_blk_mq_free_request: Release individually allocated
tags

android_vh_blk_mq_complete_request: Record the time when the request was
completed

android_vh_blk_mq_add_to_requeue_list: Add requests to a separate
distribution queue

android_rvh_blk_mq_delay_run_hw_queue: The process of calling queue_rq
to handle the request may be scheduled, so restricted hooks need to be
used

android_vh_blk_mq_run_hw_queue: Set need_run to true

android_vh_blk_mq_insert_request: Insert the request into a customized
queue

android_rvh_blk_mq_alloc_rq_map: The process of assigning customized
tags may be scheduled, so restricted hooks need to be used

android_rvh_blk_mq_init_allocated_queue: The customized scheduler is
initialized and needs to allocate some resources. This process may be
scheduled, so restricted hooks need to be used

android_vh_blk_mq_exit_queue: Release resources allocated by the
customized scheduler

android_vh_blk_mq_alloc_tag_set: Get tagset information

Bug: 319582497
Bug: 327716807

Change-Id: I2b16d69a1e7085a4f5f82660b75188c517b01894
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/blk-mq.c                 | 46 ++++++++++++++++++++++---
 drivers/android/vendor_hooks.c | 11 ++++++
 include/trace/hooks/block.h    | 62 +++++++++++++++++++++++++++++++++-
 3 files changed, 114 insertions(+), 5 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 21544b119a7e..f5dc90f25d31 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -353,6 +353,7 @@ static struct request *__blk_mq_alloc_request(struct blk_mq_alloc_data *data)
 	struct elevator_queue *e = q->elevator;
 	u64 alloc_time_ns = 0;
 	unsigned int tag;
+	bool skip = false;
 
 	/* alloc_time includes depth and tag waits */
 	if (blk_queue_rq_alloc_time(q))
@@ -384,7 +385,9 @@ static struct request *__blk_mq_alloc_request(struct blk_mq_alloc_data *data)
 	 * case just retry the hctx assignment and tag allocation as CPU hotplug
 	 * should have migrated us to an online CPU by now.
 	 */
-	tag = blk_mq_get_tag(data);
+	trace_android_rvh_internal_blk_mq_alloc_request(&skip, &tag, data);
+	if (!skip)
+		tag = blk_mq_get_tag(data);
 	if (tag == BLK_MQ_NO_TAG) {
 		if (data->flags & BLK_MQ_REQ_NOWAIT)
 			return NULL;
@@ -496,12 +499,17 @@ static void __blk_mq_free_request(struct request *rq)
 	struct blk_mq_ctx *ctx = rq->mq_ctx;
 	struct blk_mq_hw_ctx *hctx = rq->mq_hctx;
 	const int sched_tag = rq->internal_tag;
+	bool skip = false;
 
 	blk_crypto_free_request(rq);
 	blk_pm_mark_last_busy(rq);
 	rq->mq_hctx = NULL;
-	if (rq->tag != BLK_MQ_NO_TAG)
-		blk_mq_put_tag(hctx->tags, ctx, rq->tag);
+
+	trace_android_vh_internal_blk_mq_free_request(&skip, rq, hctx);
+	if (!skip) {
+		if (rq->tag != BLK_MQ_NO_TAG)
+			blk_mq_put_tag(hctx->tags, ctx, rq->tag);
+	}
 	if (sched_tag != BLK_MQ_NO_TAG)
 		blk_mq_put_tag(hctx->sched_tags, ctx, sched_tag);
 	blk_mq_sched_restart(hctx);
@@ -701,6 +709,11 @@ EXPORT_SYMBOL_GPL(blk_mq_complete_request_remote);
  **/
 void blk_mq_complete_request(struct request *rq)
 {
+	bool skip = false;
+
+	trace_android_vh_blk_mq_complete_request(&skip, rq);
+	if (skip)
+		return;
 	if (!blk_mq_complete_request_remote(rq))
 		rq->q->mq_ops->complete(rq);
 }
@@ -827,7 +840,12 @@ void blk_mq_add_to_requeue_list(struct request *rq, bool at_head,
 {
 	struct request_queue *q = rq->q;
 	unsigned long flags;
+	bool skip = false;
 
+	trace_android_vh_blk_mq_add_to_requeue_list(&skip, rq,
+						     kick_requeue_list);
+	if (skip)
+		return;
 	/*
 	 * We abuse this flag that is otherwise used by the I/O scheduler to
 	 * request head insertion from the workqueue.
@@ -1593,9 +1611,15 @@ static int blk_mq_hctx_next_cpu(struct blk_mq_hw_ctx *hctx)
 static void __blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async,
 					unsigned long msecs)
 {
+	bool skip = false;
+
 	if (unlikely(blk_mq_hctx_stopped(hctx)))
 		return;
 
+	trace_android_rvh_blk_mq_delay_run_hw_queue(&skip, hctx, async);
+	if (skip)
+		return;
+
 	if (!async && !(hctx->flags & BLK_MQ_F_BLOCKING)) {
 		int cpu = get_cpu();
 		if (cpumask_test_cpu(cpu, hctx->cpumask)) {
@@ -1651,6 +1675,7 @@ void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
 		blk_mq_hctx_has_pending(hctx);
 	hctx_unlock(hctx, srcu_idx);
 
+	trace_android_vh_blk_mq_run_hw_queue(&need_run, hctx);
 	if (need_run)
 		__blk_mq_delay_run_hw_queue(hctx, async, 0);
 }
@@ -1877,9 +1902,14 @@ void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
 			     bool at_head)
 {
 	struct blk_mq_ctx *ctx = rq->mq_ctx;
+	bool skip = false;
 
 	lockdep_assert_held(&ctx->lock);
 
+	trace_android_vh_blk_mq_insert_request(&skip, hctx, rq);
+	if (skip)
+		return;
+
 	__blk_mq_insert_req_list(hctx, rq, at_head);
 	blk_mq_hctx_mark_pending(hctx, ctx);
 }
@@ -2419,12 +2449,15 @@ struct blk_mq_tags *blk_mq_alloc_rq_map(struct blk_mq_tag_set *set,
 {
 	struct blk_mq_tags *tags;
 	int node;
+	bool skip = false;
 
 	node = blk_mq_hw_queue_to_node(&set->map[HCTX_TYPE_DEFAULT], hctx_idx);
 	if (node == NUMA_NO_NODE)
 		node = set->numa_node;
 
-	tags = blk_mq_init_tags(nr_tags, reserved_tags, node, flags);
+	trace_android_rvh_blk_mq_alloc_rq_map(&skip, &tags, set, node, flags);
+	if (!skip)
+		tags = blk_mq_init_tags(nr_tags, reserved_tags, node, flags);
 	if (!tags)
 		return NULL;
 
@@ -3362,6 +3395,8 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
 	blk_mq_add_queue_tag_set(set, q);
 	blk_mq_map_swqueue(q);
 
+	trace_android_rvh_blk_mq_init_allocated_queue(q);
+
 	if (elevator_init)
 		elevator_init_mq(q);
 
@@ -3385,6 +3420,7 @@ void blk_mq_exit_queue(struct request_queue *q)
 {
 	struct blk_mq_tag_set *set = q->tag_set;
 
+	trace_android_vh_blk_mq_exit_queue(q);
 	/* Checks hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED. */
 	blk_mq_exit_hw_queues(q, set, set->nr_hw_queues);
 	/* May clear BLK_MQ_F_TAG_QUEUE_SHARED in hctx->flags. */
@@ -3575,6 +3611,8 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set)
 	if (ret)
 		goto out_free_mq_map;
 
+	trace_android_vh_blk_mq_alloc_tag_set(set);
+
 	ret = blk_mq_alloc_map_and_requests(set);
 	if (ret)
 		goto out_free_mq_map;
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 44eb4a22960b..1cb58a55a07a 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -513,6 +513,17 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_handler);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_check_ctrl);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_ufs_err_print_ctrl);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_bio_free);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_internal_blk_mq_alloc_request);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_internal_blk_mq_free_request);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_complete_request);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_add_to_requeue_list);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_mq_delay_run_hw_queue);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_run_hw_queue);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_insert_request);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_mq_alloc_rq_map);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_mq_init_allocated_queue);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_exit_queue);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_alloc_tag_set);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/block.h b/include/trace/hooks/block.h
index a748dae4671e..39cba4bd0756 100644
--- a/include/trace/hooks/block.h
+++ b/include/trace/hooks/block.h
@@ -14,15 +14,18 @@
 struct blk_mq_tags;
 struct blk_mq_alloc_data;
 struct blk_mq_tag_set;
+struct blk_mq_hw_ctx;
 #else
 /* struct blk_mq_tags */
 #include <../block/blk-mq-tag.h>
 /* struct blk_mq_alloc_data */
 #include <../block/blk-mq.h>
-/* struct blk_mq_tag_set */
+/* struct blk_mq_tag_set struct blk_mq_hw_ctx*/
 #include <linux/blk-mq.h>
 #endif /* __GENKSYMS__ */
 struct bio;
+struct request_queue;
+struct request;
 
 DECLARE_HOOK(android_vh_blk_alloc_rqs,
 	TP_PROTO(size_t *rq_size, struct blk_mq_tag_set *set,
@@ -38,6 +41,63 @@ DECLARE_HOOK(android_vh_bio_free,
 	TP_PROTO(struct bio *bio),
 	TP_ARGS(bio));
 
+DECLARE_RESTRICTED_HOOK(android_rvh_internal_blk_mq_alloc_request,
+	TP_PROTO(bool *skip, int *tag, struct blk_mq_alloc_data *data),
+	TP_ARGS(skip, tag, data), 1);
+
+DECLARE_HOOK(android_vh_internal_blk_mq_free_request,
+	TP_PROTO(bool *skip, struct request *rq, struct blk_mq_hw_ctx *hctx),
+	TP_ARGS(skip, rq, hctx));
+
+DECLARE_HOOK(android_vh_blk_mq_complete_request,
+	TP_PROTO(bool *skip, struct request *rq),
+	TP_ARGS(skip, rq));
+
+DECLARE_HOOK(android_vh_blk_mq_add_to_requeue_list,
+	TP_PROTO(bool *skip, struct request *rq, bool kick_requeue_list),
+	TP_ARGS(skip, rq, kick_requeue_list));
+
+DECLARE_HOOK(android_vh_blk_mq_get_driver_tag,
+	TP_PROTO(struct request *rq),
+	TP_ARGS(rq));
+
+DECLARE_RESTRICTED_HOOK(android_rvh_blk_mq_delay_run_hw_queue,
+	TP_PROTO(bool *skip, struct blk_mq_hw_ctx *hctx, bool async),
+	TP_ARGS(skip, hctx, async), 1);
+
+DECLARE_HOOK(android_vh_blk_mq_run_hw_queue,
+	TP_PROTO(bool *need_run, struct blk_mq_hw_ctx *hctx),
+	TP_ARGS(need_run, hctx));
+
+DECLARE_HOOK(android_vh_blk_mq_insert_request,
+	TP_PROTO(bool *skip, struct blk_mq_hw_ctx *hctx, struct request *rq),
+	TP_ARGS(skip, hctx, rq));
+
+DECLARE_RESTRICTED_HOOK(android_rvh_blk_mq_alloc_rq_map,
+	TP_PROTO(bool *skip, struct blk_mq_tags **tags,
+		struct blk_mq_tag_set *set, int node, unsigned int flags),
+	TP_ARGS(skip, tags, set, node, flags), 1);
+
+DECLARE_HOOK(android_vh_blk_mq_hctx_notify_dead,
+	TP_PROTO(bool *skip, struct blk_mq_hw_ctx *hctx),
+	TP_ARGS(skip, hctx));
+
+DECLARE_RESTRICTED_HOOK(android_rvh_blk_mq_init_allocated_queue,
+	TP_PROTO(struct request_queue *q),
+	TP_ARGS(q), 1);
+
+DECLARE_HOOK(android_vh_blk_mq_exit_queue,
+	TP_PROTO(struct request_queue *q),
+	TP_ARGS(q));
+
+DECLARE_HOOK(android_vh_blk_mq_alloc_tag_set,
+	TP_PROTO(struct blk_mq_tag_set *set),
+	TP_ARGS(set));
+
+DECLARE_HOOK(android_vh_blk_mq_update_nr_requests,
+	TP_PROTO(bool *skip, struct request_queue *q),
+	TP_ARGS(skip, q));
+
 #endif /* _TRACE_HOOK_BLOCK_H */
 
 /* This part must be outside protection */

From f3d6606815ff90af64fc49d4b40f32cb287161e8 Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 19:55:59 +0800
Subject: [PATCH 1038/1043] ANDROID: add hooks into blk-core.c for customized
 I/O scheduler

android_rvh_blk_allocated_queue_init: Allocate specific request_queue
information and save the pointer address in the ANDROID_OEM_DATA field.
The allocation process may be scheduled, so a restricted hook function
is used

android_rvh_blk_flush_plug_list: Flush the customized plug list. During
this process, the scheduled queue_rq will be called to process the
request, so a restricted hook function is used

Bug: 319582497
Bug: 327716807

Change-Id: I0af3915de899b678ffd4f207cac2e35a744936b8
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/blk-core.c               | 9 +++++++++
 drivers/android/vendor_hooks.c | 2 ++
 include/trace/hooks/block.h    | 9 +++++++++
 3 files changed, 20 insertions(+)

diff --git a/block/blk-core.c b/block/blk-core.c
index d64ce14cbe6c..73adca697336 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -66,6 +66,9 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(block_rq_merge);
 EXPORT_TRACEPOINT_SYMBOL_GPL(block_rq_requeue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(block_rq_complete);
 
+#undef CREATE_TRACE_POINTS
+#include <trace/hooks/block.h>
+
 DEFINE_IDA(blk_queue_ida);
 
 /*
@@ -522,6 +525,7 @@ struct request_queue *blk_alloc_queue(int node_id)
 {
 	struct request_queue *q;
 	int ret;
+	bool skip = false;
 
 	q = kmem_cache_alloc_node(blk_requestq_cachep,
 				GFP_KERNEL | __GFP_ZERO, node_id);
@@ -585,6 +589,10 @@ struct request_queue *blk_alloc_queue(int node_id)
 	blk_set_default_limits(&q->limits);
 	q->nr_requests = BLKDEV_MAX_RQ;
 
+	trace_android_rvh_blk_allocated_queue_init(&skip, q);
+	if (skip)
+		goto fail_ref;
+
 	return q;
 
 fail_ref:
@@ -1761,6 +1769,7 @@ EXPORT_SYMBOL(blk_check_plugged);
 
 void blk_flush_plug_list(struct blk_plug *plug, bool from_schedule)
 {
+	trace_android_rvh_blk_flush_plug_list(plug, from_schedule);
 	flush_plug_callbacks(plug, from_schedule);
 
 	if (!list_empty(&plug->mq_list))
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 1cb58a55a07a..130f51a3dbfb 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -524,6 +524,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_mq_alloc_rq_map);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_mq_init_allocated_queue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_exit_queue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_alloc_tag_set);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_allocated_queue_init);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_flush_plug_list);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/block.h b/include/trace/hooks/block.h
index 39cba4bd0756..9d2db2257e16 100644
--- a/include/trace/hooks/block.h
+++ b/include/trace/hooks/block.h
@@ -26,6 +26,7 @@ struct blk_mq_hw_ctx;
 struct bio;
 struct request_queue;
 struct request;
+struct blk_plug;
 
 DECLARE_HOOK(android_vh_blk_alloc_rqs,
 	TP_PROTO(size_t *rq_size, struct blk_mq_tag_set *set,
@@ -98,6 +99,14 @@ DECLARE_HOOK(android_vh_blk_mq_update_nr_requests,
 	TP_PROTO(bool *skip, struct request_queue *q),
 	TP_ARGS(skip, q));
 
+DECLARE_RESTRICTED_HOOK(android_rvh_blk_allocated_queue_init,
+	TP_PROTO(bool *skip, struct request_queue *q),
+	TP_ARGS(skip, q), 1);
+
+DECLARE_RESTRICTED_HOOK(android_rvh_blk_flush_plug_list,
+	TP_PROTO(struct blk_plug *plug, bool from_schedule),
+	TP_ARGS(plug, from_schedule), 1);
+
 #endif /* _TRACE_HOOK_BLOCK_H */
 
 /* This part must be outside protection */

From 7f70f636e5c9bbed97aa81a4d69646c3ddede5f2 Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 20:18:19 +0800
Subject: [PATCH 1039/1043] ANDROID: add hooks into blk-flush.c for customized
 I/O scheduler

android_vh_blk_alloc_flush_queue: Expand the flush request size to carry
more customized information

Bug: 319582497
Bug: 327716807

Change-Id: I728852bd29ff7f851545c52fbdeafa7cd3a4addf
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/blk-flush.c              | 10 ++++++++--
 drivers/android/vendor_hooks.c |  1 +
 include/trace/hooks/block.h    |  6 ++++++
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/block/blk-flush.c b/block/blk-flush.c
index 33b487b5cbf7..af59a7e4684f 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -467,11 +467,13 @@ int blkdev_issue_flush(struct block_device *bdev, gfp_t gfp_mask)
 }
 EXPORT_SYMBOL(blkdev_issue_flush);
 
+#include <trace/hooks/block.h>
 struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size,
 					      gfp_t flags)
 {
 	struct blk_flush_queue *fq;
 	int rq_sz = sizeof(struct request);
+	bool skip = false;
 
 	fq = kzalloc_node(sizeof(*fq), flags, node);
 	if (!fq)
@@ -479,8 +481,12 @@ struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size,
 
 	spin_lock_init(&fq->mq_flush_lock);
 
-	rq_sz = round_up(rq_sz + cmd_size, cache_line_size());
-	fq->flush_rq = kzalloc_node(rq_sz, flags, node);
+	trace_android_vh_blk_alloc_flush_queue(&skip, cmd_size, flags, node,
+					       fq);
+	if (!skip) {
+		rq_sz = round_up(rq_sz + cmd_size, cache_line_size());
+		fq->flush_rq = kzalloc_node(rq_sz, flags, node);
+	}
 	if (!fq->flush_rq)
 		goto fail_rq;
 
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 130f51a3dbfb..1f7df8e2281b 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -526,6 +526,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_exit_queue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_alloc_tag_set);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_allocated_queue_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_flush_plug_list);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_alloc_flush_queue);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/block.h b/include/trace/hooks/block.h
index 9d2db2257e16..a58e5de14a70 100644
--- a/include/trace/hooks/block.h
+++ b/include/trace/hooks/block.h
@@ -27,6 +27,7 @@ struct bio;
 struct request_queue;
 struct request;
 struct blk_plug;
+struct blk_flush_queue;
 
 DECLARE_HOOK(android_vh_blk_alloc_rqs,
 	TP_PROTO(size_t *rq_size, struct blk_mq_tag_set *set,
@@ -107,6 +108,11 @@ DECLARE_RESTRICTED_HOOK(android_rvh_blk_flush_plug_list,
 	TP_PROTO(struct blk_plug *plug, bool from_schedule),
 	TP_ARGS(plug, from_schedule), 1);
 
+DECLARE_HOOK(android_vh_blk_alloc_flush_queue,
+	TP_PROTO(bool *skip, int cmd_size, int flags, int node,
+		 struct blk_flush_queue *fq),
+	TP_ARGS(skip, cmd_size, flags, node, fq));
+
 #endif /* _TRACE_HOOK_BLOCK_H */
 
 /* This part must be outside protection */

From d2ad26f01a46924308c6e0b57cd3a9dea03ac9cf Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 20:24:00 +0800
Subject: [PATCH 1040/1043] ANDROID: add hooks into blk-ma-tag.c for customized
 I/O scheduler

android_vh_blk_mq_all_tag_iter: The customized solution adds a new tag
type, so need to use the customized solution for traversal

android_vh_blk_mq_queue_tag_busy_iter: The customized solution adds a
new tag type, so need to use the customized solution for traversal

android_vh_blk_mq_free_tags: Release the customized tag

Bug: 319582497
Bug: 327716807

Change-Id: I648a9a31c11c284a75653405b8f8521d9da34d20
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/blk-mq-tag.c             | 19 +++++++++++++++++++
 drivers/android/vendor_hooks.c |  4 ++++
 include/trace/hooks/blk_mq.h   | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 56 insertions(+)
 create mode 100644 include/trace/hooks/blk_mq.h

diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 16ad9e656610..a1125b9e34f1 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -15,6 +15,8 @@
 #include "blk-mq.h"
 #include "blk-mq-tag.h"
 
+#include <trace/hooks/blk_mq.h>
+
 /*
  * If a previously inactive queue goes active, bump the active user count.
  * We need to do this before try to allocate driver tag, then even if fail
@@ -336,8 +338,13 @@ static void bt_tags_for_each(struct blk_mq_tags *tags, struct sbitmap_queue *bt,
 static void __blk_mq_all_tag_iter(struct blk_mq_tags *tags,
 		busy_tag_iter_fn *fn, void *priv, unsigned int flags)
 {
+	bool skip = false;
+
 	WARN_ON_ONCE(flags & BT_TAG_ITER_RESERVED);
 
+	trace_android_vh_blk_mq_all_tag_iter(&skip, tags, fn, priv);
+	if (skip)
+		return;
 	if (tags->nr_reserved_tags)
 		bt_tags_for_each(tags, tags->breserved_tags, fn, priv,
 				 flags | BT_TAG_ITER_RESERVED);
@@ -438,6 +445,7 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn,
 {
 	struct blk_mq_hw_ctx *hctx;
 	int i;
+	bool skip = false;
 
 	/*
 	 * __blk_mq_update_nr_hw_queues() updates nr_hw_queues and queue_hw_ctx
@@ -457,6 +465,11 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn,
 		if (!blk_mq_hw_queue_mapped(hctx))
 			continue;
 
+		trace_android_vh_blk_mq_queue_tag_busy_iter(&skip, hctx, fn,
+							    priv);
+		if (skip)
+			continue;
+
 		if (tags->nr_reserved_tags)
 			bt_for_each(hctx, tags->breserved_tags, fn, priv, true);
 		bt_for_each(hctx, tags->bitmap_tags, fn, priv, false);
@@ -556,6 +569,12 @@ struct blk_mq_tags *blk_mq_init_tags(unsigned int total_tags,
 
 void blk_mq_free_tags(struct blk_mq_tags *tags, unsigned int flags)
 {
+	bool skip = false;
+
+	trace_android_vh_blk_mq_free_tags(&skip, tags);
+	if (skip)
+		return;
+
 	if (!(flags & BLK_MQ_F_TAG_HCTX_SHARED)) {
 		sbitmap_queue_free(tags->bitmap_tags);
 		sbitmap_queue_free(tags->breserved_tags);
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 1f7df8e2281b..87c98cd92694 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -45,6 +45,7 @@
 #include <trace/hooks/thermal.h>
 #include <trace/hooks/ufshcd.h>
 #include <trace/hooks/block.h>
+#include <trace/hooks/blk_mq.h>
 #include <trace/hooks/cgroup.h>
 #include <trace/hooks/sys.h>
 #include <trace/hooks/traps.h>
@@ -527,6 +528,9 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_alloc_tag_set);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_allocated_queue_init);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_rvh_blk_flush_plug_list);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_alloc_flush_queue);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_all_tag_iter);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_queue_tag_busy_iter);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_free_tags);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/blk_mq.h b/include/trace/hooks/blk_mq.h
new file mode 100644
index 000000000000..75d36a48ebad
--- /dev/null
+++ b/include/trace/hooks/blk_mq.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM blk_mq
+
+#define TRACE_INCLUDE_PATH trace/hooks
+
+#if !defined(_TRACE_HOOK_BLK_MQ_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_HOOK_BLK_MQ_H
+
+#include <trace/hooks/vendor_hooks.h>
+
+struct blk_mq_tag_set;
+struct blk_mq_hw_ctx;
+
+
+DECLARE_HOOK(android_vh_blk_mq_all_tag_iter,
+	TP_PROTO(bool *skip, struct blk_mq_tags *tags, busy_tag_iter_fn *fn,
+		 void *priv),
+	TP_ARGS(skip, tags, fn, priv));
+
+DECLARE_HOOK(android_vh_blk_mq_queue_tag_busy_iter,
+	TP_PROTO(bool *skip, struct blk_mq_hw_ctx *hctx, busy_iter_fn * fn,
+		 void *priv),
+	TP_ARGS(skip, hctx, fn, priv));
+
+DECLARE_HOOK(android_vh_blk_mq_free_tags,
+	TP_PROTO(bool *skip, struct blk_mq_tags *tags),
+	TP_ARGS(skip, tags));
+
+#endif /* _TRACE_HOOK_BLK_MQ_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>

From f68e7e001165bcd34dcdcab1b07dcb50ed7528bd Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Wed, 10 Jan 2024 20:36:37 +0800
Subject: [PATCH 1041/1043] ANDROID: add hooks into blk-mq-sched.c for
 customized I/O scheduler

android_vh_blk_mq_sched_insert_request: Add judgment on rq. If it is a
customized rq, it needs to be added to the corresponding customized
queue

Bug: 319582497
Bug: 327716807

Change-Id: I2bf8fee37273b3495d60c64bb53e43debceb5614
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 block/blk-mq-sched.c           | 6 +++++-
 drivers/android/vendor_hooks.c | 1 +
 include/trace/hooks/block.h    | 4 ++++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index 91b7626dbcd1..856fe30f1a3c 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -422,6 +422,7 @@ static bool blk_mq_sched_bypass_insert(struct blk_mq_hw_ctx *hctx,
 	return false;
 }
 
+#include <trace/hooks/block.h>
 void blk_mq_sched_insert_request(struct request *rq, bool at_head,
 				 bool run_queue, bool async)
 {
@@ -429,10 +430,13 @@ void blk_mq_sched_insert_request(struct request *rq, bool at_head,
 	struct elevator_queue *e = q->elevator;
 	struct blk_mq_ctx *ctx = rq->mq_ctx;
 	struct blk_mq_hw_ctx *hctx = rq->mq_hctx;
+	bool skip = false;
 
 	WARN_ON(e && (rq->tag != BLK_MQ_NO_TAG));
 
-	if (blk_mq_sched_bypass_insert(hctx, !!e, rq)) {
+	trace_android_vh_blk_mq_sched_insert_request(&skip, rq);
+
+	if (!skip && blk_mq_sched_bypass_insert(hctx, !!e, rq)) {
 		/*
 		 * Firstly normal IO request is inserted to scheduler queue or
 		 * sw queue, meantime we add flush request to dispatch queue(
diff --git a/drivers/android/vendor_hooks.c b/drivers/android/vendor_hooks.c
index 87c98cd92694..4d75905a763f 100644
--- a/drivers/android/vendor_hooks.c
+++ b/drivers/android/vendor_hooks.c
@@ -531,6 +531,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_alloc_flush_queue);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_all_tag_iter);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_queue_tag_busy_iter);
 EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_free_tags);
+EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_blk_mq_sched_insert_request);
 /*
  * For type visibility
  */
diff --git a/include/trace/hooks/block.h b/include/trace/hooks/block.h
index a58e5de14a70..9126e6c0e3ff 100644
--- a/include/trace/hooks/block.h
+++ b/include/trace/hooks/block.h
@@ -113,6 +113,10 @@ DECLARE_HOOK(android_vh_blk_alloc_flush_queue,
 		 struct blk_flush_queue *fq),
 	TP_ARGS(skip, cmd_size, flags, node, fq));
 
+DECLARE_HOOK(android_vh_blk_mq_sched_insert_request,
+	TP_PROTO(bool *skip, struct request *rq),
+	TP_ARGS(skip, rq));
+
 #endif /* _TRACE_HOOK_BLOCK_H */
 
 /* This part must be outside protection */

From 098dad372e02ccf90fef6eb520f15e417d4b69d6 Mon Sep 17 00:00:00 2001
From: hao lv <hao.lv5@transsion.com>
Date: Fri, 1 Mar 2024 16:50:41 +0800
Subject: [PATCH 1042/1043] ANDROID: GKI: Update symbols to symbol list

Leaf changes summary: 38 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 19 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 19 Added variables

19 Added functions:

  [A] 'function int __traceiter_android_rvh_blk_allocated_queue_init(void*, bool*, request_queue*)'
  [A] 'function int __traceiter_android_rvh_blk_flush_plug_list(void*, blk_plug*, bool)'
  [A] 'function int __traceiter_android_rvh_blk_mq_alloc_rq_map(void*, bool*, blk_mq_tags**, blk_mq_tag_set*, int, unsigned int)'
  [A] 'function int __traceiter_android_rvh_blk_mq_delay_run_hw_queue(void*, bool*, blk_mq_hw_ctx*, bool)'
  [A] 'function int __traceiter_android_rvh_blk_mq_init_allocated_queue(void*, request_queue*)'
  [A] 'function int __traceiter_android_rvh_internal_blk_mq_alloc_request(void*, bool*, int*, blk_mq_alloc_data*)'
  [A] 'function int __traceiter_android_vh_bio_free(void*, bio*)'
  [A] 'function int __traceiter_android_vh_blk_alloc_flush_queue(void*, bool*, int, int, int, blk_flush_queue*)'
  [A] 'function int __traceiter_android_vh_blk_mq_add_to_requeue_list(void*, bool*, request*, bool)'
  [A] 'function int __traceiter_android_vh_blk_mq_all_tag_iter(void*, bool*, blk_mq_tags*, busy_tag_iter_fn*, void*)'
  [A] 'function int __traceiter_android_vh_blk_mq_alloc_tag_set(void*, blk_mq_tag_set*)'
  [A] 'function int __traceiter_android_vh_blk_mq_complete_request(void*, bool*, request*)'
  [A] 'function int __traceiter_android_vh_blk_mq_exit_queue(void*, request_queue*)'
  [A] 'function int __traceiter_android_vh_blk_mq_free_tags(void*, bool*, blk_mq_tags*)'
  [A] 'function int __traceiter_android_vh_blk_mq_insert_request(void*, bool*, blk_mq_hw_ctx*, request*)'
  [A] 'function int __traceiter_android_vh_blk_mq_queue_tag_busy_iter(void*, bool*, blk_mq_hw_ctx*, busy_iter_fn*, void*)'
  [A] 'function int __traceiter_android_vh_blk_mq_run_hw_queue(void*, bool*, blk_mq_hw_ctx*)'
  [A] 'function int __traceiter_android_vh_blk_mq_sched_insert_request(void*, bool*, request*)'
  [A] 'function int __traceiter_android_vh_internal_blk_mq_free_request(void*, bool*, request*, blk_mq_hw_ctx*)'

19 Added variables:

  [A] 'tracepoint __tracepoint_android_rvh_blk_allocated_queue_init'
  [A] 'tracepoint __tracepoint_android_rvh_blk_flush_plug_list'
  [A] 'tracepoint __tracepoint_android_rvh_blk_mq_alloc_rq_map'
  [A] 'tracepoint __tracepoint_android_rvh_blk_mq_delay_run_hw_queue'
  [A] 'tracepoint __tracepoint_android_rvh_blk_mq_init_allocated_queue'
  [A] 'tracepoint __tracepoint_android_rvh_internal_blk_mq_alloc_request'
  [A] 'tracepoint __tracepoint_android_vh_bio_free'
  [A] 'tracepoint __tracepoint_android_vh_blk_alloc_flush_queue'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_add_to_requeue_list'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_all_tag_iter'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_alloc_tag_set'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_complete_request'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_exit_queue'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_free_tags'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_insert_request'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_queue_tag_busy_iter'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_run_hw_queue'
  [A] 'tracepoint __tracepoint_android_vh_blk_mq_sched_insert_request'
  [A] 'tracepoint __tracepoint_android_vh_internal_blk_mq_free_request'

Bug: 319582497
Bug: 327716807

Change-Id: I35d4708c6fa74041783784299a5182b68eb762b2
Signed-off-by: hao lv <hao.lv5@transsion.com>
---
 android/abi_gki_aarch64.xml       | 609 +++++++++++++++++++-----------
 android/abi_gki_aarch64_transsion |  38 ++
 2 files changed, 433 insertions(+), 214 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 226ceb691807..aec31f310807 100644
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -312,6 +312,11 @@
       <elf-symbol name='__traceiter_android_rvh_arm64_serror_panic' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe90dfa30'/>
       <elf-symbol name='__traceiter_android_rvh_bad_mode' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3dc2e9e1'/>
       <elf-symbol name='__traceiter_android_rvh_binder_transaction' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf57c4087'/>
+      <elf-symbol name='__traceiter_android_rvh_blk_allocated_queue_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe1a72e48'/>
+      <elf-symbol name='__traceiter_android_rvh_blk_flush_plug_list' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x563beda3'/>
+      <elf-symbol name='__traceiter_android_rvh_blk_mq_alloc_rq_map' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2c5a29eb'/>
+      <elf-symbol name='__traceiter_android_rvh_blk_mq_delay_run_hw_queue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x96ab47'/>
+      <elf-symbol name='__traceiter_android_rvh_blk_mq_init_allocated_queue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4d9a2052'/>
       <elf-symbol name='__traceiter_android_rvh_build_perf_domains' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4b4a53af'/>
       <elf-symbol name='__traceiter_android_rvh_can_migrate_task' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x44f6f339'/>
       <elf-symbol name='__traceiter_android_rvh_cgroup_force_kthread_migration' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x453305e0'/>
@@ -352,6 +357,7 @@
       <elf-symbol name='__traceiter_android_rvh_get_swap_page' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x465de79d'/>
       <elf-symbol name='__traceiter_android_rvh_gic_v3_set_affinity' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x25a6dad6'/>
       <elf-symbol name='__traceiter_android_rvh_handle_pte_fault_end' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4d48345a'/>
+      <elf-symbol name='__traceiter_android_rvh_internal_blk_mq_alloc_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe50e1ee'/>
       <elf-symbol name='__traceiter_android_rvh_iommu_setup_dma_ops' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x18bdcba6'/>
       <elf-symbol name='__traceiter_android_rvh_irqs_disable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x707d1f10'/>
       <elf-symbol name='__traceiter_android_rvh_irqs_enable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7a345722'/>
@@ -462,7 +468,19 @@
       <elf-symbol name='__traceiter_android_vh_binder_transaction_received' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xffec96fd'/>
       <elf-symbol name='__traceiter_android_vh_binder_wait_for_work' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1c902cd9'/>
       <elf-symbol name='__traceiter_android_vh_binder_wakeup_ilocked' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x418a26b2'/>
+      <elf-symbol name='__traceiter_android_vh_bio_free' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2a161502'/>
+      <elf-symbol name='__traceiter_android_vh_blk_alloc_flush_queue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x92bac4d9'/>
       <elf-symbol name='__traceiter_android_vh_blk_alloc_rqs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9ed158df'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_add_to_requeue_list' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbe59fea7'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_all_tag_iter' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8020ae79'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_alloc_tag_set' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd4323541'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_complete_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3a9056f9'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_exit_queue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x251264f0'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_free_tags' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9dc87c69'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_insert_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x67063237'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_queue_tag_busy_iter' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd4033674'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_run_hw_queue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x884b716c'/>
+      <elf-symbol name='__traceiter_android_vh_blk_mq_sched_insert_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2ed2b5a'/>
       <elf-symbol name='__traceiter_android_vh_blk_rq_ctx_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x644af33f'/>
       <elf-symbol name='__traceiter_android_vh_build_sched_domains' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf1522f52'/>
       <elf-symbol name='__traceiter_android_vh_cgroup_attach' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5ce3c902'/>
@@ -547,6 +565,7 @@
       <elf-symbol name='__traceiter_android_vh_inactive_is_low' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x500ba3a7'/>
       <elf-symbol name='__traceiter_android_vh_include_reserved_zone' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe1272155'/>
       <elf-symbol name='__traceiter_android_vh_init_swap_info_struct' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x98d473fa'/>
+      <elf-symbol name='__traceiter_android_vh_internal_blk_mq_free_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xaeb2449d'/>
       <elf-symbol name='__traceiter_android_vh_iommu_alloc_iova' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfc2a81cc'/>
       <elf-symbol name='__traceiter_android_vh_iommu_free_iova' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x364f5d4'/>
       <elf-symbol name='__traceiter_android_vh_iommu_iovad_alloc_iova' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x55a0de3'/>
@@ -6417,6 +6436,11 @@
       <elf-symbol name='__tracepoint_android_rvh_arm64_serror_panic' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3eeb0795'/>
       <elf-symbol name='__tracepoint_android_rvh_bad_mode' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x11c4733a'/>
       <elf-symbol name='__tracepoint_android_rvh_binder_transaction' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4f8ddeb5'/>
+      <elf-symbol name='__tracepoint_android_rvh_blk_allocated_queue_init' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9f5ed90a'/>
+      <elf-symbol name='__tracepoint_android_rvh_blk_flush_plug_list' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x76830e1f'/>
+      <elf-symbol name='__tracepoint_android_rvh_blk_mq_alloc_rq_map' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9675344f'/>
+      <elf-symbol name='__tracepoint_android_rvh_blk_mq_delay_run_hw_queue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcdbc5348'/>
+      <elf-symbol name='__tracepoint_android_rvh_blk_mq_init_allocated_queue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb501ea69'/>
       <elf-symbol name='__tracepoint_android_rvh_build_perf_domains' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7ff307b5'/>
       <elf-symbol name='__tracepoint_android_rvh_can_migrate_task' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x89ef9455'/>
       <elf-symbol name='__tracepoint_android_rvh_cgroup_force_kthread_migration' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc180285'/>
@@ -6457,6 +6481,7 @@
       <elf-symbol name='__tracepoint_android_rvh_get_swap_page' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x647dedce'/>
       <elf-symbol name='__tracepoint_android_rvh_gic_v3_set_affinity' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6ffd12d7'/>
       <elf-symbol name='__tracepoint_android_rvh_handle_pte_fault_end' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6adf3b7c'/>
+      <elf-symbol name='__tracepoint_android_rvh_internal_blk_mq_alloc_request' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc10682d1'/>
       <elf-symbol name='__tracepoint_android_rvh_iommu_setup_dma_ops' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2461d175'/>
       <elf-symbol name='__tracepoint_android_rvh_irqs_disable' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x44ac9f4b'/>
       <elf-symbol name='__tracepoint_android_rvh_irqs_enable' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc9d53b36'/>
@@ -6567,7 +6592,19 @@
       <elf-symbol name='__tracepoint_android_vh_binder_transaction_received' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x886b6106'/>
       <elf-symbol name='__tracepoint_android_vh_binder_wait_for_work' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9168ce14'/>
       <elf-symbol name='__tracepoint_android_vh_binder_wakeup_ilocked' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x45c1c15b'/>
+      <elf-symbol name='__tracepoint_android_vh_bio_free' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb55c7078'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_alloc_flush_queue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1267dea4'/>
       <elf-symbol name='__tracepoint_android_vh_blk_alloc_rqs' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x23957f60'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_add_to_requeue_list' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2ea47a42'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_all_tag_iter' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xeaf2ce99'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_alloc_tag_set' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5974d1f8'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_complete_request' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf382518d'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_exit_queue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa8cd98b7'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_free_tags' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd65200b7'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_insert_request' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd940959e'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_queue_tag_busy_iter' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb51b6eda'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_run_hw_queue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xebf20441'/>
+      <elf-symbol name='__tracepoint_android_vh_blk_mq_sched_insert_request' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd9a5bc2f'/>
       <elf-symbol name='__tracepoint_android_vh_blk_rq_ctx_init' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa5491a33'/>
       <elf-symbol name='__tracepoint_android_vh_build_sched_domains' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe9491ecd'/>
       <elf-symbol name='__tracepoint_android_vh_cgroup_attach' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x83be6a33'/>
@@ -6652,6 +6689,7 @@
       <elf-symbol name='__tracepoint_android_vh_inactive_is_low' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9da95945'/>
       <elf-symbol name='__tracepoint_android_vh_include_reserved_zone' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdf6b3544'/>
       <elf-symbol name='__tracepoint_android_vh_init_swap_info_struct' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1264c599'/>
+      <elf-symbol name='__tracepoint_android_vh_internal_blk_mq_free_request' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x54ae9e4'/>
       <elf-symbol name='__tracepoint_android_vh_iommu_alloc_iova' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x456fc48'/>
       <elf-symbol name='__tracepoint_android_vh_iommu_free_iova' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd04c533c'/>
       <elf-symbol name='__tracepoint_android_vh_iommu_iovad_alloc_iova' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7907ef49'/>
@@ -7513,6 +7551,7 @@
           <var-decl name='last_rowner' type-id='7359adad' visibility='default' filepath='include/linux/rwsem.h' line='69' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='b7aeff71' size-in-bits='64' id='01aeefda'/>
       <pointer-type-def type-id='6d8d26fb' size-in-bits='64' id='01b378ab'/>
       <pointer-type-def type-id='5547c428' size-in-bits='64' id='01b4845e'/>
       <pointer-type-def type-id='fdbf7a0f' size-in-bits='64' id='01b75fec'/>
@@ -38838,14 +38877,7 @@
         <parameter type-id='a42536cd'/>
         <return type-id='a42536cd'/>
       </function-type>
-      <class-decl name='raw_hashinfo' size-in-bits='16448' is-struct='yes' visibility='default' filepath='include/net/raw.h' line='35' column='1' id='51ee3086'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='lock' type-id='ac16795b' visibility='default' filepath='include/net/raw.h' line='36' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='ht' type-id='a7c26c7b' visibility='default' filepath='include/net/raw.h' line='37' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='raw_hashinfo' is-struct='yes' visibility='default' is-declaration-only='yes' id='51ee3086'/>
       <pointer-type-def type-id='918531c2' size-in-bits='64' id='51f1236c'/>
       <pointer-type-def type-id='25c33493' size-in-bits='64' id='52006477'/>
       <pointer-type-def type-id='cd1fc343' size-in-bits='64' id='52009e4b'/>
@@ -46505,6 +46537,13 @@
         <parameter type-id='00c7b870'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <function-type size-in-bits='64' id='632545b7'>
+        <parameter type-id='a47d3467'/>
+        <parameter type-id='3dad1a48'/>
+        <parameter type-id='eaa32e2f'/>
+        <parameter type-id='b50a4934'/>
+        <return type-id='b50a4934'/>
+      </function-type>
       <function-type size-in-bits='64' id='632cd7c3'>
         <parameter type-id='fbc017ef'/>
         <parameter type-id='aff725d5'/>
@@ -75889,9 +75928,6 @@
         </data-member>
       </union-decl>
       <typedef-decl name='iova_flush_cb' type-id='53072f48' filepath='include/linux/iova.h' line='41' column='1' id='a7bae79c'/>
-      <array-type-def dimensions='1' type-id='e151255a' size-in-bits='16384' id='a7c26c7b'>
-        <subrange length='256' type-id='7ff19f0f' id='36e5b9fa'/>
-      </array-type-def>
       <function-type size-in-bits='64' id='a7c3e9e0'>
         <parameter type-id='0c65b409'/>
         <parameter type-id='19c2251e'/>
@@ -82941,6 +82977,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='ab342f3f' size-in-bits='64' id='b7ad3a03'/>
+      <typedef-decl name='busy_iter_fn' type-id='632545b7' filepath='include/linux/blk-mq.h' line='278' column='1' id='b7aeff71'/>
       <function-type size-in-bits='64' id='b7b43e53'>
         <parameter type-id='0fbf3cfd'/>
         <parameter type-id='07b9ee34'/>
@@ -116557,9 +116594,9 @@
       </function-type>
       <pointer-type-def type-id='46f53066' size-in-bits='64' id='fffb07a4'/>
       <qualified-type-def type-id='55efd1a3' const='yes' id='fffdaf52'/>
-      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='520' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
+      <var-decl name='GKI_struct_gic_chip_data' type-id='d3100295' mangled-name='GKI_struct_gic_chip_data' visibility='default' filepath='drivers/android/vendor_hooks.c' line='540' column='1' elf-symbol-id='GKI_struct_gic_chip_data'/>
       <var-decl name='GKI_struct_selinux_state' type-id='4ae52763' mangled-name='GKI_struct_selinux_state' visibility='default' filepath='security/selinux/vendor_hooks.c' line='21' column='1' elf-symbol-id='GKI_struct_selinux_state'/>
-      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='525' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
+      <var-decl name='GKI_struct_swap_slots_cache' type-id='30eaa112' mangled-name='GKI_struct_swap_slots_cache' visibility='default' filepath='drivers/android/vendor_hooks.c' line='545' column='1' elf-symbol-id='GKI_struct_swap_slots_cache'/>
       <function-decl name='PDE_DATA' mangled-name='PDE_DATA' filepath='fs/proc/generic.c' line='802' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='PDE_DATA'>
         <parameter type-id='c5a4eb7f' name='inode' filepath='fs/proc/generic.c' line='802' column='1'/>
         <return type-id='eaa32e2f'/>
@@ -116693,9 +116730,9 @@
         <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq-debugfs.c' line='331' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__blk_mq_end_request' mangled-name='__blk_mq_end_request' filepath='block/blk-mq.c' line='542' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__blk_mq_end_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='542' column='1'/>
-        <parameter type-id='f4e2facd' name='error' filepath='block/blk-mq.c' line='542' column='1'/>
+      <function-decl name='__blk_mq_end_request' mangled-name='__blk_mq_end_request' filepath='block/blk-mq.c' line='550' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__blk_mq_end_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='550' column='1'/>
+        <parameter type-id='f4e2facd' name='error' filepath='block/blk-mq.c' line='550' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='__blk_rq_map_sg' mangled-name='__blk_rq_map_sg' filepath='block/blk-merge.c' line='525' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__blk_rq_map_sg'>
@@ -118362,6 +118399,39 @@
         <parameter type-id='55866c73' name='tr' filepath='include/trace/hooks/binder.h' line='73' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_rvh_blk_allocated_queue_init' mangled-name='__traceiter_android_rvh_blk_allocated_queue_init' filepath='include/trace/hooks/block.h' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_blk_allocated_queue_init'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='103' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='103' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='include/trace/hooks/block.h' line='103' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_rvh_blk_flush_plug_list' mangled-name='__traceiter_android_rvh_blk_flush_plug_list' filepath='include/trace/hooks/block.h' line='107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_blk_flush_plug_list'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='107' column='1'/>
+        <parameter type-id='39944481' name='plug' filepath='include/trace/hooks/block.h' line='107' column='1'/>
+        <parameter type-id='b50a4934' name='from_schedule' filepath='include/trace/hooks/block.h' line='107' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_rvh_blk_mq_alloc_rq_map' mangled-name='__traceiter_android_rvh_blk_mq_alloc_rq_map' filepath='include/trace/hooks/block.h' line='78' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_blk_mq_alloc_rq_map'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <parameter type-id='c527e30d' name='tags' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <parameter type-id='cc26d15f' name='set' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <parameter type-id='95e97e5e' name='node' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='include/trace/hooks/block.h' line='78' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_rvh_blk_mq_delay_run_hw_queue' mangled-name='__traceiter_android_rvh_blk_mq_delay_run_hw_queue' filepath='include/trace/hooks/block.h' line='66' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_blk_mq_delay_run_hw_queue'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='66' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='66' column='1'/>
+        <parameter type-id='a47d3467' name='hctx' filepath='include/trace/hooks/block.h' line='66' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='include/trace/hooks/block.h' line='66' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_rvh_blk_mq_init_allocated_queue' mangled-name='__traceiter_android_rvh_blk_mq_init_allocated_queue' filepath='include/trace/hooks/block.h' line='87' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_blk_mq_init_allocated_queue'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='87' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='include/trace/hooks/block.h' line='87' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_rvh_build_perf_domains' mangled-name='__traceiter_android_rvh_build_perf_domains' filepath='include/trace/hooks/sched.h' line='203' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_build_perf_domains'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/sched.h' line='203' column='1'/>
         <parameter type-id='d8e6b335' name='eas_check' filepath='include/trace/hooks/sched.h' line='203' column='1'/>
@@ -118635,6 +118705,13 @@
         <parameter type-id='7359adad' name='highest_memmap_pfn' filepath='include/trace/hooks/mm.h' line='229' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_rvh_internal_blk_mq_alloc_request' mangled-name='__traceiter_android_rvh_internal_blk_mq_alloc_request' filepath='include/trace/hooks/block.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_internal_blk_mq_alloc_request'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='46' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='46' column='1'/>
+        <parameter type-id='7292109c' name='tag' filepath='include/trace/hooks/block.h' line='46' column='1'/>
+        <parameter type-id='3620a178' name='data' filepath='include/trace/hooks/block.h' line='46' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_rvh_iommu_setup_dma_ops' mangled-name='__traceiter_android_rvh_iommu_setup_dma_ops' filepath='include/trace/hooks/iommu.h' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_iommu_setup_dma_ops'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='21' column='1'/>
         <parameter type-id='fa0b179b' name='dev' filepath='include/trace/hooks/iommu.h' line='21' column='1'/>
@@ -119369,19 +119446,97 @@
         <parameter type-id='d1cf113c' name='proc' filepath='include/trace/hooks/binder.h' line='53' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_blk_alloc_rqs' mangled-name='__traceiter_android_vh_blk_alloc_rqs' filepath='include/trace/hooks/block.h' line='26' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_alloc_rqs'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='26' column='1'/>
-        <parameter type-id='78c01427' name='rq_size' filepath='include/trace/hooks/block.h' line='26' column='1'/>
-        <parameter type-id='cc26d15f' name='set' filepath='include/trace/hooks/block.h' line='26' column='1'/>
-        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/block.h' line='26' column='1'/>
+      <function-decl name='__traceiter_android_vh_bio_free' mangled-name='__traceiter_android_vh_bio_free' filepath='include/trace/hooks/block.h' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_bio_free'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='42' column='1'/>
+        <parameter type-id='fb55efa1' name='bio' filepath='include/trace/hooks/block.h' line='42' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_blk_rq_ctx_init' mangled-name='__traceiter_android_vh_blk_rq_ctx_init' filepath='include/trace/hooks/block.h' line='31' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_rq_ctx_init'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='31' column='1'/>
-        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='31' column='1'/>
-        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/block.h' line='31' column='1'/>
-        <parameter type-id='3620a178' name='data' filepath='include/trace/hooks/block.h' line='31' column='1'/>
-        <parameter type-id='91ce1af9' name='alloc_time_ns' filepath='include/trace/hooks/block.h' line='31' column='1'/>
+      <function-decl name='__traceiter_android_vh_blk_alloc_flush_queue' mangled-name='__traceiter_android_vh_blk_alloc_flush_queue' filepath='include/trace/hooks/block.h' line='111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_alloc_flush_queue'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <parameter type-id='95e97e5e' name='cmd_size' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <parameter type-id='95e97e5e' name='node' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <parameter type-id='e118aff9' name='fq' filepath='include/trace/hooks/block.h' line='111' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_alloc_rqs' mangled-name='__traceiter_android_vh_blk_alloc_rqs' filepath='include/trace/hooks/block.h' line='32' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_alloc_rqs'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='32' column='1'/>
+        <parameter type-id='78c01427' name='rq_size' filepath='include/trace/hooks/block.h' line='32' column='1'/>
+        <parameter type-id='cc26d15f' name='set' filepath='include/trace/hooks/block.h' line='32' column='1'/>
+        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/block.h' line='32' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_add_to_requeue_list' mangled-name='__traceiter_android_vh_blk_mq_add_to_requeue_list' filepath='include/trace/hooks/block.h' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_add_to_requeue_list'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='58' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='58' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='58' column='1'/>
+        <parameter type-id='b50a4934' name='kick_requeue_list' filepath='include/trace/hooks/block.h' line='58' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_all_tag_iter' mangled-name='__traceiter_android_vh_blk_mq_all_tag_iter' filepath='include/trace/hooks/blk_mq.h' line='16' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_all_tag_iter'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/blk_mq.h' line='16' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/blk_mq.h' line='16' column='1'/>
+        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/blk_mq.h' line='16' column='1'/>
+        <parameter type-id='65a8a3df' name='fn' filepath='include/trace/hooks/blk_mq.h' line='16' column='1'/>
+        <parameter type-id='eaa32e2f' name='priv' filepath='include/trace/hooks/blk_mq.h' line='16' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_alloc_tag_set' mangled-name='__traceiter_android_vh_blk_mq_alloc_tag_set' filepath='include/trace/hooks/block.h' line='95' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_alloc_tag_set'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='95' column='1'/>
+        <parameter type-id='cc26d15f' name='set' filepath='include/trace/hooks/block.h' line='95' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_complete_request' mangled-name='__traceiter_android_vh_blk_mq_complete_request' filepath='include/trace/hooks/block.h' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_complete_request'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='54' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='54' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='54' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_exit_queue' mangled-name='__traceiter_android_vh_blk_mq_exit_queue' filepath='include/trace/hooks/block.h' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_exit_queue'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='91' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='include/trace/hooks/block.h' line='91' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_free_tags' mangled-name='__traceiter_android_vh_blk_mq_free_tags' filepath='include/trace/hooks/blk_mq.h' line='26' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_free_tags'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/blk_mq.h' line='26' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/blk_mq.h' line='26' column='1'/>
+        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/blk_mq.h' line='26' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_insert_request' mangled-name='__traceiter_android_vh_blk_mq_insert_request' filepath='include/trace/hooks/block.h' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_insert_request'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='74' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='74' column='1'/>
+        <parameter type-id='a47d3467' name='hctx' filepath='include/trace/hooks/block.h' line='74' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='74' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_queue_tag_busy_iter' mangled-name='__traceiter_android_vh_blk_mq_queue_tag_busy_iter' filepath='include/trace/hooks/blk_mq.h' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_queue_tag_busy_iter'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/blk_mq.h' line='21' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/blk_mq.h' line='21' column='1'/>
+        <parameter type-id='a47d3467' name='hctx' filepath='include/trace/hooks/blk_mq.h' line='21' column='1'/>
+        <parameter type-id='01aeefda' name='fn' filepath='include/trace/hooks/blk_mq.h' line='21' column='1'/>
+        <parameter type-id='eaa32e2f' name='priv' filepath='include/trace/hooks/blk_mq.h' line='21' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_run_hw_queue' mangled-name='__traceiter_android_vh_blk_mq_run_hw_queue' filepath='include/trace/hooks/block.h' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_run_hw_queue'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='70' column='1'/>
+        <parameter type-id='d8e6b335' name='need_run' filepath='include/trace/hooks/block.h' line='70' column='1'/>
+        <parameter type-id='a47d3467' name='hctx' filepath='include/trace/hooks/block.h' line='70' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_mq_sched_insert_request' mangled-name='__traceiter_android_vh_blk_mq_sched_insert_request' filepath='include/trace/hooks/block.h' line='116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_mq_sched_insert_request'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='116' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='116' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='116' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_blk_rq_ctx_init' mangled-name='__traceiter_android_vh_blk_rq_ctx_init' filepath='include/trace/hooks/block.h' line='37' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_blk_rq_ctx_init'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='37' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='37' column='1'/>
+        <parameter type-id='0461ecf5' name='tags' filepath='include/trace/hooks/block.h' line='37' column='1'/>
+        <parameter type-id='3620a178' name='data' filepath='include/trace/hooks/block.h' line='37' column='1'/>
+        <parameter type-id='91ce1af9' name='alloc_time_ns' filepath='include/trace/hooks/block.h' line='37' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__traceiter_android_vh_build_sched_domains' mangled-name='__traceiter_android_vh_build_sched_domains' filepath='include/trace/hooks/sched.h' line='291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_build_sched_domains'>
@@ -119913,6 +120068,13 @@
         <parameter type-id='63de1ba0' name='swap_avail_heads' filepath='include/trace/hooks/mm.h' line='317' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_vh_internal_blk_mq_free_request' mangled-name='__traceiter_android_vh_internal_blk_mq_free_request' filepath='include/trace/hooks/block.h' line='50' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_internal_blk_mq_free_request'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/block.h' line='50' column='1'/>
+        <parameter type-id='d8e6b335' name='skip' filepath='include/trace/hooks/block.h' line='50' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/block.h' line='50' column='1'/>
+        <parameter type-id='a47d3467' name='hctx' filepath='include/trace/hooks/block.h' line='50' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_vh_iommu_alloc_iova' mangled-name='__traceiter_android_vh_iommu_alloc_iova' filepath='include/trace/hooks/iommu.h' line='29' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_iommu_alloc_iova'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='29' column='1'/>
         <parameter type-id='fa0b179b' name='dev' filepath='include/trace/hooks/iommu.h' line='29' column='1'/>
@@ -121502,6 +121664,11 @@
       <var-decl name='__tracepoint_android_rvh_arm64_serror_panic' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_arm64_serror_panic' visibility='default' filepath='include/trace/hooks/traps.h' line='34' column='1' elf-symbol-id='__tracepoint_android_rvh_arm64_serror_panic'/>
       <var-decl name='__tracepoint_android_rvh_bad_mode' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_bad_mode' visibility='default' filepath='include/trace/hooks/traps.h' line='30' column='1' elf-symbol-id='__tracepoint_android_rvh_bad_mode'/>
       <var-decl name='__tracepoint_android_rvh_binder_transaction' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_binder_transaction' visibility='default' filepath='include/trace/hooks/binder.h' line='73' column='1' elf-symbol-id='__tracepoint_android_rvh_binder_transaction'/>
+      <var-decl name='__tracepoint_android_rvh_blk_allocated_queue_init' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_blk_allocated_queue_init' visibility='default' filepath='include/trace/hooks/block.h' line='103' column='1' elf-symbol-id='__tracepoint_android_rvh_blk_allocated_queue_init'/>
+      <var-decl name='__tracepoint_android_rvh_blk_flush_plug_list' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_blk_flush_plug_list' visibility='default' filepath='include/trace/hooks/block.h' line='107' column='1' elf-symbol-id='__tracepoint_android_rvh_blk_flush_plug_list'/>
+      <var-decl name='__tracepoint_android_rvh_blk_mq_alloc_rq_map' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_blk_mq_alloc_rq_map' visibility='default' filepath='include/trace/hooks/block.h' line='78' column='1' elf-symbol-id='__tracepoint_android_rvh_blk_mq_alloc_rq_map'/>
+      <var-decl name='__tracepoint_android_rvh_blk_mq_delay_run_hw_queue' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_blk_mq_delay_run_hw_queue' visibility='default' filepath='include/trace/hooks/block.h' line='66' column='1' elf-symbol-id='__tracepoint_android_rvh_blk_mq_delay_run_hw_queue'/>
+      <var-decl name='__tracepoint_android_rvh_blk_mq_init_allocated_queue' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_blk_mq_init_allocated_queue' visibility='default' filepath='include/trace/hooks/block.h' line='87' column='1' elf-symbol-id='__tracepoint_android_rvh_blk_mq_init_allocated_queue'/>
       <var-decl name='__tracepoint_android_rvh_build_perf_domains' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_build_perf_domains' visibility='default' filepath='include/trace/hooks/sched.h' line='203' column='1' elf-symbol-id='__tracepoint_android_rvh_build_perf_domains'/>
       <var-decl name='__tracepoint_android_rvh_can_migrate_task' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_can_migrate_task' visibility='default' filepath='include/trace/hooks/sched.h' line='57' column='1' elf-symbol-id='__tracepoint_android_rvh_can_migrate_task'/>
       <var-decl name='__tracepoint_android_rvh_cgroup_force_kthread_migration' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_cgroup_force_kthread_migration' visibility='default' filepath='include/trace/hooks/cgroup.h' line='31' column='1' elf-symbol-id='__tracepoint_android_rvh_cgroup_force_kthread_migration'/>
@@ -121542,6 +121709,7 @@
       <var-decl name='__tracepoint_android_rvh_get_swap_page' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_get_swap_page' visibility='default' filepath='include/trace/hooks/mm.h' line='282' column='1' elf-symbol-id='__tracepoint_android_rvh_get_swap_page'/>
       <var-decl name='__tracepoint_android_rvh_gic_v3_set_affinity' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_gic_v3_set_affinity' visibility='default' filepath='include/trace/hooks/gic_v3.h' line='22' column='1' elf-symbol-id='__tracepoint_android_rvh_gic_v3_set_affinity'/>
       <var-decl name='__tracepoint_android_rvh_handle_pte_fault_end' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_handle_pte_fault_end' visibility='default' filepath='include/trace/hooks/mm.h' line='229' column='1' elf-symbol-id='__tracepoint_android_rvh_handle_pte_fault_end'/>
+      <var-decl name='__tracepoint_android_rvh_internal_blk_mq_alloc_request' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_internal_blk_mq_alloc_request' visibility='default' filepath='include/trace/hooks/block.h' line='46' column='1' elf-symbol-id='__tracepoint_android_rvh_internal_blk_mq_alloc_request'/>
       <var-decl name='__tracepoint_android_rvh_iommu_setup_dma_ops' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_iommu_setup_dma_ops' visibility='default' filepath='include/trace/hooks/iommu.h' line='21' column='1' elf-symbol-id='__tracepoint_android_rvh_iommu_setup_dma_ops'/>
       <var-decl name='__tracepoint_android_rvh_irqs_disable' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_irqs_disable' visibility='default' filepath='include/trace/hooks/preemptirq.h' line='22' column='1' elf-symbol-id='__tracepoint_android_rvh_irqs_disable'/>
       <var-decl name='__tracepoint_android_rvh_irqs_enable' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_irqs_enable' visibility='default' filepath='include/trace/hooks/preemptirq.h' line='26' column='1' elf-symbol-id='__tracepoint_android_rvh_irqs_enable'/>
@@ -121652,8 +121820,20 @@
       <var-decl name='__tracepoint_android_vh_binder_transaction_received' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_binder_transaction_received' visibility='default' filepath='include/trace/hooks/binder.h' line='127' column='1' elf-symbol-id='__tracepoint_android_vh_binder_transaction_received'/>
       <var-decl name='__tracepoint_android_vh_binder_wait_for_work' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_binder_wait_for_work' visibility='default' filepath='include/trace/hooks/binder.h' line='56' column='1' elf-symbol-id='__tracepoint_android_vh_binder_wait_for_work'/>
       <var-decl name='__tracepoint_android_vh_binder_wakeup_ilocked' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_binder_wakeup_ilocked' visibility='default' filepath='include/trace/hooks/binder.h' line='53' column='1' elf-symbol-id='__tracepoint_android_vh_binder_wakeup_ilocked'/>
-      <var-decl name='__tracepoint_android_vh_blk_alloc_rqs' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_alloc_rqs' visibility='default' filepath='include/trace/hooks/block.h' line='26' column='1' elf-symbol-id='__tracepoint_android_vh_blk_alloc_rqs'/>
-      <var-decl name='__tracepoint_android_vh_blk_rq_ctx_init' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_rq_ctx_init' visibility='default' filepath='include/trace/hooks/block.h' line='31' column='1' elf-symbol-id='__tracepoint_android_vh_blk_rq_ctx_init'/>
+      <var-decl name='__tracepoint_android_vh_bio_free' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_bio_free' visibility='default' filepath='include/trace/hooks/block.h' line='42' column='1' elf-symbol-id='__tracepoint_android_vh_bio_free'/>
+      <var-decl name='__tracepoint_android_vh_blk_alloc_flush_queue' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_alloc_flush_queue' visibility='default' filepath='include/trace/hooks/block.h' line='111' column='1' elf-symbol-id='__tracepoint_android_vh_blk_alloc_flush_queue'/>
+      <var-decl name='__tracepoint_android_vh_blk_alloc_rqs' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_alloc_rqs' visibility='default' filepath='include/trace/hooks/block.h' line='32' column='1' elf-symbol-id='__tracepoint_android_vh_blk_alloc_rqs'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_add_to_requeue_list' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_add_to_requeue_list' visibility='default' filepath='include/trace/hooks/block.h' line='58' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_add_to_requeue_list'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_all_tag_iter' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_all_tag_iter' visibility='default' filepath='include/trace/hooks/blk_mq.h' line='16' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_all_tag_iter'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_alloc_tag_set' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_alloc_tag_set' visibility='default' filepath='include/trace/hooks/block.h' line='95' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_alloc_tag_set'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_complete_request' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_complete_request' visibility='default' filepath='include/trace/hooks/block.h' line='54' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_complete_request'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_exit_queue' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_exit_queue' visibility='default' filepath='include/trace/hooks/block.h' line='91' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_exit_queue'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_free_tags' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_free_tags' visibility='default' filepath='include/trace/hooks/blk_mq.h' line='26' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_free_tags'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_insert_request' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_insert_request' visibility='default' filepath='include/trace/hooks/block.h' line='74' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_insert_request'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_queue_tag_busy_iter' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_queue_tag_busy_iter' visibility='default' filepath='include/trace/hooks/blk_mq.h' line='21' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_queue_tag_busy_iter'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_run_hw_queue' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_run_hw_queue' visibility='default' filepath='include/trace/hooks/block.h' line='70' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_run_hw_queue'/>
+      <var-decl name='__tracepoint_android_vh_blk_mq_sched_insert_request' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_mq_sched_insert_request' visibility='default' filepath='include/trace/hooks/block.h' line='116' column='1' elf-symbol-id='__tracepoint_android_vh_blk_mq_sched_insert_request'/>
+      <var-decl name='__tracepoint_android_vh_blk_rq_ctx_init' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_blk_rq_ctx_init' visibility='default' filepath='include/trace/hooks/block.h' line='37' column='1' elf-symbol-id='__tracepoint_android_vh_blk_rq_ctx_init'/>
       <var-decl name='__tracepoint_android_vh_build_sched_domains' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_build_sched_domains' visibility='default' filepath='include/trace/hooks/sched.h' line='291' column='1' elf-symbol-id='__tracepoint_android_vh_build_sched_domains'/>
       <var-decl name='__tracepoint_android_vh_cgroup_attach' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_cgroup_attach' visibility='default' filepath='include/trace/hooks/cgroup.h' line='38' column='1' elf-symbol-id='__tracepoint_android_vh_cgroup_attach'/>
       <var-decl name='__tracepoint_android_vh_cgroup_set_task' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_cgroup_set_task' visibility='default' filepath='include/trace/hooks/cgroup.h' line='25' column='1' elf-symbol-id='__tracepoint_android_vh_cgroup_set_task'/>
@@ -121737,6 +121917,7 @@
       <var-decl name='__tracepoint_android_vh_inactive_is_low' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_inactive_is_low' visibility='default' filepath='include/trace/hooks/vmscan.h' line='46' column='1' elf-symbol-id='__tracepoint_android_vh_inactive_is_low'/>
       <var-decl name='__tracepoint_android_vh_include_reserved_zone' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_include_reserved_zone' visibility='default' filepath='include/trace/hooks/mm.h' line='94' column='1' elf-symbol-id='__tracepoint_android_vh_include_reserved_zone'/>
       <var-decl name='__tracepoint_android_vh_init_swap_info_struct' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_init_swap_info_struct' visibility='default' filepath='include/trace/hooks/mm.h' line='317' column='1' elf-symbol-id='__tracepoint_android_vh_init_swap_info_struct'/>
+      <var-decl name='__tracepoint_android_vh_internal_blk_mq_free_request' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_internal_blk_mq_free_request' visibility='default' filepath='include/trace/hooks/block.h' line='50' column='1' elf-symbol-id='__tracepoint_android_vh_internal_blk_mq_free_request'/>
       <var-decl name='__tracepoint_android_vh_iommu_alloc_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_alloc_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='29' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_alloc_iova'/>
       <var-decl name='__tracepoint_android_vh_iommu_free_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_free_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='38' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_free_iova'/>
       <var-decl name='__tracepoint_android_vh_iommu_iovad_alloc_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_iovad_alloc_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='34' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_iovad_alloc_iova'/>
@@ -122960,25 +123141,25 @@
         <parameter type-id='b59d7dce' name='count' filepath='lib/hexdump.c' line='95' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='bio_add_page' mangled-name='bio_add_page' filepath='block/bio.c' line='934' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_add_page'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='934' column='1'/>
-        <parameter type-id='02f11ed4' name='page' filepath='block/bio.c' line='934' column='1'/>
-        <parameter type-id='f0981eeb' name='len' filepath='block/bio.c' line='935' column='1'/>
-        <parameter type-id='f0981eeb' name='offset' filepath='block/bio.c' line='935' column='1'/>
+      <function-decl name='bio_add_page' mangled-name='bio_add_page' filepath='block/bio.c' line='936' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_add_page'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='936' column='1'/>
+        <parameter type-id='02f11ed4' name='page' filepath='block/bio.c' line='936' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='block/bio.c' line='937' column='1'/>
+        <parameter type-id='f0981eeb' name='offset' filepath='block/bio.c' line='937' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bio_add_pc_page' mangled-name='bio_add_pc_page' filepath='block/bio.c' line='846' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_add_pc_page'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/bio.c' line='846' column='1'/>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='846' column='1'/>
-        <parameter type-id='02f11ed4' name='page' filepath='block/bio.c' line='847' column='1'/>
-        <parameter type-id='f0981eeb' name='len' filepath='block/bio.c' line='847' column='1'/>
-        <parameter type-id='f0981eeb' name='offset' filepath='block/bio.c' line='847' column='1'/>
+      <function-decl name='bio_add_pc_page' mangled-name='bio_add_pc_page' filepath='block/bio.c' line='848' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_add_pc_page'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/bio.c' line='848' column='1'/>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='848' column='1'/>
+        <parameter type-id='02f11ed4' name='page' filepath='block/bio.c' line='849' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='block/bio.c' line='849' column='1'/>
+        <parameter type-id='f0981eeb' name='offset' filepath='block/bio.c' line='849' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bio_alloc_bioset' mangled-name='bio_alloc_bioset' filepath='block/bio.c' line='437' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_alloc_bioset'>
-        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='block/bio.c' line='437' column='1'/>
-        <parameter type-id='f0981eeb' name='nr_iovecs' filepath='block/bio.c' line='437' column='1'/>
-        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='438' column='1'/>
+      <function-decl name='bio_alloc_bioset' mangled-name='bio_alloc_bioset' filepath='block/bio.c' line='439' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_alloc_bioset'>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='block/bio.c' line='439' column='1'/>
+        <parameter type-id='f0981eeb' name='nr_iovecs' filepath='block/bio.c' line='439' column='1'/>
+        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='440' column='1'/>
         <return type-id='fb55efa1'/>
       </function-decl>
       <function-decl name='bio_associate_blkg' mangled-name='bio_associate_blkg' filepath='block/blk-cgroup.c' line='1882' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_associate_blkg'>
@@ -122990,9 +123171,9 @@
         <parameter type-id='cfff5953' name='css' filepath='block/blk-cgroup.c' line='1859' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_chain' mangled-name='bio_chain' filepath='block/bio.c' line='338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_chain'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='338' column='1'/>
-        <parameter type-id='fb55efa1' name='parent' filepath='block/bio.c' line='338' column='1'/>
+      <function-decl name='bio_chain' mangled-name='bio_chain' filepath='block/bio.c' line='340' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_chain'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='340' column='1'/>
+        <parameter type-id='fb55efa1' name='parent' filepath='block/bio.c' line='340' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='bio_clone_blkg_association' mangled-name='bio_clone_blkg_association' filepath='block/blk-cgroup.c' line='1904' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_clone_blkg_association'>
@@ -123007,40 +123188,40 @@
         <parameter type-id='3eb7c31c' name='gfp_mask' filepath='block/blk-crypto.c' line='83' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_endio' mangled-name='bio_endio' filepath='block/bio.c' line='1426' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_endio'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1426' column='1'/>
+      <function-decl name='bio_endio' mangled-name='bio_endio' filepath='block/bio.c' line='1428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_endio'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1428' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_init' mangled-name='bio_init' filepath='block/bio.c' line='278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_init'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='278' column='1'/>
-        <parameter type-id='cddcb53e' name='table' filepath='block/bio.c' line='278' column='1'/>
-        <parameter type-id='8efea9e5' name='max_vecs' filepath='block/bio.c' line='279' column='1'/>
+      <function-decl name='bio_init' mangled-name='bio_init' filepath='block/bio.c' line='280' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_init'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='280' column='1'/>
+        <parameter type-id='cddcb53e' name='table' filepath='block/bio.c' line='280' column='1'/>
+        <parameter type-id='8efea9e5' name='max_vecs' filepath='block/bio.c' line='281' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_put' mangled-name='bio_put' filepath='block/bio.c' line='648' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_put'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='648' column='1'/>
+      <function-decl name='bio_put' mangled-name='bio_put' filepath='block/bio.c' line='650' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_put'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='650' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_reset' mangled-name='bio_reset' filepath='block/bio.c' line='300' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_reset'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='300' column='1'/>
+      <function-decl name='bio_reset' mangled-name='bio_reset' filepath='block/bio.c' line='302' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_reset'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='302' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_split' mangled-name='bio_split' filepath='block/bio.c' line='1477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_split'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1477' column='1'/>
-        <parameter type-id='95e97e5e' name='sectors' filepath='block/bio.c' line='1477' column='1'/>
-        <parameter type-id='3eb7c31c' name='gfp' filepath='block/bio.c' line='1478' column='1'/>
-        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1478' column='1'/>
+      <function-decl name='bio_split' mangled-name='bio_split' filepath='block/bio.c' line='1479' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_split'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1479' column='1'/>
+        <parameter type-id='95e97e5e' name='sectors' filepath='block/bio.c' line='1479' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='block/bio.c' line='1480' column='1'/>
+        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1480' column='1'/>
         <return type-id='fb55efa1'/>
       </function-decl>
-      <function-decl name='bioset_exit' mangled-name='bioset_exit' filepath='block/bio.c' line='1549' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_exit'>
-        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1549' column='1'/>
+      <function-decl name='bioset_exit' mangled-name='bioset_exit' filepath='block/bio.c' line='1551' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_exit'>
+        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1551' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bioset_init' mangled-name='bioset_init' filepath='block/bio.c' line='1586' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_init'>
-        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1586' column='1'/>
-        <parameter type-id='f0981eeb' name='pool_size' filepath='block/bio.c' line='1587' column='1'/>
-        <parameter type-id='f0981eeb' name='front_pad' filepath='block/bio.c' line='1588' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='block/bio.c' line='1589' column='1'/>
+      <function-decl name='bioset_init' mangled-name='bioset_init' filepath='block/bio.c' line='1588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_init'>
+        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1588' column='1'/>
+        <parameter type-id='f0981eeb' name='pool_size' filepath='block/bio.c' line='1589' column='1'/>
+        <parameter type-id='f0981eeb' name='front_pad' filepath='block/bio.c' line='1590' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='block/bio.c' line='1591' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='bit_wait_timeout' mangled-name='bit_wait_timeout' filepath='kernel/sched/wait_bit.c' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bit_wait_timeout'>
@@ -123133,8 +123314,8 @@
         <parameter type-id='3eb7c31c' name='flags' filepath='lib/bitmap.c' line='1255' column='1'/>
         <return type-id='1d2c2b85'/>
       </function-decl>
-      <function-decl name='blk_alloc_queue' mangled-name='blk_alloc_queue' filepath='block/blk-core.c' line='521' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_alloc_queue'>
-        <parameter type-id='95e97e5e' name='node_id' filepath='block/blk-core.c' line='521' column='1'/>
+      <function-decl name='blk_alloc_queue' mangled-name='blk_alloc_queue' filepath='block/blk-core.c' line='524' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_alloc_queue'>
+        <parameter type-id='95e97e5e' name='node_id' filepath='block/blk-core.c' line='524' column='1'/>
         <return type-id='e7d2a5fc'/>
       </function-decl>
       <function-decl name='blk_bio_list_merge' mangled-name='blk_bio_list_merge' filepath='block/blk-merge.c' line='1094' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_bio_list_merge'>
@@ -123144,14 +123325,14 @@
         <parameter type-id='f0981eeb' name='nr_segs' filepath='block/blk-merge.c' line='1095' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='blk_check_plugged' mangled-name='blk_check_plugged' filepath='block/blk-core.c' line='1737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_check_plugged'>
-        <parameter type-id='f31816b5' name='unplug' filepath='block/blk-core.c' line='1737' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='block/blk-core.c' line='1737' column='1'/>
-        <parameter type-id='95e97e5e' name='size' filepath='block/blk-core.c' line='1738' column='1'/>
+      <function-decl name='blk_check_plugged' mangled-name='blk_check_plugged' filepath='block/blk-core.c' line='1745' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_check_plugged'>
+        <parameter type-id='f31816b5' name='unplug' filepath='block/blk-core.c' line='1745' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='block/blk-core.c' line='1745' column='1'/>
+        <parameter type-id='95e97e5e' name='size' filepath='block/blk-core.c' line='1746' column='1'/>
         <return type-id='39914f13'/>
       </function-decl>
-      <function-decl name='blk_cleanup_queue' mangled-name='blk_cleanup_queue' filepath='block/blk-core.c' line='376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_cleanup_queue'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='376' column='1'/>
+      <function-decl name='blk_cleanup_queue' mangled-name='blk_cleanup_queue' filepath='block/blk-core.c' line='379' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_cleanup_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='379' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_execute_rq' mangled-name='blk_execute_rq' filepath='block/blk-exec.c' line='79' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_execute_rq'>
@@ -123169,27 +123350,27 @@
         <parameter type-id='5afdaa66' name='done' filepath='block/blk-exec.c' line='50' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_finish_plug' mangled-name='blk_finish_plug' filepath='block/blk-core.c' line='1780' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_finish_plug'>
-        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1780' column='1'/>
+      <function-decl name='blk_finish_plug' mangled-name='blk_finish_plug' filepath='block/blk-core.c' line='1789' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_finish_plug'>
+        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1789' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_freeze_queue_start' mangled-name='blk_freeze_queue_start' filepath='block/blk-mq.c' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_freeze_queue_start'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='136' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_get_queue' mangled-name='blk_get_queue' filepath='block/blk-core.c' line='614' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_queue'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='614' column='1'/>
+      <function-decl name='blk_get_queue' mangled-name='blk_get_queue' filepath='block/blk-core.c' line='622' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='622' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='blk_get_request' mangled-name='blk_get_request' filepath='block/blk-core.c' line='631' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_request'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='631' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='631' column='1'/>
-        <parameter type-id='346d62be' name='flags' filepath='block/blk-core.c' line='632' column='1'/>
+      <function-decl name='blk_get_request' mangled-name='blk_get_request' filepath='block/blk-core.c' line='639' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_request'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='639' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='639' column='1'/>
+        <parameter type-id='346d62be' name='flags' filepath='block/blk-core.c' line='640' column='1'/>
         <return type-id='3dad1a48'/>
       </function-decl>
-      <function-decl name='blk_insert_cloned_request' mangled-name='blk_insert_cloned_request' filepath='block/blk-core.c' line='1195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_insert_cloned_request'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='1195' column='1'/>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1195' column='1'/>
+      <function-decl name='blk_insert_cloned_request' mangled-name='blk_insert_cloned_request' filepath='block/blk-core.c' line='1203' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_insert_cloned_request'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='1203' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1203' column='1'/>
         <return type-id='f4e2facd'/>
       </function-decl>
       <function-decl name='blk_ksm_get_slot_idx' mangled-name='blk_ksm_get_slot_idx' filepath='block/keyslot-manager.c' line='211' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_ksm_get_slot_idx'>
@@ -123214,29 +123395,29 @@
         <parameter type-id='bf8a20d2' name='ksm' filepath='block/keyslot-manager.c' line='413' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_alloc_request' mangled-name='blk_mq_alloc_request' filepath='block/blk-mq.c' line='403' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_request'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='403' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-mq.c' line='403' column='1'/>
-        <parameter type-id='346d62be' name='flags' filepath='block/blk-mq.c' line='404' column='1'/>
+      <function-decl name='blk_mq_alloc_request' mangled-name='blk_mq_alloc_request' filepath='block/blk-mq.c' line='406' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_request'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='406' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-mq.c' line='406' column='1'/>
+        <parameter type-id='346d62be' name='flags' filepath='block/blk-mq.c' line='407' column='1'/>
         <return type-id='3dad1a48'/>
       </function-decl>
-      <function-decl name='blk_mq_alloc_request_hctx' mangled-name='blk_mq_alloc_request_hctx' filepath='block/blk-mq.c' line='431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_request_hctx'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='431' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-mq.c' line='432' column='1'/>
-        <parameter type-id='346d62be' name='flags' filepath='block/blk-mq.c' line='432' column='1'/>
-        <parameter type-id='f0981eeb' name='hctx_idx' filepath='block/blk-mq.c' line='432' column='1'/>
+      <function-decl name='blk_mq_alloc_request_hctx' mangled-name='blk_mq_alloc_request_hctx' filepath='block/blk-mq.c' line='434' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_request_hctx'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='434' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-mq.c' line='435' column='1'/>
+        <parameter type-id='346d62be' name='flags' filepath='block/blk-mq.c' line='435' column='1'/>
+        <parameter type-id='f0981eeb' name='hctx_idx' filepath='block/blk-mq.c' line='435' column='1'/>
         <return type-id='3dad1a48'/>
       </function-decl>
-      <function-decl name='blk_mq_alloc_tag_set' mangled-name='blk_mq_alloc_tag_set' filepath='block/blk-mq.c' line='3514' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_tag_set'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3514' column='1'/>
+      <function-decl name='blk_mq_alloc_tag_set' mangled-name='blk_mq_alloc_tag_set' filepath='block/blk-mq.c' line='3550' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_tag_set'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3550' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_mq_complete_request' mangled-name='blk_mq_complete_request' filepath='block/blk-mq.c' line='702' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_complete_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='702' column='1'/>
+      <function-decl name='blk_mq_complete_request' mangled-name='blk_mq_complete_request' filepath='block/blk-mq.c' line='710' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_complete_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='710' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_complete_request_remote' mangled-name='blk_mq_complete_request_remote' filepath='block/blk-mq.c' line='669' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_complete_request_remote'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='669' column='1'/>
+      <function-decl name='blk_mq_complete_request_remote' mangled-name='blk_mq_complete_request_remote' filepath='block/blk-mq.c' line='677' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_complete_request_remote'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='677' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='blk_mq_debugfs_rq_show' mangled-name='blk_mq_debugfs_rq_show' filepath='block/blk-mq-debugfs.c' line='358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_debugfs_rq_show'>
@@ -123244,22 +123425,22 @@
         <parameter type-id='eaa32e2f' name='v' filepath='block/blk-mq-debugfs.c' line='358' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_mq_delay_kick_requeue_list' mangled-name='blk_mq_delay_kick_requeue_list' filepath='block/blk-mq.c' line='856' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_delay_kick_requeue_list'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='856' column='1'/>
-        <parameter type-id='7359adad' name='msecs' filepath='block/blk-mq.c' line='857' column='1'/>
+      <function-decl name='blk_mq_delay_kick_requeue_list' mangled-name='blk_mq_delay_kick_requeue_list' filepath='block/blk-mq.c' line='874' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_delay_kick_requeue_list'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='874' column='1'/>
+        <parameter type-id='7359adad' name='msecs' filepath='block/blk-mq.c' line='875' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_end_request' mangled-name='blk_mq_end_request' filepath='block/blk-mq.c' line='567' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_end_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='567' column='1'/>
-        <parameter type-id='f4e2facd' name='error' filepath='block/blk-mq.c' line='567' column='1'/>
+      <function-decl name='blk_mq_end_request' mangled-name='blk_mq_end_request' filepath='block/blk-mq.c' line='575' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_end_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='575' column='1'/>
+        <parameter type-id='f4e2facd' name='error' filepath='block/blk-mq.c' line='575' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_free_request' mangled-name='blk_mq_free_request' filepath='block/blk-mq.c' line='511' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='511' column='1'/>
+      <function-decl name='blk_mq_free_request' mangled-name='blk_mq_free_request' filepath='block/blk-mq.c' line='519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='519' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_free_tag_set' mangled-name='blk_mq_free_tag_set' filepath='block/blk-mq.c' line='3610' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_tag_set'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3610' column='1'/>
+      <function-decl name='blk_mq_free_tag_set' mangled-name='blk_mq_free_tag_set' filepath='block/blk-mq.c' line='3648' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_tag_set'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3648' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_freeze_queue' mangled-name='blk_mq_freeze_queue' filepath='block/blk-mq.c' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_freeze_queue'>
@@ -123275,15 +123456,15 @@
         <parameter type-id='7359adad' name='timeout' filepath='block/blk-mq.c' line='157' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_mq_init_queue' mangled-name='blk_mq_init_queue' filepath='block/blk-mq.c' line='3161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_queue'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3161' column='1'/>
+      <function-decl name='blk_mq_init_queue' mangled-name='blk_mq_init_queue' filepath='block/blk-mq.c' line='3194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_queue'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3194' column='1'/>
         <return type-id='e7d2a5fc'/>
       </function-decl>
-      <function-decl name='blk_mq_init_sq_queue' mangled-name='blk_mq_init_sq_queue' filepath='block/blk-mq.c' line='3171' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_sq_queue'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3171' column='1'/>
-        <parameter type-id='e1962c5d' name='ops' filepath='block/blk-mq.c' line='3172' column='1'/>
-        <parameter type-id='f0981eeb' name='queue_depth' filepath='block/blk-mq.c' line='3173' column='1'/>
-        <parameter type-id='f0981eeb' name='set_flags' filepath='block/blk-mq.c' line='3174' column='1'/>
+      <function-decl name='blk_mq_init_sq_queue' mangled-name='blk_mq_init_sq_queue' filepath='block/blk-mq.c' line='3204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_sq_queue'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3204' column='1'/>
+        <parameter type-id='e1962c5d' name='ops' filepath='block/blk-mq.c' line='3205' column='1'/>
+        <parameter type-id='f0981eeb' name='queue_depth' filepath='block/blk-mq.c' line='3206' column='1'/>
+        <parameter type-id='f0981eeb' name='set_flags' filepath='block/blk-mq.c' line='3207' column='1'/>
         <return type-id='e7d2a5fc'/>
       </function-decl>
       <function-decl name='blk_mq_map_queues' mangled-name='blk_mq_map_queues' filepath='block/blk-mq-cpumap.c' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_map_queues'>
@@ -123296,31 +123477,31 @@
         <parameter type-id='95e97e5e' name='offset' filepath='block/blk-mq-pci.c' line='27' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_mq_queue_inflight' mangled-name='blk_mq_queue_inflight' filepath='block/blk-mq.c' line='892' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_queue_inflight'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='892' column='1'/>
+      <function-decl name='blk_mq_queue_inflight' mangled-name='blk_mq_queue_inflight' filepath='block/blk-mq.c' line='910' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_queue_inflight'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='910' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='blk_mq_quiesce_queue' mangled-name='blk_mq_quiesce_queue' filepath='block/blk-mq.c' line='224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_quiesce_queue'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='224' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_requeue_request' mangled-name='blk_mq_requeue_request' filepath='block/blk-mq.c' line='777' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_requeue_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='777' column='1'/>
-        <parameter type-id='b50a4934' name='kick_requeue_list' filepath='block/blk-mq.c' line='777' column='1'/>
+      <function-decl name='blk_mq_requeue_request' mangled-name='blk_mq_requeue_request' filepath='block/blk-mq.c' line='790' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_requeue_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='790' column='1'/>
+        <parameter type-id='b50a4934' name='kick_requeue_list' filepath='block/blk-mq.c' line='790' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_rq_cpu' mangled-name='blk_mq_rq_cpu' filepath='block/blk-mq.c' line='4031' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_rq_cpu'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='4031' column='1'/>
+      <function-decl name='blk_mq_rq_cpu' mangled-name='blk_mq_rq_cpu' filepath='block/blk-mq.c' line='4069' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_rq_cpu'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='4069' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='blk_mq_run_hw_queue' mangled-name='blk_mq_run_hw_queue' filepath='block/blk-mq.c' line='1636' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_run_hw_queue'>
-        <parameter type-id='a47d3467' name='hctx' filepath='block/blk-mq.c' line='1636' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1636' column='1'/>
+      <function-decl name='blk_mq_run_hw_queue' mangled-name='blk_mq_run_hw_queue' filepath='block/blk-mq.c' line='1660' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_run_hw_queue'>
+        <parameter type-id='a47d3467' name='hctx' filepath='block/blk-mq.c' line='1660' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1660' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_run_hw_queues' mangled-name='blk_mq_run_hw_queues' filepath='block/blk-mq.c' line='1699' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_run_hw_queues'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='1699' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1699' column='1'/>
+      <function-decl name='blk_mq_run_hw_queues' mangled-name='blk_mq_run_hw_queues' filepath='block/blk-mq.c' line='1724' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_run_hw_queues'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='1724' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1724' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_sched_mark_restart_hctx' mangled-name='blk_mq_sched_mark_restart_hctx' filepath='block/blk-mq-sched.c' line='50' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_sched_mark_restart_hctx'>
@@ -123343,49 +123524,49 @@
         <parameter type-id='79808846' name='merged_request' filepath='block/blk-merge.c' line='1120' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='blk_mq_start_request' mangled-name='blk_mq_start_request' filepath='block/blk-mq.c' line='737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_start_request'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='737' column='1'/>
+      <function-decl name='blk_mq_start_request' mangled-name='blk_mq_start_request' filepath='block/blk-mq.c' line='750' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_start_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='750' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_start_stopped_hw_queues' mangled-name='blk_mq_start_stopped_hw_queues' filepath='block/blk-mq.c' line='1834' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_start_stopped_hw_queues'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='1834' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1834' column='1'/>
+      <function-decl name='blk_mq_start_stopped_hw_queues' mangled-name='blk_mq_start_stopped_hw_queues' filepath='block/blk-mq.c' line='1859' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_start_stopped_hw_queues'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='1859' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1859' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_stop_hw_queue' mangled-name='blk_mq_stop_hw_queue' filepath='block/blk-mq.c' line='1779' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_stop_hw_queue'>
-        <parameter type-id='a47d3467' name='hctx' filepath='block/blk-mq.c' line='1779' column='1'/>
+      <function-decl name='blk_mq_stop_hw_queue' mangled-name='blk_mq_stop_hw_queue' filepath='block/blk-mq.c' line='1804' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_stop_hw_queue'>
+        <parameter type-id='a47d3467' name='hctx' filepath='block/blk-mq.c' line='1804' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_tag_to_rq' mangled-name='blk_mq_tag_to_rq' filepath='block/blk-mq.c' line='864' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tag_to_rq'>
-        <parameter type-id='0461ecf5' name='tags' filepath='block/blk-mq.c' line='864' column='1'/>
-        <parameter type-id='f0981eeb' name='tag' filepath='block/blk-mq.c' line='864' column='1'/>
+      <function-decl name='blk_mq_tag_to_rq' mangled-name='blk_mq_tag_to_rq' filepath='block/blk-mq.c' line='882' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tag_to_rq'>
+        <parameter type-id='0461ecf5' name='tags' filepath='block/blk-mq.c' line='882' column='1'/>
+        <parameter type-id='f0981eeb' name='tag' filepath='block/blk-mq.c' line='882' column='1'/>
         <return type-id='3dad1a48'/>
       </function-decl>
-      <function-decl name='blk_mq_tagset_busy_iter' mangled-name='blk_mq_tagset_busy_iter' filepath='block/blk-mq-tag.c' line='378' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tagset_busy_iter'>
-        <parameter type-id='cc26d15f' name='tagset' filepath='block/blk-mq-tag.c' line='378' column='1'/>
-        <parameter type-id='65a8a3df' name='fn' filepath='block/blk-mq-tag.c' line='379' column='1'/>
-        <parameter type-id='eaa32e2f' name='priv' filepath='block/blk-mq-tag.c' line='379' column='1'/>
+      <function-decl name='blk_mq_tagset_busy_iter' mangled-name='blk_mq_tagset_busy_iter' filepath='block/blk-mq-tag.c' line='385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tagset_busy_iter'>
+        <parameter type-id='cc26d15f' name='tagset' filepath='block/blk-mq-tag.c' line='385' column='1'/>
+        <parameter type-id='65a8a3df' name='fn' filepath='block/blk-mq-tag.c' line='386' column='1'/>
+        <parameter type-id='eaa32e2f' name='priv' filepath='block/blk-mq-tag.c' line='386' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_tagset_wait_completed_request' mangled-name='blk_mq_tagset_wait_completed_request' filepath='block/blk-mq-tag.c' line='408' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tagset_wait_completed_request'>
-        <parameter type-id='cc26d15f' name='tagset' filepath='block/blk-mq-tag.c' line='408' column='1'/>
+      <function-decl name='blk_mq_tagset_wait_completed_request' mangled-name='blk_mq_tagset_wait_completed_request' filepath='block/blk-mq-tag.c' line='415' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_tagset_wait_completed_request'>
+        <parameter type-id='cc26d15f' name='tagset' filepath='block/blk-mq-tag.c' line='415' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_unfreeze_queue' mangled-name='blk_mq_unfreeze_queue' filepath='block/blk-mq.c' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_unfreeze_queue'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='192' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_unique_tag' mangled-name='blk_mq_unique_tag' filepath='block/blk-mq-tag.c' line='638' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_unique_tag'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq-tag.c' line='638' column='1'/>
+      <function-decl name='blk_mq_unique_tag' mangled-name='blk_mq_unique_tag' filepath='block/blk-mq-tag.c' line='657' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_unique_tag'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq-tag.c' line='657' column='1'/>
         <return type-id='19c2251e'/>
       </function-decl>
       <function-decl name='blk_mq_unquiesce_queue' mangled-name='blk_mq_unquiesce_queue' filepath='block/blk-mq.c' line='250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_unquiesce_queue'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='250' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_update_nr_hw_queues' mangled-name='blk_mq_update_nr_hw_queues' filepath='block/blk-mq.c' line='3813' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_update_nr_hw_queues'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3813' column='1'/>
-        <parameter type-id='95e97e5e' name='nr_hw_queues' filepath='block/blk-mq.c' line='3813' column='1'/>
+      <function-decl name='blk_mq_update_nr_hw_queues' mangled-name='blk_mq_update_nr_hw_queues' filepath='block/blk-mq.c' line='3851' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_update_nr_hw_queues'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3851' column='1'/>
+        <parameter type-id='95e97e5e' name='nr_hw_queues' filepath='block/blk-mq.c' line='3851' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_virtio_map_queues' mangled-name='blk_mq_virtio_map_queues' filepath='block/blk-mq-virtio.c' line='24' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_virtio_map_queues'>
@@ -123394,22 +123575,22 @@
         <parameter type-id='95e97e5e' name='first_vec' filepath='block/blk-mq-virtio.c' line='25' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_op_str' mangled-name='blk_op_str' filepath='block/blk-core.c' line='164' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_op_str'>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='164' column='1'/>
+      <function-decl name='blk_op_str' mangled-name='blk_op_str' filepath='block/blk-core.c' line='167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_op_str'>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='167' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='blk_poll' mangled-name='blk_poll' filepath='block/blk-mq.c' line='3977' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_poll'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='3977' column='1'/>
-        <parameter type-id='041bc907' name='cookie' filepath='block/blk-mq.c' line='3977' column='1'/>
-        <parameter type-id='b50a4934' name='spin' filepath='block/blk-mq.c' line='3977' column='1'/>
+      <function-decl name='blk_poll' mangled-name='blk_poll' filepath='block/blk-mq.c' line='4015' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_poll'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='4015' column='1'/>
+        <parameter type-id='041bc907' name='cookie' filepath='block/blk-mq.c' line='4015' column='1'/>
+        <parameter type-id='b50a4934' name='spin' filepath='block/blk-mq.c' line='4015' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_put_queue' mangled-name='blk_put_queue' filepath='block/blk-core.c' line='342' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_queue'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='342' column='1'/>
+      <function-decl name='blk_put_queue' mangled-name='blk_put_queue' filepath='block/blk-core.c' line='345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='345' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_put_request' mangled-name='blk_put_request' filepath='block/blk-core.c' line='647' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_request'>
-        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='647' column='1'/>
+      <function-decl name='blk_put_request' mangled-name='blk_put_request' filepath='block/blk-core.c' line='655' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_request'>
+        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='655' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_queue_alignment_offset' mangled-name='blk_queue_alignment_offset' filepath='block/blk-settings.c' line='367' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_alignment_offset'>
@@ -123437,19 +123618,19 @@
         <parameter type-id='95e97e5e' name='mask' filepath='block/blk-settings.c' line='732' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_queue_flag_clear' mangled-name='blk_queue_flag_clear' filepath='block/blk-core.c' line='97' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_clear'>
-        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='97' column='1'/>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='97' column='1'/>
+      <function-decl name='blk_queue_flag_clear' mangled-name='blk_queue_flag_clear' filepath='block/blk-core.c' line='100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_clear'>
+        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='100' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='100' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_queue_flag_set' mangled-name='blk_queue_flag_set' filepath='block/blk-core.c' line='86' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_set'>
-        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='86' column='1'/>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='86' column='1'/>
+      <function-decl name='blk_queue_flag_set' mangled-name='blk_queue_flag_set' filepath='block/blk-core.c' line='89' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_set'>
+        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='89' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='89' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_queue_flag_test_and_set' mangled-name='blk_queue_flag_test_and_set' filepath='block/blk-core.c' line='111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_test_and_set'>
-        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='111' column='1'/>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='111' column='1'/>
+      <function-decl name='blk_queue_flag_test_and_set' mangled-name='blk_queue_flag_test_and_set' filepath='block/blk-core.c' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_test_and_set'>
+        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='114' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='114' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='blk_queue_io_min' mangled-name='blk_queue_io_min' filepath='block/blk-settings.c' line='425' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_io_min'>
@@ -123580,28 +123761,28 @@
         <parameter type-id='fb55efa1' name='bio' filepath='block/blk-map.c' line='644' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_set_queue_dying' mangled-name='blk_set_queue_dying' filepath='block/blk-core.c' line='348' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_set_queue_dying'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='348' column='1'/>
+      <function-decl name='blk_set_queue_dying' mangled-name='blk_set_queue_dying' filepath='block/blk-core.c' line='351' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_set_queue_dying'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='351' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_set_stacking_limits' mangled-name='blk_set_stacking_limits' filepath='block/blk-settings.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_set_stacking_limits'>
         <parameter type-id='7604ff1d' name='lim' filepath='block/blk-settings.c' line='74' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_start_plug' mangled-name='blk_start_plug' filepath='block/blk-core.c' line='1696' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_start_plug'>
-        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1696' column='1'/>
+      <function-decl name='blk_start_plug' mangled-name='blk_start_plug' filepath='block/blk-core.c' line='1704' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_start_plug'>
+        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1704' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_stat_enable_accounting' mangled-name='blk_stat_enable_accounting' filepath='block/blk-stat.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_stat_enable_accounting'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-stat.c' line='187' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_status_to_errno' mangled-name='blk_status_to_errno' filepath='block/blk-core.c' line='216' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_status_to_errno'>
-        <parameter type-id='f4e2facd' name='status' filepath='block/blk-core.c' line='216' column='1'/>
+      <function-decl name='blk_status_to_errno' mangled-name='blk_status_to_errno' filepath='block/blk-core.c' line='219' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_status_to_errno'>
+        <parameter type-id='f4e2facd' name='status' filepath='block/blk-core.c' line='219' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_sync_queue' mangled-name='blk_sync_queue' filepath='block/blk-core.c' line='304' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_sync_queue'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='304' column='1'/>
+      <function-decl name='blk_sync_queue' mangled-name='blk_sync_queue' filepath='block/blk-core.c' line='307' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_sync_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='307' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_unregister_region' mangled-name='blk_unregister_region' filepath='block/genhd.c' line='659' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_unregister_region'>
@@ -123609,10 +123790,10 @@
         <parameter type-id='7359adad' name='range' filepath='block/genhd.c' line='659' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_update_request' mangled-name='blk_update_request' filepath='block/blk-core.c' line='1435' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_update_request'>
-        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='1435' column='1'/>
-        <parameter type-id='f4e2facd' name='error' filepath='block/blk-core.c' line='1435' column='1'/>
-        <parameter type-id='f0981eeb' name='nr_bytes' filepath='block/blk-core.c' line='1436' column='1'/>
+      <function-decl name='blk_update_request' mangled-name='blk_update_request' filepath='block/blk-core.c' line='1443' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_update_request'>
+        <parameter type-id='3dad1a48' name='req' filepath='block/blk-core.c' line='1443' column='1'/>
+        <parameter type-id='f4e2facd' name='error' filepath='block/blk-core.c' line='1443' column='1'/>
+        <parameter type-id='f0981eeb' name='nr_bytes' filepath='block/blk-core.c' line='1444' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='blk_verify_command' mangled-name='blk_verify_command' filepath='block/scsi_ioctl.c' line='200' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_verify_command'>
@@ -127807,10 +127988,10 @@
         <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='2334' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='disk_end_io_acct' mangled-name='disk_end_io_acct' filepath='block/blk-core.c' line='1381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_end_io_acct'>
-        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1381' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1381' column='1'/>
-        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1382' column='1'/>
+      <function-decl name='disk_end_io_acct' mangled-name='disk_end_io_acct' filepath='block/blk-core.c' line='1389' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_end_io_acct'>
+        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1389' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1389' column='1'/>
+        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1390' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='disk_stack_limits' mangled-name='disk_stack_limits' filepath='block/blk-settings.c' line='648' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_stack_limits'>
@@ -127819,10 +128000,10 @@
         <parameter type-id='a42536cd' name='offset' filepath='block/blk-settings.c' line='649' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='disk_start_io_acct' mangled-name='disk_start_io_acct' filepath='block/blk-core.c' line='1352' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_start_io_acct'>
-        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1352' column='1'/>
-        <parameter type-id='f0981eeb' name='sectors' filepath='block/blk-core.c' line='1352' column='1'/>
-        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1353' column='1'/>
+      <function-decl name='disk_start_io_acct' mangled-name='disk_start_io_acct' filepath='block/blk-core.c' line='1360' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_start_io_acct'>
+        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1360' column='1'/>
+        <parameter type-id='f0981eeb' name='sectors' filepath='block/blk-core.c' line='1360' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-core.c' line='1361' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='display_timings_release' mangled-name='display_timings_release' filepath='drivers/video/display_timing.c' line='12' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='display_timings_release'>
@@ -131991,7 +132172,7 @@
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='freq_scale' type-id='7359adad' mangled-name='freq_scale' visibility='default' filepath='drivers/base/arch_topology.c' line='35' column='1' elf-symbol-id='freq_scale'/>
-      <var-decl name='fs_bio_set' type-id='dfa886b2' mangled-name='fs_bio_set' visibility='default' filepath='block/bio.c' line='48' column='1' elf-symbol-id='fs_bio_set'/>
+      <var-decl name='fs_bio_set' type-id='dfa886b2' mangled-name='fs_bio_set' visibility='default' filepath='block/bio.c' line='49' column='1' elf-symbol-id='fs_bio_set'/>
       <function-decl name='fscrypt_decrypt_bio' mangled-name='fscrypt_decrypt_bio' filepath='fs/crypto/bio.c' line='29' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fscrypt_decrypt_bio'>
         <parameter type-id='fb55efa1' name='bio' filepath='fs/crypto/bio.c' line='29' column='1'/>
         <return type-id='48b5725f'/>
@@ -138997,16 +139178,16 @@
         <parameter type-id='edcbd723' name='kp' filepath='kernel/params.c' line='242' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='part_end_io_acct' mangled-name='part_end_io_acct' filepath='block/blk-core.c' line='1373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_end_io_acct'>
-        <parameter type-id='84dc82b7' name='part' filepath='block/blk-core.c' line='1373' column='1'/>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1373' column='1'/>
-        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1374' column='1'/>
+      <function-decl name='part_end_io_acct' mangled-name='part_end_io_acct' filepath='block/blk-core.c' line='1381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_end_io_acct'>
+        <parameter type-id='84dc82b7' name='part' filepath='block/blk-core.c' line='1381' column='1'/>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1381' column='1'/>
+        <parameter type-id='7359adad' name='start_time' filepath='block/blk-core.c' line='1382' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='part_start_io_acct' mangled-name='part_start_io_acct' filepath='block/blk-core.c' line='1343' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_start_io_acct'>
-        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1343' column='1'/>
-        <parameter type-id='c4219d27' name='part' filepath='block/blk-core.c' line='1343' column='1'/>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1344' column='1'/>
+      <function-decl name='part_start_io_acct' mangled-name='part_start_io_acct' filepath='block/blk-core.c' line='1351' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='part_start_io_acct'>
+        <parameter type-id='33c599da' name='disk' filepath='block/blk-core.c' line='1351' column='1'/>
+        <parameter type-id='c4219d27' name='part' filepath='block/blk-core.c' line='1351' column='1'/>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1352' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='passthru_features_check' mangled-name='passthru_features_check' filepath='net/core/dev.c' line='3507' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='passthru_features_check'>
@@ -141602,8 +141783,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='net/core/netevent.c' line='28' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_oom_notifier' mangled-name='register_oom_notifier' filepath='mm/oom_kill.c' line='1080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_oom_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1080' column='1'/>
+      <function-decl name='register_oom_notifier' mangled-name='register_oom_notifier' filepath='mm/oom_kill.c' line='1075' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_oom_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1075' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='register_pernet_device' mangled-name='register_pernet_device' filepath='net/core/net_namespace.c' line='1316' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_pernet_device'>
@@ -142599,8 +142780,8 @@
         <return type-id='4bdecfd7'/>
       </function-decl>
       <var-decl name='rps_needed' type-id='237c0d27' mangled-name='rps_needed' visibility='default' filepath='net/core/dev.c' line='4296' column='1' elf-symbol-id='rps_needed'/>
-      <function-decl name='rq_flush_dcache_pages' mangled-name='rq_flush_dcache_pages' filepath='block/blk-core.c' line='1534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rq_flush_dcache_pages'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1534' column='1'/>
+      <function-decl name='rq_flush_dcache_pages' mangled-name='rq_flush_dcache_pages' filepath='block/blk-core.c' line='1542' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rq_flush_dcache_pages'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-core.c' line='1542' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rsa_parse_priv_key' mangled-name='rsa_parse_priv_key' filepath='crypto/rsa_helper.c' line='181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rsa_parse_priv_key'>
@@ -146113,16 +146294,16 @@
         <parameter type-id='c485c22c' name='bh' filepath='fs/buffer.c' line='3086' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='submit_bio' mangled-name='submit_bio' filepath='block/blk-core.c' line='1077' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1077' column='1'/>
+      <function-decl name='submit_bio' mangled-name='submit_bio' filepath='block/blk-core.c' line='1085' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1085' column='1'/>
         <return type-id='041bc907'/>
       </function-decl>
-      <function-decl name='submit_bio_noacct' mangled-name='submit_bio_noacct' filepath='block/blk-core.c' line='1042' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_noacct'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1042' column='1'/>
+      <function-decl name='submit_bio_noacct' mangled-name='submit_bio_noacct' filepath='block/blk-core.c' line='1050' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_noacct'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1050' column='1'/>
         <return type-id='041bc907'/>
       </function-decl>
-      <function-decl name='submit_bio_wait' mangled-name='submit_bio_wait' filepath='block/bio.c' line='1155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_wait'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1155' column='1'/>
+      <function-decl name='submit_bio_wait' mangled-name='submit_bio_wait' filepath='block/bio.c' line='1157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_wait'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1157' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='subsys_system_register' mangled-name='subsys_system_register' filepath='drivers/base/bus.c' line='1159' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='subsys_system_register'>
@@ -147990,8 +148171,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='net/core/netevent.c' line='44' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='unregister_oom_notifier' mangled-name='unregister_oom_notifier' filepath='mm/oom_kill.c' line='1086' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_oom_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1086' column='1'/>
+      <function-decl name='unregister_oom_notifier' mangled-name='unregister_oom_notifier' filepath='mm/oom_kill.c' line='1081' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_oom_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1081' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='unregister_pernet_device' mangled-name='unregister_pernet_device' filepath='net/core/net_namespace.c' line='1337' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_pernet_device'>
diff --git a/android/abi_gki_aarch64_transsion b/android/abi_gki_aarch64_transsion
index d238c721db9e..e4f2f55e3cfc 100644
--- a/android/abi_gki_aarch64_transsion
+++ b/android/abi_gki_aarch64_transsion
@@ -46,6 +46,25 @@
   __traceiter_android_vh_unuse_swap_page
   __traceiter_android_vh_waiting_for_page_migration
   __traceiter_android_vh_should_end_madvise
+  __traceiter_android_vh_bio_free
+  __traceiter_android_rvh_internal_blk_mq_alloc_request
+  __traceiter_android_vh_internal_blk_mq_free_request
+  __traceiter_android_vh_blk_mq_complete_request
+  __traceiter_android_vh_blk_mq_add_to_requeue_list
+  __traceiter_android_rvh_blk_mq_delay_run_hw_queue
+  __traceiter_android_vh_blk_mq_run_hw_queue
+  __traceiter_android_vh_blk_mq_insert_request
+  __traceiter_android_rvh_blk_mq_alloc_rq_map
+  __traceiter_android_rvh_blk_mq_init_allocated_queue
+  __traceiter_android_vh_blk_mq_exit_queue
+  __traceiter_android_vh_blk_mq_alloc_tag_set
+  __traceiter_android_rvh_blk_allocated_queue_init
+  __traceiter_android_rvh_blk_flush_plug_list
+  __traceiter_android_vh_blk_alloc_flush_queue
+  __traceiter_android_vh_blk_mq_all_tag_iter
+  __traceiter_android_vh_blk_mq_queue_tag_busy_iter
+  __traceiter_android_vh_blk_mq_free_tags
+  __traceiter_android_vh_blk_mq_sched_insert_request
   __tracepoint_android_rvh_alloc_si
   __tracepoint_android_rvh_alloc_swap_slot_cache
   __tracepoint_android_rvh_drain_slots_cache_cpu
@@ -82,4 +101,23 @@
   __tracepoint_android_vh_unuse_swap_page
   __tracepoint_android_vh_waiting_for_page_migration
   __tracepoint_android_vh_should_end_madvise
+  __tracepoint_android_vh_bio_free
+  __tracepoint_android_rvh_internal_blk_mq_alloc_request
+  __tracepoint_android_vh_internal_blk_mq_free_request
+  __tracepoint_android_vh_blk_mq_complete_request
+  __tracepoint_android_vh_blk_mq_add_to_requeue_list
+  __tracepoint_android_rvh_blk_mq_delay_run_hw_queue
+  __tracepoint_android_vh_blk_mq_run_hw_queue
+  __tracepoint_android_vh_blk_mq_insert_request
+  __tracepoint_android_rvh_blk_mq_alloc_rq_map
+  __tracepoint_android_rvh_blk_mq_init_allocated_queue
+  __tracepoint_android_vh_blk_mq_exit_queue
+  __tracepoint_android_vh_blk_mq_alloc_tag_set
+  __tracepoint_android_rvh_blk_allocated_queue_init
+  __tracepoint_android_rvh_blk_flush_plug_list
+  __tracepoint_android_vh_blk_alloc_flush_queue
+  __tracepoint_android_vh_blk_mq_all_tag_iter
+  __tracepoint_android_vh_blk_mq_queue_tag_busy_iter
+  __tracepoint_android_vh_blk_mq_free_tags
+  __tracepoint_android_vh_blk_mq_sched_insert_request
   zero_pfn

From 518b72930b2b8171328ca3551d0b5c2869f4f229 Mon Sep 17 00:00:00 2001
From: Lokesh Gidra <lokeshgidra@google.com>
Date: Tue, 16 Jan 2024 20:20:25 +0000
Subject: [PATCH 1043/1043] ANDROID: userfaultfd: allow SPF for
 UFFD_FEATURE_SIGBUS on private+anon

Currently we bail out of speculative page fault when we detect that the
fault address is in a userfaultfd registered vma. However, if userfaultfd
is being used with UFFD_FEATURE_SIGBUS feature, then handle_userfault()
doesn't do much and is easiest to handle with SPF. This patch lets
MISSING userfaultfs on private anonymous mappings be allowed with SPF if
UFFD_FEATURE_SIGBUS is used.

With this patch we get >99% success rate for userfaults caused during
userfaultfd GC's compaction phase. This translates into eliminating
uninterruptible sleep time in do_page_fault() due to userfaults.

Bug: 329565495
Bug: 320478828
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Change-Id: Ic7fde0fde03602b35179bc0cf891ddbbc434190f
(cherry picked from commit 582c6d188ec138d8ed9c6ef235bf5698d80d7d6b)
(cherry picked from commit a905086c85cb076b98620df34ee237ece7c0599f)
---
 fs/userfaultfd.c              | 96 ++++++++++++++++++++++++++---------
 include/linux/mm_types.h      |  2 +-
 include/linux/userfaultfd_k.h | 12 ++++-
 mm/memory.c                   | 34 ++++++++++---
 mm/userfaultfd.c              |  2 +-
 5 files changed, 111 insertions(+), 35 deletions(-)

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index e11d1a6732a6..519589f633b1 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -70,6 +70,7 @@ struct userfaultfd_ctx {
 	bool mmap_changing;
 	/* mm with one ore more vmas attached to this userfaultfd_ctx */
 	struct mm_struct *mm;
+	struct rcu_head rcu_head;
 };
 
 struct userfaultfd_fork_ctx {
@@ -155,6 +156,13 @@ static void userfaultfd_ctx_get(struct userfaultfd_ctx *ctx)
 	refcount_inc(&ctx->refcount);
 }
 
+static void __free_userfaultfd_ctx(struct rcu_head *head)
+{
+	struct userfaultfd_ctx *ctx = container_of(head, struct userfaultfd_ctx,
+						   rcu_head);
+	kmem_cache_free(userfaultfd_ctx_cachep, ctx);
+}
+
 /**
  * userfaultfd_ctx_put - Releases a reference to the internal userfaultfd
  * context.
@@ -175,7 +183,7 @@ static void userfaultfd_ctx_put(struct userfaultfd_ctx *ctx)
 		VM_BUG_ON(spin_is_locked(&ctx->fd_wqh.lock));
 		VM_BUG_ON(waitqueue_active(&ctx->fd_wqh));
 		mmdrop(ctx->mm);
-		kmem_cache_free(userfaultfd_ctx_cachep, ctx);
+		call_rcu(&ctx->rcu_head, __free_userfaultfd_ctx);
 	}
 }
 
@@ -349,6 +357,24 @@ static inline long userfaultfd_get_blocking_state(unsigned int flags)
 	return TASK_UNINTERRUPTIBLE;
 }
 
+#ifdef CONFIG_SPECULATIVE_PAGE_FAULT
+bool userfaultfd_using_sigbus(struct vm_area_struct *vma)
+{
+	struct userfaultfd_ctx *ctx;
+	bool ret;
+
+	/*
+	 * Do it inside RCU section to ensure that the ctx doesn't
+	 * disappear under us.
+	 */
+	rcu_read_lock();
+	ctx = rcu_dereference(vma->vm_userfaultfd_ctx.ctx);
+	ret = ctx && (ctx->features & UFFD_FEATURE_SIGBUS);
+	rcu_read_unlock();
+	return ret;
+}
+#endif
+
 /*
  * The locking rules involved in returning VM_FAULT_RETRY depending on
  * FAULT_FLAG_ALLOW_RETRY, FAULT_FLAG_RETRY_NOWAIT and
@@ -393,7 +419,8 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason)
 	 */
 	mmap_assert_locked(mm);
 
-	ctx = vmf->vma->vm_userfaultfd_ctx.ctx;
+	ctx = rcu_dereference_protected(vmf->vma->vm_userfaultfd_ctx.ctx,
+					lockdep_is_held(&mm->mmap_lock));
 	if (!ctx)
 		goto out;
 
@@ -610,8 +637,10 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
 		/* the various vma->vm_userfaultfd_ctx still points to it */
 		mmap_write_lock(mm);
 		for (vma = mm->mmap; vma; vma = vma->vm_next)
-			if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) {
-				vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+			if (rcu_access_pointer(vma->vm_userfaultfd_ctx.ctx) ==
+			    release_new_ctx) {
+				rcu_assign_pointer(vma->vm_userfaultfd_ctx.ctx,
+						   NULL);
 				vma->vm_flags &= ~__VM_UFFD_FLAGS;
 			}
 		mmap_write_unlock(mm);
@@ -641,10 +670,13 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs)
 	struct userfaultfd_ctx *ctx = NULL, *octx;
 	struct userfaultfd_fork_ctx *fctx;
 
-	octx = vma->vm_userfaultfd_ctx.ctx;
+	octx = rcu_dereference_protected(
+			vma->vm_userfaultfd_ctx.ctx,
+			lockdep_is_held(&vma->vm_mm->mmap_lock));
+
 	if (!octx || !(octx->features & UFFD_FEATURE_EVENT_FORK)) {
 		vm_write_begin(vma);
-		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+		rcu_assign_pointer(vma->vm_userfaultfd_ctx.ctx, NULL);
 		WRITE_ONCE(vma->vm_flags,
 			   vma->vm_flags & ~__VM_UFFD_FLAGS);
 		vm_write_end(vma);
@@ -683,7 +715,7 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs)
 		list_add_tail(&fctx->list, fcs);
 	}
 
-	vma->vm_userfaultfd_ctx.ctx = ctx;
+	rcu_assign_pointer(vma->vm_userfaultfd_ctx.ctx, ctx);
 	return 0;
 }
 
@@ -716,7 +748,8 @@ void mremap_userfaultfd_prep(struct vm_area_struct *vma,
 {
 	struct userfaultfd_ctx *ctx;
 
-	ctx = vma->vm_userfaultfd_ctx.ctx;
+	ctx = rcu_dereference_protected(vma->vm_userfaultfd_ctx.ctx,
+					lockdep_is_held(&vma->vm_mm->mmap_lock));
 
 	if (!ctx)
 		return;
@@ -727,7 +760,7 @@ void mremap_userfaultfd_prep(struct vm_area_struct *vma,
 		WRITE_ONCE(ctx->mmap_changing, true);
 	} else {
 		/* Drop uffd context if remap feature not enabled */
-		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+		rcu_assign_pointer(vma->vm_userfaultfd_ctx.ctx, NULL);
 		vma->vm_flags &= ~__VM_UFFD_FLAGS;
 	}
 }
@@ -764,7 +797,8 @@ bool userfaultfd_remove(struct vm_area_struct *vma,
 	struct userfaultfd_ctx *ctx;
 	struct userfaultfd_wait_queue ewq;
 
-	ctx = vma->vm_userfaultfd_ctx.ctx;
+	ctx = rcu_dereference_protected(vma->vm_userfaultfd_ctx.ctx,
+					lockdep_is_held(&mm->mmap_lock));
 	if (!ctx || !(ctx->features & UFFD_FEATURE_EVENT_REMOVE))
 		return true;
 
@@ -802,7 +836,9 @@ int userfaultfd_unmap_prep(struct vm_area_struct *vma,
 {
 	for ( ; vma && vma->vm_start < end; vma = vma->vm_next) {
 		struct userfaultfd_unmap_ctx *unmap_ctx;
-		struct userfaultfd_ctx *ctx = vma->vm_userfaultfd_ctx.ctx;
+		struct userfaultfd_ctx *ctx =
+			rcu_dereference_protected(vma->vm_userfaultfd_ctx.ctx,
+						  lockdep_is_held(&vma->vm_mm->mmap_lock));
 
 		if (!ctx || !(ctx->features & UFFD_FEATURE_EVENT_UNMAP) ||
 		    has_unmap_ctx(ctx, unmaps, start, end))
@@ -867,10 +903,13 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
 	mmap_write_lock(mm);
 	prev = NULL;
 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
+		struct userfaultfd_ctx *cur_uffd_ctx =
+				rcu_dereference_protected(vma->vm_userfaultfd_ctx.ctx,
+							  lockdep_is_held(&mm->mmap_lock));
 		cond_resched();
-		BUG_ON(!!vma->vm_userfaultfd_ctx.ctx ^
+		BUG_ON(!!cur_uffd_ctx ^
 		       !!(vma->vm_flags & __VM_UFFD_FLAGS));
-		if (vma->vm_userfaultfd_ctx.ctx != ctx) {
+		if (cur_uffd_ctx != ctx) {
 			prev = vma;
 			continue;
 		}
@@ -887,7 +926,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
 			prev = vma;
 		vm_write_begin(vma);
 		WRITE_ONCE(vma->vm_flags, new_flags);
-		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+		rcu_assign_pointer(vma->vm_userfaultfd_ctx.ctx, NULL);
 		vm_write_end(vma);
 	}
 	mmap_write_unlock(mm);
@@ -1350,9 +1389,12 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
 	found = false;
 	basic_ioctls = false;
 	for (cur = vma; cur && cur->vm_start < end; cur = cur->vm_next) {
+		struct userfaultfd_ctx *cur_uffd_ctx =
+				rcu_dereference_protected(cur->vm_userfaultfd_ctx.ctx,
+							  lockdep_is_held(&mm->mmap_lock));
 		cond_resched();
 
-		BUG_ON(!!cur->vm_userfaultfd_ctx.ctx ^
+		BUG_ON(!!cur_uffd_ctx ^
 		       !!(cur->vm_flags & __VM_UFFD_FLAGS));
 
 		/* check not compatible vmas */
@@ -1395,8 +1437,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
 		 * wouldn't know which one to deliver the userfaults to.
 		 */
 		ret = -EBUSY;
-		if (cur->vm_userfaultfd_ctx.ctx &&
-		    cur->vm_userfaultfd_ctx.ctx != ctx)
+		if (cur_uffd_ctx && cur_uffd_ctx != ctx)
 			goto out_unlock;
 
 		/*
@@ -1414,18 +1455,20 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
 
 	ret = 0;
 	do {
+		struct userfaultfd_ctx *cur_uffd_ctx =
+				rcu_dereference_protected(vma->vm_userfaultfd_ctx.ctx,
+							  lockdep_is_held(&mm->mmap_lock));
 		cond_resched();
 
 		BUG_ON(!vma_can_userfault(vma, vm_flags));
-		BUG_ON(vma->vm_userfaultfd_ctx.ctx &&
-		       vma->vm_userfaultfd_ctx.ctx != ctx);
+		BUG_ON(cur_uffd_ctx && cur_uffd_ctx != ctx);
 		WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
 
 		/*
 		 * Nothing to do: this vma is already registered into this
 		 * userfaultfd and with the right tracking mode too.
 		 */
-		if (vma->vm_userfaultfd_ctx.ctx == ctx &&
+		if (cur_uffd_ctx == ctx &&
 		    (vma->vm_flags & vm_flags) == vm_flags)
 			goto skip;
 
@@ -1461,7 +1504,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
 		 */
 		vm_write_begin(vma);
 		WRITE_ONCE(vma->vm_flags, new_flags);
-		vma->vm_userfaultfd_ctx.ctx = ctx;
+		rcu_assign_pointer(vma->vm_userfaultfd_ctx.ctx, ctx);
 		vm_write_end(vma);
 
 		if (is_vm_hugetlb_page(vma) && uffd_disable_huge_pmd_share(vma))
@@ -1561,7 +1604,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
 	for (cur = vma; cur && cur->vm_start < end; cur = cur->vm_next) {
 		cond_resched();
 
-		BUG_ON(!!cur->vm_userfaultfd_ctx.ctx ^
+		BUG_ON(!!rcu_access_pointer(cur->vm_userfaultfd_ctx.ctx) ^
 		       !!(cur->vm_flags & __VM_UFFD_FLAGS));
 
 		/*
@@ -1583,6 +1626,9 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
 
 	ret = 0;
 	do {
+		struct userfaultfd_ctx *cur_uffd_ctx =
+				rcu_dereference_protected(vma->vm_userfaultfd_ctx.ctx,
+							  lockdep_is_held(&mm->mmap_lock));
 		cond_resched();
 
 		BUG_ON(!vma_can_userfault(vma, vma->vm_flags));
@@ -1591,7 +1637,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
 		 * Nothing to do: this vma is already registered into this
 		 * userfaultfd and with the right tracking mode too.
 		 */
-		if (!vma->vm_userfaultfd_ctx.ctx)
+		if (!cur_uffd_ctx)
 			goto skip;
 
 		WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
@@ -1610,7 +1656,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
 			struct userfaultfd_wake_range range;
 			range.start = start;
 			range.len = vma_end - start;
-			wake_userfault(vma->vm_userfaultfd_ctx.ctx, &range);
+			wake_userfault(cur_uffd_ctx, &range);
 		}
 
 		new_flags = vma->vm_flags & ~__VM_UFFD_FLAGS;
@@ -1641,7 +1687,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
 		 */
 		vm_write_begin(vma);
 		WRITE_ONCE(vma->vm_flags, new_flags);
-		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+		rcu_assign_pointer(vma->vm_userfaultfd_ctx.ctx, NULL);
 		vm_write_end(vma);
 
 	skip:
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index c853f612a815..bd4eb4547da3 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -292,7 +292,7 @@ struct vm_region {
 #ifdef CONFIG_USERFAULTFD
 #define NULL_VM_UFFD_CTX ((struct vm_userfaultfd_ctx) { NULL, })
 struct vm_userfaultfd_ctx {
-	struct userfaultfd_ctx *ctx;
+	struct userfaultfd_ctx __rcu *ctx;
 };
 #else /* CONFIG_USERFAULTFD */
 #define NULL_VM_UFFD_CTX ((struct vm_userfaultfd_ctx) {})
diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h
index 331d2ccf0bcc..43902f3efbd1 100644
--- a/include/linux/userfaultfd_k.h
+++ b/include/linux/userfaultfd_k.h
@@ -36,6 +36,9 @@
 extern int sysctl_unprivileged_userfaultfd;
 
 extern vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason);
+#ifdef CONFIG_SPECULATIVE_PAGE_FAULT
+extern bool userfaultfd_using_sigbus(struct vm_area_struct *vma);
+#endif
 
 /*
  * The mode of operation for __mcopy_atomic and its helpers.
@@ -75,7 +78,7 @@ extern int mwriteprotect_range(struct mm_struct *dst_mm,
 static inline bool is_mergeable_vm_userfaultfd_ctx(struct vm_area_struct *vma,
 					struct vm_userfaultfd_ctx vm_ctx)
 {
-	return vma->vm_userfaultfd_ctx.ctx == vm_ctx.ctx;
+	return rcu_access_pointer(vma->vm_userfaultfd_ctx.ctx) == vm_ctx.ctx;
 }
 
 /*
@@ -154,6 +157,13 @@ static inline vm_fault_t handle_userfault(struct vm_fault *vmf,
 	return VM_FAULT_SIGBUS;
 }
 
+#ifdef CONFIG_SPECULATIVE_PAGE_FAULT
+static inline bool userfaultfd_using_sigbus(struct vm_area_struct *vma)
+{
+	return false;
+}
+#endif
+
 static inline bool is_mergeable_vm_userfaultfd_ctx(struct vm_area_struct *vma,
 					struct vm_userfaultfd_ctx vm_ctx)
 {
diff --git a/mm/memory.c b/mm/memory.c
index 857cfc90893f..f055ef333e42 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -5028,6 +5028,7 @@ static vm_fault_t ___handle_speculative_fault(struct mm_struct *mm,
 	pud_t pudval;
 	int seq;
 	vm_fault_t ret;
+	bool uffd_missing_sigbus = false;
 
 	/* Clear flags that may lead to release the mmap_sem to retry */
 	flags &= ~(FAULT_FLAG_ALLOW_RETRY|FAULT_FLAG_KILLABLE);
@@ -5040,20 +5041,31 @@ static vm_fault_t ___handle_speculative_fault(struct mm_struct *mm,
 		return VM_FAULT_RETRY;
 	}
 
-	if (!vmf_allows_speculation(&vmf))
-		return VM_FAULT_RETRY;
-
 	vmf.vma_flags = READ_ONCE(vmf.vma->vm_flags);
 	vmf.vma_page_prot = READ_ONCE(vmf.vma->vm_page_prot);
 
 #ifdef CONFIG_USERFAULTFD
-	/* Can't call userland page fault handler in the speculative path */
+	/*
+	 * Only support SPF for SIGBUS+MISSING userfaults in private anonymous
+	 * VMAs. Rest all should be retried with mmap_lock.
+	 */
 	if (unlikely(vmf.vma_flags & __VM_UFFD_FLAGS)) {
-		trace_spf_vma_notsup(_RET_IP_, vmf.vma, address);
-		return VM_FAULT_RETRY;
+		uffd_missing_sigbus = vma_is_anonymous(vmf.vma) &&
+					(vmf.vma_flags & VM_UFFD_MISSING) &&
+					userfaultfd_using_sigbus(vmf.vma);
+		if (!uffd_missing_sigbus) {
+			trace_spf_vma_notsup(_RET_IP_, vmf.vma, address);
+			return VM_FAULT_RETRY;
+		}
+		/* Not having anon_vma implies that the PTE is missing */
+		if (!vmf.vma->anon_vma)
+			return VM_FAULT_SIGBUS;
 	}
 #endif
 
+	if (!vmf_allows_speculation(&vmf))
+		return VM_FAULT_RETRY;
+
 	if (vmf.vma_flags & VM_GROWSDOWN || vmf.vma_flags & VM_GROWSUP) {
 		/*
 		 * This could be detected by the check address against VMA's
@@ -5171,6 +5183,9 @@ static vm_fault_t ___handle_speculative_fault(struct mm_struct *mm,
 
 	local_irq_enable();
 
+	if (!vmf.pte && uffd_missing_sigbus)
+		return VM_FAULT_SIGBUS;
+
 	/*
 	 * We need to re-validate the VMA after checking the bounds, otherwise
 	 * we might have a false positive on the bounds.
@@ -5204,7 +5219,12 @@ static vm_fault_t ___handle_speculative_fault(struct mm_struct *mm,
 out_walk:
 	trace_spf_vma_notsup(_RET_IP_, vmf.vma, address);
 	local_irq_enable();
-	return VM_FAULT_RETRY;
+	/*
+	 * Failing page-table walk is similar to page-missing so give an
+	 * opportunity to SIGBUS+MISSING userfault to handle it before retrying
+	 * with mmap_lock
+	 */
+	return uffd_missing_sigbus ? VM_FAULT_SIGBUS : VM_FAULT_RETRY;
 
 out_segv:
 	trace_spf_vma_access(_RET_IP_, vmf.vma, address);
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index fa707e50b102..8ab123714314 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -42,7 +42,7 @@ struct vm_area_struct *find_dst_vma(struct mm_struct *dst_mm,
 	 * enforce the VM_MAYWRITE check done at uffd registration
 	 * time.
 	 */
-	if (!dst_vma->vm_userfaultfd_ctx.ctx)
+	if (!rcu_access_pointer(dst_vma->vm_userfaultfd_ctx.ctx))
 		return NULL;
 
 	return dst_vma;